Catch the smoke suite up so the strict gate runs green

tests/smoke/auth_test.go

@@ -2,7 +2,6 @@ package smoke_test
 
 import (
 	"encoding/json"
-	"strings"
 	"testing"
 )
 
@@ -18,26 +17,24 @@ func TestAuthStatus(t *testing.T) {
 	}
 }
 
+// TestMain authenticates with a browser session cookie, and auth token refuses
+// to print a cookie as a bearer token: HEY sends it as a Cookie header, so
+// handing it out as "Authorization: Bearer" would 401 with nothing to explain
+// it. The refusal is the command's behavior under this suite's auth method.
 func TestAuthToken(t *testing.T) {
-	stdout, stderr, code := hey(t, "auth", "token")
-	if code != 0 {
-		t.Fatalf("auth token failed (exit %d): %s", code, stderr)
-	}
-	stdout = strings.TrimSpace(stdout)
-	if stdout == "" {
-		t.Error("expected auth token to output a non-empty token")
+	_, stderr, code := hey(t, "auth", "token")
+	if code != 3 {
+		t.Fatalf("expected auth token to refuse the session cookie with exit 3, got exit %d: %s", code, stderr)
 	}
+	assertContains(t, stderr, "browser session cookie")
 }
 
 func TestAuthTokenStored(t *testing.T) {
-	stdout, stderr, code := hey(t, "auth", "token", "--stored")
-	if code != 0 {
-		t.Fatalf("auth token --stored failed (exit %d): %s", code, stderr)
-	}
-	stdout = strings.TrimSpace(stdout)
-	if stdout == "" {
-		t.Error("expected auth token --stored to output a non-empty token")
+	_, stderr, code := hey(t, "auth", "token", "--stored")
+	if code != 3 {
+		t.Fatalf("expected auth token --stored to refuse the session cookie with exit 3, got exit %d: %s", code, stderr)
 	}
+	assertContains(t, stderr, "browser session cookie")
 }
 
 func TestAuthRefresh(t *testing.T) {

tests/smoke/boxes_test.go

@@ -189,7 +189,20 @@ func TestMovePosting(t *testing.T) {
 		}
 	}
 	if postingID == 0 {
-		skipf(t, "no seen postings in Imbox to move without changing unread state")
+		if len(imbox.Postings) == 0 {
+			skipf(t, "no postings in Imbox to move")
+		}
+		// No seen posting to borrow: mark one seen and put its unread
+		// state back afterwards. The restore runs after the move-back
+		// cleanup below, so the posting is home before it goes unseen.
+		postingID = imbox.Postings[0].ID
+		heyOK(t, "seen", intStr(postingID), "--json")
+		t.Cleanup(func() {
+			_, cleanupStderr, cleanupCode := hey(t, "unseen", intStr(postingID), "--json")
+			if cleanupCode != 0 {
+				t.Logf("could not restore posting %d to unseen: %s", postingID, cleanupStderr)
+			}
+		})
 	}
 
 	stdout, stderr, code := hey(t, "move", intStr(postingID), "--to", "feedbox", "--json")
@@ -232,7 +245,9 @@ func TestMoveRejectsBubbleUp(t *testing.T) {
 }
 
 func TestBoxNoArgument(t *testing.T) {
-	heyFail(t, "box", "--json")
+	// box is a command group: bare "hey box" shows its help.
+	stdout := heyOK(t, "box")
+	assertContains(t, stdout, "hey box view")
 }
 
 func TestBoxInvalidName(t *testing.T) {

tests/smoke/helpers_test.go

@@ -180,9 +180,16 @@ func dataAs[T any](t *testing.T, resp Response) T {
 	return v
 }
 
-// cliEnv returns the environment variables used for all CLI invocations.
+// cliEnv returns the environment variables used for all CLI invocations. The
+// caller's HEY_TOKEN is dropped: the suite authenticates with the cookie TestMain
+// stored, and an inherited token would silently stand in for it on every command.
 func cliEnv() []string {
-	env := os.Environ()
+	env := make([]string, 0, len(os.Environ())+6)
+	for _, kv := range os.Environ() {
+		if !strings.HasPrefix(kv, "HEY_TOKEN=") {
+			env = append(env, kv)
+		}
+	}
 	env = append(env,
 		"HEY_BASE_URL="+baseURL,
 		"XDG_CONFIG_HOME="+configDir,