@bongos/core 1.19.901 → 1.19.903

package/scripts/gds/shell.js

@@ -1,102 +0,0 @@
-#!/usr/bin/env node
-// scripts/gds/shell.js — `bongos shell` (GDS-V4 · V4.R80 · task 1247).
-//
-// Opens a terminal on the builder's cloud dev box. Wakes/provisions it first
-// (POST /box/ensure), ensures the local SSH key exists + is registered, pins the
-// box host key, then `ssh -t root@<host>` into /workspace. On the FIRST connect to
-// a given box it runs an interactive `claude` so the one-time /login (Trusted
-// Devices enrollment, interactive-only by design — ADR 0038) is completed; silent
-// after that.
-//
-//   bongos shell                 interactive shell on the cloud box
-//   bongos shell -- <cmd...>      run <cmd> on the box (non-interactive)
-//   bongos shell --login          force the first-run `claude` /login handoff
-//   bongos shell --local          open a shell on the LOCAL clone (Metic+ only)
-
-'use strict';
-
-const os = require('node:os');
-const path = require('node:path');
-const { spawnSync, execFileSync } = require('node:child_process');
-const lib = require('./box-connect-lib');
-
-function repoRoot() {
-  try {
-    return execFileSync('git', ['rev-parse', '--show-toplevel'], { encoding: 'utf8' }).trim();
-  } catch (_) {
-    return process.cwd();
-  }
-}
-
-async function runLocal({ remoteCmd, log }) {
-  const rank = await lib.fetchRank();
-  if (!lib.rankAtLeast(rank, 'metic')) {
-    console.error(
-      `✖ \`--local\` is a Metic+ convenience (your rank: ${rank || 'unknown'}). ` +
-        'The standard environment is the cloud box: run `bongos shell` without `--local`.'
-    );
-    process.exit(1);
-  }
-  const root = repoRoot();
-  log(`▸ Local clone: ${root.replace(os.homedir(), '~')}`);
-  const isDevcontainer = require('node:fs').existsSync(path.join(root, '.devcontainer', 'devcontainer.json'));
-  if (isDevcontainer) {
-    log('  (a .devcontainer is present — open it in VS Code with `bongos code --local`, then "Reopen in Container".)');
-  }
-  if (remoteCmd) {
-    const r = spawnSync(remoteCmd[0], remoteCmd.slice(1), { cwd: root, stdio: 'inherit', shell: process.platform === 'win32' });
-    process.exit(r.status == null ? 1 : r.status);
-  }
-  const shell = process.env.SHELL || (process.platform === 'win32' ? process.env.COMSPEC || 'cmd.exe' : 'bash');
-  const r = spawnSync(shell, process.platform === 'win32' ? [] : ['-l'], { cwd: root, stdio: 'inherit' });
-  process.exit(r.status == null ? 1 : r.status);
-}
-
-async function main() {
-  const argv = process.argv.slice(2);
-  const local = argv.includes('--local');
-  const forceLogin = argv.includes('--login');
-  let rest = argv.filter((a) => a !== '--local' && a !== '--login');
-  if (rest[0] === '--') rest = rest.slice(1);
-  const remoteCmd = rest.length ? rest : null;
-  const log = console.log;
-
-  if (local) return runLocal({ remoteCmd, log });
-
-  if (!lib.binPresent('ssh', ['-V'])) {
-    console.error('✖ The `ssh` client was not found. Install OpenSSH (macOS/Linux ship it; on Windows enable the "OpenSSH Client" optional feature) and re-run.');
-    process.exit(1);
-  }
-
-  console.log(`▸ Connecting to your ${require('./cli-lib').productName()} dev box…`);
-  const { box, keyPath } = await lib.prepareConnection({ log });
-  const host = box.hostname;
-
-  const sshArgs = ['-t', '-i', keyPath, '-o', 'IdentitiesOnly=yes', '-o', 'StrictHostKeyChecking=accept-new', `${lib.BOX_USER}@${host}`];
-  let firstRun = false;
-  if (remoteCmd) {
-    // Everything after the host IS the remote command (ssh option parsing stops
-    // at the destination), so pass the tokens directly — no `--` separator, which
-    // ssh would forward to the remote shell as a bogus first word.
-    sshArgs.push(...remoteCmd);
-  } else {
-    firstRun = forceLogin || lib.isFirstLogin(host);
-    // BV1.R101: re-scope /workspace to the active claim on connect, so an
-    // interactive shell always lands in a folder holding exactly that task's code.
-    sshArgs.push(lib.buildRemoteShellCommand({ firstRun, sync: true }));
-    console.log(`▸ Opening a shell on ${host} (${lib.WORKSPACE}, scoped to your active claim)…`);
-  }
-
-  const r = spawnSync('ssh', sshArgs, { stdio: 'inherit' });
-  if (r.error) {
-    console.error(`✖ ssh failed to launch: ${r.error.message}`);
-    process.exit(1);
-  }
-  if (firstRun && r.status === 0) lib.markLoginDone(host);
-  process.exit(r.status == null ? 1 : r.status);
-}
-
-main().catch((err) => {
-  console.error(`✖ ${err.message}`);
-  process.exit(1);
-});

package/tests/bongos_box_connect.mjs

@@ -1,166 +0,0 @@
-// tests/bongos_box_connect.mjs — pure helpers behind `bongos shell` / `bongos code`
-// (V4.R80 / task 1247). DB-free + network-free: only the pure string/decision
-// helpers are exercised. Picked up by scripts/gds/run-unit-tests.js (the `unit` gate).
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import crypto from 'node:crypto';
-import lib from '../scripts/gds/box-connect-lib.js';
-
-const HOST = 'box-alice.dev.example.com';
-
-test('rankAtLeast gates --local at Metic+', () => {
-  assert.equal(lib.rankAtLeast('metic', 'metic'), true);
-  assert.equal(lib.rankAtLeast('archon', 'metic'), true);
-  assert.equal(lib.rankAtLeast('thetes', 'metic'), false);
-  assert.equal(lib.rankAtLeast('xenos', 'metic'), false);
-  assert.equal(lib.rankAtLeast(null, 'metic'), false);
-  assert.equal(lib.rankAtLeast('nonsense', 'metic'), false);
-});
-
-test('buildSshAliasBlock carries the box user, key, and host-key policy', () => {
-  const b = lib.buildSshAliasBlock({ hostname: HOST, identityFile: '~/.ssh/otb_builder' });
-  assert.match(b, new RegExp(`^Host ${HOST}$`, 'm'));
-  assert.match(b, /User root/);
-  assert.match(b, /IdentityFile ~\/\.ssh\/otb_builder/);
-  assert.match(b, /StrictHostKeyChecking accept-new/);
-  assert.match(b, /IdentitiesOnly yes/);
-});
-
-test('upsertSshConfigText appends when absent and preserves other content', () => {
-  const existing = 'Host example\n    HostName example.com\n';
-  const next = lib.upsertSshConfigText(existing, { hostname: HOST, identityFile: '~/.ssh/otb_builder' });
-  assert.ok(next.includes('Host example'), 'keeps the pre-existing block');
-  assert.ok(next.includes(`Host ${HOST}`), 'adds the box block');
-});
-
-test('upsertSshConfigText is idempotent (re-run yields the same body)', () => {
-  const once = lib.upsertSshConfigText('', { hostname: HOST, identityFile: '~/.ssh/otb_builder' });
-  const twice = lib.upsertSshConfigText(once, { hostname: HOST, identityFile: '~/.ssh/otb_builder' });
-  assert.equal(twice, once);
-  // Exactly one block for this host.
-  const matches = twice.match(new RegExp(`Host ${HOST.replace(/\./g, '\\.')}\\b`, 'g')) || [];
-  assert.equal(matches.length, 1);
-});
-
-test('upsertSshConfigText replaces a changed block in place, not duplicating', () => {
-  const first = lib.upsertSshConfigText('', { hostname: HOST, identityFile: '~/.ssh/otb_builder' });
-  const changed = lib.upsertSshConfigText(first, { hostname: HOST, identityFile: '~/.ssh/other_key' });
-  assert.ok(changed.includes('IdentityFile ~/.ssh/other_key'));
-  assert.ok(!changed.includes('IdentityFile ~/.ssh/otb_builder'));
-  const begins = changed.match(/# >>> bongos-managed/g) || [];
-  assert.equal(begins.length, 1);
-});
-
-test('buildKnownHostsUpsert drops the stale line for the host, keeps others, appends keys', () => {
-  const existing = [
-    'other.example.com ssh-ed25519 AAAAOTHER',
-    `${HOST} ssh-ed25519 AAAASTALE`,
-  ].join('\n') + '\n';
-  const hostKeys = 'ssh-ed25519 AAAANEW\nssh-rsa AAAARSANEW';
-  const next = lib.buildKnownHostsUpsert(existing, HOST, hostKeys);
-  assert.ok(next.includes('other.example.com ssh-ed25519 AAAAOTHER'), 'keeps unrelated hosts');
-  assert.ok(!next.includes('AAAASTALE'), 'drops the stale key for this host');
-  assert.ok(next.includes(`${HOST} ssh-ed25519 AAAANEW`), 'appends the reported key');
-  assert.ok(next.includes(`${HOST} ssh-rsa AAAARSANEW`), 'appends every reported key');
-});
-
-// task 1002509 — the upsert used to compare field 1 to the hostname with `!==`, so
-// the two forms OpenSSH actually writes survived the "replace" and stale lines
-// ACCUMULATED: the client kept verifying against the first, now-wrong entry
-// ("Host denied (verification failed)") on a box that had just re-reported keys.
-test('buildKnownHostsUpsert drops a host,ip entry for this box (the accumulation bug)', () => {
-  const existing = `${HOST},192.0.2.30 ssh-ed25519 STALE\n`;
-  const next = lib.buildKnownHostsUpsert(existing, HOST, 'ssh-ed25519 AAAANEW');
-  assert.ok(!next.includes('STALE'), 'a `host,ip` field-1 names this host and must be replaced');
-  assert.ok(next.includes(`${HOST} ssh-ed25519 AAAANEW`));
-});
-
-test('buildKnownHostsUpsert drops a HASHED entry for this box, keeps another host, keeps comments', () => {
-  const salt = crypto.randomBytes(20);
-  const hashFor = (h) => `|1|${salt.toString('base64')}|${crypto.createHmac('sha1', salt).update(h).digest('base64')}`;
-  const existing = [
-    '# hand-written note',
-    `${hashFor(HOST)} ssh-ed25519 STALEHASHED`,
-    `${hashFor('other.example.com')} ssh-ed25519 KEEPHASHED`,
-  ].join('\n') + '\n';
-  const next = lib.buildKnownHostsUpsert(existing, HOST, 'ssh-ed25519 AAAANEW');
-  assert.ok(!next.includes('STALEHASHED'), 'HashKnownHosts entries must be matched, not stepped over');
-  assert.ok(next.includes('KEEPHASHED'), 'another host hashed with the same salt stays');
-  assert.ok(next.includes('# hand-written note'), 'comments survive');
-});
-
-test('buildKnownHostsUpsert drops an IP-keyed line when the box IP is supplied', () => {
-  const existing = '203.0.113.7 ssh-ed25519 STALEIP\nunrelated.example.com ssh-ed25519 KEEP\n';
-  const next = lib.buildKnownHostsUpsert(existing, HOST, 'ssh-ed25519 AAAANEW', '203.0.113.7');
-  assert.ok(!next.includes('STALEIP'), 'DNS is repointed on every wake — an old IP line is stale too');
-  assert.ok(next.includes('KEEP'));
-});
-
-test('buildKnownHostsUpsert is idempotent — re-running never grows the file', () => {
-  const first = lib.buildKnownHostsUpsert('', HOST, 'ssh-ed25519 AAAANEW\nssh-rsa AAAARSA');
-  const second = lib.buildKnownHostsUpsert(first, HOST, 'ssh-ed25519 AAAANEW\nssh-rsa AAAARSA');
-  assert.equal(second, first);
-  assert.equal(second.split('\n').filter(Boolean).length, 2);
-});
-
-// task 1002509 — the old inline logic FAILED OPEN: no fingerprint (ssh-keygen absent
-// from a GUI process's leaner PATH) or an unreadable key list meant "skip", so a
-// builder whose key was never on the server got a bare "Permission denied". A
-// redundant POST is free (the server upserts by fingerprint), uncertainty is not.
-test('decideKeyRegistration registers on uncertainty and skips only on proof', () => {
-  const FP = 'SHA256:abc';
-  assert.deepEqual(lib.decideKeyRegistration({ created: true }), { register: true, why: 'created' });
-  assert.equal(lib.decideKeyRegistration({ fingerprint: FP, listedKeys: [{ fingerprint: FP }] }).register, false);
-  assert.equal(lib.decideKeyRegistration({ fingerprint: FP, listedKeys: [{ fingerprint: 'SHA256:other' }] }).register, true);
-  assert.equal(lib.decideKeyRegistration({ fingerprint: FP, listedKeys: [] }).register, true);
-  // the two fail-open holes this closes:
-  assert.equal(lib.decideKeyRegistration({ fingerprint: null, listedKeys: [] }).register, true);
-  assert.equal(lib.decideKeyRegistration({ fingerprint: null, listedKeys: [{ fingerprint: FP }] }).register, true);
-  assert.equal(lib.decideKeyRegistration({ fingerprint: FP, listFailed: true }).register, true);
-  assert.equal(lib.decideKeyRegistration({}).register, true, 'no information at all → register');
-});
-
-test('buildRemoteShellCommand forces claude only on first run and always lands in /workspace', () => {
-  const first = lib.buildRemoteShellCommand({ firstRun: true });
-  const later = lib.buildRemoteShellCommand({ firstRun: false });
-  assert.match(first, /cd \/workspace/);
-  assert.match(first, /claude \|\| true/);
-  assert.match(first, /exec bash -l/);
-  assert.match(later, /cd \/workspace/);
-  assert.ok(!/claude/.test(later), 'no forced claude on a normal connect');
-  assert.match(later, /exec bash -l/);
-});
-
-test('buildRemoteShellCommand re-scopes on connect ONLY with sync:true (BV1.R101)', () => {
-  const noSync = lib.buildRemoteShellCommand({ firstRun: false, sync: false });
-  const withSync = lib.buildRemoteShellCommand({ firstRun: false, sync: true });
-  assert.ok(!/box-sync/.test(noSync), 'default (sync:false) never re-scopes');
-  assert.match(withSync, /node scripts\/gds\/box-sync\.js \|\| true/);
-  // order: cd → re-scope → shell, so the builder lands in the scoped folder.
-  assert.ok(withSync.indexOf('cd /workspace') < withSync.indexOf('box-sync'), 'cd before sync');
-  assert.ok(withSync.indexOf('box-sync') < withSync.indexOf('exec bash -l'), 'sync before the shell');
-  // sync + firstRun: re-scope THEN the one-time claude /login handoff.
-  const both = lib.buildRemoteShellCommand({ firstRun: true, sync: true });
-  assert.ok(both.indexOf('box-sync') < both.indexOf('claude || true'), 'sync before the first-run login');
-});
-
-test('buildRemoteResyncCommand is a cd + re-scope one-shot (bongos code path) — no shell (BV1.R101)', () => {
-  const cmd = lib.buildRemoteResyncCommand();
-  assert.match(cmd, /cd \/workspace/);
-  assert.match(cmd, /node scripts\/gds\/box-sync\.js \|\| true/);
-  assert.ok(!/exec bash/.test(cmd), 'one-shot — never spawns a login shell');
-});
-
-test('remoteAuthority builds a VS Code Remote-SSH authority', () => {
-  assert.equal(lib.remoteAuthority(HOST), `ssh-remote+${HOST}`);
-});
-
-test('parseEnsure normalizes the /box/ensure body', () => {
-  assert.deepEqual(lib.parseEnsure({ action: 'ready', state: 'active', queued: false }), {
-    action: 'ready',
-    state: 'active',
-    message: null,
-  });
-  assert.deepEqual(lib.parseEnsure({}), { action: null, state: null, message: null });
-  assert.deepEqual(lib.parseEnsure(null), { action: null, state: null, message: null });
-});

package/tests/box_scope_predicate.mjs

@@ -1,117 +0,0 @@
-// tests/box_scope_predicate.mjs
-//
-// task 1002593 — "is this a box-scope refusal?" must have exactly ONE definition,
-// and it must survive the error-envelope shape.
-//
-// THE BUG THIS PINS. A box-scoped session (ADR 0053) may call only the dev-box
-// bootstrap endpoints; everything else answers 403 box_scope. Callers branched on
-// `res.data.error === 'box_scope'`. Then routes moved to the object error envelope
-// (ADR 0116) — `data.error` became `{ code, message, details }` — and every one of
-// those comparisons silently became dead code. Nothing failed; the branch just
-// stopped firing, and builders got the generic 403 path instead of the guided
-// re-auth the branch existed to give them. Task 1002162 fixed it in cli-lib by
-// adding isBoxScope(); scripts/gds/ship-land.js was the last site still deciding
-// for itself, and task 1002593 repointed it.
-//
-// WHY A DRIFT GUARD AND NOT JUST UNIT CASES. The original defect was not a wrong
-// answer — it was a comparison that could never be true. A unit test of the good
-// predicate cannot see a second, dead one somewhere else in the tree; only a scan
-// can. So the last test here is the one that actually protects against a repeat.
-//
-// Run:  node tests/box_scope_predicate.mjs
-
-import { strict as assert } from 'node:assert';
-import fs from 'node:fs';
-import path from 'node:path';
-import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
-
-const require = createRequire(import.meta.url);
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const CLI_DIR = path.join(ROOT, 'scripts', 'gds');
-const { isBoxScope } = require(path.join(CLI_DIR, 'cli-lib.js'));
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-
-const ENVELOPE = { status: 403, data: { error: { code: 'box_scope', message: 'box-scoped session' } } };
-const LEGACY = { status: 403, data: { error: 'box_scope' } };
-
-t('fires for the CURRENT object error envelope — the shape that killed the old comparison', () => {
-  assert.equal(isBoxScope(ENVELOPE), true);
-});
-
-t('the old hand-rolled comparison is provably dead against that same shape', () => {
-  // Not a tautology: this is the regression itself. If someone reintroduces
-  // `data.error === 'box_scope'` anywhere, this is what it evaluates to.
-  assert.equal(ENVELOPE.data.error === 'box_scope', false,
-    'the envelope shape must NOT satisfy a bare string comparison — that is the whole defect');
-});
-
-t('still fires for the LEGACY flat shape, so a pinned older core keeps working', () => {
-  assert.equal(isBoxScope(LEGACY), true);
-});
-
-t('does not fire on a different code at 403', () => {
-  assert.equal(isBoxScope({ status: 403, data: { error: { code: 'rank_too_low_for_task' } } }), false);
-  assert.equal(isBoxScope({ status: 403, data: { error: 'forbidden' } }), false);
-});
-
-t('does not fire on a non-403, even carrying the code', () => {
-  assert.equal(isBoxScope({ status: 200, data: { error: { code: 'box_scope' } } }), false,
-    'status is part of the contract — a 200 mentioning box_scope is not a refusal');
-  assert.equal(isBoxScope({ status: 500, data: { error: { code: 'box_scope' } } }), false);
-});
-
-t('tolerates missing/!odd bodies instead of throwing', () => {
-  for (const bad of [undefined, null, {}, { status: 403 }, { status: 403, data: null }, { status: 403, data: {} }]) {
-    assert.equal(isBoxScope(bad), false, `${JSON.stringify(bad)} must be a quiet false, not a throw`);
-  }
-  assert.equal(isBoxScope({ status: 403, data: { error: null } }), false,
-    'a null error must not be read as an envelope');
-});
-
-// ---------------------------------------------------------------------------
-// The drift guard. One definition, and no second opinion anywhere in the CLI.
-// ---------------------------------------------------------------------------
-t('no CLI script decides box-scope for itself — cli-lib owns the predicate', () => {
-  const files = fs.readdirSync(CLI_DIR).filter((f) => f.endsWith('.js'));
-  // Fail loudly on a scan that found nothing: an empty sweep looks exactly like a
-  // clean one, and a guard that silently stops scanning protects nothing.
-  assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
-
-  const offenders = [];
-  let sawTheCanary = false;
-  for (const f of files) {
-    const src = fs.readFileSync(path.join(CLI_DIR, f), 'utf8');
-    if (f === 'cli-lib.js') {
-      // The one legitimate definition. Confirms the scan can actually see the
-      // pattern it is looking for, so a regex that has drifted off the source
-      // shape reports as a failure here rather than as a clean sweep everywhere.
-      sawTheCanary = /===\s*'box_scope'/.test(src);
-      continue;
-    }
-    // Strip comments: several files DISCUSS the old comparison on purpose.
-    const code = src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
-    for (const m of code.matchAll(/[^\n]*===\s*'box_scope'[^\n]*/g)) {
-      offenders.push(`${f}: ${m[0].trim()}`);
-    }
-  }
-
-  assert.ok(sawTheCanary, 'cli-lib.js no longer contains the comparison — this guard is looking for the wrong pattern');
-  assert.deepEqual(offenders, [],
-    `these sites decide box-scope themselves instead of calling isBoxScope(); that is how the comparison died last time:\n  ${offenders.join('\n  ')}`);
-});
-
-t('ship-land.js — the site task 1002593 repointed — uses the shared predicate', () => {
-  const src = fs.readFileSync(path.join(CLI_DIR, 'ship-land.js'), 'utf8');
-  assert.match(src, /isBoxScope\s*\(/, 'the box-scope branch must call the shared predicate');
-  assert.match(src, /require\('\.\/cli-lib'\)/, 'and import it from cli-lib rather than redefining it');
-});
-
-console.log(`\nbox_scope_predicate: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/cli_box_scope.mjs

@@ -1,92 +0,0 @@
-// tests/cli_box_scope.mjs
-//
-// task 1050 (C): cli-lib detects a dev-box bootstrap-scoped 403 and turns it into
-// a guided re-auth (open the hall, re-issue, paste) instead of the raw
-// `failed to load profile: { error: 'box_scope' }` dump that was the #1027
-// nightmare's first wall. isBoxScope is the pure detector behind that — it must
-// fire ONLY on a genuine 403 box_scope, never on other 403s or other statuses
-// (a false positive would wrongly send a normally-authed builder to re-auth).
-//
-// Run:  node tests/cli_box_scope.mjs
-
-// task 1002162: the detector originally compared `res.data.error` to the STRING
-// 'box_scope'. The live server emits the ADR 0116 (R01) envelope, so that field
-// is an OBJECT and the test never matched — both call sites in cli-lib were dead
-// code. The envelope cases below import the server's REAL `envelope()` formatter
-// rather than hand-typing the shape, so if the wire contract changes again this
-// test fails instead of silently drifting back into a no-op.
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const lib = require('../scripts/gds/cli-lib.js');
-const { isBoxScope } = lib;
-const { envelope } = require('../src/bongos/api-errors.js');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ok  ${name}`); }
-  catch (err) { failed++; console.log(`  FAIL ${name}\n     ${err.message}`); }
-}
-
-test('isBoxScope: true ONLY for 403 + error "box_scope"', () => {
-  assert.equal(isBoxScope({ status: 403, data: { error: 'box_scope' } }), true);
-});
-
-test('isBoxScope: false for a different 403 (e.g. not_your_task) — must not hijack', () => {
-  assert.equal(isBoxScope({ status: 403, data: { error: 'not_your_task' } }), false);
-  assert.equal(isBoxScope({ status: 403, data: { error: 'forbidden' } }), false);
-});
-
-test('isBoxScope: false for box_scope error on the WRONG status', () => {
-  assert.equal(isBoxScope({ status: 401, data: { error: 'box_scope' } }), false);
-  assert.equal(isBoxScope({ status: 200, data: { error: 'box_scope' } }), false);
-});
-
-test('isBoxScope: false on a normal success', () => {
-  assert.equal(isBoxScope({ status: 200, data: { ok: true } }), false);
-});
-
-test('isBoxScope: false on missing/empty data (no crash)', () => {
-  assert.equal(isBoxScope({ status: 403, data: null }), false);
-  assert.equal(isBoxScope({ status: 403 }), false);
-  assert.equal(isBoxScope(null), false);
-  assert.equal(isBoxScope(undefined), false);
-});
-
-// ---------------------------------------------------------------------------
-// task 1002162 — the ADR 0116 envelope. THE REGRESSION: these are the shapes the
-// live server actually sends, built by the server's own formatter.
-// ---------------------------------------------------------------------------
-
-test('isBoxScope: true for the REAL server envelope (the shape that was missed)', () => {
-  assert.equal(isBoxScope({ status: 403, data: envelope('box_scope') }), true);
-});
-
-test('isBoxScope: true for an envelope carrying message + details', () => {
-  const body = envelope('box_scope', 'box-scoped session', { what_to_do: 're-auth' });
-  assert.equal(body.error.code, 'box_scope', 'guard: envelope() still nests under .error.code');
-  assert.equal(isBoxScope({ status: 403, data: body }), true);
-});
-
-test('isBoxScope: false for a DIFFERENT code in envelope form — must not hijack', () => {
-  assert.equal(isBoxScope({ status: 403, data: envelope('not_your_task') }), false);
-  assert.equal(isBoxScope({ status: 403, data: envelope('forbidden') }), false);
-  assert.equal(isBoxScope({ status: 403, data: envelope('rank_forbidden') }), false);
-});
-
-test('isBoxScope: false for the envelope on the WRONG status', () => {
-  assert.equal(isBoxScope({ status: 401, data: envelope('box_scope') }), false);
-  assert.equal(isBoxScope({ status: 200, data: envelope('box_scope') }), false);
-});
-
-test('isBoxScope: no crash on a null/odd error field', () => {
-  assert.equal(isBoxScope({ status: 403, data: { error: null } }), false);
-  assert.equal(isBoxScope({ status: 403, data: { error: {} } }), false);
-  assert.equal(isBoxScope({ status: 403, data: {} }), false);
-});
-
-console.log('');
-console.log(`cli_box_scope: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);