From cc35671645207971402212cd9220a6352f65d52c Mon Sep 17 00:00:00 2001
From: Boardwalk Private Reference Scan <private-reference-scan@boardwalk.sh>
Date: Mon, 13 Jul 2026 23:58:02 +0000
Subject: [PATCH] Remove private/internal references from 2026-07-13

Automated remediation for daily private reference scan.
---
 src/commands/session.test.ts | 10 +++++-----
 src/commands/status.test.ts  |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/src/commands/session.test.ts b/src/commands/session.test.ts
index 8694f58..3a8b421 100644
--- a/src/commands/session.test.ts
+++ b/src/commands/session.test.ts
@@ -39,7 +39,7 @@ describe("runLogin --token (first-class API-key auth)", () => {
 
   it("whoami reports the API-key method (session line prints even when the probe fails)", async () => {
     const c = config(dir);
-    await runLogin({ config: c }, { token: "bwk_x" });
+    await runLogin({ config: c }, { token: "TEST_TOKEN" });
     const lines: string[] = [];
     const offline = (() => Promise.reject(new Error("offline"))) as typeof fetch;
     await runWhoami({ config: c, log: (l) => lines.push(l), fetchImpl: offline });
@@ -49,21 +49,21 @@ describe("runLogin --token (first-class API-key auth)", () => {
 
   it("whoami lists the account's orgs with their ids (OIDC trust policies pin on the id)", async () => {
     const c = config(dir);
-    await runLogin({ config: c }, { token: "bwk_x" });
+    await runLogin({ config: c }, { token: "TEST_TOKEN" });
     const me = {
       user: { id: "user_1", email: "ada@example.com", name: null },
-      memberships: [{ orgId: "01ORGDEMO", role: "owner", slug: "demo-org", plan: "solo" }],
+      memberships: [{ orgId: "demo-org-id", role: "owner", slug: "demo-org", plan: "solo" }],
     };
     const fetchImpl = (() =>
       Promise.resolve(new Response(JSON.stringify(me), { status: 200 }))) as typeof fetch;
     const lines: string[] = [];
     await runWhoami({ config: c, log: (l) => lines.push(l), fetchImpl });
-    expect(lines.join("\n")).toContain("org demo-org (owner) id=01ORGDEMO");
+    expect(lines.join("\n")).toContain("org demo-org (owner) id=demo-org-id");
   });
 
   it("logout clears the stored key", async () => {
     const c = config(dir);
-    await runLogin({ config: c }, { token: "bwk_x" });
+    await runLogin({ config: c }, { token: "TEST_TOKEN" });
     runLogout({ config: c, log: () => undefined });
     await expect(runWhoami({ config: c, log: () => undefined })).rejects.toThrow(/Not logged in/);
   });
diff --git a/src/commands/status.test.ts b/src/commands/status.test.ts
index d12cfc9..b65446e 100644
--- a/src/commands/status.test.ts
+++ b/src/commands/status.test.ts
@@ -50,8 +50,8 @@ describe("formatStatus", () => {
         email: "ada@example.com",
         name: "Ada Lovelace",
         orgs: [
-          { id: "01ORGDEMO", slug: "demo-org", role: "owner", plan: "solo" },
-          { id: "01ORGACME", slug: "acme", role: "member", plan: "free" },
+          { id: "demo-org-id", slug: "demo-org", role: "owner", plan: "solo" },
+          { id: "acme-org-id", slug: "acme", role: "member", plan: "free" },
         ],
       },
       project: { orgSlug: "demo-org", workflowId: "wf_abc123" },
@@ -66,8 +66,8 @@ describe("formatStatus", () => {
     expect(out).toMatch(/Account\s+✓ ada@example\.com \(Ada Lovelace\)/);
     expect(out).toMatch(/Auth\s+OAuth session · scope=workflows · expires in 13h/);
     // One org per line, each carrying the org id (what an OIDC trust policy pins on).
-    expect(out).toMatch(/Orgs\s+demo-org \(owner · Solo\) · id 01ORGDEMO/);
-    expect(out).toMatch(/^\s+acme \(member · Free\) · id 01ORGACME$/m);
+    expect(out).toMatch(/Orgs\s+demo-org \(owner · Solo\) · id demo-org-id/);
+    expect(out).toMatch(/^\s+acme \(member · Free\) · id acme-org-id$/m);
     expect(out).toMatch(/Project\s+demo-org \/ wf_abc123/);
   });