cli_test.v

1module tests23import net4import net.http5import os6import time7import src.exchange8import src.storage910const root = @VMODROOT11const binary = os.join_path(root, 'build', 'koh3')1213struct Result {14mut:15	code int16	out  string17	err  string18}1920fn testsuite_begin() {21	os.mkdir_all(os.join_path(root, 'build')) or { panic(err) }22	build := os.execute('v -o ${q(binary)} ${q(os.join_path(root, 'src', 'koh.v'))}')23	if build.exit_code != 0 {24		panic('could not build koh3: ${build.output}')25	}26}2728fn q(s string) string {29	return "'${s.replace("'", "'\\''")}'"30}3132fn temp_repo(name string) string {33	dir := os.join_path(os.temp_dir(), 'koh3-cli-${name}-${time.now().unix_nano()}')34	os.mkdir_all(dir) or { panic(err) }35	return dir36}3738fn run(repo string, args ...string) Result {39	home := temp_repo('home')40	defer { os.rmdir_all(home) or {} }41	return run_home(repo, home, ...args)42}4344fn run_home(repo string, home string, args ...string) Result {45	stamp := '${os.getpid()}-${time.now().unix_nano()}'46	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')47	out_path := '${base}.out'48	err_path := '${base}.err'49	code_path := '${base}.code'50	mut command := 'HOME=${q(home)} ${q(binary)}'51	for arg in args {52		command += ' ${q(arg)}'53	}54	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'55	result := os.execute(shell)56	if result.exit_code != 0 {57		panic('could not run test command: ${result.output}')58	}59	code := os.read_file(code_path) or { panic(err) }60	out := os.read_file(out_path) or { '' }61	err := os.read_file(err_path) or { '' }62	os.rm(out_path) or {}63	os.rm(err_path) or {}64	os.rm(code_path) or {}65	return Result{66		code: code.int()67		out:  out68		err:  err69	}70}7172// shown is what a terminal leaves on screen: on each line, only what follows its73// last carriage return, so a progress line cleared in place does not count.74fn shown(out string) []string {75	return out.split('\n').map(it.trim_right('\r').all_after_last('\r')).filter(it.trim_space() != '')76}7778fn run_pty_home(repo string, home string, answers []string, args ...string) Result {79	stamp := '${os.getpid()}-${time.now().unix_nano()}'80	transcript := os.join_path(os.temp_dir(), 'koh3-pty-${stamp}.txt')81	script_path := os.join_path(os.temp_dir(), 'koh3-pty-${stamp}.exp')82	defer {83		os.rm(transcript) or {}84		os.rm(script_path) or {}85	}86	mut script := 'log_file -noappend {${transcript}}\nset timeout 20\nspawn -noecho env {HOME=${home}} NO_COLOR=1 {${binary}}'87	for arg in args {88		script += ' {${arg}}'89	}90	script += '\n'91	// Each answer waits for its prompt: typed ahead, it would be flushed when the pager takes the92	// terminal raw. `close` ends a run that is still asking, so `wait` can never hang the suite.93	for answer in answers {94		script += 'expect -re {› \$|message: \$|confirm: \$|\\[y/N\\] \$|q quit}\nsend -- "${answer}\\r"\n'95	}96	script += 'expect eof\ncatch close\nset status [wait]\nexit [lindex $status 3]\n'97	os.write_file(script_path, script) or { panic(err) }98	result := os.execute('cd ${q(repo)} && expect -f ${q(script_path)}')99	return Result{100		code: result.exit_code101		out:  os.read_file(transcript) or { '' }102		err:  result.output103	}104}105106fn init_repo(repo string) {107	r := run(repo, 'init')108	assert r.code == 0109	assert os.exists(os.join_path(repo, '.koh'))110	assert os.exists(os.join_path(repo, '.kohignore'))111}112113fn write(repo string, path string, text string) {114	full := os.join_path(repo, path)115	os.mkdir_all(os.dir(full)) or { panic(err) }116	os.write_file(full, text) or { panic(err) }117}118119fn read_json_has(text string, key string) {120	if !text.contains(key) {121		panic('missing JSON key ${key}: ${text}')122	}123}124125fn test_init_and_usage() {126	dir := temp_repo('init')127	defer { os.rmdir_all(dir) or {} }128	r := run(dir, 'init', '--json')129	assert r.code == 0130	read_json_has(r.out, 'repo')131	read_json_has(r.out, 'ignore_created')132	assert run(dir, 'init').code == 1133	assert run(dir, 'unknown-command').code == 2134	assert run(dir, 'unknown-command').err.contains('unknown command')135	// An agent asking for JSON gets JSON for a usage mistake too, exit 2.136	for args in [['unknown-command', '--json'], ['save', '--json'], ['save', 'x', '--nope', '--json']] {137		r2 := run(dir, ...args)138		assert r2.code == 2139		assert r2.out == ''140		assert r2.err.starts_with('{"error":'), r2.err141	}142}143144// The help screen is commands and plain words: every flag lives in `koh man`.145// this_platform is the platform name for the machine the tests run on, so a146// build test does not depend on which machine that is.147fn this_platform() string {148	machine := os.uname().machine149	arch := if machine in ['arm64', 'aarch64'] { 'aarch64' } else { 'x86_64' }150	return '${os.user_os()}-${arch}'151}152153// `koh build` builds with `koh.build`: the version and platform fill the output154// path, and each artifact is printed with its size.155fn test_build_builds_the_named_platforms() {156	dir := temp_repo('build_ok')157	defer { os.rmdir_all(dir) or {} }158	init_repo(dir)159	host := this_platform()160	write(dir, 'VERSION', '1.2.3\n')161	write(dir, 'koh.build', 'command = mkdir -p out && printf built > out/demo-1.2.3-${host}162output = out/demo-{version}-{platform}163platforms = ${host}164')165	one := run(dir, 'build')166	assert one.code == 0, one.err167	assert one.out.contains('version 1.2.3')168	assert one.out.contains('out/demo-1.2.3-${host}')169	assert os.exists(os.join_path(dir, 'out/demo-1.2.3-${host}'))170171	// --platform picks one, --all takes every platform the file names.172	write(dir, 'koh.build', 'command = mkdir -p out && printf m > out/demo-macos-aarch64 && printf l > out/demo-linux-aarch64173output = out/demo-{platform}174platforms = macos-aarch64, linux-aarch64175')176	all := run(dir, 'build', '--all', '--json')177	assert all.code == 0, all.err178	assert all.out.contains('"platform":"macos-aarch64"')179	assert all.out.contains('"platform":"linux-aarch64"')180	assert os.exists(os.join_path(dir, 'out/demo-linux-aarch64'))181	picked := run(dir, 'build', '--platform', 'linux-aarch64')182	assert picked.code == 0, picked.err183	assert picked.out.contains('out/demo-linux-aarch64')184	assert !picked.out.contains('out/demo-macos-aarch64')185}186187// The item's exit check, as a test: `koh build` builds Koh 3 itself with the188// real toolchain, in a copy, and the binary it produces runs.189// `koh update` refuses a command line that cannot be answered: JSON cannot carry190// the question, and a stray argument is a mistake. Both are settled before any191// source is read, so no network is needed here.192fn test_update_refuses_a_command_line_it_cannot_answer() {193	dir := temp_repo('update_args')194	defer { os.rmdir_all(dir) or {} }195	init_repo(dir)196	json_without_yes := run(dir, 'update', '--json')197	assert json_without_yes.code == 2198	assert json_without_yes.err.contains('needs --yes')199	assert run(dir, 'update', 'extra').code == 2200}201202fn test_build_builds_koh_itself() {203	dir := temp_repo('selfbuild')204	defer { os.rmdir_all(dir) or {} }205	// Only what a build reads: the copy needs no history and no archive.206	for item in ['src', 'vendor', 'docs', 'v.mod', 'VERSION'] {207		os.cp_all(os.join_path(root, item), os.join_path(dir, item), true) or { panic(err) }208	}209	write(dir, 'koh.build', 'command = mkdir -p zig-out/bin && v -o zig-out/bin/koh3 src/koh.v210output = zig-out/bin/koh3211platforms = ${this_platform()}212')213	init_repo(dir)214	built := run(dir, 'build')215	assert built.code == 0, built.err216	assert built.out.contains('zig-out/bin/koh3')217	fresh := os.join_path(dir, 'zig-out/bin/koh3')218	assert os.exists(fresh)219	version := os.read_file(os.join_path(dir, 'VERSION'))!.trim_space()220	assert os.execute('${q(fresh)} --version').output.trim_space() == 'koh ${version}'221}222223fn test_build_refuses_what_it_cannot_do() {224	dir := temp_repo('build_bad')225	defer { os.rmdir_all(dir) or {} }226	init_repo(dir)227	missing := run(dir, 'build')228	assert missing.code == 1229	assert missing.err.contains('koh.build')230231	write(dir, 'koh.build', 'command = true232output = out/demo233platforms = macos-aarch64234')235	no_version := run(dir, 'build')236	assert no_version.code == 1237	assert no_version.err.contains('VERSION')238239	write(dir, 'VERSION', '1.2.3\n')240	not_listed := run(dir, 'build', '--platform', 'linux-aarch64')241	assert not_listed.code == 1242	assert not_listed.err.contains('does not build for')243244	unknown := run(dir, 'build', '--platform', 'amiga')245	assert unknown.code == 1246	assert unknown.err.contains('amiga')247248	both := run(dir, 'build', '--all', '--platform', 'macos-aarch64')249	assert both.code == 2250	assert both.err.contains('cannot be combined')251252	write(dir, 'koh.build', 'command = true253output = out/demo254platforms = macos-aarch64, amiga255')256	bad_platform := run(dir, 'build')257	assert bad_platform.code == 1258	assert bad_platform.err.contains('amiga')259260	write(dir, 'koh.build', 'command = sh -c \'echo "no toolchain" >&2; exit 1\'261output = out/demo262platforms = ${this_platform()}263')264	failed := run(dir, 'build')265	assert failed.code == 1266	assert failed.err.contains('no toolchain')267}268269fn test_the_help_screen_lists_commands_and_no_flags() {270	dir := temp_repo('help')271	defer { os.rmdir_all(dir) or {} }272	help := run(dir, '--help')273	assert help.code == 0274	names := ['save', 'checkpoint', 'status', 'view', 'diff', 'undo', 'revert', 'load', 'offer',275		'steal']276	for name in names {277		assert help.out.contains('  ${name} '), name278	}279	assert help.out.contains('koh man <command>')280	assert help.out.contains('  status      where things stand\n')281	assert help.out.contains('  diff        what changed\n')282	assert help.out.contains('Asha Software · asha.software')283	// No flag text anywhere on the screen.284	assert !help.out.contains('--'), help.out285	lines := help.out.split_into_lines()286	for line in lines {287		assert line.runes().len <= 80, line288	}289	// Each command has its own paragraph, a blank line above it.290	for name in names {291		for i, line in lines {292			if line.starts_with('  ${name} ') {293				assert i > 0 && lines[i - 1] == '', line294			}295		}296	}297	// A bare `koh` keeps its stream and exit code; `-h` shows the same screen.298	bare := run(dir)299	assert bare.code == 2300	assert bare.out == ''301	assert bare.err.contains('koh man <command>')302	short := run(dir, '-h')303	assert short.code == 0304	assert short.out == help.out305}306307// Colour on the screen follows NO_COLOR, as it does everywhere else.308fn test_the_help_screen_has_no_colour_when_it_is_off() {309	dir := temp_repo('help_plain')310	defer { os.rmdir_all(dir) or {} }311	home := temp_repo('help_plain_home')312	defer { os.rmdir_all(home) or {} }313	out_path := os.join_path(os.temp_dir(), 'koh3-help-${os.getpid()}-${time.now().unix_nano()}')314	defer { os.rm(out_path) or {} }315	code := os.system('cd ${q(dir)} && HOME=${q(home)} NO_COLOR=1 ${q(binary)} --help > ${q(out_path)}')316	assert code == 0317	text := os.read_file(out_path) or { panic(err) }318	assert !text.contains('\x1b'), text319	assert text.contains('  save        snapshot your work')320}321322// The binary embeds VERSION while saves bump v.mod; they drifted once.323fn test_version_matches_the_manifest() {324	dir := temp_repo('version')325	defer { os.rmdir_all(dir) or {} }326	version := run(dir, '--version').out.trim_space().all_after('koh ')327	manifest := os.read_file(os.join_path(root, 'v.mod')) or { panic(err) }328	assert manifest.contains("version: '${version}'"), version329}330331fn test_save_checkpoint_and_status() {332	dir := temp_repo('save')333	defer { os.rmdir_all(dir) or {} }334	init_repo(dir)335	write(dir, 'tracked.txt', 'one\n')336	r := run(dir, 'save', 'first message', '--agent', 'agent-7', '--session', 'session-a', '--json')337	assert r.code == 0338	for key in ['id', 'parent', 'message', 'created_at', 'machine', 'is_checkpoint', 'agent', 'session',339		'files', 'size_bytes'] {340		read_json_has(r.out, key)341	}342	assert r.out.contains('"message":"first message"')343	assert r.out.contains('"agent":"agent-7"')344	assert r.out.contains('"session":"session-a"')345	assert r.out.contains('"is_checkpoint":false')346	assert run(dir, 'save', 'again').code == 1347	assert run(dir, 'save', 'again').err.contains('nothing has changed since the last save')348	assert run(dir, 'save').code == 2349	assert run(dir, 'save', 'x', '--bogus').code == 2350	cp := run(dir, 'checkpoint', 'still first', '--json')351	assert cp.code == 0352	assert cp.out.contains('"is_checkpoint":true')353	assert cp.out.contains('"parent":')354	clean := run(dir, 'status')355	assert clean.code == 0356	assert clean.out.contains('no changes')357	write(dir, 'tracked.txt', 'two\n')358	write(dir, 'new.txt', 'new\n')359	os.rm(os.join_path(dir, 'tracked.txt')) or { panic(err) }360	write(dir, '.kohignore', '*.log\n')361	status := run(dir, 'status')362	assert status.code == 0363	assert status.out.contains('+')364	assert status.out.contains('~') || status.out.contains('-')365	assert status.out.contains('added')366	js := run(dir, 'status', '--json')367	assert js.code == 0368	for key in ['head_id', 'head_msg', 'dirty', 'modified', 'added', 'deleted', 'ignore_changed',369		'saves', 'size_bytes', 'head_flagged'] {370		read_json_has(js.out, key)371	}372	assert js.out.contains('"ignore_changed":true')373	// What the shell prompt shows: saves on the line, the .koh size, the flag.374	assert js.out.contains('"saves":2')375	assert js.out.contains('"size_bytes":${os.file_size(os.join_path(dir, '.koh'))}')376	assert js.out.contains('"head_flagged":false')377	head := js.out.all_after('"head_id":"').all_before('"')378	assert run(dir, 'flag', head, '--reason', 'bad').code == 0379	assert run(dir, 'status', '--json').out.contains('"head_flagged":true')380}381382fn test_status_requires_repo_and_ignore_rules() {383	dir := temp_repo('status')384	defer { os.rmdir_all(dir) or {} }385	assert run(dir, 'status').code == 1386	init_repo(dir)387	write(dir, '.kohignore', '*.log\nbuild/\n')388	write(dir, 'keep.txt', 'keep\n')389	write(dir, 'ignored.log', 'ignore\n')390	write(dir, 'build/output.txt', 'ignore\n')391	saved := run(dir, 'save', 'keep', '--json')392	assert saved.code == 0393	id := saved.out.all_after('"id":"')[..12]394	// Where things stand comes first, clean or not.395	clean := run(dir, 'status').out396	assert clean.contains('at [${id}] keep · '), clean397	assert clean.contains(' · 1 save\n'), clean398	assert clean.contains('no changes')399	write(dir, 'keep.txt', 'changed\n')400	assert run(dir, 'status').out.contains('at [${id}] keep · ')401	write(dir, 'keep.txt', 'keep\n')402	assert !run(dir, 'status').out.contains('ignored.log')403	assert !run(dir, 'status').out.contains('build/output.txt')404	assert !run(dir, 'status').out.contains('LOG.md')405}406407fn test_status_and_save_report_unsafe_names_without_refusing_the_save() {408	dir := temp_repo('unsafe-names')409	defer { os.rmdir_all(dir) or {} }410	init_repo(dir)411	write(dir, 'safe.txt', 'safe\n')412	assert run(dir, 'save', 'safe').code == 0413	os.write_file('${dir}/bad\\name.txt', 'bad\n') or { panic(err) }414	os.write_file('${dir}/Icon\r', 'icon\n') or { panic(err) }415416	status := run(dir, 'status', '--json')417	assert status.code == 0418	assert status.out.contains('"unsafe_paths":["Icon\\\\x0d","bad\\\\\\\\name.txt"]'), status.out419	saved := run(dir, 'checkpoint', 'unsafe names', '--json')420	assert saved.code == 0421	assert saved.out.contains('"unsafe_paths":["Icon\\\\x0d","bad\\\\\\\\name.txt"]'), saved.out422}423424// LOG.md is a convenience written after the save lands. If it cannot be425// written, the save still happened, and an agent that retried on a failure426// would only be told nothing had changed.427fn test_a_save_succeeds_when_log_md_cannot_be_written() {428	dir := temp_repo('logmd')429	defer { os.rmdir_all(dir) or {} }430	init_repo(dir)431	os.mkdir_all(os.join_path(dir, 'LOG.md')) or { panic(err) }432	write(dir, 'a.txt', 'one\n')433	r := run(dir, 'save', 'first', '--json')434	assert r.code == 0435	assert r.out.starts_with('{')436	assert r.err.contains('LOG.md')437	assert run(dir, 'view', '--json').out.contains('"message":"first"')438}439440// A folder of ignored files can sit where a restored file should go. Koh441// never touches ignored files, so the restore must stop and say so, not drop442// the file inside the folder under a temporary name.443fn test_a_restore_refuses_a_folder_of_ignored_files_in_the_way() {444	dir := temp_repo('dir-in-way')445	defer { os.rmdir_all(dir) or {} }446	init_repo(dir)447	write(dir, 'out', 'a file\n')448	first := run(dir, 'save', 'out is a file', '--json').out.all_after('"id":"')[..12]449	os.rm(os.join_path(dir, 'out')) or { panic(err) }450	write(dir, 'out/build.log', 'ignored\n')451	assert run(dir, 'save', 'out is gone').code == 0452	r := run(dir, 'load', first, '--yes')453	assert r.code == 1454	assert r.err.contains('out')455	assert os.ls(os.join_path(dir, 'out'))! == ['build.log']456}457458// Koh never follows a symlink, so a folder replaced by a link to somewhere459// else is not the repo's to write into: restoring through it would overwrite460// files outside the repo. The refusal comes before anything is recorded.461fn test_a_restore_never_writes_through_a_symlinked_folder() {462	dir := temp_repo('link-in-way')463	outside := temp_repo('link-target')464	defer {465		os.rmdir_all(dir) or {}466		os.rmdir_all(outside) or {}467	}468	init_repo(dir)469	write(dir, 'docs/a.md', 'saved\n')470	first := run(dir, 'save', 'docs', '--json').out.all_after('"id":"')[..12]471	os.rmdir_all(os.join_path(dir, 'docs')) or { panic(err) }472	write(outside, 'a.md', 'precious\n')473	os.symlink(outside, os.join_path(dir, 'docs')) or { panic(err) }474	assert run(dir, 'save', 'docs is a link now').code == 0475	head := run(dir, 'status', '--json').out476	r := run(dir, 'load', first, '--yes')477	assert r.code == 1478	assert r.err.contains('docs')479	assert os.read_file(os.join_path(outside, 'a.md'))! == 'precious\n'480	assert run(dir, 'status', '--json').out == head481}482483// A restore records its save first, then writes files. When the writing stops484// part way, the half-written tree is not somebody's work: saving it would485// record (and offer) a tree that undoes changes nobody asked to undo. Every486// command that would build on it points at revert, which finishes the job.487fn test_a_restore_cut_short_points_at_revert() {488	dir := temp_repo('cut-short')489	defer {490		os.chmod(os.join_path(dir, 'zz'), 0o755) or {}491		os.rmdir_all(dir) or {}492	}493	init_repo(dir)494	write(dir, 'zero', '0\n')495	assert run(dir, 'save', 'zero').code == 0496	write(dir, 'a.txt', 'v1\n')497	write(dir, 'zz/f', 'v1\n')498	assert run(dir, 'save', 'first').code == 0499	write(dir, 'a.txt', 'v2\n')500	write(dir, 'zz/f', 'v2\n')501	assert run(dir, 'save', 'second').code == 0502	// a.txt is written, then the read-only folder stops the restore: the503	// tree is genuinely half one save and half the other.504	os.chmod(os.join_path(dir, 'zz'), 0o555)!505	stopped := run(dir, 'undo', '--yes')506	assert stopped.code == 1507	assert stopped.err.contains('koh revert')508	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'509	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v2\n'510	// Even a status that cannot read the tree says what happened.511	os.chmod(os.join_path(dir, 'zz'), 0o000)!512	assert run(dir, 'status').err.contains('koh revert')513	os.chmod(os.join_path(dir, 'zz'), 0o755)!514515	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":true')516	for args in [['save', 'half'], ['checkpoint', 'half'], ['undo', '--yes']] {517		r := run(dir, ...args)518		assert r.code == 1519		assert r.err.contains('koh revert')520	}521	assert run(dir, 'revert', '--yes').code == 0522	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'523	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v1\n'524	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":false')525	write(dir, 'a.txt', 'v3\n')526	assert run(dir, 'save', 'carry on').code == 0527}528529// Doctor clears peek folders left from earlier days, never one somebody may530// be reading right now.531fn test_doctor_sweeps_only_old_peek_folders() {532	dir := temp_repo('peek-sweep')533	// V's temp_dir is /tmp on macOS whatever TMPDIR says, so these live in534	// the real temp directory under names no save could have.535	fresh := os.join_path(os.temp_dir(), 'koh-peek-fresh${os.getpid()}')536	old := os.join_path(os.temp_dir(), 'koh-peek-old${os.getpid()}')537	linked := os.join_path(os.temp_dir(), 'koh-peek-link${os.getpid()}')538	target := temp_repo('peek-link-target')539	defer {540		os.rmdir_all(dir) or {}541		os.rmdir_all(fresh) or {}542		os.rmdir_all(old) or {}543		os.rm(linked) or {}544		os.rmdir_all(target) or {}545	}546	init_repo(dir)547	write(dir, 'a.txt', 'one\n')548	assert run(dir, 'save', 'one').code == 0549	os.mkdir_all(fresh) or { panic(err) }550	os.mkdir_all(old) or { panic(err) }551	two_days_ago := time.now().unix() - 2 * 86400552	os.utime(old, two_days_ago, two_days_ago) or { panic(err) }553	write(target, 'keep.txt', 'keep')554	os.utime(target, two_days_ago, two_days_ago) or { panic(err) }555	os.symlink(target, linked) or { panic(err) }556	assert run(dir, 'doctor', '--json').code == 0557	assert os.exists(old)558	assert run(dir, 'doctor', '--json', '--yes').code == 0559	assert os.exists(fresh)560	assert !os.exists(old)561	assert os.is_link(linked)562	assert os.read_file(os.join_path(target, 'keep.txt'))! == 'keep'563}564565// A file saved long ago and ignored since holds work no save has. Loading the566// old save must not write over it; the document says a restore never touches567// ignored files.568fn test_a_restore_never_overwrites_an_ignored_file() {569	dir := temp_repo('ignored-restore')570	defer { os.rmdir_all(dir) or {} }571	init_repo(dir)572	write(dir, '.env', 'KEY=saved long ago\n')573	first := run(dir, 'save', 'with env', '--json').out.all_after('"id":"')[..12]574	write(dir, '.kohignore', '.env\n')575	assert run(dir, 'save', 'ignore env').code == 0576	write(dir, '.env', 'KEY=never saved\n')577	assert run(dir, 'load', first, '--yes').code == 0578	assert os.read_file(os.join_path(dir, '.env'))! == 'KEY=never saved\n'579580	// Where the ignored file is missing, the restore still brings it back.581	other := temp_repo('ignored-restore-missing')582	defer { os.rmdir_all(other) or {} }583	init_repo(other)584	write(other, '.env', 'KEY=saved long ago\n')585	again := run(other, 'save', 'with env', '--json').out.all_after('"id":"')[..12]586	write(other, '.kohignore', '.env\n')587	assert run(other, 'save', 'ignore env').code == 0588	os.rm(os.join_path(other, '.env')) or { panic(err) }589	assert run(other, 'load', again, '--yes').code == 0590	assert os.read_file(os.join_path(other, '.env'))! == 'KEY=saved long ago\n'591}592593// A going-back preview lists paths only. Running diff(1) per file to draw it594// cost 27 s for 5,000 changed files, so it must not run diff at all.595fn test_a_going_back_preview_does_not_run_diff() {596	dir := temp_repo('preview-nodiff')597	home := temp_repo('preview-nodiff-home')598	defer {599		os.rmdir_all(dir) or {}600		os.rmdir_all(home) or {}601	}602	init_repo(dir)603	write(dir, 'a.txt', 'one\n')604	assert run_home(dir, home, 'save', 'one').code == 0605	write(dir, 'a.txt', 'two\n')606	assert run_home(dir, home, 'save', 'two').code == 0607	fake := os.join_path(home, 'bin')608	os.mkdir_all(fake) or { panic(err) }609	marker := os.join_path(home, 'diff-ran')610	os.write_file(os.join_path(fake, 'diff'), '#!/bin/sh\ntouch ${q(marker)}\nexit 2\n') or {611		panic(err)612	}613	os.chmod(os.join_path(fake, 'diff'), 0o755) or { panic(err) }614	assert run_home_with_path(dir, home, fake, 'undo', '--yes').code == 0615	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'616	assert !os.exists(marker)617}618619// A restore rewrites only what differs. Rewriting every file resets every620// mtime, so the next status has to hash the whole tree again.621fn test_a_restore_leaves_unchanged_files_alone() {622	dir := temp_repo('restore-skip')623	defer { os.rmdir_all(dir) or {} }624	init_repo(dir)625	write(dir, 'a.txt', 'one\n')626	write(dir, 'same.txt', 'never changes\n')627	assert run(dir, 'save', 'one').code == 0628	write(dir, 'a.txt', 'two\n')629	assert run(dir, 'save', 'two').code == 0630	long_ago := i64(1700000000)631	os.utime(os.join_path(dir, 'same.txt'), long_ago, long_ago) or { panic(err) }632	assert run(dir, 'undo', '--yes').code == 0633	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'634	assert os.file_last_mod_unix(os.join_path(dir, 'same.txt')) == long_ago635}636637// `save` records the executable bit, so `status` has to see it too, or a638// chmod would be invisible until it turned up in a save.639fn test_status_sees_an_executable_bit_change() {640	dir := temp_repo('chmod')641	defer { os.rmdir_all(dir) or {} }642	init_repo(dir)643	write(dir, 'run.sh', 'echo hi\n')644	assert run(dir, 'save', 'script').code == 0645	os.chmod(os.join_path(dir, 'run.sh'), 0o755) or { panic(err) }646	status := run(dir, 'status', '--json')647	assert status.out.contains('"dirty":true')648	assert status.out.contains('"modified":["run.sh"]')649}650651fn test_view_and_diff() {652	dir := temp_repo('history')653	defer { os.rmdir_all(dir) or {} }654	init_repo(dir)655	write(dir, 'a.txt', 'one\n')656	first := run(dir, 'save', 'one', '--session', 'alpha', '--json')657	id1 := first.out.all_after('"id":"')[..12]658	write(dir, 'a.txt', 'two\n')659	second := run(dir, 'save', 'two', '--session', 'beta', '--json')660	id2 := second.out.all_after('"id":"')[..12]661	cp := run(dir, 'checkpoint', 'checkpoint', '--json')662	assert cp.code == 0663	printed := run(dir, 'view')664	assert printed.code == 0665	assert printed.out.contains('▸')666	assert printed.out.contains('◐')667	lj := run(dir, 'view', '--json')668	assert lj.code == 0669	assert lj.out.contains('"head_id"')670	assert lj.out.contains('"saves"')671	assert run(dir, 'view', '--since', 'today').out.contains('two')672	session := run(dir, 'view', '--session', 'alpha')673	assert session.out.contains('one')674	assert !session.out.contains('two')675	assert run(dir, 'view', '--since', '9999-01-01').out.contains('no saves in that range')676	write(dir, 'a.txt', 'three\n')677	d := run(dir, 'diff')678	assert d.code == 0679	assert d.out.contains('--- a/')680	assert d.out.contains('+++ b/')681	assert run(dir, 'diff', id1).code == 0682	assert run(dir, 'diff', id1, id2).code == 0683	dj := run(dir, 'diff', '--json')684	assert dj.code == 0685	assert dj.out.contains('"from"')686	assert dj.out.contains('"to"')687	assert dj.out.contains('"files"')688	assert dj.out.contains('"change":"modified"')689	assert run(dir, 'diff', 'not-a-real-id').code == 1690	assert run(dir, 'diff', id1, id2, 'third').code == 1691	write(dir, 'blob.bin', '\x00\x01\x02')692	diff_binary := run(dir, 'diff', '--json')693	assert diff_binary.out.contains('"binary":true')694	assert diff_binary.out.contains('Binary files differ')695}696697fn test_undo_revert_and_load() {698	dir := temp_repo('restore')699	defer { os.rmdir_all(dir) or {} }700	init_repo(dir)701	write(dir, 'a.txt', 'one\n')702	one := run(dir, 'save', 'one', '--json').out703	id1 := one.all_after('"id":"')[..12]704	write(dir, 'a.txt', 'two\n')705	write(dir, 'gone.txt', 'gone\n')706	second := run(dir, 'save', 'two', '--json').out707	id2 := second.all_after('"id":"')[..12]708	write(dir, 'a.txt', 'three\n')709	third := run(dir, 'save', 'three', '--json').out710	id3 := third.all_after('"id":"')[..12]711	// Unsaved work — here a file never saved — blocks every going-back but712	// revert, as in Koh 2: a restore must never overwrite what only the disk has.713	write(dir, 'never.txt', 'keep me\n')714	view_before := run(dir, 'view').out715	for args in [['undo', '--yes'], ['load', id1, '--yes'], ['pluck', id2, '--yes']] {716		blocked := run(dir, ...args)717		assert blocked.code == 1718		assert blocked.err.contains('unsaved changes')719	}720	assert run(dir, 'view').out == view_before721	os.rm(os.join_path(dir, 'never.txt')) or { panic(err) }722	write(dir, 'a.txt', 'edited, never saved\n')723	assert run(dir, 'undo', '--yes').err.contains('unsaved changes')724	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'edited, never saved\n'725	write(dir, 'a.txt', 'three\n')726	os.rm(os.join_path(dir, 'gone.txt')) or { panic(err) }727	assert run(dir, 'load', id1, '--yes').err.contains('unsaved changes')728	write(dir, 'gone.txt', 'gone\n')729	undo := run(dir, 'undo', '--yes', '--json')730	assert undo.code == 0731	if !undo.out.contains(id2) {732		panic('undo JSON did not name ${id2}: ${undo.out}')733	}734	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'735	assert os.exists(os.join_path(dir, 'gone.txt'))736	assert run(dir, 'load', id3, '--yes').code == 0737	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'three\n'738	assert run(dir, 'undo', '2', '--yes').code == 0739	assert run(dir, 'load', id2, '--yes').code == 0740	assert run(dir, 'undo', '99', '--yes').err.contains('nothing before')741	write(dir, 'a.txt', 'dirty\n')742	before := run(dir, 'view')743	refuse := run(dir, 'revert')744	assert refuse.code == 1745	assert refuse.err.contains('needs --yes when not interactive')746	assert run(dir, 'view').out == before.out747	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'748	write(dir, 'untracked.txt', 'remove\n')749	rv := run(dir, 'revert', '--yes', '--json')750	assert rv.code == 0751	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'752	assert !os.exists(os.join_path(dir, 'untracked.txt'))753	// The way back to the discarded work is named, not left to be found.754	kept := rv.out.all_after('"checkpoint":"')[..12]755	assert run(dir, 'load', kept, '--yes').code == 0756	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'757	assert os.read_file(os.join_path(dir, 'untracked.txt'))! == 'remove\n'758	write(dir, 'a.txt', 'dirty again\n')759	assert run(dir, 'revert', '--yes').out.contains('koh load ')760	assert run(dir, 'revert', '--yes').out.contains('working tree already matches')761	assert run(dir, 'load', '--checkpoint', '--yes').code == 0762	assert run(dir, 'load', id2, '--json').code == 1763	assert run(dir, 'load', id2, '--json').err.contains('error')764	assert run(dir, 'load').code == 2765	assert run(dir, 'load', 'unknown-id', '--yes').code == 1766}767768fn test_flag_and_flagged_view() {769	dir := temp_repo('flag')770	defer { os.rmdir_all(dir) or {} }771	init_repo(dir)772	write(dir, 'flag.txt', 'one\n')773	saved := run(dir, 'save', 'flag me', '--json')774	id := saved.out.all_after('"id":"')[..12]775	flagged := run(dir, 'flag', id, '--reason', 'unsafe', '--json')776	assert flagged.code == 0777	assert flagged.out.contains('"flagged":true')778	assert flagged.out.contains('"reason":"unsafe"')779	list := run(dir, 'flag', '--json')780	assert list.code == 0781	assert list.out.contains(id)782	assert list.out.contains('unsafe')783	assert run(dir, 'view').out.contains('⚑')784	assert run(dir, 'flag', '--clear', id).code == 0785	assert run(dir, 'flag').out.contains('nothing is flagged')786	assert run(dir, 'flag', 'unknown-id').code == 1787	assert run(dir, 'flag').code == 0788}789790fn test_pluck_forward_reverse_dry_run_and_conflict() {791	dir := temp_repo('pluck')792	defer { os.rmdir_all(dir) or {} }793	init_repo(dir)794	write(dir, 'a.txt', 'one\n')795	first := run(dir, 'save', 'one', '--json').out796	id1 := first.all_after('"id":"')[..12]797	write(dir, 'a.txt', 'two\n')798	second := run(dir, 'save', 'two', '--json').out799	id2 := second.all_after('"id":"')[..12]800	assert run(dir, 'load', id1, '--yes').code == 0801	dry := run(dir, 'pluck', id2, '--dry-run')802	assert dry.code == 0803	assert dry.out.contains('a.txt')804	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'805	assert run(dir, 'pluck', id2, '--yes').code == 0806	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'807	assert run(dir, 'pluck', '--reverse', id2, '--yes').code == 0808	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'809	write(dir, 'a.txt', 'different\n')810	assert run(dir, 'pluck', id2, '--dry-run').code == 1811	assert run(dir, 'save', 'different').code == 0812	conflict := run(dir, 'pluck', id2, '--yes')813	assert conflict.code == 1814	assert conflict.err.contains('a.txt')815	assert run(dir, 'pluck').code == 2816	assert run(dir, 'pluck', 'unknown-id').code == 1817}818819fn test_peek_and_doctor() {820	dir := temp_repo('peek-doctor')821	defer { os.rmdir_all(dir) or {} }822	init_repo(dir)823	write(dir, 'peek.txt', 'peek me\n')824	assert run(dir, 'save', 'peekable').code == 0825	id := run(dir, 'view', '--json').out.all_after('"id":"')[..12]826	before_view := run(dir, 'view', '--json').out827	peek := run(dir, 'peek', id, '--json')828	assert peek.code == 0829	peek_path := peek.out.all_after('"path":"').before('"')830	assert peek.out.contains('"id":"${id}"')831	assert os.read_file(os.join_path(peek_path, 'peek.txt'))! == 'peek me\n'832	assert run(dir, 'status').out.contains('no changes')833	assert run(dir, 'view', '--json').out == before_view834	assert run(dir, 'peek').code == 2835	assert run(dir, 'peek', 'unknown-id').code == 1836	backup := os.join_path(dir, 'doctor.backup')837	healthy := run(dir, 'doctor')838	assert healthy.code == 0839	assert healthy.out.contains('is healthy')840	report := run(dir, 'doctor', '--json')841	assert report.code == 0842	for key in ['problems', 'objects', 'saves', 'checkpoints', 'cached_files', 'peek_folders_removed',843		'backup'] {844		read_json_has(report.out, key)845	}846	backed := run(dir, 'doctor', '--backup', backup)847	assert backed.code == 0848	assert os.exists(backup)849	assert backed.out.contains(backup)850	assert run(dir, 'doctor', '--backup', backup).code == 1851	assert run(dir, 'peek', id, '--json').code == 0852	// A peek made today is left for whoever is reading it.853	kept := run(dir, 'doctor', '--json')854	assert kept.code == 0855	assert os.exists(peek_path)856	os.rmdir_all(peek_path) or {}857}858859// Repairs follow a requested backup, so a failed backup stops them.860fn test_doctor_repairs_nothing_when_the_requested_backup_fails() {861	dir := temp_repo('doctor-backup-failure')862	defer { os.rmdir_all(dir) or {} }863	init_repo(dir)864	write(dir, 'app', 'app\n')865	assert run(dir, 'save', 'app').code == 0866	store := storage.open(dir)!867	store.db.exec('UPDATE objects SET size = size + 1')!868	store.close()869	existing := os.join_path(dir, 'existing.backup')870	os.write_file(existing, 'precious')!871	refused := run(dir, 'doctor', '--backup', existing, '--yes', '--json')872	assert refused.code == 1873	assert refused.out.contains('"repaired":[]'), refused.out874	assert os.read_file(existing)! == 'precious'875	assert run(dir, 'doctor', '--json').code == 1876	// On a terminal the report still appears, naming the failed backup.877	home := temp_repo('doctor-backup-home')878	defer { os.rmdir_all(home) or {} }879	shown := run_pty_home(dir, home, [], 'doctor', '--backup', existing)880	assert shown.code == 1, shown.out881	assert shown.out.contains('choose a backup path that does not exist yet'), shown.out882	assert os.read_file(existing)! == 'precious'883}884885fn test_strip_refuses_without_terminal() {886	dir := temp_repo('strip')887	defer { os.rmdir_all(dir) or {} }888	init_repo(dir)889	write(dir, 'secret.txt', 'keep\n')890	assert run(dir, 'save', 'secret').code == 0891	before_view := run(dir, 'view', '--json').out892	refused := run(dir, 'strip', 'secret.txt')893	assert refused.code == 1894	assert refused.err.contains('needs a terminal')895	assert run(dir, 'view', '--json').out == before_view896	assert os.read_file(os.join_path(dir, 'secret.txt'))! == 'keep\n'897	assert run(dir, 'view', '--json').out.contains('secret')898}899900// A whole-history strip bans the path: `.kohignore` names it, once, and the file left on disk901// is never unsaved work or part of a save again.902fn test_strip_adds_the_path_to_kohignore_and_it_stays_out() {903	dir := temp_repo('strip-ignore')904	home := temp_repo('strip-ignore-home')905	defer { os.rmdir_all(dir) or {} }906	defer { os.rmdir_all(home) or {} }907	init_repo(dir)908	write(dir, 'secret.txt', 'leaked\n')909	write(dir, 'keep.txt', 'fine\n')910	assert run_home(dir, home, 'save', 'leak').code == 0911	assert run(dir, 'strip', 'secret.txt', '--yes').code == 1912	assert run_pty_home(dir, home, [''], 'strip', 'secret.txt', '--yes').code == 1913	stripped := run_pty_home(dir, home, ['secret.txt'], 'strip', 'secret.txt', '--yes')914	assert stripped.code == 0, stripped.out915	assert stripped.out.contains('added /secret.txt to .kohignore')916	ignore_path := os.join_path(dir, '.kohignore')917	assert os.read_file(ignore_path)!.split_into_lines().filter(it == '/secret.txt').len == 1918	assert run_home(dir, home, 'save', 'ignore the stripped secret').code == 0919	write(dir, 'secret.txt', 'leaked again\n')920	assert run_home(dir, home, 'status', '--json').out.contains('"dirty":false')921	// Running the strip again (with no remote, it stays pending) adds no second line.922	again := run_pty_home(dir, home, [], 'strip', 'secret.txt')923	assert again.code == 0, again.out924	assert os.read_file(ignore_path)!.split_into_lines().filter(it == '/secret.txt').len == 1925}926927// `koh view` is the one way into the history: the whole line by default,928// checkpoints alone with the flag, and the two lists never overlap.929fn test_view_shows_the_line_and_checkpoints_apart() {930	dir := temp_repo('view')931	defer { os.rmdir_all(dir) or {} }932	init_repo(dir)933	write(dir, 'view.txt', 'one\n')934	assert run(dir, 'save', 'plain save').code == 0935	assert run(dir, 'checkpoint', 'checkpoint save').code == 0936	line := run(dir, 'view')937	assert line.code == 0938	assert line.out.contains('plain save')939	assert line.out.contains('checkpoint save')940	checkpoints := run(dir, 'view', '--checkpoints')941	assert checkpoints.code == 0942	assert checkpoints.out.contains('checkpoint save')943	assert !checkpoints.out.contains('plain save')944	json_line := run(dir, 'view', '--json')945	assert json_line.code == 0946	assert json_line.out.contains('"is_checkpoint":false')947	assert json_line.out.contains('"is_checkpoint":true')948	json_checkpoints := run(dir, 'view', '--checkpoints', '--json')949	assert json_checkpoints.code == 0950	assert json_checkpoints.out.contains('"is_checkpoint":true')951	assert !json_checkpoints.out.contains('"is_checkpoint":false')952	// `view` takes no arguments, so a stray one is a usage error, and the names953	// it replaced are gone rather than hidden: the diagnostic says which.954	assert run(dir, 'view', 'extra').code == 2955	for gone in ['log', 'saves', 'checkpoints'] {956		refused := run(dir, gone)957		assert refused.code == 2958		assert refused.err.contains('unknown command "${gone}"')959	}960	// Every save is on the whole line exactly once, as the JSON says.961	assert line.out.split_into_lines().len == json_line.out.count('"id":"')962}963964fn test_remote_configuration_is_isolated_and_atomic() {965	dir := temp_repo('remote')966	home := temp_repo('remote-home')967	defer {968		os.rmdir_all(dir) or {}969		os.rmdir_all(home) or {}970	}971	empty := run_home(dir, home, 'remote', '--json')972	assert empty.code == 0973	assert empty.out.contains('"configured":false')974	target := os.join_path(home, 'remote-store')975	set := run_home(dir, home, 'remote', 'folder', target)976	assert set.code == 0977	assert os.is_dir(target)978	state := run_home(dir, home, 'remote', '--json')979	assert state.code == 0980	assert state.out.contains('"kind":"folder"')981	assert state.out.contains(target)982	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').code == 1983	assert run_home(dir, home, 'remote', '--json').out.contains(target)984	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region', '--yes').err.contains('KOH_ACCESS_KEY')985	assert run_home(dir, home, 'remote', '--forget').code == 1986	assert run_home(dir, home, 'remote', '--forget', '--json').code == 1987	assert run_pty_home(dir, home, [''], 'remote', '--forget').code == 1988	assert run_home(dir, home, 'remote', '--json').out.contains(target)989	assert run_home(dir, home, 'remote', 'folder', target + '-other').code == 1990	assert run_pty_home(dir, home, [''], 'remote', 'folder', target + '-other').code == 1991	assert !os.exists(target + '-other')992	assert run_pty_home(dir, home, ['Y'], 'remote', 'folder', target + '-other').code == 0993	assert run_pty_home(dir, home, ['Y'], 'remote', '--forget').code == 0994	assert run_home(dir, home, 'remote', '--json').out.contains('"configured":false')995}996997// The files under ~/.config/koh can be written by hand instead of by998// `koh remote`, and are then read the same way.999fn test_remote_written_by_hand() {1000	dir := temp_repo('remote-by-hand')1001	home := temp_repo('remote-by-hand-home')1002	defer {1003		os.rmdir_all(dir) or {}1004		os.rmdir_all(home) or {}1005	}1006	config := os.join_path(home, '.config', 'koh')1007	os.mkdir_all(config) or { panic(err) }1008	target := os.join_path(home, 'remote-store')1009	os.mkdir_all(target) or { panic(err) }1010	os.write_file(os.join_path(config, 'remote'), 'kind = folder\npath = ${target}\n') or {1011		panic(err)1012	}1013	assert run_home(dir, home, 'init').code == 01014	os.write_file(os.join_path(dir, 'a.txt'), 'a\n') or { panic(err) }1015	assert run_home(dir, home, 'save', 'first').code == 01016	offered := run_home(dir, home, 'offer', '--json')1017	assert offered.code == 01018	assert offered.out.contains('"head"')10191020	// Keys anyone else can read are refused before they are ever sent.1021	os.write_file(os.join_path(config, 'remote'), 'kind=s3\nendpoint=http://127.0.0.1:1\nbucket=b\nregion=r\n') or {1022		panic(err)1023	}1024	credentials := os.join_path(config, 'credentials')1025	os.write_file(credentials, 'access_key=AK\nsecret_key=SK\n') or { panic(err) }1026	os.chmod(credentials, 0o644) or { panic(err) }1027	loose := run_home(dir, home, 'offer')1028	assert loose.code == 11029	assert loose.err.contains('chmod 600')10301031	// A setting koh cannot read is replaced by setting the remote again.1032	os.write_file(os.join_path(config, 'remote'), 'kind=ftp\n') or { panic(err) }1033	unreadable := run_home(dir, home, 'offer')1034	assert unreadable.code == 11035	assert unreadable.err.contains('not readable')1036	assert run_home(dir, home, 'remote', 'folder', target, '--yes').code == 01037	assert run_home(dir, home, 'offer').code == 01038}10391040// A stolen repo belongs to the repo it was stolen from, whatever its folder is1041// called later: renaming it must not start a second repo on the remote.1042fn test_a_renamed_stolen_repo_keeps_offering_to_its_repo() {1043	syncroot := temp_repo('rename-steal')1044	home := temp_repo('rename-steal-home')1045	defer {1046		os.rmdir_all(syncroot) or {}1047		os.rmdir_all(home) or {}1048	}1049	remote := os.join_path(syncroot, 'remote')1050	a := os.join_path(syncroot, 'A', 'proj')1051	b_parent := os.join_path(syncroot, 'B')1052	os.mkdir_all(a) or { panic(err) }1053	os.mkdir_all(b_parent) or { panic(err) }1054	init_repo(a)1055	write(a, 'a.txt', 'from A\n')1056	assert run_home(a, home, 'remote', 'folder', remote).code == 01057	assert run_home(a, home, 'save', 'A first').code == 01058	assert run_home(b_parent, home, 'steal', 'proj').code == 01059	renamed := os.join_path(b_parent, 'renamed')1060	os.mv(os.join_path(b_parent, 'proj'), renamed) or { panic(err) }1061	write(renamed, 'b.txt', 'from B\n')1062	assert run_home(renamed, home, 'save', 'B first').code == 01063	assert !os.exists(os.join_path(remote, 'renamed'))1064	assert run_home(a, home, 'steal', '--yes').code == 01065	assert os.read_file(os.join_path(a, 'b.txt'))! == 'from B\n'1066}10671068// A damaged object on the remote stops a steal, names the object, and leaves1069// no half-made folder that would make the retry refuse.1070fn test_steal_of_a_damaged_remote_leaves_nothing() {1071	syncroot := temp_repo('damaged')1072	home := temp_repo('damaged-home')1073	defer {1074		os.rmdir_all(syncroot) or {}1075		os.rmdir_all(home) or {}1076	}1077	remote := os.join_path(syncroot, 'remote')1078	a := os.join_path(syncroot, 'A', 'proj')1079	b_parent := os.join_path(syncroot, 'B')1080	os.mkdir_all(a) or { panic(err) }1081	os.mkdir_all(b_parent) or { panic(err) }1082	init_repo(a)1083	write(a, 'a.txt', 'from A\n')1084	assert run_home(a, home, 'remote', 'folder', remote).code == 01085	assert run_home(a, home, 'save', 'A first').code == 01086	objects := os.join_path(remote, 'proj', 'objects')1087	for name in os.ls(objects) or { panic(err) } {1088		os.chmod(os.join_path(objects, name), 0o644) or {}1089		os.write_file(os.join_path(objects, name), 'junk') or { panic(err) }1090	}1091	stolen := run_home(b_parent, home, 'steal', 'proj')1092	assert stolen.code == 11093	assert stolen.err.contains('is damaged')1094	assert !os.exists(os.join_path(b_parent, 'proj'))1095}10961097fn test_steal_drops_crafted_unsafe_paths_and_lands_the_rest() {1098	syncroot := temp_repo('unsafe-remote')1099	home := temp_repo('unsafe-remote-home')1100	defer {1101		os.rmdir_all(syncroot) or {}1102		os.rmdir_all(home) or {}1103	}1104	remote := os.join_path(syncroot, 'remote')1105	a := os.join_path(syncroot, 'A', 'proj')1106	b_parent := os.join_path(syncroot, 'B')1107	os.mkdir_all(a) or { panic(err) }1108	os.mkdir_all(b_parent) or { panic(err) }1109	init_repo(a)1110	write(a, 'safe.txt', 'safe\n')1111	assert run_home(a, home, 'remote', 'folder', remote).code == 01112	id := run_home(a, home, 'save', 'crafted', '--json').out.all_after('"id":"')[..12]1113	assert run_home(a, home, 'offer').code == 01114	record_path := os.join_path(remote, 'proj', 'saves', id)1115	record := os.read_file(record_path) or { panic(err) }1116	path_at := record.index('"path":"safe.txt"') or { panic('safe path missing from ${record}') }1117	file_start := record[..path_at].last_index('{') or { panic('safe file start missing') }1118	file_end := path_at + (record[path_at..].index('}') or { panic('safe file end missing') }) + 11119	file := record[file_start..file_end]1120	mut files := [file]1121	for path in ['../outside.txt', '/etc/koh-test', 'a/../../outside.txt', 'bad\\\\name',1122		'control\\rname'] {1123		files << file.replace('safe.txt', path)1124	}1125	os.write_file(record_path, record[..file_start] + files.join(',') + record[file_end..]) or {1126		panic(err)1127	}11281129	stolen := run_home(b_parent, home, 'steal', 'proj')1130	assert stolen.code == 0, stolen.err1131	for dropped in ['../outside.txt', 'bad\\\\name', 'control\\x0dname'] {1132		assert (stolen.out + stolen.err).contains('dropped unsafe path ${dropped}'), stolen.out + stolen.err1133	}1134	assert os.read_file(os.join_path(b_parent, 'proj', 'safe.txt'))! == 'safe\n'1135	assert !os.exists(os.join_path(b_parent, 'outside.txt'))1136	assert !os.exists(os.join_path(b_parent, 'proj', 'bad', 'name'))1137	assert !os.exists('${b_parent}/proj/control\rname')1138}11391140fn test_offer_steal_folder_remote() {1141	syncroot := temp_repo('sync')1142	home := temp_repo('sync-home')1143	defer {1144		os.rmdir_all(syncroot) or {}1145		os.rmdir_all(home) or {}1146	}1147	remote := os.join_path(syncroot, 'remote')1148	a := os.join_path(syncroot, 'A', 'proj')1149	b_parent := os.join_path(syncroot, 'B')1150	os.mkdir_all(a) or { panic(err) }1151	os.mkdir_all(b_parent) or { panic(err) }1152	init_repo(a)1153	write(a, 'a.txt', 'from A\n')1154	assert run_home(a, home, 'remote', 'folder', remote).code == 01155	assert run_home(a, home, 'save', 'A first').code == 01156	stolen := run_home(b_parent, home, 'steal', 'proj')1157	assert stolen.code == 01158	b := os.join_path(b_parent, 'proj')1159	assert os.read_file(os.join_path(b, 'a.txt'))! == 'from A\n'1160	write(b, 'b.txt', 'from B\n')1161	assert run_home(b, home, 'save', 'B first').code == 01162	write(a, 'a2.txt', 'second\n')1163	assert run_home(a, home, 'save', 'A second').code == 01164	assert run_home(a, home, 'steal', '--yes').code == 01165	assert os.exists(os.join_path(a, 'b.txt'))1166	assert run_home(b_parent, home, 'steal', '--list').out.contains('proj')1167	// Kepr keeps its own files in the same remote; a folder without a `head` is no repo.1168	os.mkdir_all(os.join_path(remote, '.kepr', 'media', 'proj')) or { panic(err) }1169	os.write_file(os.join_path(remote, '.kepr', 'media', 'proj', 'a.png'), 'png') or { panic(err) }1170	assert run_home(b_parent, home, 'steal', '--list', '--json').out.contains('"repos":["proj"]')1171	write(a, 'clash.txt', 'base\n')1172	assert run_home(a, home, 'save', 'clash base').code == 01173	assert run_home(b, home, 'steal', '--yes').code == 01174	write(a, 'clash.txt', 'A version\n')1175	assert run_home(a, home, 'save', 'A clash').code == 01176	write(b, 'clash.txt', 'B version\n')1177	assert run_home(b, home, 'save', 'B clash').code == 01178	refused := run_home(b, home, 'steal', '--yes')1179	assert refused.code == 11180	assert refused.err.contains('--mine') || refused.err.contains('--theirs')1181	b_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]1182	theirs := run_home(b, home, 'steal', '--theirs', '--json', '--yes')1183	assert theirs.code == 01184	// The pre-combine tree is off the line now; the way back must be named,1185	// or an agent without the history view cannot find it.1186	assert theirs.out.contains('"previous_head":"${b_head}"')1187	assert theirs.out.contains('"kept_versions":["clash.txt:${b_head}"]')1188	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'1189	assert run_home(b, home, 'load', b_head, '--yes').code == 01190	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B version\n'1191	assert run_home(b, home, 'load', theirs.out.all_after('"head":"')[..12], '--yes').code == 01192	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'1193	write(a, 'clash.txt', 'A second\n')1194	assert run_home(a, home, 'save', 'A second clash').code == 01195	write(b, 'clash.txt', 'B second\n')1196	assert run_home(b, home, 'save', 'B second clash').code == 01197	assert run_home(b, home, 'steal', '--mine', '--yes').code == 01198	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B second\n'1199	assert run_home(b, home, 'view').out.contains('combine: kept mine for')1200}12011202fn test_guided_steal_walks_the_terminal_and_can_cancel() {1203	syncroot := temp_repo('guided-steal')1204	home := temp_repo('guided-steal-home')1205	defer {1206		os.rmdir_all(syncroot) or {}1207		os.rmdir_all(home) or {}1208	}1209	remote := os.join_path(syncroot, 'remote')1210	a := os.join_path(syncroot, 'A', 'proj')1211	b_parent := os.join_path(syncroot, 'B')1212	os.mkdir_all(a) or { panic(err) }1213	os.mkdir_all(b_parent) or { panic(err) }1214	init_repo(a)1215	write(a, 'clash.txt', 'base\n')1216	write(a, 'other.txt', 'base\n')1217	write(a, 'same.txt', 'base\n')1218	write(a, 'remote-only.txt', 'base\n')1219	write(a, 'local-only.txt', 'base\n')1220	assert run_home(a, home, 'remote', 'folder', remote).code == 01221	assert run_home(a, home, 'save', 'base').code == 01222	fetched := run_home(b_parent, home, 'steal', 'proj')1223	assert fetched.code == 01224	assert fetched.out.contains('1 save at'), fetched.out1225	b := os.join_path(b_parent, 'proj')12261227	write(b, 'dirty.txt', 'mine\n')1228	before := run_home(b, home, 'status', '--json').out1229	quit := run_pty_home(b, home, ['q'], 'steal')1230	assert quit.out.contains('steal proj')1231	assert quit.out.contains('you have 1 unsaved file')1232	assert quit.out.contains('dirty.txt')1233	assert run_home(b, home, 'status', '--json').out == before1234	// A save needs a message; an empty one stops, says so, and saves nothing.1235	unsaid := run_pty_home(b, home, ['s', ''], 'steal')1236	assert unsaid.code == 11237	assert unsaid.out.contains('no message — nothing was saved')1238	assert run_home(b, home, 'status', '--json').out == before1239	checkpoint := run_pty_home(b, home, ['c'], 'steal')1240	assert checkpoint.code == 0, checkpoint.err1241	assert run_home(b, home, 'view', '--checkpoints').out.contains('before steal')12421243	assert run_home(a, home, 'steal', '--yes').code == 01244	write(a, 'forward.txt', 'new\n')1245	assert run_home(a, home, 'save', 'fast forward').code == 01246	unchanged := run_home(b, home, 'status', '--json').out1247	all_before := run_home(b, home, 'view', '--json').out1248	assert run_home(b, home, 'steal').code == 11249	assert run_pty_home(b, home, [''], 'steal').code == 11250	assert run_home(b, home, 'status', '--json').out == unchanged1251	assert run_home(b, home, 'view', '--json').out == all_before1252	forward := run_pty_home(b, home, ['Y'], 'steal')1253	assert forward.out.contains('proj is up to date · 1 new save')1254	assert forward.code == 0, forward.out1255	write(a, 'clash.txt', 'remote\n')1256	write(a, 'other.txt', 'remote\n')1257	write(a, 'same.txt', 'identical\n')1258	write(a, 'remote-only.txt', 'remote\n')1259	assert run_home(a, home, 'save', 'remote change').code == 01260	write(b, 'clash.txt', 'mine\n')1261	write(b, 'other.txt', 'mine\n')1262	write(b, 'same.txt', 'identical\n')1263	write(b, 'local-only.txt', 'mine\n')1264	assert run_home(b, home, 'save', 'local change').code == 01265	local_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]1266	// `d` opens both changes in the pager, which Enter leaves; `?` explains the two sides.1267	cancel := run_pty_home(b, home, ['d', '', '?', 'm', 'b', 't', 't', 'n'], 'steal')1268	assert cancel.out.contains('your changes')1269	assert cancel.out.contains('remote changes')1270	assert cancel.out.contains('Nothing is lost either way')1271	// The shared save's age, relative: seconds old here, so `now` unless the machine is slow.1272	since := cancel.out.split_into_lines().filter(it.contains('both moved since'))1273	assert since.len == 11274	assert since[0].trim_space().ends_with(' · now') || since[0].trim_space().ends_with(' ago'), since[0]1275	assert cancel.out.contains('5 files changed')1276	assert cancel.out.contains('2 combine by themselves')1277	assert cancel.out.contains('1 changed the same way')1278	assert cancel.out.contains('2 need you')1279	assert cancel.out.contains('ready to combine')1280	assert run_home(b, home, 'status', '--json').out.contains('"head_id":"${local_head}"')1281	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'mine\n'12821283	done := run_pty_home(b, home, ['y'], 'steal', '--theirs')1284	assert done.out.contains('combined · offered to proj')1285	assert done.out.contains('took theirs: clash.txt · other.txt')1286	assert !done.out.contains('kept mine')1287	assert done.out.contains('to undo all of it: koh load ${local_head}')1288	assert done.out.contains('your clash.txt is in ${local_head}')1289	assert !done.out.contains('\x1b')1290	for line in done.out.split_into_lines() {1291		assert line.runes().len <= 80, line1292	}1293}12941295// A steal brings in the whole history, flags included; both output forms must1296// say which saves came in flagged, and why.1297fn test_a_steal_reports_flagged_saves() {1298	syncroot := temp_repo('steal-flags')1299	home := temp_repo('steal-flags-home')1300	defer {1301		os.rmdir_all(syncroot) or {}1302		os.rmdir_all(home) or {}1303	}1304	a := os.join_path(syncroot, 'A', 'proj')1305	os.mkdir_all(a) or { panic(err) }1306	init_repo(a)1307	assert run_home(a, home, 'remote', 'folder', os.join_path(syncroot, 'remote')).code == 01308	write(a, 'a.txt', 'one\n')1309	id := run_home(a, home, 'save', 'risky', '--json').out.all_after('"id":"')[..12]1310	assert run_home(a, home, 'flag', id, '--reason', 'broke the build').code == 01311	assert run_home(a, home, 'offer').code == 01312	for name in ['B', 'C'] {1313		os.mkdir_all(os.join_path(syncroot, name)) or { panic(err) }1314	}1315	json_stolen := run_home(os.join_path(syncroot, 'B'), home, 'steal', 'proj', '--json')1316	assert json_stolen.code == 01317	assert json_stolen.out.contains('"flagged":["${id}"]')1318	text_stolen := run_home(os.join_path(syncroot, 'C'), home, 'steal', 'proj')1319	assert text_stolen.code == 01320	assert text_stolen.out.contains('[${id}] came in flagged — broke the build')1321}13221323// A folder remote on a disk or share that is not mounted is simply not there.1324// Creating it would put the saves in a stand-in folder the other machine never1325// sees; the offer must say what is wrong instead.1326fn test_an_unmounted_folder_remote_is_not_recreated() {1327	syncroot := temp_repo('unmounted')1328	home := temp_repo('unmounted-home')1329	defer {1330		os.rmdir_all(syncroot) or {}1331		os.rmdir_all(home) or {}1332	}1333	mount := os.join_path(syncroot, 'nas')1334	remote := os.join_path(mount, 'koh')1335	a := os.join_path(syncroot, 'proj')1336	os.mkdir_all(a) or { panic(err) }1337	init_repo(a)1338	assert run_home(a, home, 'remote', 'folder', remote).code == 01339	write(a, 'a.txt', 'one\n')1340	assert run_home(a, home, 'save', 'first').code == 01341	os.rename(mount, os.join_path(syncroot, 'nas-unplugged')) or { panic(err) }1342	os.mkdir(mount) or { panic(err) }1343	offered := run_home(a, home, 'offer')1344	assert offered.code == 11345	assert offered.err.contains('mounted')1346	assert !os.exists(remote)1347	write(a, 'a.txt', 'two\n')1348	saved := run_home(a, home, 'save', 'second')1349	assert saved.code == 01350	assert saved.out.contains('mounted')1351	assert !os.exists(remote)1352}13531354fn test_man_and_koh2_migration_gate() {1355	dir := temp_repo('man')1356	home := temp_repo('man-home')1357	defer {1358		os.rmdir_all(dir) or {}1359		os.rmdir_all(home) or {}1360	}1361	whole := run_home(dir, home, 'man')1362	assert whole.code == 01363	assert whole.out.contains('NAME')1364	assert whole.out.contains('COMMANDS')1365	assert whole.out.contains('STRICT KOH DISCIPLINE')1366	assert whole.out.contains('Asha Software · asha.software')1367	assert !whole.out.contains('\x1b') && !whole.out.contains('◆')1368	strip := run_home(dir, home, 'man', 'strip')1369	assert strip.code == 01370	assert strip.out.contains('strip')1371	assert !strip.out.contains('koh save ')1372	steal := run_home(dir, home, 'man', 'steal').out1373	assert steal.starts_with('    koh steal') && steal.contains('koh steal my-project')1374	for command in ['save', 'checkpoint', 'status', 'view', 'diff', 'undo', 'revert', 'load', 'pluck',1375		'peek', 'flag', 'remote', 'offer', 'steal', 'ignore', 'strip', 'build', 'update', 'init',1376		'doctor', 'migrate', 'man'] {1377		entry := run_home(dir, home, 'man', command)1378		assert entry.code == 0, command1379		assert entry.out.starts_with('    koh ${command}'), command1380	}1381	assert run_home(dir, home, 'help', 'doctor').out == run_home(dir, home, 'man', 'doctor').out1382	assert !whole.out.contains('--offline')1383	assert run_home(dir, home, 'man', 'nonsense').code == 21384	legacy := temp_repo('legacy')1385	defer { os.rmdir_all(legacy) or {} }1386	os.mkdir_all(os.join_path(legacy, '.koh')) or { panic(err) }1387	fake := os.join_path(home, 'bin')1388	os.mkdir_all(fake) or { panic(err) }1389	fake_koh := os.join_path(fake, 'koh2')1390	os.write_file(fake_koh, '#!/bin/sh\nprintf "handoff:%s\\n" "$*"\nexit 7\n') or { panic(err) }1391	os.chmod(fake_koh, 0o755) or { panic(err) }1392	for command in ['init', 'save', 'checkpoint', 'status', 'diff', 'undo', 'revert', 'load', 'flag',1393		'pluck', 'peek', 'offer', 'view', 'strip', 'build', 'doctor', 'steal'] {1394		refused := run_home_with_path(legacy, home, fake, command, '--json')1395		assert refused.code == 1, command1396		assert refused.out.trim_space() == '', command1397		assert refused.err.contains('koh migrate'), refused.err1398		assert !refused.err.contains('handing'), refused.err1399		assert os.is_dir(os.join_path(legacy, '.koh'))1400		assert !os.exists(os.join_path(legacy, '.koh-v2'))1401	}1402	// And one that belongs to the machine, not the repo, is Koh 3's own.1403	remote := run_home_with_path(legacy, home, fake, 'remote')1404	assert !remote.out.contains('handoff'), remote.out1405	assert remote.err.contains('needs a terminal'), remote.err1406}14071408fn run_home_with_path(repo string, home string, bin_dir string, args ...string) Result {1409	stamp := '${os.getpid()}-${time.now().unix_nano()}'1410	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')1411	out_path := '${base}.out'1412	err_path := '${base}.err'1413	code_path := '${base}.code'1414	mut command := 'HOME=${q(home)} PATH=${q(bin_dir + ':' + os.getenv('PATH'))} ${q(binary)}'1415	for arg in args {1416		command += ' ${q(arg)}'1417	}1418	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'1419	result := os.execute(shell)1420	if result.exit_code != 0 {1421		panic('could not run test command: ${result.output}')1422	}1423	code := os.read_file(code_path) or { panic(err) }1424	out := os.read_file(out_path) or { '' }1425	err := os.read_file(err_path) or { '' }1426	os.rm(out_path) or {}1427	os.rm(err_path) or {}1428	os.rm(code_path) or {}1429	return Result{1430		code: code.int()1431		out:  out1432		err:  err1433	}1434}14351436// --- migration -------------------------------------------------------------14371438// koh2_binary finds Koh 2: `koh2` since the cutover, `koh` before it, and never Koh 3.1439fn koh2_binary() string {1440	for name in ['koh2', 'koh'] {1441		path := os.find_abs_path_of_executable(name) or { continue }1442		if os.execute('${os.quoted_path(path)} --version').output.starts_with('koh v2') {1443			return path1444		}1445	}1446	return ''1447}14481449// run_koh2 runs the Koh 2 binary in a fixture; its own output is not under1450// test here.1451fn run_koh2(dir string, command string) {1452	os.execute('cd ${q(dir)} && ${command} >/dev/null 2>&1')1453}14541455fn save_ids(dir string) []string {1456	mut ids := []string{}1457	for name in os.ls(os.join_path(dir, '.koh', 'snapshots')) or { []string{} } {1458		if name.ends_with('.json') {1459			ids << name.trim_right('.json')1460		}1461	}1462	ids.sort()1463	return ids1464}14651466fn test_migrate_converts_a_koh2_repo_and_keeps_every_save() {1467	koh2 := koh2_binary()1468	if koh2 == '' {1469		println('skipping the migration tests: koh (Koh 2) is not on PATH')1470		return1471	}1472	dir := temp_repo('migrate')1473	defer { os.rmdir_all(dir) or {} }1474	home := temp_repo('migrate-home')1475	defer { os.rmdir_all(home) or {} }1476	run_koh2(dir, '${q(koh2)} init')1477	// One file large enough to be an object, one small enough to be inlined.1478	write(dir, 'code.txt', 'x'.repeat(700))1479	write(dir, 'tiny.txt', 'tiny\n')1480	run_koh2(dir, '${q(koh2)} save "first save"')1481	run_koh2(dir, '${q(koh2)} checkpoint "before something"')1482	write(dir, 'code.txt', 'y'.repeat(700))1483	run_koh2(dir, '${q(koh2)} save "second save"')1484	original := save_ids(dir)1485	assert original.len == 314861487	// A version handed back must be readable.1488	unreadable := run_home(dir, home, 'migrate', '--with', os.join_path(dir, 'no-such-backup'), '--yes')1489	assert unreadable.code == 1 && unreadable.err.contains('cannot read'), unreadable.err1490	// Off a terminal it asks nothing and changes nothing without --yes.1491	unasked := run_home(dir, home, 'migrate')1492	assert unasked.code == 1 && unasked.err.contains('needs --yes'), unasked.err1493	assert os.is_dir(os.join_path(dir, '.koh'))1494	report := run_home(dir, home, 'migrate', '--yes')1495	assert report.code == 01496	assert report.out.contains('this will:')1497	assert report.out.contains('migrated 3 saves')1498	// The swap: `.koh` is a file, the old data is archived, nothing is left in the draft.1499	assert os.is_file(os.join_path(dir, '.koh'))1500	assert os.is_dir(os.join_path(dir, '.koh-v2'))1501	assert os.is_file(os.join_path(dir, '.kohignore'))1502	assert !os.exists(os.join_path(dir, '.koh-migrate'))15031504	// Every save kept its original ID, and the new repo is sound.1505	listed := run_home(dir, home, 'view', '--json')1506	assert listed.code == 01507	for id in original {1508		assert listed.out.contains(id)1509	}1510	assert run_home(dir, home, 'doctor').code == 01511	assert run_home(dir, home, 'status').code == 015121513	// Migrating again has nothing to convert.1514	assert run_home(dir, home, 'migrate', '--yes').code == 11515}15161517fn test_migrate_refuses_a_tree_that_does_not_match_the_last_save() {1518	koh2 := koh2_binary()1519	if koh2 == '' {1520		return1521	}1522	dir := temp_repo('migrate-dirty')1523	defer { os.rmdir_all(dir) or {} }1524	home := temp_repo('migrate-dirty-home')1525	defer { os.rmdir_all(home) or {} }1526	run_koh2(dir, '${q(koh2)} init')1527	write(dir, 'code.txt', 'x'.repeat(700))1528	run_koh2(dir, '${q(koh2)} save "only save"')1529	write(dir, 'code.txt', 'unsaved change\n')15301531	refused := run_home(dir, home, 'migrate', '--yes')1532	assert refused.code == 11533	assert refused.err.contains('save with koh2 first')1534	// Nothing moved: still Koh 2, no archive, no draft file.1535	assert os.is_dir(os.join_path(dir, '.koh'))1536	assert !os.exists(os.join_path(dir, '.koh-v2'))1537	assert !os.exists(os.join_path(dir, '.koh-migrate'))1538}15391540// Koh 2 never saved a root `.kohconfig`, root `.kohignore.<remote>` rules or1541// `*.bundle` files, so a clean Koh 2 repo may hold them. Most real repos have1542// a `.kohconfig`; migrate must not call them unsaved work.1543fn test_migrate_passes_over_the_files_koh2_never_saved() {1544	koh2 := koh2_binary()1545	if koh2 == '' {1546		return1547	}1548	dir := temp_repo('migrate-koh2-ignores')1549	defer { os.rmdir_all(dir) or {} }1550	home := temp_repo('migrate-koh2-ignores-home')1551	defer { os.rmdir_all(home) or {} }1552	run_koh2(dir, '${q(koh2)} init')1553	write(dir, 'code.txt', 'x'.repeat(700))1554	run_koh2(dir, '${q(koh2)} save "only save"')1555	write(dir, '.kohconfig', 'stable_days = 14\n')1556	write(dir, '.kohignore.public', 'private/\n')1557	write(dir, 'lib/app.bundle', 'bundle\n')1558	write(dir, 'ios/Settings.bundle/Root.plist', 'settings\n')1559	// Koh 2 keeps saving a file under a folder pattern added later, where1560	// Koh 3 reads the same rule as covering the folder: the saved file is on1561	// disk and matches, so the tree is clean.1562	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')1563	run_koh2(dir, '${q(koh2)} save --agent test --session test "add the dsym"')1564	// Koh 2 skips *.bundle even when its rules no longer list it.1565	ignore_path := os.join_path(dir, '.koh', 'ignore')1566	rules := os.read_file(ignore_path)!.split_into_lines().filter(it != '*.bundle')1567	os.write_file(ignore_path, rules.join('\n') + '\nnative/*.dSYM\n')!1568	// A saved file the walk skips still has to match what was saved.1569	write(dir, 'native/t.dSYM/Info.plist', 'changed\n')1570	changed := run_home(dir, home, 'migrate', '--yes')1571	assert changed.code == 11572	assert changed.err.contains('native/t.dSYM/Info.plist does not match')1573	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')1574	assert os.execute('cd ${q(dir)} && ${q(koh2)} status --json').output.contains('"dirty":false')15751576	migrated := run_home(dir, home, 'migrate', '--yes')1577	assert migrated.code == 0, migrated.err1578	// They stay where they were, for the user to keep or delete.1579	assert os.read_file(os.join_path(dir, '.kohconfig'))! == 'stable_days = 14\n'1580}15811582struct FakeKepr {1583	no_access bool1584	// One reply the redemption must cope with: '500', 'garbage' or 'incomplete'.1585	fail string1586	// When set, /api/connect answers 307 here instead of a code reply.1587	redirect_to string1588mut:1589	objects map[string][]u81590	// What the client asked for. A map, because the server holds its own copy of this struct.1591	seen map[string]string1592}15931594fn (mut h FakeKepr) handle(req http.Request) http.Response {1595	if req.method == .post && req.url == '/api/connect' {1596		h.seen['code'] = req.data1597		if h.redirect_to != '' {1598			return http.Response{1599				status_code: 3071600				status_msg:  'Temporary Redirect'1601				header:      http.new_header(1602					key:   .location1603					value: h.redirect_to1604				)1605			}1606		}1607		if h.fail == '500' {1608			return http.Response{ status_code: 500, status_msg: 'Internal Server Error' }1609		}1610		if h.fail == 'garbage' {1611			return http.Response{ status_code: 200, status_msg: 'OK', body: 'not json at all' }1612		}1613		if h.fail == 'incomplete' {1614			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://x","bucket":"","region":"","access_key_id":"","secret_access_key":""}' }1615		}1616		if req.data == 'code=good' && !h.no_access {1617			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://${req.header.get_custom('Host', http.HeaderQueryConfig{}) or { '' }}","bucket":"bucket","region":"test","access_key_id":"access","secret_access_key":"secret"}' }1618		}1619		return http.Response{ status_code: 404, status_msg: 'Not Found', body: '{"error":"no_code","message":"no code"}' }1620	}1621	if req.method == .get && req.url.starts_with('/connect') {1622		h.seen['connect'] = req.url1623		return http.Response{ status_code: if h.no_access { 404 } else { 302 }, status_msg: 'Found' }1624	}1625	key := req.url1626	if key.starts_with('/bucket/') {1627		match req.method {1628			.put {1629				if req.header.get_custom('If-None-Match', http.HeaderQueryConfig{}) or { '' } == '*' && key in h.objects {1630					return http.Response{ status_code: 412, status_msg: 'Precondition Failed' }1631				}1632				h.objects[key] = req.data.bytes()1633				return http.Response{ status_code: 200, status_msg: 'OK' }1634			}1635			.get {1636				if body := h.objects[key] {1637					return http.Response{1638						status_code: 2001639						status_msg:  'OK'1640						body:        body.bytestr()1641						header:      http.new_header(1642							key:   .etag1643							value: '"tag"'1644						)1645					}1646				}1647				return http.Response{ status_code: 404, status_msg: 'Not Found' }1648			}1649			.delete {1650				h.objects.delete(key)1651				return http.Response{ status_code: 204, status_msg: 'No Content' }1652			}1653			else {}1654		}1655	}1656	return http.Response{ status_code: 404, status_msg: 'Not Found' }1657}16581659fn start_fake_kepr(no_access bool, fail string, redirect_to string) !(int, &http.Server, &FakeKepr) {1660	for port in 19401 .. 19411 {1661		listener := net.listen_tcp(.ip, '127.0.0.1:${port}') or { continue }1662		fake := &FakeKepr{1663			no_access:   no_access1664			fail:        fail1665			redirect_to: redirect_to1666			seen:        map[string]string{}1667		}1668		mut server := &http.Server{1669			listener:             listener1670			handler:              fake1671			show_startup_message: false1672		}1673		spawn server.listen_and_serve()1674		server.wait_till_running()!1675		return port, server, fake1676	}1677	return error('no free fake Kepr port')1678}16791680// A slash makes an argument an address, so half an address is an error and never a repo name.1681fn test_steal_refuses_an_address_that_is_not_one() {1682	outside := temp_repo('steal-address')1683	home := temp_repo('steal-address-home')1684	defer { os.rmdir_all(outside) or {} }1685	defer { os.rmdir_all(home) or {} }1686	// The repo half becomes a URL path segment and a folder here, so it is a name Kepr serves.1687	for bad in ['kepr.uk/', '/shipped', 'kepr.uk/..', 'kepr.uk/.', 'kepr.uk/a b', 'kepr.uk/nina?x',1688		'kepr.uk/nina#x', 'kepr.uk/nína'] {1689		refused := run_home(outside, home, 'steal', bad)1690		assert refused.code == 1, bad1691		assert refused.err.contains('is not <host>/<repo>'), '${bad}: ${refused.err}'1692	}1693	assert run_home(outside, home, 'steal', 'one', 'two').code == 21694	assert run_home(outside, home, 'steal', '--list', 'extra').code == 21695}16961697fn test_remote_kepr_saves_and_refuses_without_changes() {1698	repo := temp_repo('kepr')1699	home := temp_repo('kepr-home')1700	defer { os.rmdir_all(repo) or {} }1701	defer { os.rmdir_all(home) or {} }1702	init_repo(repo)1703	port, mut server, fake := start_fake_kepr(false, '', '')!1704	defer { server.stop() }1705	host := 'http://127.0.0.1:${port}'1706	// A trailing slash is the same host, and the saved line keeps the normalised form.1707	good := run_home(repo, home, 'remote', '${host}/', '--code', 'good')1708	assert good.code == 0, good.err1709	remote_path := os.join_path(home, '.config', 'koh', 'remote')1710	credentials_path := os.join_path(home, '.config', 'koh', 'credentials')1711	assert os.read_file(remote_path)! == '# written by koh remote — the remote for every repo on this machine\nkind=s3\nendpoint=${host}\nbucket=bucket\nregion=test\nkepr=${host}\n'1712	assert os.read_file(credentials_path)! == '# written by koh remote — keep this file private\naccess_key=access\nsecret_key=secret\n'1713	// The code went as a form field, and the connect page was never asked for: there was a code.1714	assert (fake.seen['code'] or { '' }) == 'code=good'1715	assert (fake.seen['connect'] or { '' }) == ''1716	// A refused code, a missing terminal and a wrong reply all leave both files as they were.1717	before := os.read_file(remote_path)!1718	before_keys := os.read_file(credentials_path)!1719	bad := run_home(repo, home, 'remote', host, '--yes', '--code', 'bad')1720	assert bad.code == 11721	assert bad.err.contains('wrong or has expired')1722	// The 404 could also mean a Kepr that hands out nothing, so the connect page is asked for1723	// with this machine's name. (This machine's name holds no character needing an escape, so1724	// that part of the query cannot be exercised here.)1725	// `machine.name()` is `os.hostname() or { 'unknown' }`, so the query carries the same text.1726	assert (fake.seen['connect'] or { '' }).contains('machine=${os.hostname() or { 'unknown' }}')1727	no_terminal := run_home(repo, home, 'remote', host, '--yes')1728	assert no_terminal.code == 11729	assert no_terminal.err.contains('needs a terminal')1730	assert os.read_file(remote_path)! == before1731	assert os.read_file(credentials_path)! == before_keys1732}17331734fn test_remote_kepr_refuses_hosts_that_are_not_hosts() {1735	repo := temp_repo('kepr-host')1736	home := temp_repo('kepr-host-home')1737	defer { os.rmdir_all(repo) or {} }1738	defer { os.rmdir_all(home) or {} }1739	init_repo(repo)1740	for host in ['kepr.uk/foo', 'https://kepr.uk?x=1', 'kepr.uk#frag', '[email protected]', 'kepr uk',1741		'http://127.0.0.1:1/foo', 'https://'] {1742		refused := run_home(repo, home, 'remote', host, '--yes', '--code', 'good')1743		assert refused.code == 1, host1744		assert refused.err.contains('is not a Kepr address'), '${host}: ${refused.err}'1745	}1746	// The reply carries the bucket's secret key, so plain http is only for this machine's own Kepr.1747	for host in ['http://kepr.uk', 'http://10.0.0.2:3000', 'http://KEPR.uk:80'] {1748		refused := run_home(repo, home, 'remote', host, '--yes', '--code', 'good')1749		assert refused.code == 1, host1750		assert refused.err.contains('needs https'), '${host}: ${refused.err}'1751		stolen := run_home(home, home, 'steal', '${host}/nina')1752		assert stolen.code == 1, host1753		assert stolen.err.contains('needs https'), '${host}: ${stolen.err}'1754	}1755	// --code belongs to the host form alone.1756	assert run_home(repo, home, 'remote', 's3', 'https://x', 'b', 'r', '--code', 'good').code == 21757	assert run_home(repo, home, 'remote', 'folder', '/tmp', '--code', 'good').code == 21758	assert run_home(repo, home, 'remote', '--code', 'good').code == 21759	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1760}17611762fn test_remote_kepr_refuses_what_is_not_a_code_reply() {1763	repo := temp_repo('kepr-reply')1764	home := temp_repo('kepr-reply-home')1765	defer { os.rmdir_all(repo) or {} }1766	defer { os.rmdir_all(home) or {} }1767	init_repo(repo)1768	remote_path := os.join_path(home, '.config', 'koh', 'remote')1769	for mode in ['500', 'garbage', 'incomplete'] {1770		port, mut server, _ := start_fake_kepr(false, mode, '')!1771		refused := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')1772		server.stop()1773		assert refused.code == 1, mode1774		assert refused.err.contains('nothing was changed'), '${mode}: ${refused.err}'1775		assert !os.exists(remote_path)1776	}1777	// A redirect would hand the code to wherever it points, so it is refused and never followed.1778	target_port, mut target, target_fake := start_fake_kepr(false, '', '')!1779	port, mut server, _ := start_fake_kepr(false, '', 'http://127.0.0.1:${target_port}/api/connect')!1780	redirected := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')1781	server.stop()1782	target.stop()1783	assert redirected.code == 11784	assert redirected.err.contains('refused the code')1785	assert target_fake.seen.len == 0, 'the code was forwarded: ${target_fake.seen}'1786	assert !os.exists(remote_path)1787}17881789// An unreachable Kepr is a refusal too, and the settings are still untouched.1790fn test_remote_kepr_that_cannot_be_reached_changes_nothing() {1791	repo := temp_repo('kepr-down')1792	home := temp_repo('kepr-down-home')1793	defer { os.rmdir_all(repo) or {} }1794	defer { os.rmdir_all(home) or {} }1795	init_repo(repo)1796	refused := run_home(repo, home, 'remote', 'http://127.0.0.1:1', '--code', 'good')1797	assert refused.code == 11798	assert refused.err.contains('could not reach Kepr')1799	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1800}18011802fn test_remote_kepr_without_bucket_access_is_explained() {1803	repo := temp_repo('kepr-no-access')1804	home := temp_repo('kepr-no-access-home')1805	defer { os.rmdir_all(repo) or {} }1806	defer { os.rmdir_all(home) or {} }1807	init_repo(repo)1808	port, mut server, _ := start_fake_kepr(true, '', '')!1809	defer { server.stop() }1810	r := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'bad')1811	assert r.code == 11812	assert r.err.contains("doesn't hand out bucket access")1813	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1814}18151816fn test_ignore_batch_preview_cancel_and_toggle() {1817	repo := temp_repo('ignore-batch')1818	home := temp_repo('ignore-home')1819	defer {1820		os.rmdir_all(repo) or {}1821		os.rmdir_all(home) or {}1822	}1823	assert run_home(repo, home, 'init').code == 01824	assert run_home(repo, home, 'save', 'initial').code == 01825	write(repo, 'one/a.txt', 'a')1826	write(repo, 'two/b.txt', 'b')1827	write(repo, 'literal*.txt', 'literal')1828	before := os.read_file(os.join_path(repo, '.kohignore'))!1829	refused := run_home(repo, home, 'ignore', 'one', 'two', 'literal*.txt', '--json')1830	assert refused.code == 11831	assert refused.out.contains('"changed":false')1832	assert refused.out.contains('koh strip <path>')1833	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1834	cancel := run_pty_home(repo, home, [''], 'ignore', 'one', 'two', 'literal*.txt')1835	assert cancel.code == 11836	assert cancel.out.contains('/one/') && cancel.out.contains('/two/')1837	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1838	assert run_home(repo, home, 'ignore', 'one').code == 11839	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1840	assert run_pty_home(repo, home, ['y'], 'ignore', 'confirmed.txt').code == 01841	added := run_home(repo, home, 'ignore', 'one', './one', 'two', 'literal*.txt', '--yes', '--json')1842	assert added.code == 01843	assert added.out.contains('"changed":true')1844	text := os.read_file(os.join_path(repo, '.kohignore'))!1845	assert text.count('/one/\n') == 11846	assert text.contains('/literal\\*.txt\n')1847	status := run_home(repo, home, 'status', '--json')1848	assert status.code == 01849	assert !status.out.contains('one/a.txt') && !status.out.contains('literal*.txt')1850	assert run_home(repo, home, 'ignore', 'one', '--yes').code == 01851	assert run_home(repo, home, 'status', '--json').out.contains('one/a.txt')1852	assert run_home(repo, home, 'ignore', 'two/b.txt', '--yes').code == 01853	assert !os.read_file(os.join_path(repo, '.kohignore'))!.contains('/two/')1854}18551856fn test_ignore_global_rules_and_scope_overlap() {1857	repo := temp_repo('ignore-global')1858	other := temp_repo('ignore-other')1859	home := temp_repo('ignore-home')1860	defer {1861		os.rmdir_all(repo) or {}1862		os.rmdir_all(other) or {}1863		os.rmdir_all(home) or {}1864	}1865	assert run_home(repo, home, 'init').code == 01866	assert run_home(repo, home, 'save', 'initial').code == 01867	assert run_home(other, home, 'init').code == 01868	assert run_home(other, home, 'save', 'initial').code == 01869	write(repo, 'cache/a', 'a')1870	write(other, 'nested/cache/b', 'b')1871	assert run_home(repo, home, 'ignore', 'cache', '--yes').code == 01872	assert run_home(repo, home, 'ignore', 'cache', '--global', '--yes').code == 01873	assert os.read_file(os.join_path(home, '.kohignore'))! == 'cache/\n'1874	assert run_home(other, home, 'save', 'global rules applied').code == 11875	assert !run_home(other, home, 'status', '--json').out.contains('nested/cache/b')1876	result := run_home(repo, home, 'ignore', 'cache', '--yes')1877	assert result.code == 0 && result.out.contains('still ignored')1878	assert !run_home(repo, home, 'status', '--json').out.contains('cache/a')1879	assert run_home(repo, home, 'ignore', 'cache', '--global', '--yes').code == 01880	assert run_home(repo, home, 'status', '--json').out.contains('cache/a')1881	assert run_home(other, home, 'status', '--json').out.contains('nested/cache/b')1882	assert run_home(home, home, 'ignore', 'missing/', '--global', '--yes').code == 01883}18841885fn test_ignore_broad_rules_mixed_batch_and_invalid_paths() {1886	repo := temp_repo('ignore-rules')1887	home := temp_repo('ignore-home')1888	defer {1889		os.rmdir_all(repo) or {}1890		os.rmdir_all(home) or {}1891	}1892	assert run_home(repo, home, 'init').code == 01893	assert run_home(repo, home, 'save', 'initial').code == 01894	write(repo, '.kohignore', '# keep this\n*.log\n/folder/\n')1895	write(repo, 'folder/a', 'a')1896	os.symlink(home, os.join_path(repo, 'link'))!1897	before := os.read_file(os.join_path(repo, '.kohignore'))!1898	for bad in ['../outside', '.koh', '.kohignore', '.', 'link/a', 'bad\nname'] {1899		assert run_home(repo, home, 'ignore', 'good', bad, '--yes').code == 11900		assert os.read_file(os.join_path(repo, '.kohignore'))! == before1901	}1902	mixed := run_home(repo, home, 'ignore', 'a.log', 'new.txt', '--yes')1903	assert mixed.code == 0 && mixed.out.contains('other items')1904	assert os.read_file(os.join_path(repo, '.kohignore'))! == '# keep this\n/folder/\n/new.txt\n'1905	assert run_home(os.join_path(repo, 'folder'), home, 'ignore', 'a', '--yes').code == 01906	assert !os.read_file(os.join_path(repo, '.kohignore'))!.contains('/folder/')1907	assert run_home(repo, home, 'ignore').code == 21908}19091910fn test_ignore_reads_symlinked_other_scope_and_subdirectory_rules() {1911	repo := temp_repo('ignore-symlink')1912	home := temp_repo('ignore-home')1913	defer {1914		os.rmdir_all(repo) or {}1915		os.rmdir_all(home) or {}1916	}1917	assert run_home(repo, home, 'init').code == 01918	write(home, 'rules', 'cache/\n')1919	os.symlink(os.join_path(home, 'rules'), os.join_path(home, '.kohignore'))!1920	local := run_home(repo, home, 'ignore', 'cache/', '--yes')1921	assert local.code == 0 && local.out.contains('still ignored')1922	assert run_home(repo, home, 'ignore', 'cache/', '--global', '--yes').code == 11923	os.rm(os.join_path(home, '.kohignore'))!1924	write(home, '.kohignore', 'cache/\n')1925	write(repo, '.kohignore', '/sub/cache/\n')1926	write(repo, 'sub/cache/a', 'a')1927	global := run_home(os.join_path(repo, 'sub'), home, 'ignore', 'cache', '--global', '--yes')1928	assert global.code == 0 && global.out.contains('still ignored')1929	assert os.read_file(os.join_path(repo, '.kohignore'))! == '/sub/cache/\n'1930	assert os.read_file(os.join_path(home, '.kohignore'))! == ''1931}19321933fn test_ignore_refuses_stripped_paths_and_preserves_crlf_comments() {1934	repo := temp_repo('ignore-stripped')1935	home := temp_repo('ignore-home')1936	defer {1937		os.rmdir_all(repo) or {}1938		os.rmdir_all(home) or {}1939	}1940	assert run_home(repo, home, 'init').code == 01941	write(repo, 'secret', 'secret')1942	assert run_home(repo, home, 'save', 'initial').code == 01943	assert run_pty_home(repo, home, ['y', 'secret'], 'strip', 'secret').code == 01944	before := os.read_file(os.join_path(repo, '.kohignore'))!1945	assert run_home(repo, home, 'ignore', 'secret', '--yes').code == 11946	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1947	write(repo, '.kohignore', '# keep\r\n*.log\r\nlast')1948	assert run_home(repo, home, 'ignore', 'one.log', '--yes').code == 01949	assert os.read_file(os.join_path(repo, '.kohignore'))! == '# keep\r\nlast'1950}19511952fn test_strip_multiple_paths_confirms_entire_batch_before_changes() {1953	repo := temp_repo('strip-batch')1954	home := temp_repo('strip-home')1955	defer {1956		os.rmdir_all(repo) or {}1957		os.rmdir_all(home) or {}1958	}1959	assert run_home(repo, home, 'init').code == 01960	write(repo, 'private/a', 'a')1961	write(repo, 'secret.txt', 'secret')1962	write(repo, 'keep.txt', 'keep')1963	assert run_home(repo, home, 'save', 'initial').code == 01964	before := os.read_file(os.join_path(repo, '.kohignore'))!1965	cancel := run_pty_home(repo, home, ['y', 'private', ''], 'strip', 'private/', 'secret.txt')1966	assert cancel.code == 11967	assert cancel.out.contains('private') && cancel.out.contains('secret.txt')1968	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1969	assert run_home(repo, home, 'status', '--json').out.contains('"dirty":false')1970	assert run_pty_home(repo, home, [], 'strip', 'private', '../bad').code == 11971	assert os.read_file(os.join_path(repo, '.kohignore'))! == before1972	stripped := run_pty_home(repo, home, ['y', 'private', 'private/a', 'secret.txt'], 'strip', 'private/', 'private', 'private/a', 'secret.txt', '--json')1973	assert stripped.code == 0, stripped.out1974	assert stripped.out.contains('"strips":[')1975	assert stripped.out.contains('"path":"private"') && stripped.out.contains('"path":"secret.txt"')1976	assert os.read_file(os.join_path(repo, 'secret.txt'))! == 'secret'1977	assert os.read_file(os.join_path(repo, 'private/a'))! == 'a'1978	text := os.read_file(os.join_path(repo, '.kohignore'))!1979	assert text.count('/private\n') == 1 && text.count('/secret.txt\n') == 11980	assert !text.contains('/private/a\n')1981	assert run_home(repo, home, 'save', 'rules').code == 01982	assert run_home(repo, home, 'status', '--json').out.contains('"dirty":false')1983}19841985fn test_strip_legacy_paths_and_trailing_slash_remote_retry() {1986	repo := temp_repo('strip-legacy')1987	home := temp_repo('strip-home')1988	remote_dir := temp_repo('strip-remote')1989	defer {1990		os.rmdir_all(repo) or {}1991		os.rmdir_all(home) or {}1992		os.rmdir_all(remote_dir) or {}1993	}1994	assert run_home(repo, home, 'init').code == 01995	write(repo, 'secret', 'secret')1996	assert run_home(repo, home, 'save', 'legacy').code == 01997	store := storage.open(repo)!1998	store.db.exec("UPDATE save_files SET path = '../unsafe' WHERE path = 'secret'")!1999	store.close()2000	legacy := run_pty_home(repo, home, ['y', '../unsafe'], 'strip', '../unsafe')2001	assert legacy.code == 0, legacy.out2002	assert run_home(repo, home, 'doctor', '--json').code == 02003	write(repo, 'private/a', 'private')2004	assert run_home(repo, home, 'remote', 'folder', remote_dir).code == 02005	assert run_home(repo, home, 'save', 'folder').code == 02006	old_store := storage.open(repo)!2007	exchange.strip_local(old_store, 'private/', '')!2008	old_store.close()2009	retried := run_pty_home(repo, home, [], 'strip', 'private/')2010	assert retried.code == 0 && retried.out.contains('already stripped'), retried.out2011	checked := storage.open(repo)!2012	defer { checked.close() }2013	assert !exchange.strip_pending(checked, 'private/')2014}20152016fn test_strip_batch_reports_each_ignore_write_failure() {2017	repo := temp_repo('strip-rule-failure')2018	home := temp_repo('strip-home')2019	remote_dir := temp_repo('strip-rule-remote')2020	defer {2021		os.rmdir_all(repo) or {}2022		os.rmdir_all(home) or {}2023		os.rmdir_all(remote_dir) or {}2024	}2025	assert run_home(repo, home, 'init').code == 02026	write(repo, 'one', 'one')2027	write(repo, 'two', 'two')2028	assert run_home(repo, home, 'remote', 'folder', remote_dir).code == 02029	assert run_home(repo, home, 'save', 'initial').code == 02030	os.rename(os.join_path(repo, '.kohignore'), os.join_path(repo, 'rules-backup'))!2031	os.mkdir(os.join_path(repo, '.kohignore'))!2032	failed := run_pty_home(repo, home, ['y', 'one', 'two'], 'strip', 'one', 'two', '--json')2033	assert failed.code == 1, failed.out2034	assert failed.out.count('"ignore_failed":') == 22035	assert failed.out.contains('by hand') && failed.out.contains('history ban still applies')2036	assert failed.out.contains('"path":"one"') && failed.out.contains('"path":"two"')2037	store := storage.open(repo)!2038	defer { store.close() }2039	assert exchange.strip_scope(store, 'one', '')!.files == 02040	assert exchange.strip_scope(store, 'two', '')!.files == 02041	assert !exchange.strip_pending(store, 'one') && !exchange.strip_pending(store, 'two')2042}20432044fn test_destructive_restore_enter_cancels_and_uppercase_y_confirms() {2045	dir := temp_repo('restore-default-no')2046	home := temp_repo('restore-default-no-home')2047	defer {2048		os.rmdir_all(dir) or {}2049		os.rmdir_all(home) or {}2050	}2051	assert run_home(dir, home, 'init').code == 02052	write(dir, 'file.txt', 'old\n')2053	assert run_home(dir, home, 'save', 'old').code == 02054	id := run_home(dir, home, 'status', '--json').out.all_after('"head_id":"')[..12]2055	write(dir, 'file.txt', 'new\n')2056	assert run_home(dir, home, 'save', 'new').code == 02057	before := run_home(dir, home, 'status', '--json').out2058	current := before.all_after('"head_id":"')[..12]2059	for args in [['undo'], ['load', id], ['pluck', current, '--reverse']] {2060		cancel := run_pty_home(dir, home, [''], ...args)2061		assert cancel.code == 12062		assert cancel.out.contains('continue? [y/N]')2063		assert run_home(dir, home, 'status', '--json').out == before2064		assert os.read_file(os.join_path(dir, 'file.txt'))! == 'new\n'2065	}2066	write(dir, 'file.txt', 'unsaved\n')2067	assert run_pty_home(dir, home, [''], 'revert').code == 12068	assert os.read_file(os.join_path(dir, 'file.txt'))! == 'unsaved\n'2069	assert run_pty_home(dir, home, ['Y'], 'revert').code == 02070	assert os.read_file(os.join_path(dir, 'file.txt'))! == 'new\n'2071}20722073fn test_events_only_sync_requires_consent_and_noop_does_not() {2074	base := temp_repo('event-consent')2075	home := temp_repo('event-consent-home')2076	defer {2077		os.rmdir_all(base) or {}2078		os.rmdir_all(home) or {}2079	}2080	a := os.join_path(base, 'A', 'proj')2081	parent := os.join_path(base, 'B')2082	os.mkdir_all(a)!2083	os.mkdir_all(parent)!2084	assert run_home(a, home, 'init').code == 02085	assert run_home(a, home, 'remote', 'folder', os.join_path(base, 'remote')).code == 02086	write(a, 'secret.txt', 'secret')2087	assert run_home(a, home, 'save', 'base').code == 02088	assert run_home(parent, home, 'steal', 'proj').code == 02089	b := os.join_path(parent, 'proj')2090	assert run_home(b, home, 'steal').code == 02091	assert run_home(b, home, 'offer').code == 02092	assert run_pty_home(a, home, ['y', 'secret.txt'], 'strip', 'secret.txt').code == 02093	before := run_home(b, home, 'view', '--json').out2094	assert run_home(b, home, 'steal', '--json').code == 12095	assert run_pty_home(b, home, [''], 'steal').code == 12096	assert run_home(b, home, 'view', '--json').out == before2097	store := storage.open(b)!2098	held := store.db.prepare("SELECT COUNT(*) FROM save_files WHERE path = 'secret.txt'")!2099	assert held.step()!2100	assert held.int(0) > 02101	held.finalize()2102	store.close()2103	assert run_home(b, home, 'steal', '--yes').code == 02104	checked := storage.open(b)!2105	removed := checked.db.prepare("SELECT COUNT(*) FROM save_files WHERE path = 'secret.txt'")!2106	assert removed.step()!2107	assert removed.int(0) == 02108	removed.finalize()2109	checked.close()2110}21112112fn test_doctor_reports_corruption_restores_and_dirty_work_in_one_document() {2113	repo := temp_repo('doctor-health')2114	init_repo(repo)2115	write(repo, 'app', 'original')2116	assert run(repo, 'save', 'baseline').code == 02117	write(repo, 'app', 'unsaved work')2118	ordinary := run(repo, 'doctor', '--json')2119	assert ordinary.code == 02120	assert ordinary.out.contains('"health":"healthy"')2121	assert ordinary.out.contains('"modified":["app"]')2122	assert ordinary.out.contains('"line_saves":1')2123	assert ordinary.out.contains('"scope":')2124	store := storage.open(repo)!2125	store.db.exec('UPDATE objects SET size = size + 1')!2126	store.set_state('restoring', 'yes')!2127	store.close()2128	broken := run(repo, 'doctor', '--json')2129	assert broken.code == 12130	assert broken.out.contains('"health":"unhealthy"')2131	assert broken.out.contains('stored size does not match')2132	assert broken.out.contains('"restore_unfinished":true')2133	assert broken.out.contains('"checks":')2134	assert broken.out.contains('"root":')2135	assert broken.out.contains('"remedy":"run koh revert;')2136	assert broken.out.contains('"repairs":["restore 2 damaged or missing objects from verified copies"')2137	assert broken.out.contains('"repaired":[]')2138	assert run(repo, 'doctor', '--json').code == 12139	repaired := run(repo, 'doctor', '--json', '--yes')2140	assert repaired.code == 0, repaired.out2141	assert repaired.out.contains('"health":"healthy"')2142	assert repaired.out.contains('"repaired":["restore 2 damaged or missing objects from verified copies","finish the interrupted restore')2143	assert repaired.out.contains('"restore_unfinished":false')2144	assert os.read_file(os.join_path(repo, 'app'))! == 'original'2145	assert run(repo, 'view', '--json').out.contains('revert: discarded changes')2146	assert run(repo, 'doctor', 'unexpected').code == 22147}21482149fn test_doctor_checks_the_remote_by_default_and_fast_explicitly_skips_it() {2150	repo := temp_repo('doctor-remote')2151	home := temp_repo('doctor-remote-home')2152	bucket := temp_repo('doctor-remote-bucket')2153	assert run_home(repo, home, 'remote', 'folder', bucket).code == 02154	assert run_home(repo, home, 'init').code == 02155	write(repo, 'app', 'original')2156	assert run_home(repo, home, 'save', 'baseline').code == 02157	before := run_home(repo, home, 'view', '--json').out2158	healthy := run_home(repo, home, 'doctor', '--json')2159	assert healthy.code == 02160	assert healthy.out.contains('remote history, events and objects')2161	assert healthy.out.contains('"remote_saves":1')2162	assert run_home(repo, home, 'view', '--json').out == before2163	store := storage.open(repo)!2164	name := store.state('remote_repo') or { panic('missing remote repo') }2165	store.close()2166	os.write_file(os.join_path(bucket, name, 'objects', storage.hash_hex('original'.bytes())),2167		'corrupt')!2168	bad := run_home(repo, home, 'doctor', '--json')2169	assert bad.code == 12170	assert bad.out.contains('damaged remote object')2171	assert bad.out.contains('"name":"SQLite integrity","status":"pass"')2172	assert bad.out.contains('"repairs":["upload 1 object and 0 saves the remote lacks or holds damaged"]')2173	mended := run_home(repo, home, 'doctor', '--json', '--yes')2174	assert mended.code == 0, mended.out2175	assert mended.out.contains('"repaired":["upload 1 object')2176	assert os.read_file(os.join_path(bucket, name, 'objects', storage.hash_hex('original'.bytes())))! != 'corrupt'2177	fast := run_home(repo, home, 'doctor', '--fast', '--json')2178	assert fast.code == 02179	assert fast.out.contains('--fast requested')2180	assert fast.out.contains('"status":"skipped"')2181	removed := run_home(repo, home, 'doctor', '--offline', '--json')2182	assert removed.code == 22183	assert removed.err.contains('--offline')2184}21852186fn test_doctor_returns_a_report_when_the_database_cannot_be_opened() {2187	repo := temp_repo('doctor-unreadable')2188	init_repo(repo)2189	os.write_file(os.join_path(repo, '.koh'), 'not a SQLite database')!2190	result := run(repo, 'doctor', '--json')2191	assert result.code == 12192	assert result.out.contains('"health":"unhealthy"')2193	assert result.out.contains('"metadata_available":false')2194	assert result.out.contains('"name":"database open","status":"fail"')2195	assert result.out.contains('further checks could not run')2196	assert result.out.contains('koh doctor --backup')2197	assert result.err == ''2198}