chore(scripts): drop the script unit tests and the exports that served them

[waleedlatif1]

Summary

• Deletes scripts/check-migrations-safety.test.ts and scripts/check-tool-request-boundary.test.ts
• Drops the bun test … half of the check:tool-request-boundary gate in package.json (it invoked a file this PR removes, so CI would fail otherwise). check:migrations never referenced its test
• Un-exports lintSql and findToolRequestBoundaryViolations — both had zero references outside their own script and existed only so the tests could reach them. They stay in place as internal functions

The sibling removal for check-sql-date-binding rides on #6340, which owns that file. Different package.json line, so the two do not conflict.

Verification

Both gates still run and still pass on their own:

check:tool-request-boundary  ✓ production tool requests are materialized only by the shared transport
check:migrations             ✓ No new migrations to check.

No YAML, JSON, or script reference to either deleted file remains.

Type of Change

• Chore

Testing

Ran both check gates directly; biome clean on all three changed files.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 6, 2026 9:31pm

[cursor]

PR Summary

Low Risk
Test-only code and exports are removed; production check scripts and CI gates are unchanged aside from dropping the redundant test invocation.

Overview
Removes scripts/check-migrations-safety.test.ts and scripts/check-tool-request-boundary.test.ts, which were the only consumers of test-only exports from the corresponding check scripts.

check:tool-request-boundary in package.json now runs only scripts/check-tool-request-boundary.ts (the deleted bun test step would have failed CI).

lintSql and findToolRequestBoundaryViolations are no longer exported; they remain as internal helpers used by the CLI entrypoints. The check:migrations and check:tool-request-boundary gates still run as before.

^{Reviewed by Cursor Bugbot for commit dcecd26. Configure here.}

[waleedlatif1]

Folding this into #6340 instead — that PR already owns the check-sql-date-binding test removal and the same package.json gate cleanup, so keeping them together makes the change reviewable as one unit rather than split across two PRs.

[greptile-apps]

Greptile Summary

This PR removes the standalone unit suites for two repository policy scripts, removes the boundary suite from its package gate, and makes the helpers private.

• Keeps both production checks available as standalone Bun scripts.
• Removes behavioral regression coverage for the tool-request boundary scanner and migration safety linter.
• Removes exports that had no remaining consumers.

Confidence Score: 4/5

The PR appears safe to merge, but it removes the only focused regression coverage for two policy-enforcement scripts.

Both production gates remain executable and the removed exports have no consumers, while the accepted concerns are non-blocking losses of behavioral test coverage rather than current functional failures.

Files Needing Attention: package.json, scripts/check-tool-request-boundary.test.ts, scripts/check-migrations-safety.test.ts

Important Files Changed

Filename	Overview
package.json	Removes the boundary scanner’s unit-test phase while preserving its standalone production scan.
scripts/check-tool-request-boundary.test.ts	Deletes the only controlled coverage for prohibited and permitted tool-request access patterns.
scripts/check-tool-request-boundary.ts	Makes the scanner helper private; no remaining external consumers were found.
scripts/check-migrations-safety.test.ts	Deletes broad coverage of migration classifications, annotations, and SQL parser edge cases without replacement.
scripts/check-migrations-safety.ts	Makes lintSql private while leaving the production migration check behavior intact.

Comments Outside Diff (1)

1. scripts/check-migrations-safety.test.ts

   Migration linter coverage removed

   Deleting this suite removes the only controlled coverage for destructive-operation classifications, safety annotations, and SQL parser edge cases. Since the remaining gate exercises lintSql only on changed migrations, a later parser or rule regression can go unnoticed until it incorrectly accepts or rejects a real migration.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "chore(scripts): drop the script unit tes..." | Re-trigger Greptile}

[greptile-apps]

Boundary scanner coverage removed

The gate now scans only the current production tree, so it no longer exercises controlled cases for direct, computed, optional, aliased, and destructured request access. A later scanner regression can therefore leave CI green while missing prohibited access or rejecting valid request objects.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!