cli_test.v

1module tests23import net4import net.http5import os6import time78const root = @VMODROOT9const binary = os.join_path(root, 'build', 'koh3')1011struct Result {12mut:13	code int14	out  string15	err  string16}1718fn testsuite_begin() {19	os.mkdir_all(os.join_path(root, 'build')) or { panic(err) }20	build := os.execute('v -o ${q(binary)} ${q(os.join_path(root, 'src', 'koh3.v'))}')21	if build.exit_code != 0 {22		panic('could not build koh3: ${build.output}')23	}24}2526fn q(s string) string {27	return "'${s.replace("'", "'\\''")}'"28}2930fn temp_repo(name string) string {31	dir := os.join_path(os.temp_dir(), 'koh3-cli-${name}-${time.now().unix_nano()}')32	os.mkdir_all(dir) or { panic(err) }33	return dir34}3536fn run(repo string, args ...string) Result {37	home := temp_repo('home')38	defer { os.rmdir_all(home) or {} }39	return run_home(repo, home, ...args)40}4142fn run_home(repo string, home string, args ...string) Result {43	stamp := '${os.getpid()}-${time.now().unix_nano()}'44	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')45	out_path := '${base}.out'46	err_path := '${base}.err'47	code_path := '${base}.code'48	mut command := 'HOME=${q(home)} ${q(binary)}'49	for arg in args {50		command += ' ${q(arg)}'51	}52	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'53	result := os.execute(shell)54	if result.exit_code != 0 {55		panic('could not run test command: ${result.output}')56	}57	code := os.read_file(code_path) or { panic(err) }58	out := os.read_file(out_path) or { '' }59	err := os.read_file(err_path) or { '' }60	os.rm(out_path) or {}61	os.rm(err_path) or {}62	os.rm(code_path) or {}63	return Result{64		code: code.int()65		out:  out66		err:  err67	}68}6970fn init_repo(repo string) {71	r := run(repo, 'init')72	assert r.code == 073	assert os.exists(os.join_path(repo, '.koh'))74	assert os.exists(os.join_path(repo, '.kohignore'))75}7677fn write(repo string, path string, text string) {78	full := os.join_path(repo, path)79	os.mkdir_all(os.dir(full)) or { panic(err) }80	os.write_file(full, text) or { panic(err) }81}8283fn read_json_has(text string, key string) {84	if !text.contains(key) {85		panic('missing JSON key ${key}: ${text}')86	}87}8889fn test_init_and_usage() {90	dir := temp_repo('init')91	defer { os.rmdir_all(dir) or {} }92	r := run(dir, 'init', '--json')93	assert r.code == 094	read_json_has(r.out, 'repo')95	read_json_has(r.out, 'ignore_created')96	assert run(dir, 'init').code == 197	assert run(dir, 'unknown-command').code == 298	assert run(dir, 'unknown-command').err.contains('unknown command')99	// An agent asking for JSON gets JSON for a usage mistake too, exit 2.100	for args in [['unknown-command', '--json'], ['save', '--json'], ['save', 'x', '--nope', '--json']] {101		r2 := run(dir, ...args)102		assert r2.code == 2103		assert r2.out == ''104		assert r2.err.starts_with('{"error":'), r2.err105	}106}107108// The help screen is commands and plain words: every flag lives in `koh man`.109// this_platform is the platform name for the machine the tests run on, so a110// build test does not depend on which machine that is.111fn this_platform() string {112	machine := os.uname().machine113	arch := if machine in ['arm64', 'aarch64'] { 'aarch64' } else { 'x86_64' }114	return '${os.user_os()}-${arch}'115}116117// `koh build` builds with `koh.build`: the version and platform fill the output118// path, and each artifact is printed with its size.119fn test_build_builds_the_named_platforms() {120	dir := temp_repo('build_ok')121	defer { os.rmdir_all(dir) or {} }122	init_repo(dir)123	host := this_platform()124	write(dir, 'VERSION', '1.2.3\n')125	write(dir, 'koh.build', 'command = mkdir -p out && printf built > out/demo-1.2.3-${host}126output = out/demo-{version}-{platform}127platforms = ${host}128')129	one := run(dir, 'build')130	assert one.code == 0, one.err131	assert one.out.contains('version 1.2.3')132	assert one.out.contains('out/demo-1.2.3-${host}')133	assert os.exists(os.join_path(dir, 'out/demo-1.2.3-${host}'))134135	// --platform picks one, --all takes every platform the file names.136	write(dir, 'koh.build', 'command = mkdir -p out && printf m > out/demo-macos-aarch64 && printf l > out/demo-linux-aarch64137output = out/demo-{platform}138platforms = macos-aarch64, linux-aarch64139')140	all := run(dir, 'build', '--all', '--json')141	assert all.code == 0, all.err142	assert all.out.contains('"platform":"macos-aarch64"')143	assert all.out.contains('"platform":"linux-aarch64"')144	assert os.exists(os.join_path(dir, 'out/demo-linux-aarch64'))145	picked := run(dir, 'build', '--platform', 'linux-aarch64')146	assert picked.code == 0, picked.err147	assert picked.out.contains('out/demo-linux-aarch64')148	assert !picked.out.contains('out/demo-macos-aarch64')149}150151// The item's exit check, as a test: `koh build` builds Koh 3 itself with the152// real toolchain, in a copy, and the binary it produces runs.153// `koh update` refuses a command line that cannot be answered: JSON cannot carry154// the question, and a stray argument is a mistake. Both are settled before any155// source is read, so no network is needed here.156fn test_update_refuses_a_command_line_it_cannot_answer() {157	dir := temp_repo('update_args')158	defer { os.rmdir_all(dir) or {} }159	init_repo(dir)160	json_without_yes := run(dir, 'update', '--json')161	assert json_without_yes.code == 2162	assert json_without_yes.err.contains('needs --yes')163	assert run(dir, 'update', 'extra').code == 2164}165166fn test_build_builds_koh_itself() {167	dir := temp_repo('selfbuild')168	defer { os.rmdir_all(dir) or {} }169	// Only what a build reads: the copy needs no history and no archive.170	for item in ['src', 'vendor', 'docs', 'v.mod', 'VERSION'] {171		os.cp_all(os.join_path(root, item), os.join_path(dir, item), true) or { panic(err) }172	}173	write(dir, 'koh.build', 'command = mkdir -p zig-out/bin && v -o zig-out/bin/koh3 src/koh3.v174output = zig-out/bin/koh3175platforms = ${this_platform()}176')177	init_repo(dir)178	built := run(dir, 'build')179	assert built.code == 0, built.err180	assert built.out.contains('zig-out/bin/koh3')181	fresh := os.join_path(dir, 'zig-out/bin/koh3')182	assert os.exists(fresh)183	version := os.read_file(os.join_path(dir, 'VERSION'))!.trim_space()184	assert os.execute('${q(fresh)} --version').output.trim_space() == 'koh ${version}'185}186187fn test_build_refuses_what_it_cannot_do() {188	dir := temp_repo('build_bad')189	defer { os.rmdir_all(dir) or {} }190	init_repo(dir)191	missing := run(dir, 'build')192	assert missing.code == 1193	assert missing.err.contains('koh.build')194195	write(dir, 'koh.build', 'command = true196output = out/demo197platforms = macos-aarch64198')199	no_version := run(dir, 'build')200	assert no_version.code == 1201	assert no_version.err.contains('VERSION')202203	write(dir, 'VERSION', '1.2.3\n')204	not_listed := run(dir, 'build', '--platform', 'linux-aarch64')205	assert not_listed.code == 1206	assert not_listed.err.contains('does not build for')207208	unknown := run(dir, 'build', '--platform', 'amiga')209	assert unknown.code == 1210	assert unknown.err.contains('amiga')211212	both := run(dir, 'build', '--all', '--platform', 'macos-aarch64')213	assert both.code == 2214	assert both.err.contains('cannot be combined')215216	write(dir, 'koh.build', 'command = true217output = out/demo218platforms = macos-aarch64, amiga219')220	bad_platform := run(dir, 'build')221	assert bad_platform.code == 1222	assert bad_platform.err.contains('amiga')223224	write(dir, 'koh.build', 'command = sh -c \'echo "no toolchain" >&2; exit 1\'225output = out/demo226platforms = ${this_platform()}227')228	failed := run(dir, 'build')229	assert failed.code == 1230	assert failed.err.contains('no toolchain')231}232233fn test_the_help_screen_lists_commands_and_no_flags() {234	dir := temp_repo('help')235	defer { os.rmdir_all(dir) or {} }236	help := run(dir, '--help')237	assert help.code == 0238	names := ['save', 'checkpoint', 'status', 'view', 'diff', 'undo', 'revert', 'load', 'offer',239		'steal']240	for name in names {241		assert help.out.contains('  ${name} '), name242	}243	assert help.out.contains('koh man <command>')244	// No flag text anywhere on the screen.245	assert !help.out.contains('--'), help.out246	lines := help.out.split_into_lines()247	for line in lines {248		assert line.runes().len <= 80, line249	}250	// Each command has its own paragraph, a blank line above it.251	for name in names {252		for i, line in lines {253			if line.starts_with('  ${name} ') {254				assert i > 0 && lines[i - 1] == '', line255			}256		}257	}258	// A bare `koh` keeps its stream and exit code; `-h` shows the same screen.259	bare := run(dir)260	assert bare.code == 2261	assert bare.out == ''262	assert bare.err.contains('koh man <command>')263	short := run(dir, '-h')264	assert short.code == 0265	assert short.out == help.out266}267268// Colour on the screen follows NO_COLOR, as it does everywhere else.269fn test_the_help_screen_has_no_colour_when_it_is_off() {270	dir := temp_repo('help_plain')271	defer { os.rmdir_all(dir) or {} }272	home := temp_repo('help_plain_home')273	defer { os.rmdir_all(home) or {} }274	out_path := os.join_path(os.temp_dir(), 'koh3-help-${os.getpid()}-${time.now().unix_nano()}')275	defer { os.rm(out_path) or {} }276	code := os.system('cd ${q(dir)} && HOME=${q(home)} NO_COLOR=1 ${q(binary)} --help > ${q(out_path)}')277	assert code == 0278	text := os.read_file(out_path) or { panic(err) }279	assert !text.contains('\x1b'), text280	assert text.contains('  save        snapshot your work')281}282283// The binary embeds VERSION while saves bump v.mod; they drifted once.284fn test_version_matches_the_manifest() {285	dir := temp_repo('version')286	defer { os.rmdir_all(dir) or {} }287	version := run(dir, '--version').out.trim_space().all_after('koh ')288	manifest := os.read_file(os.join_path(root, 'v.mod')) or { panic(err) }289	assert manifest.contains("version: '${version}'"), version290}291292fn test_save_checkpoint_and_status() {293	dir := temp_repo('save')294	defer { os.rmdir_all(dir) or {} }295	init_repo(dir)296	write(dir, 'tracked.txt', 'one\n')297	r := run(dir, 'save', 'first message', '--agent', 'agent-7', '--session', 'session-a', '--json')298	assert r.code == 0299	for key in ['id', 'parent', 'message', 'created_at', 'machine', 'is_checkpoint', 'agent', 'session',300		'files', 'size_bytes'] {301		read_json_has(r.out, key)302	}303	assert r.out.contains('"message":"first message"')304	assert r.out.contains('"agent":"agent-7"')305	assert r.out.contains('"session":"session-a"')306	assert r.out.contains('"is_checkpoint":false')307	assert run(dir, 'save', 'again').code == 1308	assert run(dir, 'save', 'again').err.contains('nothing has changed since the last save')309	assert run(dir, 'save').code == 2310	assert run(dir, 'save', 'x', '--bogus').code == 2311	cp := run(dir, 'checkpoint', 'still first', '--json')312	assert cp.code == 0313	assert cp.out.contains('"is_checkpoint":true')314	assert cp.out.contains('"parent":')315	clean := run(dir, 'status')316	assert clean.code == 0317	assert clean.out.contains('no changes')318	write(dir, 'tracked.txt', 'two\n')319	write(dir, 'new.txt', 'new\n')320	os.rm(os.join_path(dir, 'tracked.txt')) or { panic(err) }321	write(dir, '.kohignore', '*.log\n')322	status := run(dir, 'status')323	assert status.code == 0324	assert status.out.contains('+')325	assert status.out.contains('~') || status.out.contains('-')326	assert status.out.contains('added')327	js := run(dir, 'status', '--json')328	assert js.code == 0329	for key in ['head_id', 'head_msg', 'dirty', 'modified', 'added', 'deleted', 'ignore_changed',330		'saves', 'size_bytes', 'head_flagged'] {331		read_json_has(js.out, key)332	}333	assert js.out.contains('"ignore_changed":true')334	// What the shell prompt shows: saves on the line, the .koh size, the flag.335	assert js.out.contains('"saves":2')336	assert js.out.contains('"size_bytes":${os.file_size(os.join_path(dir, '.koh'))}')337	assert js.out.contains('"head_flagged":false')338	head := js.out.all_after('"head_id":"').all_before('"')339	assert run(dir, 'flag', head, '--reason', 'bad').code == 0340	assert run(dir, 'status', '--json').out.contains('"head_flagged":true')341}342343fn test_status_requires_repo_and_ignore_rules() {344	dir := temp_repo('status')345	defer { os.rmdir_all(dir) or {} }346	assert run(dir, 'status').code == 1347	init_repo(dir)348	write(dir, '.kohignore', '*.log\nbuild/\n')349	write(dir, 'keep.txt', 'keep\n')350	write(dir, 'ignored.log', 'ignore\n')351	write(dir, 'build/output.txt', 'ignore\n')352	assert run(dir, 'save', 'keep').code == 0353	assert run(dir, 'status').out.contains('no changes')354	assert !run(dir, 'status').out.contains('ignored.log')355	assert !run(dir, 'status').out.contains('build/output.txt')356	assert !run(dir, 'status').out.contains('LOG.md')357}358359// LOG.md is a convenience written after the save commits. If it cannot be360// written, the save still happened, and an agent that retried on a failure361// would only be told nothing had changed.362fn test_a_save_succeeds_when_log_md_cannot_be_written() {363	dir := temp_repo('logmd')364	defer { os.rmdir_all(dir) or {} }365	init_repo(dir)366	os.mkdir_all(os.join_path(dir, 'LOG.md')) or { panic(err) }367	write(dir, 'a.txt', 'one\n')368	r := run(dir, 'save', 'first', '--json')369	assert r.code == 0370	assert r.out.starts_with('{')371	assert r.err.contains('LOG.md')372	assert run(dir, 'view', '--json').out.contains('"message":"first"')373}374375// A folder of ignored files can sit where a restored file should go. Koh376// never touches ignored files, so the restore must stop and say so, not drop377// the file inside the folder under a temporary name.378fn test_a_restore_refuses_a_folder_of_ignored_files_in_the_way() {379	dir := temp_repo('dir-in-way')380	defer { os.rmdir_all(dir) or {} }381	init_repo(dir)382	write(dir, 'out', 'a file\n')383	first := run(dir, 'save', 'out is a file', '--json').out.all_after('"id":"')[..12]384	os.rm(os.join_path(dir, 'out')) or { panic(err) }385	write(dir, 'out/build.log', 'ignored\n')386	assert run(dir, 'save', 'out is gone').code == 0387	r := run(dir, 'load', first, '--yes')388	assert r.code == 1389	assert r.err.contains('out')390	assert os.ls(os.join_path(dir, 'out'))! == ['build.log']391}392393// Koh never follows a symlink, so a folder replaced by a link to somewhere394// else is not the repo's to write into: restoring through it would overwrite395// files outside the repo. The refusal comes before anything is recorded.396fn test_a_restore_never_writes_through_a_symlinked_folder() {397	dir := temp_repo('link-in-way')398	outside := temp_repo('link-target')399	defer {400		os.rmdir_all(dir) or {}401		os.rmdir_all(outside) or {}402	}403	init_repo(dir)404	write(dir, 'docs/a.md', 'saved\n')405	first := run(dir, 'save', 'docs', '--json').out.all_after('"id":"')[..12]406	os.rmdir_all(os.join_path(dir, 'docs')) or { panic(err) }407	write(outside, 'a.md', 'precious\n')408	os.symlink(outside, os.join_path(dir, 'docs')) or { panic(err) }409	assert run(dir, 'save', 'docs is a link now').code == 0410	head := run(dir, 'status', '--json').out411	r := run(dir, 'load', first, '--yes')412	assert r.code == 1413	assert r.err.contains('docs')414	assert os.read_file(os.join_path(outside, 'a.md'))! == 'precious\n'415	assert run(dir, 'status', '--json').out == head416}417418// A restore records its save first, then writes files. When the writing stops419// part way, the half-written tree is not somebody's work: saving it would420// record (and offer) a tree that undoes changes nobody asked to undo. Every421// command that would build on it points at revert, which finishes the job.422fn test_a_restore_cut_short_points_at_revert() {423	dir := temp_repo('cut-short')424	defer {425		os.chmod(os.join_path(dir, 'zz'), 0o755) or {}426		os.rmdir_all(dir) or {}427	}428	init_repo(dir)429	write(dir, 'zero', '0\n')430	assert run(dir, 'save', 'zero').code == 0431	write(dir, 'a.txt', 'v1\n')432	write(dir, 'zz/f', 'v1\n')433	assert run(dir, 'save', 'first').code == 0434	write(dir, 'a.txt', 'v2\n')435	write(dir, 'zz/f', 'v2\n')436	assert run(dir, 'save', 'second').code == 0437	// a.txt is written, then the read-only folder stops the restore: the438	// tree is genuinely half one save and half the other.439	os.chmod(os.join_path(dir, 'zz'), 0o555)!440	stopped := run(dir, 'undo', '--yes')441	assert stopped.code == 1442	assert stopped.err.contains('koh revert')443	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'444	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v2\n'445	// Even a status that cannot read the tree says what happened.446	os.chmod(os.join_path(dir, 'zz'), 0o000)!447	assert run(dir, 'status').err.contains('koh revert')448	os.chmod(os.join_path(dir, 'zz'), 0o755)!449450	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":true')451	for args in [['save', 'half'], ['checkpoint', 'half'], ['undo', '--yes']] {452		r := run(dir, ...args)453		assert r.code == 1454		assert r.err.contains('koh revert')455	}456	assert run(dir, 'revert', '--yes').code == 0457	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'458	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v1\n'459	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":false')460	write(dir, 'a.txt', 'v3\n')461	assert run(dir, 'save', 'carry on').code == 0462}463464// Doctor clears peek folders left from earlier days, never one somebody may465// be reading right now.466fn test_doctor_sweeps_only_old_peek_folders() {467	dir := temp_repo('peek-sweep')468	// V's temp_dir is /tmp on macOS whatever TMPDIR says, so these live in469	// the real temp directory under names no save could have.470	fresh := os.join_path(os.temp_dir(), 'koh-peek-fresh${os.getpid()}')471	old := os.join_path(os.temp_dir(), 'koh-peek-old${os.getpid()}')472	defer {473		os.rmdir_all(dir) or {}474		os.rmdir_all(fresh) or {}475		os.rmdir_all(old) or {}476	}477	init_repo(dir)478	write(dir, 'a.txt', 'one\n')479	assert run(dir, 'save', 'one').code == 0480	os.mkdir_all(fresh) or { panic(err) }481	os.mkdir_all(old) or { panic(err) }482	two_days_ago := time.now().unix() - 2 * 86400483	os.utime(old, two_days_ago, two_days_ago) or { panic(err) }484	assert run(dir, 'doctor', '--json').code == 0485	assert os.exists(fresh)486	assert !os.exists(old)487}488489// A file saved long ago and ignored since holds work no save has. Loading the490// old save must not write over it; the document says a restore never touches491// ignored files.492fn test_a_restore_never_overwrites_an_ignored_file() {493	dir := temp_repo('ignored-restore')494	defer { os.rmdir_all(dir) or {} }495	init_repo(dir)496	write(dir, '.env', 'KEY=saved long ago\n')497	first := run(dir, 'save', 'with env', '--json').out.all_after('"id":"')[..12]498	write(dir, '.kohignore', '.env\n')499	assert run(dir, 'save', 'ignore env').code == 0500	write(dir, '.env', 'KEY=never saved\n')501	assert run(dir, 'load', first, '--yes').code == 0502	assert os.read_file(os.join_path(dir, '.env'))! == 'KEY=never saved\n'503504	// Where the ignored file is missing, the restore still brings it back.505	other := temp_repo('ignored-restore-missing')506	defer { os.rmdir_all(other) or {} }507	init_repo(other)508	write(other, '.env', 'KEY=saved long ago\n')509	again := run(other, 'save', 'with env', '--json').out.all_after('"id":"')[..12]510	write(other, '.kohignore', '.env\n')511	assert run(other, 'save', 'ignore env').code == 0512	os.rm(os.join_path(other, '.env')) or { panic(err) }513	assert run(other, 'load', again, '--yes').code == 0514	assert os.read_file(os.join_path(other, '.env'))! == 'KEY=saved long ago\n'515}516517// A going-back preview lists paths only. Running diff(1) per file to draw it518// cost 27 s for 5,000 changed files, so it must not run diff at all.519fn test_a_going_back_preview_does_not_run_diff() {520	dir := temp_repo('preview-nodiff')521	home := temp_repo('preview-nodiff-home')522	defer {523		os.rmdir_all(dir) or {}524		os.rmdir_all(home) or {}525	}526	init_repo(dir)527	write(dir, 'a.txt', 'one\n')528	assert run_home(dir, home, 'save', 'one').code == 0529	write(dir, 'a.txt', 'two\n')530	assert run_home(dir, home, 'save', 'two').code == 0531	fake := os.join_path(home, 'bin')532	os.mkdir_all(fake) or { panic(err) }533	marker := os.join_path(home, 'diff-ran')534	os.write_file(os.join_path(fake, 'diff'), '#!/bin/sh\ntouch ${q(marker)}\nexit 2\n') or {535		panic(err)536	}537	os.chmod(os.join_path(fake, 'diff'), 0o755) or { panic(err) }538	assert run_home_with_path(dir, home, fake, 'undo', '--yes').code == 0539	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'540	assert !os.exists(marker)541}542543// A restore rewrites only what differs. Rewriting every file resets every544// mtime, so the next status has to hash the whole tree again.545fn test_a_restore_leaves_unchanged_files_alone() {546	dir := temp_repo('restore-skip')547	defer { os.rmdir_all(dir) or {} }548	init_repo(dir)549	write(dir, 'a.txt', 'one\n')550	write(dir, 'same.txt', 'never changes\n')551	assert run(dir, 'save', 'one').code == 0552	write(dir, 'a.txt', 'two\n')553	assert run(dir, 'save', 'two').code == 0554	long_ago := i64(1700000000)555	os.utime(os.join_path(dir, 'same.txt'), long_ago, long_ago) or { panic(err) }556	assert run(dir, 'undo', '--yes').code == 0557	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'558	assert os.file_last_mod_unix(os.join_path(dir, 'same.txt')) == long_ago559}560561// `save` records the executable bit, so `status` has to see it too, or a562// chmod would be invisible until it turned up in a save.563fn test_status_sees_an_executable_bit_change() {564	dir := temp_repo('chmod')565	defer { os.rmdir_all(dir) or {} }566	init_repo(dir)567	write(dir, 'run.sh', 'echo hi\n')568	assert run(dir, 'save', 'script').code == 0569	os.chmod(os.join_path(dir, 'run.sh'), 0o755) or { panic(err) }570	status := run(dir, 'status', '--json')571	assert status.out.contains('"dirty":true')572	assert status.out.contains('"modified":["run.sh"]')573}574575fn test_view_and_diff() {576	dir := temp_repo('history')577	defer { os.rmdir_all(dir) or {} }578	init_repo(dir)579	write(dir, 'a.txt', 'one\n')580	first := run(dir, 'save', 'one', '--session', 'alpha', '--json')581	id1 := first.out.all_after('"id":"')[..12]582	write(dir, 'a.txt', 'two\n')583	second := run(dir, 'save', 'two', '--session', 'beta', '--json')584	id2 := second.out.all_after('"id":"')[..12]585	cp := run(dir, 'checkpoint', 'checkpoint', '--json')586	assert cp.code == 0587	printed := run(dir, 'view')588	assert printed.code == 0589	assert printed.out.contains('▸')590	assert printed.out.contains('◐')591	lj := run(dir, 'view', '--json')592	assert lj.code == 0593	assert lj.out.contains('"head_id"')594	assert lj.out.contains('"saves"')595	assert run(dir, 'view', '--since', 'today').out.contains('two')596	session := run(dir, 'view', '--session', 'alpha')597	assert session.out.contains('one')598	assert !session.out.contains('two')599	assert run(dir, 'view', '--since', '9999-01-01').out.contains('no saves in that range')600	write(dir, 'a.txt', 'three\n')601	d := run(dir, 'diff')602	assert d.code == 0603	assert d.out.contains('--- a/')604	assert d.out.contains('+++ b/')605	assert run(dir, 'diff', id1).code == 0606	assert run(dir, 'diff', id1, id2).code == 0607	dj := run(dir, 'diff', '--json')608	assert dj.code == 0609	assert dj.out.contains('"from"')610	assert dj.out.contains('"to"')611	assert dj.out.contains('"files"')612	assert dj.out.contains('"change":"modified"')613	assert run(dir, 'diff', 'not-a-real-id').code == 1614	assert run(dir, 'diff', id1, id2, 'third').code == 1615	write(dir, 'blob.bin', '\x00\x01\x02')616	diff_binary := run(dir, 'diff', '--json')617	assert diff_binary.out.contains('"binary":true')618	assert diff_binary.out.contains('Binary files differ')619}620621fn test_undo_revert_and_load() {622	dir := temp_repo('restore')623	defer { os.rmdir_all(dir) or {} }624	init_repo(dir)625	write(dir, 'a.txt', 'one\n')626	one := run(dir, 'save', 'one', '--json').out627	id1 := one.all_after('"id":"')[..12]628	write(dir, 'a.txt', 'two\n')629	write(dir, 'gone.txt', 'gone\n')630	second := run(dir, 'save', 'two', '--json').out631	id2 := second.all_after('"id":"')[..12]632	write(dir, 'a.txt', 'three\n')633	third := run(dir, 'save', 'three', '--json').out634	id3 := third.all_after('"id":"')[..12]635	// Unsaved work — here a file never saved — blocks every going-back but636	// revert, as in Koh 2: a restore must never overwrite what only the disk has.637	write(dir, 'never.txt', 'keep me\n')638	view_before := run(dir, 'view').out639	for args in [['undo', '--yes'], ['load', id1, '--yes'], ['pluck', id2, '--yes']] {640		blocked := run(dir, ...args)641		assert blocked.code == 1642		assert blocked.err.contains('unsaved changes')643	}644	assert run(dir, 'view').out == view_before645	os.rm(os.join_path(dir, 'never.txt')) or { panic(err) }646	write(dir, 'a.txt', 'edited, never saved\n')647	assert run(dir, 'undo', '--yes').err.contains('unsaved changes')648	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'edited, never saved\n'649	write(dir, 'a.txt', 'three\n')650	os.rm(os.join_path(dir, 'gone.txt')) or { panic(err) }651	assert run(dir, 'load', id1, '--yes').err.contains('unsaved changes')652	write(dir, 'gone.txt', 'gone\n')653	undo := run(dir, 'undo', '--yes', '--json')654	assert undo.code == 0655	if !undo.out.contains(id2) {656		panic('undo JSON did not name ${id2}: ${undo.out}')657	}658	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'659	assert os.exists(os.join_path(dir, 'gone.txt'))660	assert run(dir, 'load', id3, '--yes').code == 0661	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'three\n'662	assert run(dir, 'undo', '2', '--yes').code == 0663	assert run(dir, 'load', id2, '--yes').code == 0664	assert run(dir, 'undo', '99', '--yes').err.contains('nothing before')665	write(dir, 'a.txt', 'dirty\n')666	before := run(dir, 'view')667	refuse := run(dir, 'revert')668	assert refuse.code == 1669	assert refuse.err.contains('needs --yes when not interactive')670	assert run(dir, 'view').out == before.out671	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'672	write(dir, 'untracked.txt', 'remove\n')673	rv := run(dir, 'revert', '--yes', '--json')674	assert rv.code == 0675	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'676	assert !os.exists(os.join_path(dir, 'untracked.txt'))677	// The way back to the discarded work is named, not left to be found.678	kept := rv.out.all_after('"checkpoint":"')[..12]679	assert run(dir, 'load', kept, '--yes').code == 0680	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'681	assert os.read_file(os.join_path(dir, 'untracked.txt'))! == 'remove\n'682	write(dir, 'a.txt', 'dirty again\n')683	assert run(dir, 'revert', '--yes').out.contains('koh load ')684	assert run(dir, 'revert', '--yes').out.contains('working tree already matches')685	assert run(dir, 'load', '--checkpoint', '--yes').code == 0686	assert run(dir, 'load', id2, '--json').code == 1687	assert run(dir, 'load', id2, '--json').err.contains('error')688	assert run(dir, 'load').code == 2689	assert run(dir, 'load', 'unknown-id', '--yes').code == 1690}691692fn test_flag_and_flagged_view() {693	dir := temp_repo('flag')694	defer { os.rmdir_all(dir) or {} }695	init_repo(dir)696	write(dir, 'flag.txt', 'one\n')697	saved := run(dir, 'save', 'flag me', '--json')698	id := saved.out.all_after('"id":"')[..12]699	flagged := run(dir, 'flag', id, '--reason', 'unsafe', '--json')700	assert flagged.code == 0701	assert flagged.out.contains('"flagged":true')702	assert flagged.out.contains('"reason":"unsafe"')703	list := run(dir, 'flag', '--json')704	assert list.code == 0705	assert list.out.contains(id)706	assert list.out.contains('unsafe')707	assert run(dir, 'view').out.contains('⚑')708	assert run(dir, 'flag', '--clear', id).code == 0709	assert run(dir, 'flag').out.contains('nothing is flagged')710	assert run(dir, 'flag', 'unknown-id').code == 1711	assert run(dir, 'flag').code == 0712}713714fn test_pluck_forward_reverse_dry_run_and_conflict() {715	dir := temp_repo('pluck')716	defer { os.rmdir_all(dir) or {} }717	init_repo(dir)718	write(dir, 'a.txt', 'one\n')719	first := run(dir, 'save', 'one', '--json').out720	id1 := first.all_after('"id":"')[..12]721	write(dir, 'a.txt', 'two\n')722	second := run(dir, 'save', 'two', '--json').out723	id2 := second.all_after('"id":"')[..12]724	assert run(dir, 'load', id1, '--yes').code == 0725	dry := run(dir, 'pluck', id2, '--dry-run')726	assert dry.code == 0727	assert dry.out.contains('a.txt')728	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'729	assert run(dir, 'pluck', id2, '--yes').code == 0730	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'731	assert run(dir, 'pluck', '--reverse', id2, '--yes').code == 0732	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'733	write(dir, 'a.txt', 'different\n')734	assert run(dir, 'pluck', id2, '--dry-run').code == 1735	assert run(dir, 'save', 'different').code == 0736	conflict := run(dir, 'pluck', id2, '--yes')737	assert conflict.code == 1738	assert conflict.err.contains('a.txt')739	assert run(dir, 'pluck').code == 2740	assert run(dir, 'pluck', 'unknown-id').code == 1741}742743fn test_peek_and_doctor() {744	dir := temp_repo('peek-doctor')745	defer { os.rmdir_all(dir) or {} }746	init_repo(dir)747	write(dir, 'peek.txt', 'peek me\n')748	assert run(dir, 'save', 'peekable').code == 0749	id := run(dir, 'view', '--json').out.all_after('"id":"')[..12]750	before_view := run(dir, 'view', '--json').out751	peek := run(dir, 'peek', id, '--json')752	assert peek.code == 0753	peek_path := peek.out.all_after('"path":"').before('"')754	assert peek.out.contains('"id":"${id}"')755	assert os.read_file(os.join_path(peek_path, 'peek.txt'))! == 'peek me\n'756	assert run(dir, 'status').out.contains('no changes')757	assert run(dir, 'view', '--json').out == before_view758	assert run(dir, 'peek').code == 2759	assert run(dir, 'peek', 'unknown-id').code == 1760	backup := os.join_path(dir, 'doctor.backup')761	healthy := run(dir, 'doctor')762	assert healthy.code == 0763	assert healthy.out.contains('is sound')764	report := run(dir, 'doctor', '--json')765	assert report.code == 0766	for key in ['problems', 'objects', 'saves', 'checkpoints', 'cached_files', 'peek_folders_removed',767		'backup'] {768		read_json_has(report.out, key)769	}770	backed := run(dir, 'doctor', '--backup', backup)771	assert backed.code == 0772	assert os.exists(backup)773	assert backed.out.contains(backup)774	assert run(dir, 'doctor', '--backup', backup).code == 1775	assert run(dir, 'peek', id, '--json').code == 0776	// A peek made today is left for whoever is reading it.777	kept := run(dir, 'doctor', '--json')778	assert kept.code == 0779	assert os.exists(peek_path)780	os.rmdir_all(peek_path) or {}781}782783fn test_strip_refuses_without_terminal() {784	dir := temp_repo('strip')785	defer { os.rmdir_all(dir) or {} }786	init_repo(dir)787	write(dir, 'secret.txt', 'keep\n')788	assert run(dir, 'save', 'secret').code == 0789	before_view := run(dir, 'view', '--json').out790	refused := run(dir, 'strip', 'secret.txt')791	assert refused.code == 1792	assert refused.err.contains('needs a terminal')793	assert run(dir, 'view', '--json').out == before_view794	assert os.read_file(os.join_path(dir, 'secret.txt'))! == 'keep\n'795	assert run(dir, 'view', '--json').out.contains('secret')796}797798// `koh view` is the one way into the history: the whole line by default,799// checkpoints alone with the flag, and the two lists never overlap.800fn test_view_shows_the_line_and_checkpoints_apart() {801	dir := temp_repo('view')802	defer { os.rmdir_all(dir) or {} }803	init_repo(dir)804	write(dir, 'view.txt', 'one\n')805	assert run(dir, 'save', 'plain save').code == 0806	assert run(dir, 'checkpoint', 'checkpoint save').code == 0807	line := run(dir, 'view')808	assert line.code == 0809	assert line.out.contains('plain save')810	assert line.out.contains('checkpoint save')811	checkpoints := run(dir, 'view', '--checkpoints')812	assert checkpoints.code == 0813	assert checkpoints.out.contains('checkpoint save')814	assert !checkpoints.out.contains('plain save')815	json_line := run(dir, 'view', '--json')816	assert json_line.code == 0817	assert json_line.out.contains('"is_checkpoint":false')818	assert json_line.out.contains('"is_checkpoint":true')819	json_checkpoints := run(dir, 'view', '--checkpoints', '--json')820	assert json_checkpoints.code == 0821	assert json_checkpoints.out.contains('"is_checkpoint":true')822	assert !json_checkpoints.out.contains('"is_checkpoint":false')823	// `view` takes no arguments, so a stray one is a usage error, and the names824	// it replaced are gone rather than hidden: the diagnostic says which.825	assert run(dir, 'view', 'extra').code == 2826	for gone in ['log', 'saves', 'checkpoints'] {827		refused := run(dir, gone)828		assert refused.code == 2829		assert refused.err.contains('unknown command "${gone}"')830	}831	// Every save is on the whole line exactly once, as the JSON says.832	assert line.out.split_into_lines().len == json_line.out.count('"id":"')833}834835fn test_remote_configuration_is_isolated_and_atomic() {836	dir := temp_repo('remote')837	home := temp_repo('remote-home')838	defer {839		os.rmdir_all(dir) or {}840		os.rmdir_all(home) or {}841	}842	empty := run_home(dir, home, 'remote', '--json')843	assert empty.code == 0844	assert empty.out.contains('"configured":false')845	target := os.join_path(home, 'remote-store')846	set := run_home(dir, home, 'remote', 'folder', target)847	assert set.code == 0848	assert os.is_dir(target)849	state := run_home(dir, home, 'remote', '--json')850	assert state.code == 0851	assert state.out.contains('"kind":"folder"')852	assert state.out.contains(target)853	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').code == 1854	assert run_home(dir, home, 'remote', '--json').out.contains(target)855	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').err.contains('KOH_ACCESS_KEY')856	assert run_home(dir, home, 'remote', '--forget').code == 0857	assert run_home(dir, home, 'remote', '--json').out.contains('"configured":false')858}859860// The files under ~/.config/koh can be written by hand instead of by861// `koh remote`, and are then read the same way.862fn test_remote_written_by_hand() {863	dir := temp_repo('remote-by-hand')864	home := temp_repo('remote-by-hand-home')865	defer {866		os.rmdir_all(dir) or {}867		os.rmdir_all(home) or {}868	}869	config := os.join_path(home, '.config', 'koh')870	os.mkdir_all(config) or { panic(err) }871	target := os.join_path(home, 'remote-store')872	os.mkdir_all(target) or { panic(err) }873	os.write_file(os.join_path(config, 'remote'), 'kind = folder\npath = ${target}\n') or {874		panic(err)875	}876	assert run_home(dir, home, 'init').code == 0877	os.write_file(os.join_path(dir, 'a.txt'), 'a\n') or { panic(err) }878	assert run_home(dir, home, 'save', 'first').code == 0879	offered := run_home(dir, home, 'offer', '--json')880	assert offered.code == 0881	assert offered.out.contains('"head"')882883	// Keys anyone else can read are refused before they are ever sent.884	os.write_file(os.join_path(config, 'remote'), 'kind=s3\nendpoint=http://127.0.0.1:1\nbucket=b\nregion=r\n') or {885		panic(err)886	}887	credentials := os.join_path(config, 'credentials')888	os.write_file(credentials, 'access_key=AK\nsecret_key=SK\n') or { panic(err) }889	os.chmod(credentials, 0o644) or { panic(err) }890	loose := run_home(dir, home, 'offer')891	assert loose.code == 1892	assert loose.err.contains('chmod 600')893894	// A setting koh cannot read is replaced by setting the remote again.895	os.write_file(os.join_path(config, 'remote'), 'kind=ftp\n') or { panic(err) }896	unreadable := run_home(dir, home, 'offer')897	assert unreadable.code == 1898	assert unreadable.err.contains('not readable')899	assert run_home(dir, home, 'remote', 'folder', target).code == 0900	assert run_home(dir, home, 'offer').code == 0901}902903// A clone belongs to the repo it was stolen from, whatever its folder is904// called later: renaming it must not start a second repo on the remote.905fn test_a_renamed_clone_keeps_offering_to_its_repo() {906	syncroot := temp_repo('rename-clone')907	home := temp_repo('rename-clone-home')908	defer {909		os.rmdir_all(syncroot) or {}910		os.rmdir_all(home) or {}911	}912	remote := os.join_path(syncroot, 'remote')913	a := os.join_path(syncroot, 'A', 'proj')914	b_parent := os.join_path(syncroot, 'B')915	os.mkdir_all(a) or { panic(err) }916	os.mkdir_all(b_parent) or { panic(err) }917	init_repo(a)918	write(a, 'a.txt', 'from A\n')919	assert run_home(a, home, 'remote', 'folder', remote).code == 0920	assert run_home(a, home, 'save', 'A first').code == 0921	assert run_home(b_parent, home, 'steal', 'proj').code == 0922	renamed := os.join_path(b_parent, 'renamed')923	os.mv(os.join_path(b_parent, 'proj'), renamed) or { panic(err) }924	write(renamed, 'b.txt', 'from B\n')925	assert run_home(renamed, home, 'save', 'B first').code == 0926	assert !os.exists(os.join_path(remote, 'renamed'))927	assert run_home(a, home, 'steal').code == 0928	assert os.read_file(os.join_path(a, 'b.txt'))! == 'from B\n'929}930931// A damaged object on the remote stops a clone, names the object, and leaves932// no half-made folder that would make the retry refuse.933fn test_clone_of_a_damaged_remote_leaves_nothing() {934	syncroot := temp_repo('damaged')935	home := temp_repo('damaged-home')936	defer {937		os.rmdir_all(syncroot) or {}938		os.rmdir_all(home) or {}939	}940	remote := os.join_path(syncroot, 'remote')941	a := os.join_path(syncroot, 'A', 'proj')942	b_parent := os.join_path(syncroot, 'B')943	os.mkdir_all(a) or { panic(err) }944	os.mkdir_all(b_parent) or { panic(err) }945	init_repo(a)946	write(a, 'a.txt', 'from A\n')947	assert run_home(a, home, 'remote', 'folder', remote).code == 0948	assert run_home(a, home, 'save', 'A first').code == 0949	objects := os.join_path(remote, 'proj', 'objects')950	for name in os.ls(objects) or { panic(err) } {951		os.chmod(os.join_path(objects, name), 0o644) or {}952		os.write_file(os.join_path(objects, name), 'junk') or { panic(err) }953	}954	clone := run_home(b_parent, home, 'steal', 'proj')955	assert clone.code == 1956	assert clone.err.contains('is damaged')957	assert !os.exists(os.join_path(b_parent, 'proj'))958}959960fn test_offer_steal_folder_remote() {961	syncroot := temp_repo('sync')962	home := temp_repo('sync-home')963	defer {964		os.rmdir_all(syncroot) or {}965		os.rmdir_all(home) or {}966	}967	remote := os.join_path(syncroot, 'remote')968	a := os.join_path(syncroot, 'A', 'proj')969	b_parent := os.join_path(syncroot, 'B')970	os.mkdir_all(a) or { panic(err) }971	os.mkdir_all(b_parent) or { panic(err) }972	init_repo(a)973	write(a, 'a.txt', 'from A\n')974	assert run_home(a, home, 'remote', 'folder', remote).code == 0975	assert run_home(a, home, 'save', 'A first').code == 0976	clone := run_home(b_parent, home, 'steal', 'proj')977	assert clone.code == 0978	b := os.join_path(b_parent, 'proj')979	assert os.read_file(os.join_path(b, 'a.txt'))! == 'from A\n'980	write(b, 'b.txt', 'from B\n')981	assert run_home(b, home, 'save', 'B first').code == 0982	write(a, 'a2.txt', 'second\n')983	assert run_home(a, home, 'save', 'A second').code == 0984	assert run_home(a, home, 'steal').code == 0985	assert os.exists(os.join_path(a, 'b.txt'))986	assert run_home(b_parent, home, 'steal', '--list').out.contains('proj')987	write(a, 'clash.txt', 'base\n')988	assert run_home(a, home, 'save', 'clash base').code == 0989	assert run_home(b, home, 'steal').code == 0990	write(a, 'clash.txt', 'A version\n')991	assert run_home(a, home, 'save', 'A clash').code == 0992	write(b, 'clash.txt', 'B version\n')993	assert run_home(b, home, 'save', 'B clash').code == 0994	refused := run_home(b, home, 'steal')995	assert refused.code == 1996	assert refused.err.contains('--mine') || refused.err.contains('--theirs')997	b_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]998	theirs := run_home(b, home, 'steal', '--theirs', '--json')999	assert theirs.code == 01000	// The pre-combine tree is off the line now; the way back must be named,1001	// or an agent without the history view cannot find it.1002	assert theirs.out.contains('"previous_head":"${b_head}"')1003	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'1004	assert run_home(b, home, 'load', b_head, '--yes').code == 01005	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B version\n'1006	assert run_home(b, home, 'load', theirs.out.all_after('"head":"')[..12], '--yes').code == 01007	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'1008	write(a, 'clash.txt', 'A second\n')1009	assert run_home(a, home, 'save', 'A second clash').code == 01010	write(b, 'clash.txt', 'B second\n')1011	assert run_home(b, home, 'save', 'B second clash').code == 01012	assert run_home(b, home, 'steal', '--mine').code == 01013	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B second\n'1014	assert run_home(b, home, 'view').out.contains('combine: kept mine for')1015}10161017// A clone brings in the whole history, flags included; both output forms must1018// say which saves came in flagged, and why.1019fn test_a_clone_reports_flagged_saves() {1020	syncroot := temp_repo('clone-flags')1021	home := temp_repo('clone-flags-home')1022	defer {1023		os.rmdir_all(syncroot) or {}1024		os.rmdir_all(home) or {}1025	}1026	a := os.join_path(syncroot, 'A', 'proj')1027	os.mkdir_all(a) or { panic(err) }1028	init_repo(a)1029	assert run_home(a, home, 'remote', 'folder', os.join_path(syncroot, 'remote')).code == 01030	write(a, 'a.txt', 'one\n')1031	id := run_home(a, home, 'save', 'risky', '--json').out.all_after('"id":"')[..12]1032	assert run_home(a, home, 'flag', id, '--reason', 'broke the build').code == 01033	assert run_home(a, home, 'offer').code == 01034	for name in ['B', 'C'] {1035		os.mkdir_all(os.join_path(syncroot, name)) or { panic(err) }1036	}1037	json_clone := run_home(os.join_path(syncroot, 'B'), home, 'steal', 'proj', '--json')1038	assert json_clone.code == 01039	assert json_clone.out.contains('"flagged":["${id}"]')1040	text_clone := run_home(os.join_path(syncroot, 'C'), home, 'steal', 'proj')1041	assert text_clone.code == 01042	assert text_clone.out.contains('[${id}] came in flagged — broke the build')1043}10441045// A folder remote on a disk or share that is not mounted is simply not there.1046// Creating it would put the saves in a stand-in folder the other machine never1047// sees; the offer must say what is wrong instead.1048fn test_an_unmounted_folder_remote_is_not_recreated() {1049	syncroot := temp_repo('unmounted')1050	home := temp_repo('unmounted-home')1051	defer {1052		os.rmdir_all(syncroot) or {}1053		os.rmdir_all(home) or {}1054	}1055	mount := os.join_path(syncroot, 'nas')1056	remote := os.join_path(mount, 'koh')1057	a := os.join_path(syncroot, 'proj')1058	os.mkdir_all(a) or { panic(err) }1059	init_repo(a)1060	assert run_home(a, home, 'remote', 'folder', remote).code == 01061	write(a, 'a.txt', 'one\n')1062	assert run_home(a, home, 'save', 'first').code == 01063	os.rename(mount, os.join_path(syncroot, 'nas-unplugged')) or { panic(err) }1064	os.mkdir(mount) or { panic(err) }1065	offered := run_home(a, home, 'offer')1066	assert offered.code == 11067	assert offered.err.contains('mounted')1068	assert !os.exists(remote)1069	write(a, 'a.txt', 'two\n')1070	saved := run_home(a, home, 'save', 'second')1071	assert saved.code == 01072	assert saved.out.contains('mounted')1073	assert !os.exists(remote)1074}10751076fn test_man_and_koh2_handoff() {1077	dir := temp_repo('man')1078	home := temp_repo('man-home')1079	defer {1080		os.rmdir_all(dir) or {}1081		os.rmdir_all(home) or {}1082	}1083	whole := run_home(dir, home, 'man')1084	assert whole.code == 01085	assert whole.out.contains('NAME')1086	assert whole.out.contains('COMMANDS')1087	assert !whole.out.contains('\x1b') && !whole.out.contains('◆')1088	strip := run_home(dir, home, 'man', 'strip')1089	assert strip.code == 01090	assert strip.out.contains('strip')1091	assert !strip.out.contains('koh save ')1092	steal := run_home(dir, home, 'man', 'steal').out1093	assert steal.starts_with('    koh steal') && steal.contains('koh steal my-project')1094	assert run_home(dir, home, 'man', 'init').out.trim_space() == "koh init\n        Create `.koh` here, and a starter `.kohignore` if there isn't one."1095	assert run_home(dir, home, 'man', 'nonsense').code == 21096	legacy := temp_repo('legacy')1097	defer { os.rmdir_all(legacy) or {} }1098	os.mkdir_all(os.join_path(legacy, '.koh')) or { panic(err) }1099	fake := os.join_path(home, 'bin')1100	os.mkdir_all(fake) or { panic(err) }1101	fake_koh := os.join_path(fake, 'koh2')1102	os.write_file(fake_koh, '#!/bin/sh\nprintf "handoff:%s\\n" "$*"\nexit 7\n') or { panic(err) }1103	os.chmod(fake_koh, 0o755) or { panic(err) }1104	handoff := run_home_with_path(legacy, home, fake, 'status', '--json')1105	assert handoff.code == 71106	assert handoff.out.contains('handoff:status --json')1107	// One notice line, on stderr, so koh2's own output stays as it was.1108	assert handoff.err.contains('Koh 2 repo')1109	assert handoff.err.trim_space().split_into_lines().len == 11110	assert handoff.out.trim_space() == 'handoff:status --json'1111}11121113fn run_home_with_path(repo string, home string, bin_dir string, args ...string) Result {1114	stamp := '${os.getpid()}-${time.now().unix_nano()}'1115	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')1116	out_path := '${base}.out'1117	err_path := '${base}.err'1118	code_path := '${base}.code'1119	mut command := 'HOME=${q(home)} PATH=${q(bin_dir + ':' + os.getenv('PATH'))} ${q(binary)}'1120	for arg in args {1121		command += ' ${q(arg)}'1122	}1123	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'1124	result := os.execute(shell)1125	if result.exit_code != 0 {1126		panic('could not run test command: ${result.output}')1127	}1128	code := os.read_file(code_path) or { panic(err) }1129	out := os.read_file(out_path) or { '' }1130	err := os.read_file(err_path) or { '' }1131	os.rm(out_path) or {}1132	os.rm(err_path) or {}1133	os.rm(code_path) or {}1134	return Result{1135		code: code.int()1136		out:  out1137		err:  err1138	}1139}11401141// --- migration -------------------------------------------------------------11421143fn koh2_binary() string {1144	return os.find_abs_path_of_executable('koh') or { '' }1145}11461147// run_koh2 runs the Koh 2 binary in a fixture; its own output is not under1148// test here.1149fn run_koh2(dir string, command string) {1150	os.execute('cd ${q(dir)} && ${command} >/dev/null 2>&1')1151}11521153fn save_ids(dir string) []string {1154	mut ids := []string{}1155	for name in os.ls(os.join_path(dir, '.koh', 'snapshots')) or { []string{} } {1156		if name.ends_with('.json') {1157			ids << name.trim_right('.json')1158		}1159	}1160	ids.sort()1161	return ids1162}11631164fn test_migrate_converts_a_koh2_repo_and_keeps_every_save() {1165	koh2 := koh2_binary()1166	if koh2 == '' {1167		println('skipping the migration tests: koh (Koh 2) is not on PATH')1168		return1169	}1170	dir := temp_repo('migrate')1171	defer { os.rmdir_all(dir) or {} }1172	home := temp_repo('migrate-home')1173	defer { os.rmdir_all(home) or {} }1174	run_koh2(dir, '${q(koh2)} init')1175	// One file large enough to be an object, one small enough to be inlined.1176	write(dir, 'code.txt', 'x'.repeat(700))1177	write(dir, 'tiny.txt', 'tiny\n')1178	run_koh2(dir, '${q(koh2)} save "first save"')1179	run_koh2(dir, '${q(koh2)} checkpoint "before something"')1180	write(dir, 'code.txt', 'y'.repeat(700))1181	run_koh2(dir, '${q(koh2)} save "second save"')1182	original := save_ids(dir)1183	assert original.len == 311841185	report := run_home(dir, home, 'migrate')1186	assert report.code == 01187	assert report.out.contains('migrated 3 saves')1188	// The swap: `.koh` is a file, the old data is archived, nothing is staging.1189	assert os.is_file(os.join_path(dir, '.koh'))1190	assert os.is_dir(os.join_path(dir, '.koh-v2'))1191	assert os.is_file(os.join_path(dir, '.kohignore'))1192	assert !os.exists(os.join_path(dir, '.koh-migrate'))11931194	// Every save kept its original ID, and the new repo is sound.1195	listed := run_home(dir, home, 'view', '--json')1196	assert listed.code == 01197	for id in original {1198		assert listed.out.contains(id)1199	}1200	assert run_home(dir, home, 'doctor').code == 01201	assert run_home(dir, home, 'status').code == 012021203	// Migrating again has nothing to convert.1204	assert run_home(dir, home, 'migrate').code == 11205}12061207fn test_migrate_refuses_a_tree_that_does_not_match_the_last_save() {1208	koh2 := koh2_binary()1209	if koh2 == '' {1210		return1211	}1212	dir := temp_repo('migrate-dirty')1213	defer { os.rmdir_all(dir) or {} }1214	home := temp_repo('migrate-dirty-home')1215	defer { os.rmdir_all(home) or {} }1216	run_koh2(dir, '${q(koh2)} init')1217	write(dir, 'code.txt', 'x'.repeat(700))1218	run_koh2(dir, '${q(koh2)} save "only save"')1219	write(dir, 'code.txt', 'unsaved change\n')12201221	refused := run_home(dir, home, 'migrate')1222	assert refused.code == 11223	assert refused.err.contains('save with koh2 first')1224	// Nothing moved: still Koh 2, no archive, no staging file.1225	assert os.is_dir(os.join_path(dir, '.koh'))1226	assert !os.exists(os.join_path(dir, '.koh-v2'))1227	assert !os.exists(os.join_path(dir, '.koh-migrate'))1228}12291230// Koh 2 never saved a root `.kohconfig`, root `.kohignore.<remote>` rules or1231// `*.bundle` files, so a clean Koh 2 repo may hold them. Most real repos have1232// a `.kohconfig`; migrate must not call them unsaved work.1233fn test_migrate_passes_over_the_files_koh2_never_saved() {1234	koh2 := koh2_binary()1235	if koh2 == '' {1236		return1237	}1238	dir := temp_repo('migrate-koh2-ignores')1239	defer { os.rmdir_all(dir) or {} }1240	home := temp_repo('migrate-koh2-ignores-home')1241	defer { os.rmdir_all(home) or {} }1242	run_koh2(dir, '${q(koh2)} init')1243	write(dir, 'code.txt', 'x'.repeat(700))1244	run_koh2(dir, '${q(koh2)} save "only save"')1245	write(dir, '.kohconfig', 'stable_days = 14\n')1246	write(dir, '.kohignore.public', 'private/\n')1247	write(dir, 'lib/app.bundle', 'bundle\n')1248	write(dir, 'ios/Settings.bundle/Root.plist', 'settings\n')1249	// Koh 2 keeps saving a file under a folder pattern added later, where1250	// Koh 3 reads the same rule as covering the folder: the saved file is on1251	// disk and matches, so the tree is clean.1252	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')1253	run_koh2(dir, '${q(koh2)} save --agent test --session test "add the dsym"')1254	// Koh 2 skips *.bundle even when its rules no longer list it.1255	ignore_path := os.join_path(dir, '.koh', 'ignore')1256	rules := os.read_file(ignore_path)!.split_into_lines().filter(it != '*.bundle')1257	os.write_file(ignore_path, rules.join('\n') + '\nnative/*.dSYM\n')!1258	// A saved file the walk skips still has to match what was saved.1259	write(dir, 'native/t.dSYM/Info.plist', 'changed\n')1260	changed := run_home(dir, home, 'migrate')1261	assert changed.code == 11262	assert changed.err.contains('native/t.dSYM/Info.plist does not match')1263	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')1264	assert os.execute('cd ${q(dir)} && ${q(koh2)} status --json').output.contains('"dirty":false')12651266	migrated := run_home(dir, home, 'migrate')1267	assert migrated.code == 0, migrated.err1268	// They stay where they were, for the user to keep or delete.1269	assert os.read_file(os.join_path(dir, '.kohconfig'))! == 'stable_days = 14\n'1270}12711272struct FakeKepr {1273	no_access bool1274	// One reply the redemption must cope with: '500', 'garbage' or 'incomplete'.1275	fail string1276	// When set, /api/connect answers 307 here instead of a code reply.1277	redirect_to string1278mut:1279	objects map[string][]u81280	// What the client asked for. A map, because the server holds its own copy of this struct.1281	seen map[string]string1282}12831284fn (mut h FakeKepr) handle(req http.Request) http.Response {1285	if req.method == .post && req.url == '/api/connect' {1286		h.seen['code'] = req.data1287		if h.redirect_to != '' {1288			return http.Response{1289				status_code: 3071290				status_msg:  'Temporary Redirect'1291				header:      http.new_header(1292					key:   .location1293					value: h.redirect_to1294				)1295			}1296		}1297		if h.fail == '500' {1298			return http.Response{ status_code: 500, status_msg: 'Internal Server Error' }1299		}1300		if h.fail == 'garbage' {1301			return http.Response{ status_code: 200, status_msg: 'OK', body: 'not json at all' }1302		}1303		if h.fail == 'incomplete' {1304			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://x","bucket":"","region":"","access_key_id":"","secret_access_key":""}' }1305		}1306		if req.data == 'code=good' && !h.no_access {1307			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://${req.header.get_custom('Host', http.HeaderQueryConfig{}) or { '' }}","bucket":"bucket","region":"test","access_key_id":"access","secret_access_key":"secret"}' }1308		}1309		return http.Response{ status_code: 404, status_msg: 'Not Found', body: '{"error":"no_code","message":"no code"}' }1310	}1311	if req.method == .get && req.url.starts_with('/connect') {1312		h.seen['connect'] = req.url1313		return http.Response{ status_code: if h.no_access { 404 } else { 302 }, status_msg: 'Found' }1314	}1315	key := req.url1316	if key.starts_with('/bucket/') {1317		match req.method {1318			.put {1319				if req.header.get_custom('If-None-Match', http.HeaderQueryConfig{}) or { '' } == '*' && key in h.objects {1320					return http.Response{ status_code: 412, status_msg: 'Precondition Failed' }1321				}1322				h.objects[key] = req.data.bytes()1323				return http.Response{ status_code: 200, status_msg: 'OK' }1324			}1325			.get {1326				if body := h.objects[key] {1327					return http.Response{1328						status_code: 2001329						status_msg:  'OK'1330						body:        body.bytestr()1331						header:      http.new_header(1332							key:   .etag1333							value: '"tag"'1334						)1335					}1336				}1337				return http.Response{ status_code: 404, status_msg: 'Not Found' }1338			}1339			.delete {1340				h.objects.delete(key)1341				return http.Response{ status_code: 204, status_msg: 'No Content' }1342			}1343			else {}1344		}1345	}1346	return http.Response{ status_code: 404, status_msg: 'Not Found' }1347}13481349fn start_fake_kepr(no_access bool, fail string, redirect_to string) !(int, &http.Server, &FakeKepr) {1350	for port in 19401 .. 19411 {1351		listener := net.listen_tcp(.ip, '127.0.0.1:${port}') or { continue }1352		fake := &FakeKepr{1353			no_access:   no_access1354			fail:        fail1355			redirect_to: redirect_to1356			seen:        map[string]string{}1357		}1358		mut server := &http.Server{1359			listener:             listener1360			handler:              fake1361			show_startup_message: false1362		}1363		spawn server.listen_and_serve()1364		server.wait_till_running()!1365		return port, server, fake1366	}1367	return error('no free fake Kepr port')1368}13691370// A slash makes an argument an address, so half an address is an error and never a repo name.1371fn test_steal_refuses_an_address_that_is_not_one() {1372	outside := temp_repo('steal-address')1373	home := temp_repo('steal-address-home')1374	defer { os.rmdir_all(outside) or {} }1375	defer { os.rmdir_all(home) or {} }1376	for bad in ['kepr.uk/', '/shipped', 'kepr.uk/'] {1377		refused := run_home(outside, home, 'steal', bad)1378		assert refused.code == 1, bad1379		assert refused.err.contains('is not <host>/<repo>'), '${bad}: ${refused.err}'1380	}1381	assert run_home(outside, home, 'steal', 'one', 'two').code == 21382	assert run_home(outside, home, 'steal', '--list', 'extra').code == 21383}13841385fn test_remote_kepr_saves_and_refuses_without_changes() {1386	repo := temp_repo('kepr')1387	home := temp_repo('kepr-home')1388	defer { os.rmdir_all(repo) or {} }1389	defer { os.rmdir_all(home) or {} }1390	init_repo(repo)1391	port, mut server, fake := start_fake_kepr(false, '', '')!1392	defer { server.stop() }1393	host := 'http://127.0.0.1:${port}'1394	// A trailing slash is the same host, and the saved line keeps the normalised form.1395	good := run_home(repo, home, 'remote', '${host}/', '--code', 'good')1396	assert good.code == 0, good.err1397	remote_path := os.join_path(home, '.config', 'koh', 'remote')1398	credentials_path := os.join_path(home, '.config', 'koh', 'credentials')1399	assert os.read_file(remote_path)! == '# written by koh remote — the remote for every repo on this machine\nkind=s3\nendpoint=${host}\nbucket=bucket\nregion=test\nkepr=${host}\n'1400	assert os.read_file(credentials_path)! == '# written by koh remote — keep this file private\naccess_key=access\nsecret_key=secret\n'1401	// The code went as a form field, and the connect page was never asked for: there was a code.1402	assert (fake.seen['code'] or { '' }) == 'code=good'1403	assert (fake.seen['connect'] or { '' }) == ''1404	// A refused code, a missing terminal and a wrong reply all leave both files as they were.1405	before := os.read_file(remote_path)!1406	before_keys := os.read_file(credentials_path)!1407	bad := run_home(repo, home, 'remote', host, '--code', 'bad')1408	assert bad.code == 11409	assert bad.err.contains('wrong or has expired')1410	// The 404 could also mean a Kepr that hands out nothing, so the connect page is asked for1411	// with this machine's name. (This machine's name holds no character needing an escape, so1412	// that part of the query cannot be exercised here.)1413	// `machine.name()` is `os.hostname() or { 'unknown' }`, so the query carries the same text.1414	assert (fake.seen['connect'] or { '' }).contains('machine=${os.hostname() or { 'unknown' }}')1415	no_terminal := run_home(repo, home, 'remote', host)1416	assert no_terminal.code == 11417	assert no_terminal.err.contains('needs a terminal')1418	assert os.read_file(remote_path)! == before1419	assert os.read_file(credentials_path)! == before_keys1420}14211422fn test_remote_kepr_refuses_hosts_that_are_not_hosts() {1423	repo := temp_repo('kepr-host')1424	home := temp_repo('kepr-host-home')1425	defer { os.rmdir_all(repo) or {} }1426	defer { os.rmdir_all(home) or {} }1427	init_repo(repo)1428	for host in ['kepr.uk/foo', 'https://kepr.uk?x=1', 'kepr.uk#frag', '[email protected]', 'kepr uk',1429		'http://127.0.0.1:1/foo', 'https://'] {1430		refused := run_home(repo, home, 'remote', host, '--code', 'good')1431		assert refused.code == 1, host1432		assert refused.err.contains('is not a Kepr address'), '${host}: ${refused.err}'1433	}1434	// --code belongs to the host form alone.1435	assert run_home(repo, home, 'remote', 's3', 'https://x', 'b', 'r', '--code', 'good').code == 21436	assert run_home(repo, home, 'remote', 'folder', '/tmp', '--code', 'good').code == 21437	assert run_home(repo, home, 'remote', '--code', 'good').code == 21438	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1439}14401441fn test_remote_kepr_refuses_what_is_not_a_code_reply() {1442	repo := temp_repo('kepr-reply')1443	home := temp_repo('kepr-reply-home')1444	defer { os.rmdir_all(repo) or {} }1445	defer { os.rmdir_all(home) or {} }1446	init_repo(repo)1447	remote_path := os.join_path(home, '.config', 'koh', 'remote')1448	for mode in ['500', 'garbage', 'incomplete'] {1449		port, mut server, _ := start_fake_kepr(false, mode, '')!1450		refused := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')1451		server.stop()1452		assert refused.code == 1, mode1453		assert refused.err.contains('nothing was changed'), '${mode}: ${refused.err}'1454		assert !os.exists(remote_path)1455	}1456	// A redirect would hand the code to wherever it points, so it is refused and never followed.1457	target_port, mut target, target_fake := start_fake_kepr(false, '', '')!1458	port, mut server, _ := start_fake_kepr(false, '', 'http://127.0.0.1:${target_port}/api/connect')!1459	redirected := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')1460	server.stop()1461	target.stop()1462	assert redirected.code == 11463	assert redirected.err.contains('refused the code')1464	assert target_fake.seen.len == 0, 'the code was forwarded: ${target_fake.seen}'1465	assert !os.exists(remote_path)1466}14671468// An unreachable Kepr is a refusal too, and the settings are still untouched.1469fn test_remote_kepr_that_cannot_be_reached_changes_nothing() {1470	repo := temp_repo('kepr-down')1471	home := temp_repo('kepr-down-home')1472	defer { os.rmdir_all(repo) or {} }1473	defer { os.rmdir_all(home) or {} }1474	init_repo(repo)1475	refused := run_home(repo, home, 'remote', 'http://127.0.0.1:1', '--code', 'good')1476	assert refused.code == 11477	assert refused.err.contains('could not reach Kepr')1478	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1479}14801481fn test_remote_kepr_without_bucket_access_is_explained() {1482	repo := temp_repo('kepr-no-access')1483	home := temp_repo('kepr-no-access-home')1484	defer { os.rmdir_all(repo) or {} }1485	defer { os.rmdir_all(home) or {} }1486	init_repo(repo)1487	port, mut server, _ := start_fake_kepr(true, '', '')!1488	defer { server.stop() }1489	r := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'bad')1490	assert r.code == 11491	assert r.err.contains("doesn't hand out bucket access")1492	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))1493}