@bongos/core 1.19.1072 → 1.19.1074

package/tests/box_onboard.mjs

@@ -1,317 +0,0 @@
-// tests/box_onboard.mjs
-//
-// Hermetic unit smoke for the one-command onboarding module
-// (modules/dev-box/box-onboard.js, ADR 0031 §1/§6, #685). Covers the PURE core — SSH
-// public-key validation + fingerprinting, the injection-rejection that protects
-// authorized_keys, the managed-block + managed-settings + connect-guide
-// renderers — and the DB query SHAPES via a fake pool. NO database, NO network,
-// NO real box. The live-rank GATE for /box/authorized-keys reuses
-// box-access.decideSourceAccess, which is pinned in scripts/gds/smoke-box.sh.
-//
-// Run:  node tests/box_onboard.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import http from 'node:http';
-
-const require = createRequire(import.meta.url);
-const o = require('../modules/dev-box/box-onboard.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-async function ta(name, fn) {
-  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-// A throwaway ed25519 public key + the SHA256 fingerprint `ssh-keygen -lf`
-// prints for it (verified against ssh-keygen during development). Public keys
-// are non-secret; this one's matching private half was discarded.
-const FIXTURE_PUB = 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsaRCiI/mJIQy+FFxmIudxnSYYI6spAHH3DFkab4MVU otb@fixture';
-const FIXTURE_FP = 'SHA256:LOQ37km6nDckWk1R6EzLqObe4bKdFCe8vY4VFHy+eBY';
-
-// Minimal fake pg pool: returns queued results in order, records every call.
-function fakeDb(results) {
-  const calls = [];
-  return {
-    calls,
-    async query(sql, params) {
-      calls.push({ sql, params });
-      return results.shift() || { rows: [] };
-    },
-  };
-}
-
-console.log('validateSshPublicKey — accept:');
-
-t('valid ed25519 → ok, type, fingerprint matches ssh-keygen, comment dropped from normalized', () => {
-  const r = o.validateSshPublicKey(FIXTURE_PUB);
-  assert.equal(r.ok, true);
-  assert.equal(r.keyType, 'ssh-ed25519');
-  assert.equal(r.fingerprint, FIXTURE_FP);
-  // normalized is exactly `<type> <base64>` — the user comment is NOT carried in.
-  assert.equal(r.normalized, 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOsaRCiI/mJIQy+FFxmIudxnSYYI6spAHH3DFkab4MVU');
-  assert.equal(r.label, 'otb@fixture');
-});
-
-t('trailing newline (a .pub file) is tolerated', () => {
-  assert.equal(o.validateSshPublicKey(FIXTURE_PUB + '\n').ok, true);
-});
-
-console.log('validateSshPublicKey — reject (the authorized_keys injection surface):');
-
-t('embedded newline → multiline_or_control', () => {
-  assert.equal(o.validateSshPublicKey('ssh-ed25519 AAAA\ncommand="x" ssh-ed25519 BBBB').error, 'multiline_or_control');
-});
-t('a command="" options PREFIX is refused (line must START with a key type)', () => {
-  assert.equal(o.validateSshPublicKey('command="rm -rf /" ssh-ed25519 AAAAC3').error, 'unsupported_type');
-});
-t('unsupported key type → unsupported_type', () => {
-  assert.equal(o.validateSshPublicKey('ssh-dss AAAAB3').error, 'unsupported_type');
-});
-t('non-base64 body → bad_base64', () => {
-  assert.equal(o.validateSshPublicKey('ssh-ed25519 not-base64!!!').error, 'bad_base64');
-});
-t('valid base64 that is NOT an ssh key → bad_key_blob / type_mismatch', () => {
-  const r = o.validateSshPublicKey('ssh-ed25519 ' + Buffer.from('hello world').toString('base64'));
-  assert.equal(r.ok, false);
-  assert.ok(r.error === 'bad_key_blob' || r.error === 'type_mismatch');
-});
-t('empty / non-string → rejected', () => {
-  assert.equal(o.validateSshPublicKey('').error, 'empty');
-  assert.equal(o.validateSshPublicKey(null).error, 'not_a_string');
-  assert.equal(o.validateSshPublicKey(42).error, 'not_a_string');
-});
-
-console.log('sanitizeLabel:');
-
-t('strips quotes/control, collapses, caps length; null on empty', () => {
-  assert.equal(o.sanitizeLabel('laptop "evil"\nrm'), 'laptop evil rm');
-  assert.equal(o.sanitizeLabel('   '), null);
-  assert.equal(o.sanitizeLabel('#$%^&*'), null);          // no allowed chars → null
-  assert.equal(o.sanitizeLabel('@'), '@');                // @ IS an allowed label char
-  assert.equal(o.sanitizeLabel('x'.repeat(200)).length, 64);
-  assert.equal(o.sanitizeLabel(undefined), null);
-});
-
-console.log('authorized_keys rendering:');
-
-t('buildAuthorizedKeysFile: one line per key, trailing newline, empty set → empty string', () => {
-  assert.equal(o.buildAuthorizedKeysFile([]), '');
-  const f = o.buildAuthorizedKeysFile([
-    { public_key: 'ssh-ed25519 AAAA', label: 'laptop' },
-    { public_key: 'ssh-ed25519 BBBB', label: null },
-  ]);
-  assert.equal(f, 'ssh-ed25519 AAAA laptop\nssh-ed25519 BBBB\n');
-});
-
-t('buildAuthorizedKeysLines: a malicious DB label is re-sanitized (defense in depth)', () => {
-  // Even if a label with a newline somehow reached the DB, the renderer strips
-  // it — no second authorized_keys line can be smuggled via the comment.
-  const lines = o.buildAuthorizedKeysLines([{ public_key: 'ssh-ed25519 AAAA', label: 'ok\nssh-ed25519 EVIL' }]);
-  assert.equal(lines.length, 1);
-  assert.ok(!lines[0].includes('\n'));
-  assert.ok(lines[0].startsWith('ssh-ed25519 AAAA '));
-});
-
-t('wrapManagedBlock: markers present; empty keys → empty block (the clawback shape)', () => {
-  const empty = o.wrapManagedBlock([]);
-  assert.ok(empty.includes(o.MANAGED_BLOCK_BEGIN) && empty.includes(o.MANAGED_BLOCK_END));
-  assert.ok(!empty.includes('ssh-'));
-  const one = o.wrapManagedBlock([{ public_key: 'ssh-ed25519 AAAA', label: 'l' }]);
-  assert.match(one, /otb-managed[\s\S]*ssh-ed25519 AAAA l[\s\S]*<<< otb-managed/);
-});
-
-console.log('managed-settings:');
-
-t('buildManagedSettings: shape matches the template; allowlist pins the passed sshZone', () => {
-  // world + sshZone are supplied by the caller from the branding pack (task 1705);
-  // the renderer is pure and bakes exactly what it's given.
-  const s = o.buildManagedSettings({ login: 'alice', hostname: 'box-alice.dev.example.com', world: 'Example', sshZone: 'dev.example.com' });
-  assert.equal(s.sshConfigs[0].id, 'otb-alice');
-  assert.equal(s.sshConfigs[0].name, 'Example Dev Box');
-  assert.equal(s.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
-  assert.equal(s.sshConfigs[0].startDirectory, '~/workspace');
-  assert.deepEqual(s.sshHostAllowlist, ['*.dev.example.com']);
-});
-
-t('buildManagedSettings: bad login / hostname throw coded errors (no injection into the JSON)', () => {
-  assert.throws(() => o.buildManagedSettings({ login: 'a/b', hostname: 'x.dev.example.com' }), /BAD_LOGIN|invalid login/);
-  assert.throws(() => o.buildManagedSettings({ login: 'alice', hostname: 'evil"\nhost' }), /BAD_HOSTNAME|invalid hostname/);
-});
-
-console.log('connect guide:');
-
-t('renderConnectGuide: bakes the apiBase into the bootstrap URLs', () => {
-  const g = o.renderConnectGuide({ apiBase: 'https://staging.example.com' });
-  assert.ok(g.includes('https://staging.example.com/api/gds/box/connect.sh'));
-  assert.ok(g.includes('/api/gds/box/connect.ps1'));
-  // the supplied apiBase is baked verbatim (the caller PINS the origin — it is never
-  // a hardcoded host brand, task 1705)
-  assert.ok(o.renderConnectGuide({ apiBase: 'https://example.com' }).includes('https://example.com/api/gds/box/connect.sh'));
-});
-
-console.log('DB query shapes (fake pool):');
-
-await ta('registerSshKey: upserts ON CONFLICT (builder_id, fingerprint)', async () => {
-  const db = fakeDb([{ rows: [{ id: 7, key_type: 'ssh-ed25519', fingerprint: FIXTURE_FP, label: 'l' }] }]);
-  const row = await o.registerSshKey(db, 3, { publicKey: 'ssh-ed25519 AAAA', keyType: 'ssh-ed25519', fingerprint: FIXTURE_FP, label: 'l' });
-  assert.equal(row.id, 7);
-  assert.match(db.calls[0].sql, /INSERT INTO builder_ssh_keys/);
-  assert.match(db.calls[0].sql, /ON CONFLICT \(builder_id, fingerprint\)/);
-  assert.deepEqual(db.calls[0].params, [3, 'ssh-ed25519 AAAA', 'ssh-ed25519', FIXTURE_FP, 'l']);
-});
-
-await ta('deleteSshKey: scoped by builder_id (cannot delete another builder\'s key)', async () => {
-  const db = fakeDb([{ rows: [{ id: 9 }] }]);
-  const id = await o.deleteSshKey(db, 3, 9);
-  assert.equal(id, 9);
-  assert.match(db.calls[0].sql, /DELETE FROM builder_ssh_keys WHERE id = \$1 AND builder_id = \$2/);
-  assert.deepEqual(db.calls[0].params, [9, 3]);
-});
-
-await ta('deleteSshKey: returns null when nothing matched', async () => {
-  const db = fakeDb([{ rows: [] }]);
-  assert.equal(await o.deleteSshKey(db, 3, 999), null);
-});
-
-await ta('listSshKeys: selects the builder\'s keys', async () => {
-  const db = fakeDb([{ rows: [{ id: 1 }, { id: 2 }] }]);
-  const rows = await o.listSshKeys(db, 5);
-  assert.equal(rows.length, 2);
-  assert.match(db.calls[0].sql, /FROM builder_ssh_keys\s+WHERE builder_id = \$1/);
-  assert.deepEqual(db.calls[0].params, [5]);
-});
-
-// ===========================================================================
-// Layer 2 — REAL in-process HTTP through the actual box router (no DB).
-//
-// Same "stub the dependency module" pattern as tests/memory_isolation.mjs:
-// monkeypatch auth.requireBuilder BEFORE building the router (middleware is
-// captured at build time), stub the DB-touching box-onboard / db / boxes /
-// box-access functions (called by property at request time) so no Postgres is
-// needed, keep the PURE renderers + decideSourceAccess REAL, then fire real
-// requests. This exercises status codes, content-types, body parsing, and the
-// live-rank gate end-to-end through the genuine Express handlers.
-// ===========================================================================
-
-console.log('\nHTTP (real router, stubbed DB):');
-
-const express = require('express');
-const auth = require('../src/bongos/auth.js');
-const gdsDb = require('../src/bongos/db.js');
-const boxes = require('../modules/dev-box/boxes.js');
-const boxAccess = require('../modules/dev-box/box-access.js');
-
-// Mutable per-test fixtures.
-let CURRENT_SESSION = { id: 1, github_login: 'alice', rank: 'metic' };
-let CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
-
-// Patch the auth middleware BEFORE building the router.
-auth.requireBuilder = (req, _res, next) => { req.builder = CURRENT_SESSION; next(); };
-auth.requireRank = () => (_req, _res, next) => next();
-
-// Stub the DB-touching functions (called by property → patching the cached
-// module object is enough). Pure renderers + decideSourceAccess stay real.
-gdsDb.getBuilderById = async () => CURRENT_DB_BUILDER;
-boxes.getBoxByBuilderId = async () => ({ id: 1, builder_id: 1, state: 'active', scope: 'full' });
-boxAccess.recordSourceEvent = async () => {};
-o.registerSshKey = async (_db, _id, k) => ({ id: 11, key_type: k.keyType, fingerprint: k.fingerprint, label: k.label });
-o.listSshKeys = async () => ([{ public_key: 'ssh-ed25519 AAAA', label: 'laptop' }]);
-o.touchSshKeysUsed = async () => {};
-
-// Pin the public origin BEFORE requiring the router (PUBLIC_ORIGIN is a
-// module-level const read at require time). This proves the served bootstrap
-// bakes the PINNED origin, not a spoofable request header (blocker #2/#5).
-process.env.GDS_PUBLIC_ORIGIN = 'https://pinned.example';
-const buildBoxRouter = require('../modules/dev-box/routes/box.js');
-const app = express();
-app.use(express.json());
-app.use('/api/gds', buildBoxRouter());
-
-const server = http.createServer(app);
-await new Promise((r) => server.listen(0, r));
-const base = `http://127.0.0.1:${server.address().port}`;
-const j = (path, opts) => fetch(`${base}${path}`, opts);
-
-await ta('POST /box/ssh-key: a valid key → 201 ok', async () => {
-  const r = await j('/api/gds/box/ssh-key', {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ public_key: FIXTURE_PUB }),
-  });
-  assert.equal(r.status, 201);
-  const b = await r.json();
-  assert.equal(b.ok, true);
-  assert.equal(b.key.fingerprint, FIXTURE_FP);
-});
-
-await ta('POST /box/ssh-key: a bad key → 400 bad_ssh_key (rejected at the door)', async () => {
-  const r = await j('/api/gds/box/ssh-key', {
-    method: 'POST', headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ public_key: 'command="evil" ssh-ed25519 AAAA' }),
-  });
-  assert.equal(r.status, 400);
-  assert.equal((await r.json()).error, 'bad_ssh_key');
-});
-
-await ta('POST /box/ssh-key: a NEW key past the per-builder cap → 400 too_many_keys', async () => {
-  const saved = o.listSshKeys;
-  o.listSshKeys = async () => Array.from({ length: o.MAX_SSH_KEYS_PER_BUILDER },
-    (_, i) => ({ fingerprint: `SHA256:other${i}`, public_key: 'ssh-ed25519 X', label: null }));
-  try {
-    const r = await j('/api/gds/box/ssh-key', {
-      method: 'POST', headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ public_key: FIXTURE_PUB }),
-    });
-    assert.equal(r.status, 400);
-    const b = await r.json();
-    assert.equal(b.error, 'too_many_keys');
-    assert.equal(b.limit, o.MAX_SSH_KEYS_PER_BUILDER);
-  } finally {
-    o.listSshKeys = saved;
-  }
-});
-
-await ta('GET /box/authorized-keys: active builder → 200 text/plain with the managed lines', async () => {
-  CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
-  const r = await j('/api/gds/box/authorized-keys');
-  assert.equal(r.status, 200);
-  assert.match(r.headers.get('content-type') || '', /text\/plain/);
-  assert.equal(await r.text(), 'ssh-ed25519 AAAA laptop\n');
-});
-
-await ta('GET /box/authorized-keys: deactivated builder → 403 BOX_ACCESS_REVOKED (login clawback)', async () => {
-  CURRENT_DB_BUILDER = { rank: 'metic', status: 'inactive' };
-  const r = await j('/api/gds/box/authorized-keys');
-  assert.equal(r.status, 403);
-  assert.equal((await r.json()).error, 'BOX_ACCESS_REVOKED');
-  CURRENT_DB_BUILDER = { rank: 'metic', status: 'active' };
-});
-
-await ta('GET /box/managed-settings: → 200 JSON keyed off the session login', async () => {
-  const r = await j('/api/gds/box/managed-settings');
-  assert.equal(r.status, 200);
-  const b = await r.json();
-  assert.equal(b.sshConfigs[0].id, 'otb-alice');
-  assert.equal(b.sshConfigs[0].sshHost, 'root@box-alice.dev.example.com');
-});
-
-await ta('GET /box/connect.sh: PUBLIC, no auth → 200; bakes the PINNED origin and IGNORES a spoofed Host (blocker #2/#5)', async () => {
-  // Send a spoofed X-Forwarded-Host: a pre-fix server would reflect it into the
-  // script's GDS_API_BASE (token theft / RCE). The fix pins GDS_PUBLIC_ORIGIN.
-  const r = await j('/api/gds/box/connect.sh', { headers: { 'X-Forwarded-Host': 'evil.attacker.example' } });
-  assert.equal(r.status, 200);
-  const body = await r.text();
-  assert.ok(!body.includes('__GDS_API_BASE__'), 'placeholder must be substituted');
-  assert.ok(body.includes('https://pinned.example'), 'pinned GDS_PUBLIC_ORIGIN baked in');
-  assert.ok(!body.includes('evil.attacker.example'), 'a spoofed X-Forwarded-Host must NOT reach the served script');
-});
-
-await new Promise((r) => server.close(r));
-
-console.log(`\nbox_onboard.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/box_scope_session.mjs

@@ -1,119 +0,0 @@
-// tests/box_scope_session.mjs
-//
-// SECURITY regression guard for #919 (security_reports SR#2): a dev-box session
-// (source='box') is DENY-BY-DEFAULT. The box provisioner bakes such a session into
-// cloud-init so the box can bootstrap (#818), but the token lives ON the box —
-// OUTSIDE the ADR 0016 trust boundary — so it must NOT carry the builder's full
-// authority. auth.requireBuilder rejects a 'box' session on every route EXCEPT the
-// handful the on-box crons need, which opt in via auth.allowBoxScope (a tiny
-// middleware mounted ahead of requireBuilder that sets req.allowBoxScope = true).
-//
-// The gate is fail-closed: a route WITHOUT allowBoxScope denies a box session, so
-// any route added later is denied to boxes automatically. cli/web sessions are
-// completely unaffected (the gate only fires when source === 'box').
-//
-// lookupSession is stubbed on the db module BEFORE auth.js is required, because
-// auth.js destructures it at load time. No server/DB/network.
-//
-// Run:  node tests/box_scope_session.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-
-const db = require('../src/bongos/db-kernel.js'); // lookupSession lives in db-kernel now (ADR 0102)
-let nextSession = null;
-db.lookupSession = async () => nextSession;
-const auth = require('../src/bongos/auth.js');
-
-const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
-function fakeRes() {
-  const res = {
-    _status: null, _json: null,
-    status(c) { this._status = c; return this; },
-    json(b) { this._json = b; return this; },
-  };
-  attachFail({}, res, () => {}); // install res.fail(), exactly as the router does (task 1991)
-  return res;
-}
-
-let pass = 0, fail = 0;
-const t = async (name, fn) => {
-  try { await fn(); pass++; console.log(`PASS  ${name}`); }
-  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
-};
-
-// ---- allowBoxScope middleware ------------------------------------------------
-// BV1.R99: the opt-in is no longer a bare boolean flag — it DECLARES the box
-// scope's own permission allow-list, and requireBuilder checks the declaration
-// against the registry. The reachability contract below is unchanged.
-await t('allowBoxScope declares the box scope\'s allow-list and calls next()', async () => {
-  const req = {};
-  let nexted = false;
-  auth.allowBoxScope(req, fakeRes(), () => { nexted = true; });
-  assert.deepEqual([...req.sessionScopeNeeds], [...auth.sessionScopeFor('box').permissions]);
-  assert.ok(req.sessionScopeNeeds.length > 0, 'an empty declaration would deny every box route');
-  assert.equal(nexted, true);
-});
-
-// ---- box session DENIED on a route that did NOT opt in -----------------------
-await t('box session on a non-box route → 403 box_scope, next() NOT called', async () => {
-  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'metic', status: 'active', source: 'box' };
-  const req = { headers: { authorization: 'Bearer boxtoken' } }; // no req.allowBoxScope
-  const res = fakeRes();
-  let nexted = false;
-  await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, false, 'a box session must not reach a route without allowBoxScope');
-  assert.equal(res._status, 403);
-  assert.equal(res._json.error.code, 'box_scope');
-});
-
-// ---- box session ALLOWED when the route opted in -----------------------------
-await t('box session + allowBoxScope (middleware ran) → next() called, req.builder set', async () => {
-  nextSession = { builder_id: 3, github_login: 'boxbot', rank: 'metic', status: 'active', source: 'box' };
-  // Simulate the real chain: allowBoxScope runs first and flags the request.
-  const req = { headers: { authorization: 'Bearer boxtoken' } };
-  auth.allowBoxScope(req, fakeRes(), () => {});
-  const res = fakeRes();
-  let nexted = false;
-  await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, true, 'a box session must pass on an allow-listed route');
-  assert.equal(res._status, null);
-  assert.equal(req.builder.rank, 'metic');
-});
-
-// ---- cli / web sessions are unaffected by the box gate -----------------------
-await t('cli session on a non-box route → unaffected, next() called', async () => {
-  nextSession = { builder_id: 1, github_login: 'example-owner', rank: 'archon', status: 'active', source: 'cli' };
-  const req = { headers: { authorization: 'Bearer clitoken' } }; // no allowBoxScope
-  const res = fakeRes();
-  let nexted = false;
-  await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, true, 'a full cli session is never box-gated');
-  assert.equal(res._status, null);
-});
-
-await t('web session on a non-box route → unaffected, next() called', async () => {
-  nextSession = { builder_id: 9, github_login: 'weber', rank: 'metic', status: 'active', source: 'web' };
-  const req = { headers: { cookie: 'gds_session=webtoken' } };
-  const res = fakeRes();
-  let nexted = false;
-  await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, true);
-  assert.equal(res._status, null);
-});
-
-// ---- a legacy session with no source field is NOT treated as a box -----------
-await t('session with no source field → not box-gated (only source==="box" fires)', async () => {
-  nextSession = { builder_id: 2, github_login: 'legacy', rank: 'metic', status: 'active' }; // no source
-  const req = { headers: { authorization: 'Bearer legacytoken' } };
-  const res = fakeRes();
-  let nexted = false;
-  await auth.requireBuilder(req, res, () => { nexted = true; });
-  assert.equal(nexted, true, 'absent source must never trip the box gate');
-  assert.equal(res._status, null);
-});
-
-console.log(`\n${pass} passed, ${fail} failed`);
-process.exit(fail === 0 ? 0 : 1);

package/tests/box_sweep_docs.mjs

@@ -1,119 +0,0 @@
-// tests/box_sweep_docs.mjs — the box sweep docs must not invert against box.js
-// a third time (task 1003823).
-//
-// HISTORY, because it is the whole reason this file exists. The idle sweep has
-// changed direction twice:
-//
-//   task 804     — sweep-idle went from park to a direct deprovision, and
-//                  task 1001135 dragged four doc surfaces along with it.
-//   task 1002726 — the CODE went BACK to park-and-keep-the-snapshot, because
-//                  annihilating an idle box took the builder's uncommitted work
-//                  with it. The four doc surfaces were NOT walked back.
-//
-// So for months the routine's own SKILL.md told an agent "your single job is to
-// DESTROY" while cmdSweepIdle called parkOne. The danger is specific and worth
-// naming: an agent that believes it is supposed to destroy, and finds the sweep
-// merely parking, is being invited to reach for `box.js deprovision` to finish a
-// job it was never given — which is the one path that can silently discard a
-// builder's work.
-//
-// This guard is therefore NOT a spell-check. It asserts the one relationship
-// that matters: WHILE cmdSweepIdle parks, the docs may not say it destroys.
-// If a future task legitimately moves the idle path back to a destroy, this test
-// goes green on its own as soon as the code changes — it is pinned to the code,
-// not to a preferred wording.
-
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const read = (p) => fs.readFileSync(path.join(ROOT, p), 'utf8');
-
-const BOX_JS = 'scripts/gds/box.js';
-const IDLE_SKILL = '.claude/scheduled-tasks/box-idle-suspend/SKILL.md';
-const DORMANT_SKILL = '.claude/scheduled-tasks/box-dormant-reclaim/SKILL.md';
-// The fourth surface this guard used to read, docs/recipes/builder-box-lifecycle.md,
-// was deleted with the other three published dev-box recipes (task 1004013,
-// ADR 0305: a recipe lives with what it documents). A file that does not exist
-// cannot invert against box.js, so it drops out of the lists below rather than
-// weakening them — the two SKILL.md surfaces are still read in full.
-
-// Comments are stripped before scanning prose: each surface deliberately keeps a
-// sentence SAYING which model it used to describe, and a naive substring check
-// would read that history as the claim still being made.
-const stripHtmlComments = (md) => md.replace(/<!--[\s\S]*?-->/g, '');
-
-// The body of cmdSweepIdle, so "what the sweep does" is read from the function
-// itself rather than from a header comment that can rot the same way the docs did.
-function cmdSweepIdleBody() {
-  const src = read(BOX_JS);
-  const start = src.indexOf('async function cmdSweepIdle(');
-  assert.ok(start > 0, `cmdSweepIdle not found in ${BOX_JS} — this guard is reading the wrong file`);
-  const next = src.indexOf('\nasync function ', start + 1);
-  return src.slice(start, next > 0 ? next : src.length);
-}
-
-test('the idle sweep parks — that is the fact the docs are measured against', () => {
-  const body = cmdSweepIdleBody();
-  assert.match(body, /parkOne\(/, 'cmdSweepIdle no longer calls parkOne');
-  assert.doesNotMatch(body, /deprovisionOne\(/,
-    'cmdSweepIdle calls deprovisionOne — the idle path destroys again. That is allowed, '
-    + 'but the docs below must be rewritten to match BEFORE this guard is relaxed.');
-});
-
-test('no box-sweep doc claims the IDLE sweep destroys, while the code parks', () => {
-  // Sentences that assert a destroy as the idle sweep's OUTCOME. Each pattern is
-  // anchored on the idle path specifically, because "destroy the droplet" is a
-  // true statement about a park (the droplet does go; the snapshot stays) and
-  // "destroy the snapshot" is a true statement about sweep-dormant.
-  const lies = [
-    /idle[- ]deprovision/i,
-    /idle box is fully DESTROYED/i,
-    /destroy the droplet \*\*AND\*\* (?:its )?snapshot/i,
-    /droplet \+ snapshot destroyed/i,
-    /idle no longer feeds it/i,
-    /no longer parks/i,
-    /there is no snapshot to wake from/i,
-    /single job is to DESTROY/i,
-  ];
-
-  for (const file of [IDLE_SKILL, DORMANT_SKILL]) {
-    const prose = stripHtmlComments(read(file));
-    for (const lie of lies) {
-      assert.doesNotMatch(prose, lie,
-        `${file} still describes the pre-task-1002726 destroy model (${lie}). `
-        + 'cmdSweepIdle calls parkOne and keeps the snapshot — see task 1003823.');
-    }
-  }
-});
-
-test('the idle skill quotes the strings the worker actually prints', () => {
-  // Step 3 of the skill orders a VERBATIM relay, so a drifted string here makes
-  // the agent either fabricate a line or stall. These are the three the worker emits.
-  const skill = read(IDLE_SKILL);
-  const body = cmdSweepIdleBody();
-
-  for (const s of ['would park', 'snapshot kept, compute stopped', 'done — parked=']) {
-    assert.ok(body.includes(s), `cmdSweepIdle no longer prints ${JSON.stringify(s)}`);
-    assert.ok(skill.includes(s),
-      `${IDLE_SKILL} does not quote ${JSON.stringify(s)}, which the worker prints and `
-      + 'step 3 tells the agent to relay verbatim.');
-  }
-
-  assert.ok(!/done — deprovisioned=/.test(skill),
-    `${IDLE_SKILL} tells the agent to relay "done — deprovisioned=", a line the worker never emits.`);
-});
-
-test('every surface names sweep-dormant as the only automated snapshot delete', () => {
-  // The safety property box.js implements in prose: full reclaim warns first, so
-  // no automated path takes uncommitted work silently. A reader who misses this
-  // is the reader who reaches for deprovision.
-  for (const file of [IDLE_SKILL, DORMANT_SKILL]) {
-    assert.match(stripHtmlComments(read(file)), /only automated path that destroys a snapshot|only automated snapshot delete/i,
-      `${file} never tells the reader that sweep-dormant is the only automated path that `
-      + 'destroys a snapshot (and that it warns first) — the safety property this subsystem rests on.');
-  }
-});

package/tests/box_sync.mjs

@@ -1,55 +0,0 @@
-// tests/box_sync.mjs
-//
-// BV1.R96 (goal 1000051) — "sync now": box-sync.js locates the box source-fetch
-// script (so re-running it re-scopes the box to the active claim) and degrades
-// cleanly off a box. Pure + hermetic: resolveFetchScript threads {env, repoRoot}
-// to the shared resolveBoxInfraDir (ADR 0150 / R98); temp dirs stand in for a real
-// box infra/ tree. NO DB, NO network, NO box.
-//
-// Run:  node tests/box_sync.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { makeRunner } from './helpers.mjs';
-
-const require = createRequire(import.meta.url);
-const boxSync = require('../scripts/gds/box-sync.js');
-
-const { test, summary } = makeRunner();
-
-const tmps = [];
-function makeInfra({ template = true, fetch = true } = {}) {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsync-'));
-  tmps.push(root);
-  const infra = path.join(root, 'infra');
-  fs.mkdirSync(infra, { recursive: true });
-  // resolveBoxInfraDir validates an infra/ by the presence of the cloud-init template.
-  if (template) fs.writeFileSync(path.join(infra, 'builder-box-cloud-init.yaml'), '#cloud-config\n');
-  if (fetch) fs.writeFileSync(path.join(infra, boxSync.FETCH_SCRIPT), '#!/usr/bin/env bash\necho fetch\n');
-  return { root, infra };
-}
-
-await test('resolves the box source-fetch script when it is present on the box', () => {
-  const { infra } = makeInfra();
-  const got = boxSync.resolveFetchScript({ env: { CLOUDBONGOS_BOX_INFRA_DIR: infra }, repoRoot: '/nope' });
-  assert.equal(got, path.join(infra, boxSync.FETCH_SCRIPT));
-});
-
-await test('→ null when the infra/ has no source-fetch script (template present, fetch absent)', () => {
-  const { infra } = makeInfra({ fetch: false });
-  const got = boxSync.resolveFetchScript({ env: { CLOUDBONGOS_BOX_INFRA_DIR: infra }, repoRoot: '/nope' });
-  assert.equal(got, null);
-});
-
-await test('→ null when there is no infra/ at all (i.e. NOT on a box)', () => {
-  const bare = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsync-bare-'));
-  tmps.push(bare);
-  const got = boxSync.resolveFetchScript({ env: {}, repoRoot: path.join(bare, 'node_modules', '@bongos', 'core') });
-  assert.equal(got, null);
-});
-
-for (const d of tmps) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best-effort */ } }
-summary();