import subprocess, os
S="/tmp/dewey-chat02/scratch-board"
f=os.path.join(S,"packages/control-board/src/serve.mjs")
orig=open(f).read()
M=[
 ("conversation routes before the guard",[("""    const refused = foreignRequest(req);""","""    { const u0 = new URL(req.url, "http://localhost"); if (u0.pathname.startsWith("/api/conversation")) { let o; try { o = conversationResponse(reader, u0); } catch { o = { status: 500, body: {} }; } return sendConversationJson(res, o.status, o.body); } }
    const refused = foreignRequest(req);""")]),
 ("no nosniff",[(', "x-content-type-options": "nosniff"','')]),
 ("all refusals 422",[("status: REFUSAL_STATUS[out.refusal.code] ?? 422","status: 422")]),
 ("no query validation",[("    if (values.length !== 1 || !QUERY_VALUE.test(values[0])) return { error: `invalid ${key}` };\n","")]),
 ("unknown params allowed",[("""    if (!["id", "branch", "cursor"].includes(key)) return { error: `unknown parameter: ${key}` };\n""","")]),
 ("reconcile dropped",[("refusal: { code: out.refusal.code, reconcile: out.refusal.reconcile }","refusal: { code: out.refusal.code }")]),
 ("cursor ignored",[("  const out = query.cursor\n","  const out = false\n")]),
 ("registrations ignored",[("rootsFromSpecs(specs, loadRegistrations(seatsDir).registrations)","rootsFromSpecs(specs, [])")]),
 ("cursor without branch served",[("  if (out.cursor && !out.branch) return","  if (false) return")]),
 ("unavailable falls to 422",[("  unavailable: 404,\n","")]),
 ("CORS header sent",[('"x-content-type-options": "nosniff" });','"x-content-type-options": "nosniff", "access-control-allow-origin": "*" });')]),
]
for name,reps in M:
  src=orig
  ok=True
  for a,b in reps:
    if a not in src: print("NOT APPLIED",name); ok=False; break
    src=src.replace(a,b,1)
  if not ok: continue
  open(f,"w").write(src)
  r=subprocess.run(["node","--test","--test-concurrency=1","tests/serve.test.mjs"],cwd=os.path.join(S,"packages/control-board"),capture_output=True,text=True,timeout=600)
  fails=sorted(set(l.strip()[2:].split(" (")[0][:60] for l in r.stdout.splitlines() if l.lstrip().startswith("✖") and "failing tests" not in l))
  print(("CAUGHT " if r.returncode else "MISSED ")+name+" -> "+"; ".join(fails))
open(f,"w").write(orig)