module tests

import os
import time

const root = @VMODROOT
const binary = os.join_path(root, 'build', 'koh3')

struct Result {
mut:
	code int
	out  string
	err  string
}

fn testsuite_begin() {
	os.mkdir_all(os.join_path(root, 'build')) or { panic(err) }
	build := os.execute('v -o ${q(binary)} ${q(os.join_path(root, 'src', 'koh3.v'))}')
	if build.exit_code != 0 {
		panic('could not build koh3: ${build.output}')
	}
}

fn q(s string) string {
	return "'${s.replace("'", "'\\''")}'"
}

fn temp_repo(name string) string {
	dir := os.join_path(os.temp_dir(), 'koh3-cli-${name}-${time.now().unix_nano()}')
	os.mkdir_all(dir) or { panic(err) }
	return dir
}

fn run(repo string, args ...string) Result {
	home := temp_repo('home')
	defer { os.rmdir_all(home) or {} }
	return run_home(repo, home, ...args)
}

fn run_home(repo string, home string, args ...string) Result {
	stamp := '${os.getpid()}-${time.now().unix_nano()}'
	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')
	out_path := '${base}.out'
	err_path := '${base}.err'
	code_path := '${base}.code'
	mut command := 'HOME=${q(home)} ${q(binary)}'
	for arg in args {
		command += ' ${q(arg)}'
	}
	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'
	result := os.execute(shell)
	if result.exit_code != 0 {
		panic('could not run test command: ${result.output}')
	}
	code := os.read_file(code_path) or { panic(err) }
	out := os.read_file(out_path) or { '' }
	err := os.read_file(err_path) or { '' }
	os.rm(out_path) or {}
	os.rm(err_path) or {}
	os.rm(code_path) or {}
	return Result{
		code: code.int()
		out:  out
		err:  err
	}
}

fn init_repo(repo string) {
	r := run(repo, 'init')
	assert r.code == 0
	assert os.exists(os.join_path(repo, '.koh'))
	assert os.exists(os.join_path(repo, '.kohignore'))
}

fn write(repo string, path string, text string) {
	full := os.join_path(repo, path)
	os.mkdir_all(os.dir(full)) or { panic(err) }
	os.write_file(full, text) or { panic(err) }
}

fn read_json_has(text string, key string) {
	if !text.contains(key) {
		panic('missing JSON key ${key}: ${text}')
	}
}

fn test_init_and_usage() {
	dir := temp_repo('init')
	defer { os.rmdir_all(dir) or {} }
	r := run(dir, 'init', '--json')
	assert r.code == 0
	read_json_has(r.out, 'repo')
	read_json_has(r.out, 'ignore_created')
	assert run(dir, 'init').code == 1
	assert run(dir, 'unknown-command').code == 2
	assert run(dir, 'unknown-command').err.contains('unknown command')
	// An agent asking for JSON gets JSON for a usage mistake too, exit 2.
	for args in [['unknown-command', '--json'], ['save', '--json'], ['save', 'x', '--nope', '--json']] {
		r2 := run(dir, ...args)
		assert r2.code == 2
		assert r2.out == ''
		assert r2.err.starts_with('{"error":'), r2.err
	}
}

// The binary embeds VERSION while saves bump v.mod; they drifted once.
fn test_version_matches_the_manifest() {
	dir := temp_repo('version')
	defer { os.rmdir_all(dir) or {} }
	version := run(dir, '--version').out.trim_space().all_after('koh ')
	manifest := os.read_file(os.join_path(root, 'v.mod')) or { panic(err) }
	assert manifest.contains("version: '${version}'"), version
}

fn test_save_checkpoint_and_status() {
	dir := temp_repo('save')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'tracked.txt', 'one\n')
	r := run(dir, 'save', 'first message', '--agent', 'agent-7', '--session', 'session-a', '--json')
	assert r.code == 0
	for key in ['id', 'parent', 'message', 'created_at', 'machine', 'is_checkpoint', 'agent', 'session',
		'files', 'size_bytes'] {
		read_json_has(r.out, key)
	}
	assert r.out.contains('"message":"first message"')
	assert r.out.contains('"agent":"agent-7"')
	assert r.out.contains('"session":"session-a"')
	assert r.out.contains('"is_checkpoint":false')
	assert run(dir, 'save', 'again').code == 1
	assert run(dir, 'save', 'again').err.contains('nothing has changed since the last save')
	assert run(dir, 'save').code == 2
	assert run(dir, 'save', 'x', '--bogus').code == 2
	cp := run(dir, 'checkpoint', 'still first', '--json')
	assert cp.code == 0
	assert cp.out.contains('"is_checkpoint":true')
	assert cp.out.contains('"parent":')
	clean := run(dir, 'status')
	assert clean.code == 0
	assert clean.out.contains('no changes')
	write(dir, 'tracked.txt', 'two\n')
	write(dir, 'new.txt', 'new\n')
	os.rm(os.join_path(dir, 'tracked.txt')) or { panic(err) }
	write(dir, '.kohignore', '*.log\n')
	status := run(dir, 'status')
	assert status.code == 0
	assert status.out.contains('+')
	assert status.out.contains('~') || status.out.contains('-')
	assert status.out.contains('added')
	js := run(dir, 'status', '--json')
	assert js.code == 0
	for key in ['head_id', 'head_msg', 'dirty', 'modified', 'added', 'deleted', 'ignore_changed',
		'saves', 'size_bytes', 'head_flagged'] {
		read_json_has(js.out, key)
	}
	assert js.out.contains('"ignore_changed":true')
	// What the shell prompt shows: saves on the line, the .koh size, the flag.
	assert js.out.contains('"saves":2')
	assert js.out.contains('"size_bytes":${os.file_size(os.join_path(dir, '.koh'))}')
	assert js.out.contains('"head_flagged":false')
	head := js.out.all_after('"head_id":"').all_before('"')
	assert run(dir, 'flag', head, '--reason', 'bad').code == 0
	assert run(dir, 'status', '--json').out.contains('"head_flagged":true')
}

fn test_status_requires_repo_and_ignore_rules() {
	dir := temp_repo('status')
	defer { os.rmdir_all(dir) or {} }
	assert run(dir, 'status').code == 1
	init_repo(dir)
	write(dir, '.kohignore', '*.log\nbuild/\n')
	write(dir, 'keep.txt', 'keep\n')
	write(dir, 'ignored.log', 'ignore\n')
	write(dir, 'build/output.txt', 'ignore\n')
	assert run(dir, 'save', 'keep').code == 0
	assert run(dir, 'status').out.contains('no changes')
	assert !run(dir, 'status').out.contains('ignored.log')
	assert !run(dir, 'status').out.contains('build/output.txt')
	assert !run(dir, 'status').out.contains('LOG.md')
}

// LOG.md is a convenience written after the save commits. If it cannot be
// written, the save still happened, and an agent that retried on a failure
// would only be told nothing had changed.
fn test_a_save_succeeds_when_log_md_cannot_be_written() {
	dir := temp_repo('logmd')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	os.mkdir_all(os.join_path(dir, 'LOG.md')) or { panic(err) }
	write(dir, 'a.txt', 'one\n')
	r := run(dir, 'save', 'first', '--json')
	assert r.code == 0
	assert r.out.starts_with('{')
	assert r.err.contains('LOG.md')
	assert run(dir, 'log', '--json').out.contains('"message":"first"')
}

// A folder of ignored files can sit where a restored file should go. Koh
// never touches ignored files, so the restore must stop and say so, not drop
// the file inside the folder under a temporary name.
fn test_a_restore_refuses_a_folder_of_ignored_files_in_the_way() {
	dir := temp_repo('dir-in-way')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'out', 'a file\n')
	first := run(dir, 'save', 'out is a file', '--json').out.all_after('"id":"')[..12]
	os.rm(os.join_path(dir, 'out')) or { panic(err) }
	write(dir, 'out/build.log', 'ignored\n')
	assert run(dir, 'save', 'out is gone').code == 0
	r := run(dir, 'load', first, '--yes')
	assert r.code == 1
	assert r.err.contains('out')
	assert os.ls(os.join_path(dir, 'out'))! == ['build.log']
}

// Koh never follows a symlink, so a folder replaced by a link to somewhere
// else is not the repo's to write into: restoring through it would overwrite
// files outside the repo. The refusal comes before anything is recorded.
fn test_a_restore_never_writes_through_a_symlinked_folder() {
	dir := temp_repo('link-in-way')
	outside := temp_repo('link-target')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(outside) or {}
	}
	init_repo(dir)
	write(dir, 'docs/a.md', 'saved\n')
	first := run(dir, 'save', 'docs', '--json').out.all_after('"id":"')[..12]
	os.rmdir_all(os.join_path(dir, 'docs')) or { panic(err) }
	write(outside, 'a.md', 'precious\n')
	os.symlink(outside, os.join_path(dir, 'docs')) or { panic(err) }
	assert run(dir, 'save', 'docs is a link now').code == 0
	head := run(dir, 'status', '--json').out
	r := run(dir, 'load', first, '--yes')
	assert r.code == 1
	assert r.err.contains('docs')
	assert os.read_file(os.join_path(outside, 'a.md'))! == 'precious\n'
	assert run(dir, 'status', '--json').out == head
}

// A restore records its save first, then writes files. When the writing stops
// part way, the half-written tree is not somebody's work: saving it would
// record (and offer) a tree that undoes changes nobody asked to undo. Every
// command that would build on it points at revert, which finishes the job.
fn test_a_restore_cut_short_points_at_revert() {
	dir := temp_repo('cut-short')
	defer {
		os.chmod(os.join_path(dir, 'zz'), 0o755) or {}
		os.rmdir_all(dir) or {}
	}
	init_repo(dir)
	write(dir, 'zero', '0\n')
	assert run(dir, 'save', 'zero').code == 0
	write(dir, 'a.txt', 'v1\n')
	write(dir, 'zz/f', 'v1\n')
	assert run(dir, 'save', 'first').code == 0
	write(dir, 'a.txt', 'v2\n')
	write(dir, 'zz/f', 'v2\n')
	assert run(dir, 'save', 'second').code == 0
	// a.txt is written, then the read-only folder stops the restore: the
	// tree is genuinely half one save and half the other.
	os.chmod(os.join_path(dir, 'zz'), 0o555)!
	stopped := run(dir, 'undo', '--yes')
	assert stopped.code == 1
	assert stopped.err.contains('koh revert')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'
	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v2\n'
	// Even a status that cannot read the tree says what happened.
	os.chmod(os.join_path(dir, 'zz'), 0o000)!
	assert run(dir, 'status').err.contains('koh revert')
	os.chmod(os.join_path(dir, 'zz'), 0o755)!

	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":true')
	for args in [['save', 'half'], ['checkpoint', 'half'], ['undo', '--yes']] {
		r := run(dir, ...args)
		assert r.code == 1
		assert r.err.contains('koh revert')
	}
	assert run(dir, 'revert', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'
	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v1\n'
	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":false')
	write(dir, 'a.txt', 'v3\n')
	assert run(dir, 'save', 'carry on').code == 0
}

// Doctor clears peek folders left from earlier days, never one somebody may
// be reading right now.
fn test_doctor_sweeps_only_old_peek_folders() {
	dir := temp_repo('peek-sweep')
	// V's temp_dir is /tmp on macOS whatever TMPDIR says, so these live in
	// the real temp directory under names no save could have.
	fresh := os.join_path(os.temp_dir(), 'koh-peek-fresh${os.getpid()}')
	old := os.join_path(os.temp_dir(), 'koh-peek-old${os.getpid()}')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(fresh) or {}
		os.rmdir_all(old) or {}
	}
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	assert run(dir, 'save', 'one').code == 0
	os.mkdir_all(fresh) or { panic(err) }
	os.mkdir_all(old) or { panic(err) }
	two_days_ago := time.now().unix() - 2 * 86400
	os.utime(old, two_days_ago, two_days_ago) or { panic(err) }
	assert run(dir, 'doctor', '--json').code == 0
	assert os.exists(fresh)
	assert !os.exists(old)
}

// A file saved long ago and ignored since holds work no save has. Loading the
// old save must not write over it; the document says a restore never touches
// ignored files.
fn test_a_restore_never_overwrites_an_ignored_file() {
	dir := temp_repo('ignored-restore')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, '.env', 'KEY=saved long ago\n')
	first := run(dir, 'save', 'with env', '--json').out.all_after('"id":"')[..12]
	write(dir, '.kohignore', '.env\n')
	assert run(dir, 'save', 'ignore env').code == 0
	write(dir, '.env', 'KEY=never saved\n')
	assert run(dir, 'load', first, '--yes').code == 0
	assert os.read_file(os.join_path(dir, '.env'))! == 'KEY=never saved\n'

	// Where the ignored file is missing, the restore still brings it back.
	other := temp_repo('ignored-restore-missing')
	defer { os.rmdir_all(other) or {} }
	init_repo(other)
	write(other, '.env', 'KEY=saved long ago\n')
	again := run(other, 'save', 'with env', '--json').out.all_after('"id":"')[..12]
	write(other, '.kohignore', '.env\n')
	assert run(other, 'save', 'ignore env').code == 0
	os.rm(os.join_path(other, '.env')) or { panic(err) }
	assert run(other, 'load', again, '--yes').code == 0
	assert os.read_file(os.join_path(other, '.env'))! == 'KEY=saved long ago\n'
}

// A going-back preview lists paths only. Running diff(1) per file to draw it
// cost 27 s for 5,000 changed files, so it must not run diff at all.
fn test_a_going_back_preview_does_not_run_diff() {
	dir := temp_repo('preview-nodiff')
	home := temp_repo('preview-nodiff-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	assert run_home(dir, home, 'save', 'one').code == 0
	write(dir, 'a.txt', 'two\n')
	assert run_home(dir, home, 'save', 'two').code == 0
	fake := os.join_path(home, 'bin')
	os.mkdir_all(fake) or { panic(err) }
	marker := os.join_path(home, 'diff-ran')
	os.write_file(os.join_path(fake, 'diff'), '#!/bin/sh\ntouch ${q(marker)}\nexit 2\n') or {
		panic(err)
	}
	os.chmod(os.join_path(fake, 'diff'), 0o755) or { panic(err) }
	assert run_home_with_path(dir, home, fake, 'undo', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert !os.exists(marker)
}

// A restore rewrites only what differs. Rewriting every file resets every
// mtime, so the next status has to hash the whole tree again.
fn test_a_restore_leaves_unchanged_files_alone() {
	dir := temp_repo('restore-skip')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	write(dir, 'same.txt', 'never changes\n')
	assert run(dir, 'save', 'one').code == 0
	write(dir, 'a.txt', 'two\n')
	assert run(dir, 'save', 'two').code == 0
	long_ago := i64(1700000000)
	os.utime(os.join_path(dir, 'same.txt'), long_ago, long_ago) or { panic(err) }
	assert run(dir, 'undo', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert os.file_last_mod_unix(os.join_path(dir, 'same.txt')) == long_ago
}

// `save` records the executable bit, so `status` has to see it too, or a
// chmod would be invisible until it turned up in a save.
fn test_status_sees_an_executable_bit_change() {
	dir := temp_repo('chmod')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'run.sh', 'echo hi\n')
	assert run(dir, 'save', 'script').code == 0
	os.chmod(os.join_path(dir, 'run.sh'), 0o755) or { panic(err) }
	status := run(dir, 'status', '--json')
	assert status.out.contains('"dirty":true')
	assert status.out.contains('"modified":["run.sh"]')
}

fn test_log_and_diff() {
	dir := temp_repo('history')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	first := run(dir, 'save', 'one', '--session', 'alpha', '--json')
	id1 := first.out.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	second := run(dir, 'save', 'two', '--session', 'beta', '--json')
	id2 := second.out.all_after('"id":"')[..12]
	cp := run(dir, 'checkpoint', 'checkpoint', '--json')
	assert cp.code == 0
	log := run(dir, 'log')
	assert log.code == 0
	assert log.out.contains('▸')
	assert log.out.contains('◐')
	lj := run(dir, 'log', '--json')
	assert lj.code == 0
	assert lj.out.contains('"head_id"')
	assert lj.out.contains('"saves"')
	assert run(dir, 'log', '--since', 'today').out.contains('two')
	session := run(dir, 'log', '--session', 'alpha')
	assert session.out.contains('one')
	assert !session.out.contains('two')
	write(dir, 'a.txt', 'three\n')
	d := run(dir, 'diff')
	assert d.code == 0
	assert d.out.contains('--- a/')
	assert d.out.contains('+++ b/')
	assert run(dir, 'diff', id1).code == 0
	assert run(dir, 'diff', id1, id2).code == 0
	dj := run(dir, 'diff', '--json')
	assert dj.code == 0
	assert dj.out.contains('"from"')
	assert dj.out.contains('"to"')
	assert dj.out.contains('"files"')
	assert dj.out.contains('"change":"modified"')
	assert run(dir, 'diff', 'not-a-real-id').code == 1
	assert run(dir, 'diff', id1, id2, 'third').code == 1
	write(dir, 'blob.bin', '\x00\x01\x02')
	diff_binary := run(dir, 'diff', '--json')
	assert diff_binary.out.contains('"binary":true')
	assert diff_binary.out.contains('Binary files differ')
}

fn test_undo_revert_and_load() {
	dir := temp_repo('restore')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	one := run(dir, 'save', 'one', '--json').out
	id1 := one.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	write(dir, 'gone.txt', 'gone\n')
	second := run(dir, 'save', 'two', '--json').out
	id2 := second.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'three\n')
	third := run(dir, 'save', 'three', '--json').out
	id3 := third.all_after('"id":"')[..12]
	// Unsaved work — here a file never saved — blocks every going-back but
	// revert, as in Koh 2: a restore must never overwrite what only the disk has.
	write(dir, 'never.txt', 'keep me\n')
	log_before := run(dir, 'log').out
	for args in [['undo', '--yes'], ['load', id1, '--yes'], ['pluck', id2, '--yes']] {
		blocked := run(dir, ...args)
		assert blocked.code == 1
		assert blocked.err.contains('unsaved changes')
	}
	assert run(dir, 'log').out == log_before
	os.rm(os.join_path(dir, 'never.txt')) or { panic(err) }
	write(dir, 'a.txt', 'edited, never saved\n')
	assert run(dir, 'undo', '--yes').err.contains('unsaved changes')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'edited, never saved\n'
	write(dir, 'a.txt', 'three\n')
	os.rm(os.join_path(dir, 'gone.txt')) or { panic(err) }
	assert run(dir, 'load', id1, '--yes').err.contains('unsaved changes')
	write(dir, 'gone.txt', 'gone\n')
	undo := run(dir, 'undo', '--yes', '--json')
	assert undo.code == 0
	if !undo.out.contains(id2) {
		panic('undo JSON did not name ${id2}: ${undo.out}')
	}
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert os.exists(os.join_path(dir, 'gone.txt'))
	assert run(dir, 'load', id3, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'three\n'
	assert run(dir, 'undo', '2', '--yes').code == 0
	assert run(dir, 'load', id2, '--yes').code == 0
	assert run(dir, 'undo', '99', '--yes').err.contains('nothing before')
	write(dir, 'a.txt', 'dirty\n')
	before := run(dir, 'log')
	refuse := run(dir, 'revert')
	assert refuse.code == 1
	assert refuse.err.contains('needs --yes when not interactive')
	assert run(dir, 'log').out == before.out
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'
	write(dir, 'untracked.txt', 'remove\n')
	rv := run(dir, 'revert', '--yes', '--json')
	assert rv.code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert !os.exists(os.join_path(dir, 'untracked.txt'))
	// The way back to the discarded work is named, not left to be found.
	kept := rv.out.all_after('"checkpoint":"')[..12]
	assert run(dir, 'load', kept, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'
	assert os.read_file(os.join_path(dir, 'untracked.txt'))! == 'remove\n'
	write(dir, 'a.txt', 'dirty again\n')
	assert run(dir, 'revert', '--yes').out.contains('koh load ')
	assert run(dir, 'revert', '--yes').out.contains('working tree already matches')
	assert run(dir, 'load', '--checkpoint', '--yes').code == 0
	assert run(dir, 'load', id2, '--json').code == 1
	assert run(dir, 'load', id2, '--json').err.contains('error')
	assert run(dir, 'load').code == 2
	assert run(dir, 'load', 'unknown-id', '--yes').code == 1
}

fn test_flag_and_flagged_log() {
	dir := temp_repo('flag')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'flag.txt', 'one\n')
	saved := run(dir, 'save', 'flag me', '--json')
	id := saved.out.all_after('"id":"')[..12]
	flagged := run(dir, 'flag', id, '--reason', 'unsafe', '--json')
	assert flagged.code == 0
	assert flagged.out.contains('"flagged":true')
	assert flagged.out.contains('"reason":"unsafe"')
	list := run(dir, 'flag', '--json')
	assert list.code == 0
	assert list.out.contains(id)
	assert list.out.contains('unsafe')
	assert run(dir, 'log').out.contains('⚑')
	assert run(dir, 'flag', '--clear', id).code == 0
	assert run(dir, 'flag').out.contains('nothing is flagged')
	assert run(dir, 'flag', 'unknown-id').code == 1
	assert run(dir, 'flag').code == 0
}

fn test_pluck_forward_reverse_dry_run_and_conflict() {
	dir := temp_repo('pluck')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	first := run(dir, 'save', 'one', '--json').out
	id1 := first.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	second := run(dir, 'save', 'two', '--json').out
	id2 := second.all_after('"id":"')[..12]
	assert run(dir, 'load', id1, '--yes').code == 0
	dry := run(dir, 'pluck', id2, '--dry-run')
	assert dry.code == 0
	assert dry.out.contains('a.txt')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert run(dir, 'pluck', id2, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert run(dir, 'pluck', '--reverse', id2, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	write(dir, 'a.txt', 'different\n')
	assert run(dir, 'pluck', id2, '--dry-run').code == 1
	assert run(dir, 'save', 'different').code == 0
	conflict := run(dir, 'pluck', id2, '--yes')
	assert conflict.code == 1
	assert conflict.err.contains('a.txt')
	assert run(dir, 'pluck').code == 2
	assert run(dir, 'pluck', 'unknown-id').code == 1
}

fn test_peek_and_doctor() {
	dir := temp_repo('peek-doctor')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'peek.txt', 'peek me\n')
	assert run(dir, 'save', 'peekable').code == 0
	id := run(dir, 'log', '--json').out.all_after('"id":"')[..12]
	before_log := run(dir, 'log', '--json').out
	peek := run(dir, 'peek', id, '--json')
	assert peek.code == 0
	peek_path := peek.out.all_after('"path":"').before('"')
	assert peek.out.contains('"id":"${id}"')
	assert os.read_file(os.join_path(peek_path, 'peek.txt'))! == 'peek me\n'
	assert run(dir, 'status').out.contains('no changes')
	assert run(dir, 'log', '--json').out == before_log
	assert run(dir, 'peek').code == 2
	assert run(dir, 'peek', 'unknown-id').code == 1
	backup := os.join_path(dir, 'doctor.backup')
	healthy := run(dir, 'doctor')
	assert healthy.code == 0
	assert healthy.out.contains('is sound')
	report := run(dir, 'doctor', '--json')
	assert report.code == 0
	for key in ['problems', 'objects', 'saves', 'checkpoints', 'cached_files', 'peek_folders_removed',
		'backup'] {
		read_json_has(report.out, key)
	}
	backed := run(dir, 'doctor', '--backup', backup)
	assert backed.code == 0
	assert os.exists(backup)
	assert backed.out.contains(backup)
	assert run(dir, 'doctor', '--backup', backup).code == 1
	assert run(dir, 'peek', id, '--json').code == 0
	// A peek made today is left for whoever is reading it.
	kept := run(dir, 'doctor', '--json')
	assert kept.code == 0
	assert os.exists(peek_path)
	os.rmdir_all(peek_path) or {}
}

fn test_strip_refuses_without_terminal() {
	dir := temp_repo('strip')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'secret.txt', 'keep\n')
	assert run(dir, 'save', 'secret').code == 0
	before_log := run(dir, 'log', '--json').out
	refused := run(dir, 'strip', 'secret.txt')
	assert refused.code == 1
	assert refused.err.contains('needs a terminal')
	assert run(dir, 'log', '--json').out == before_log
	assert os.read_file(os.join_path(dir, 'secret.txt'))! == 'keep\n'
	assert run(dir, 'log', '--json').out.contains('secret')
}

fn test_saves_and_checkpoints_aliases() {
	dir := temp_repo('aliases')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'alias.txt', 'one\n')
	assert run(dir, 'save', 'plain save').code == 0
	assert run(dir, 'checkpoint', 'checkpoint save').code == 0
	saves := run(dir, 'saves')
	assert saves.code == 0
	assert saves.out.contains('plain save')
	assert saves.out.contains('checkpoint save')
	checkpoints := run(dir, 'checkpoints')
	assert checkpoints.code == 0
	assert checkpoints.out.contains('checkpoint save')
	assert !checkpoints.out.contains('plain save')
	json_result := run(dir, 'checkpoints', '--json')
	assert json_result.code == 0
	assert json_result.out.contains('"head_id"')
	assert json_result.out.contains('"saves"')
	assert json_result.out.contains('"is_checkpoint":true')
	assert !json_result.out.contains('"is_checkpoint":false')
}

fn test_remote_configuration_is_isolated_and_atomic() {
	dir := temp_repo('remote')
	home := temp_repo('remote-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	empty := run_home(dir, home, 'remote', '--json')
	assert empty.code == 0
	assert empty.out.contains('"configured":false')
	target := os.join_path(home, 'remote-store')
	set := run_home(dir, home, 'remote', 'folder', target)
	assert set.code == 0
	assert os.is_dir(target)
	state := run_home(dir, home, 'remote', '--json')
	assert state.code == 0
	assert state.out.contains('"kind":"folder"')
	assert state.out.contains(target)
	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').code == 1
	assert run_home(dir, home, 'remote', '--json').out.contains(target)
	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').err.contains('KOH_ACCESS_KEY')
	assert run_home(dir, home, 'remote', '--forget').code == 0
	assert run_home(dir, home, 'remote', '--json').out.contains('"configured":false')
}

// The files under ~/.config/koh can be written by hand instead of by
// `koh remote`, and are then read the same way.
fn test_remote_written_by_hand() {
	dir := temp_repo('remote-by-hand')
	home := temp_repo('remote-by-hand-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	config := os.join_path(home, '.config', 'koh')
	os.mkdir_all(config) or { panic(err) }
	target := os.join_path(home, 'remote-store')
	os.mkdir_all(target) or { panic(err) }
	os.write_file(os.join_path(config, 'remote'), 'kind = folder\npath = ${target}\n') or {
		panic(err)
	}
	assert run_home(dir, home, 'init').code == 0
	os.write_file(os.join_path(dir, 'a.txt'), 'a\n') or { panic(err) }
	assert run_home(dir, home, 'save', 'first').code == 0
	offered := run_home(dir, home, 'offer', '--json')
	assert offered.code == 0
	assert offered.out.contains('"head"')

	// Keys anyone else can read are refused before they are ever sent.
	os.write_file(os.join_path(config, 'remote'), 'kind=s3\nendpoint=http://127.0.0.1:1\nbucket=b\nregion=r\n') or {
		panic(err)
	}
	credentials := os.join_path(config, 'credentials')
	os.write_file(credentials, 'access_key=AK\nsecret_key=SK\n') or { panic(err) }
	os.chmod(credentials, 0o644) or { panic(err) }
	loose := run_home(dir, home, 'offer')
	assert loose.code == 1
	assert loose.err.contains('chmod 600')

	// A setting koh cannot read is replaced by setting the remote again.
	os.write_file(os.join_path(config, 'remote'), 'kind=ftp\n') or { panic(err) }
	unreadable := run_home(dir, home, 'offer')
	assert unreadable.code == 1
	assert unreadable.err.contains('not readable')
	assert run_home(dir, home, 'remote', 'folder', target).code == 0
	assert run_home(dir, home, 'offer').code == 0
}

// A clone belongs to the repo it was stolen from, whatever its folder is
// called later: renaming it must not start a second repo on the remote.
fn test_a_renamed_clone_keeps_offering_to_its_repo() {
	syncroot := temp_repo('rename-clone')
	home := temp_repo('rename-clone-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	assert run_home(b_parent, home, 'steal', 'proj').code == 0
	renamed := os.join_path(b_parent, 'renamed')
	os.mv(os.join_path(b_parent, 'proj'), renamed) or { panic(err) }
	write(renamed, 'b.txt', 'from B\n')
	assert run_home(renamed, home, 'save', 'B first').code == 0
	assert !os.exists(os.join_path(remote, 'renamed'))
	assert run_home(a, home, 'steal').code == 0
	assert os.read_file(os.join_path(a, 'b.txt'))! == 'from B\n'
}

// A damaged object on the remote stops a clone, names the object, and leaves
// no half-made folder that would make the retry refuse.
fn test_clone_of_a_damaged_remote_leaves_nothing() {
	syncroot := temp_repo('damaged')
	home := temp_repo('damaged-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	objects := os.join_path(remote, 'proj', 'objects')
	for name in os.ls(objects) or { panic(err) } {
		os.chmod(os.join_path(objects, name), 0o644) or {}
		os.write_file(os.join_path(objects, name), 'junk') or { panic(err) }
	}
	clone := run_home(b_parent, home, 'steal', 'proj')
	assert clone.code == 1
	assert clone.err.contains('is damaged')
	assert !os.exists(os.join_path(b_parent, 'proj'))
}

fn test_offer_steal_folder_remote() {
	syncroot := temp_repo('sync')
	home := temp_repo('sync-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	clone := run_home(b_parent, home, 'steal', 'proj')
	assert clone.code == 0
	b := os.join_path(b_parent, 'proj')
	assert os.read_file(os.join_path(b, 'a.txt'))! == 'from A\n'
	write(b, 'b.txt', 'from B\n')
	assert run_home(b, home, 'save', 'B first').code == 0
	write(a, 'a2.txt', 'second\n')
	assert run_home(a, home, 'save', 'A second').code == 0
	assert run_home(a, home, 'steal').code == 0
	assert os.exists(os.join_path(a, 'b.txt'))
	assert run_home(b_parent, home, 'steal', '--list').out.contains('proj')
	write(a, 'clash.txt', 'base\n')
	assert run_home(a, home, 'save', 'clash base').code == 0
	assert run_home(b, home, 'steal').code == 0
	write(a, 'clash.txt', 'A version\n')
	assert run_home(a, home, 'save', 'A clash').code == 0
	write(b, 'clash.txt', 'B version\n')
	assert run_home(b, home, 'save', 'B clash').code == 0
	refused := run_home(b, home, 'steal')
	assert refused.code == 1
	assert refused.err.contains('--mine') || refused.err.contains('--theirs')
	b_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]
	theirs := run_home(b, home, 'steal', '--theirs', '--json')
	assert theirs.code == 0
	// The pre-combine tree is off the line now; the way back must be named,
	// or an agent without the history view cannot find it.
	assert theirs.out.contains('"previous_head":"${b_head}"')
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'
	assert run_home(b, home, 'load', b_head, '--yes').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B version\n'
	assert run_home(b, home, 'load', theirs.out.all_after('"head":"')[..12], '--yes').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'
	write(a, 'clash.txt', 'A second\n')
	assert run_home(a, home, 'save', 'A second clash').code == 0
	write(b, 'clash.txt', 'B second\n')
	assert run_home(b, home, 'save', 'B second clash').code == 0
	assert run_home(b, home, 'steal', '--mine').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B second\n'
	assert run_home(b, home, 'log').out.contains('combine: kept mine for')
}

// A clone brings in the whole history, flags included; both output forms must
// say which saves came in flagged, and why.
fn test_a_clone_reports_flagged_saves() {
	syncroot := temp_repo('clone-flags')
	home := temp_repo('clone-flags-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	a := os.join_path(syncroot, 'A', 'proj')
	os.mkdir_all(a) or { panic(err) }
	init_repo(a)
	assert run_home(a, home, 'remote', 'folder', os.join_path(syncroot, 'remote')).code == 0
	write(a, 'a.txt', 'one\n')
	id := run_home(a, home, 'save', 'risky', '--json').out.all_after('"id":"')[..12]
	assert run_home(a, home, 'flag', id, '--reason', 'broke the build').code == 0
	assert run_home(a, home, 'offer').code == 0
	for name in ['B', 'C'] {
		os.mkdir_all(os.join_path(syncroot, name)) or { panic(err) }
	}
	json_clone := run_home(os.join_path(syncroot, 'B'), home, 'steal', 'proj', '--json')
	assert json_clone.code == 0
	assert json_clone.out.contains('"flagged":["${id}"]')
	text_clone := run_home(os.join_path(syncroot, 'C'), home, 'steal', 'proj')
	assert text_clone.code == 0
	assert text_clone.out.contains('[${id}] came in flagged — broke the build')
}

// A folder remote on a disk or share that is not mounted is simply not there.
// Creating it would put the saves in a stand-in folder the other machine never
// sees; the offer must say what is wrong instead.
fn test_an_unmounted_folder_remote_is_not_recreated() {
	syncroot := temp_repo('unmounted')
	home := temp_repo('unmounted-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	mount := os.join_path(syncroot, 'nas')
	remote := os.join_path(mount, 'koh')
	a := os.join_path(syncroot, 'proj')
	os.mkdir_all(a) or { panic(err) }
	init_repo(a)
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	write(a, 'a.txt', 'one\n')
	assert run_home(a, home, 'save', 'first').code == 0
	os.rename(mount, os.join_path(syncroot, 'nas-unplugged')) or { panic(err) }
	os.mkdir(mount) or { panic(err) }
	offered := run_home(a, home, 'offer')
	assert offered.code == 1
	assert offered.err.contains('mounted')
	assert !os.exists(remote)
	write(a, 'a.txt', 'two\n')
	saved := run_home(a, home, 'save', 'second')
	assert saved.code == 0
	assert saved.out.contains('mounted')
	assert !os.exists(remote)
}

fn test_man_and_koh2_handoff() {
	dir := temp_repo('man')
	home := temp_repo('man-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	whole := run_home(dir, home, 'man')
	assert whole.code == 0
	assert whole.out.contains('NAME')
	assert whole.out.contains('COMMANDS')
	assert !whole.out.contains('\x1b') && !whole.out.contains('◆')
	strip := run_home(dir, home, 'man', 'strip')
	assert strip.code == 0
	assert strip.out.contains('strip')
	assert !strip.out.contains('koh save ')
	steal := run_home(dir, home, 'man', 'steal').out
	assert steal.starts_with('    koh steal') && steal.contains('koh steal my-project')
	assert run_home(dir, home, 'man', 'init').out.trim_space() == "koh init\n        Create `.koh` here, and a starter `.kohignore` if there isn't one."
	assert run_home(dir, home, 'man', 'nonsense').code == 2
	legacy := temp_repo('legacy')
	defer { os.rmdir_all(legacy) or {} }
	os.mkdir_all(os.join_path(legacy, '.koh')) or { panic(err) }
	fake := os.join_path(home, 'bin')
	os.mkdir_all(fake) or { panic(err) }
	fake_koh := os.join_path(fake, 'koh2')
	os.write_file(fake_koh, '#!/bin/sh\nprintf "handoff:%s\\n" "$*"\nexit 7\n') or { panic(err) }
	os.chmod(fake_koh, 0o755) or { panic(err) }
	handoff := run_home_with_path(legacy, home, fake, 'status', '--json')
	assert handoff.code == 7
	assert handoff.out.contains('handoff:status --json')
	// One notice line, on stderr, so koh2's own output stays as it was.
	assert handoff.err.contains('Koh 2 repo')
	assert handoff.err.trim_space().split_into_lines().len == 1
	assert handoff.out.trim_space() == 'handoff:status --json'
}

fn run_home_with_path(repo string, home string, bin_dir string, args ...string) Result {
	stamp := '${os.getpid()}-${time.now().unix_nano()}'
	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')
	out_path := '${base}.out'
	err_path := '${base}.err'
	code_path := '${base}.code'
	mut command := 'HOME=${q(home)} PATH=${q(bin_dir + ':' + os.getenv('PATH'))} ${q(binary)}'
	for arg in args {
		command += ' ${q(arg)}'
	}
	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'
	result := os.execute(shell)
	if result.exit_code != 0 {
		panic('could not run test command: ${result.output}')
	}
	code := os.read_file(code_path) or { panic(err) }
	out := os.read_file(out_path) or { '' }
	err := os.read_file(err_path) or { '' }
	os.rm(out_path) or {}
	os.rm(err_path) or {}
	os.rm(code_path) or {}
	return Result{
		code: code.int()
		out:  out
		err:  err
	}
}

// --- migration -------------------------------------------------------------

fn koh2_binary() string {
	return os.find_abs_path_of_executable('koh') or { '' }
}

// run_koh2 runs the Koh 2 binary in a fixture; its own output is not under
// test here.
fn run_koh2(dir string, command string) {
	os.execute('cd ${q(dir)} && ${command} >/dev/null 2>&1')
}

fn save_ids(dir string) []string {
	mut ids := []string{}
	for name in os.ls(os.join_path(dir, '.koh', 'snapshots')) or { []string{} } {
		if name.ends_with('.json') {
			ids << name.trim_right('.json')
		}
	}
	ids.sort()
	return ids
}

fn test_migrate_converts_a_koh2_repo_and_keeps_every_save() {
	koh2 := koh2_binary()
	if koh2 == '' {
		println('skipping the migration tests: koh (Koh 2) is not on PATH')
		return
	}
	dir := temp_repo('migrate')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	// One file large enough to be an object, one small enough to be inlined.
	write(dir, 'code.txt', 'x'.repeat(700))
	write(dir, 'tiny.txt', 'tiny\n')
	run_koh2(dir, '${q(koh2)} save "first save"')
	run_koh2(dir, '${q(koh2)} checkpoint "before something"')
	write(dir, 'code.txt', 'y'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "second save"')
	original := save_ids(dir)
	assert original.len == 3

	report := run_home(dir, home, 'migrate')
	assert report.code == 0
	assert report.out.contains('migrated 3 saves')
	// The swap: `.koh` is a file, the old data is archived, nothing is staging.
	assert os.is_file(os.join_path(dir, '.koh'))
	assert os.is_dir(os.join_path(dir, '.koh-v2'))
	assert os.is_file(os.join_path(dir, '.kohignore'))
	assert !os.exists(os.join_path(dir, '.koh-migrate'))

	// Every save kept its original ID, and the new repo is sound.
	logged := run_home(dir, home, 'log', '--json')
	assert logged.code == 0
	for id in original {
		assert logged.out.contains(id)
	}
	assert run_home(dir, home, 'doctor').code == 0
	assert run_home(dir, home, 'status').code == 0

	// Migrating again has nothing to convert.
	assert run_home(dir, home, 'migrate').code == 1
}

fn test_migrate_refuses_a_tree_that_does_not_match_the_last_save() {
	koh2 := koh2_binary()
	if koh2 == '' {
		return
	}
	dir := temp_repo('migrate-dirty')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-dirty-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	write(dir, 'code.txt', 'x'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "only save"')
	write(dir, 'code.txt', 'unsaved change\n')

	refused := run_home(dir, home, 'migrate')
	assert refused.code == 1
	assert refused.err.contains('save with koh2 first')
	// Nothing moved: still Koh 2, no archive, no staging file.
	assert os.is_dir(os.join_path(dir, '.koh'))
	assert !os.exists(os.join_path(dir, '.koh-v2'))
	assert !os.exists(os.join_path(dir, '.koh-migrate'))
}

// Koh 2 never saved a root `.kohconfig`, root `.kohignore.<remote>` rules or
// `*.bundle` files, so a clean Koh 2 repo may hold them. Most real repos have
// a `.kohconfig`; migrate must not call them unsaved work.
fn test_migrate_passes_over_the_files_koh2_never_saved() {
	koh2 := koh2_binary()
	if koh2 == '' {
		return
	}
	dir := temp_repo('migrate-koh2-ignores')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-koh2-ignores-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	write(dir, 'code.txt', 'x'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "only save"')
	write(dir, '.kohconfig', 'stable_days = 14\n')
	write(dir, '.kohignore.public', 'private/\n')
	write(dir, 'lib/app.bundle', 'bundle\n')
	write(dir, 'ios/Settings.bundle/Root.plist', 'settings\n')
	// Koh 2 keeps saving a file under a folder pattern added later, where
	// Koh 3 reads the same rule as covering the folder: the saved file is on
	// disk and matches, so the tree is clean.
	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')
	run_koh2(dir, '${q(koh2)} save --agent test --session test "add the dsym"')
	// Koh 2 skips *.bundle even when its rules no longer list it.
	ignore_path := os.join_path(dir, '.koh', 'ignore')
	rules := os.read_file(ignore_path)!.split_into_lines().filter(it != '*.bundle')
	os.write_file(ignore_path, rules.join('\n') + '\nnative/*.dSYM\n')!
	// A saved file the walk skips still has to match what was saved.
	write(dir, 'native/t.dSYM/Info.plist', 'changed\n')
	changed := run_home(dir, home, 'migrate')
	assert changed.code == 1
	assert changed.err.contains('native/t.dSYM/Info.plist does not match')
	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')
	assert os.execute('cd ${q(dir)} && ${q(koh2)} status --json').output.contains('"dirty":false')

	migrated := run_home(dir, home, 'migrate')
	assert migrated.code == 0, migrated.err
	// They stay where they were, for the user to keep or delete.
	assert os.read_file(os.join_path(dir, '.kohconfig'))! == 'stable_days = 14\n'
}