module tests

import net
import net.http
import os
import time
import src.exchange
import src.storage

const root = @VMODROOT
const binary = os.join_path(root, 'build', 'koh3')

struct Result {
mut:
	code int
	out  string
	err  string
}

fn testsuite_begin() {
	os.mkdir_all(os.join_path(root, 'build')) or { panic(err) }
	build := os.execute('v -o ${q(binary)} ${q(os.join_path(root, 'src', 'koh.v'))}')
	if build.exit_code != 0 {
		panic('could not build koh3: ${build.output}')
	}
}

fn q(s string) string {
	return "'${s.replace("'", "'\\''")}'"
}

fn temp_repo(name string) string {
	dir := os.join_path(os.temp_dir(), 'koh3-cli-${name}-${time.now().unix_nano()}')
	os.mkdir_all(dir) or { panic(err) }
	return dir
}

fn run(repo string, args ...string) Result {
	home := temp_repo('home')
	defer { os.rmdir_all(home) or {} }
	return run_home(repo, home, ...args)
}

fn run_home(repo string, home string, args ...string) Result {
	stamp := '${os.getpid()}-${time.now().unix_nano()}'
	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')
	out_path := '${base}.out'
	err_path := '${base}.err'
	code_path := '${base}.code'
	mut command := 'HOME=${q(home)} ${q(binary)}'
	for arg in args {
		command += ' ${q(arg)}'
	}
	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'
	result := os.execute(shell)
	if result.exit_code != 0 {
		panic('could not run test command: ${result.output}')
	}
	code := os.read_file(code_path) or { panic(err) }
	out := os.read_file(out_path) or { '' }
	err := os.read_file(err_path) or { '' }
	os.rm(out_path) or {}
	os.rm(err_path) or {}
	os.rm(code_path) or {}
	return Result{
		code: code.int()
		out:  out
		err:  err
	}
}

// shown is what a terminal leaves on screen: on each line, only what follows its
// last carriage return, so a progress line cleared in place does not count.
fn shown(out string) []string {
	return out.split('\n').map(it.trim_right('\r').all_after_last('\r')).filter(it.trim_space() != '')
}

fn run_pty_home(repo string, home string, answers []string, args ...string) Result {
	stamp := '${os.getpid()}-${time.now().unix_nano()}'
	transcript := os.join_path(os.temp_dir(), 'koh3-pty-${stamp}.txt')
	script_path := os.join_path(os.temp_dir(), 'koh3-pty-${stamp}.exp')
	defer {
		os.rm(transcript) or {}
		os.rm(script_path) or {}
	}
	mut script := 'log_file -noappend {${transcript}}\nset timeout 20\nspawn -noecho env {HOME=${home}} NO_COLOR=1 {${binary}}'
	for arg in args {
		script += ' {${arg}}'
	}
	script += '\n'
	// Each answer waits for its prompt: typed ahead, it would be flushed when the pager takes the
	// terminal raw. `close` ends a run that is still asking, so `wait` can never hang the suite.
	for answer in answers {
		script += 'expect -re {› \$|message: \$|confirm: \$|\\[y/N\\] \$|q quit}\nsend -- "${answer}\\r"\n'
	}
	script += 'expect eof\ncatch close\nset status [wait]\nexit [lindex $status 3]\n'
	os.write_file(script_path, script) or { panic(err) }
	result := os.execute('cd ${q(repo)} && expect -f ${q(script_path)}')
	return Result{
		code: result.exit_code
		out:  os.read_file(transcript) or { '' }
		err:  result.output
	}
}

fn init_repo(repo string) {
	r := run(repo, 'init')
	assert r.code == 0
	assert os.exists(os.join_path(repo, '.koh'))
	assert os.exists(os.join_path(repo, '.kohignore'))
}

fn write(repo string, path string, text string) {
	full := os.join_path(repo, path)
	os.mkdir_all(os.dir(full)) or { panic(err) }
	os.write_file(full, text) or { panic(err) }
}

fn read_json_has(text string, key string) {
	if !text.contains(key) {
		panic('missing JSON key ${key}: ${text}')
	}
}

fn test_init_and_usage() {
	dir := temp_repo('init')
	defer { os.rmdir_all(dir) or {} }
	r := run(dir, 'init', '--json')
	assert r.code == 0
	read_json_has(r.out, 'repo')
	read_json_has(r.out, 'ignore_created')
	assert run(dir, 'init').code == 1
	assert run(dir, 'unknown-command').code == 2
	assert run(dir, 'unknown-command').err.contains('unknown command')
	// An agent asking for JSON gets JSON for a usage mistake too, exit 2.
	for args in [['unknown-command', '--json'], ['save', '--json'], ['save', 'x', '--nope', '--json']] {
		r2 := run(dir, ...args)
		assert r2.code == 2
		assert r2.out == ''
		assert r2.err.starts_with('{"error":'), r2.err
	}
}

// The help screen is commands and plain words: every flag lives in `koh man`.
// this_platform is the platform name for the machine the tests run on, so a
// build test does not depend on which machine that is.
fn this_platform() string {
	machine := os.uname().machine
	arch := if machine in ['arm64', 'aarch64'] { 'aarch64' } else { 'x86_64' }
	return '${os.user_os()}-${arch}'
}

// `koh build` builds with `koh.build`: the version and platform fill the output
// path, and each artifact is printed with its size.
fn test_build_builds_the_named_platforms() {
	dir := temp_repo('build_ok')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	host := this_platform()
	write(dir, 'VERSION', '1.2.3\n')
	write(dir, 'koh.build', 'command = mkdir -p out && printf built > out/demo-1.2.3-${host}
output = out/demo-{version}-{platform}
platforms = ${host}
')
	one := run(dir, 'build')
	assert one.code == 0, one.err
	assert one.out.contains('version 1.2.3')
	assert one.out.contains('out/demo-1.2.3-${host}')
	assert os.exists(os.join_path(dir, 'out/demo-1.2.3-${host}'))

	// --platform picks one, --all takes every platform the file names.
	write(dir, 'koh.build', 'command = mkdir -p out && printf m > out/demo-macos-aarch64 && printf l > out/demo-linux-aarch64
output = out/demo-{platform}
platforms = macos-aarch64, linux-aarch64
')
	all := run(dir, 'build', '--all', '--json')
	assert all.code == 0, all.err
	assert all.out.contains('"platform":"macos-aarch64"')
	assert all.out.contains('"platform":"linux-aarch64"')
	assert os.exists(os.join_path(dir, 'out/demo-linux-aarch64'))
	picked := run(dir, 'build', '--platform', 'linux-aarch64')
	assert picked.code == 0, picked.err
	assert picked.out.contains('out/demo-linux-aarch64')
	assert !picked.out.contains('out/demo-macos-aarch64')
}

// The item's exit check, as a test: `koh build` builds Koh 3 itself with the
// real toolchain, in a copy, and the binary it produces runs.
// `koh update` refuses a command line that cannot be answered: JSON cannot carry
// the question, and a stray argument is a mistake. Both are settled before any
// source is read, so no network is needed here.
fn test_update_refuses_a_command_line_it_cannot_answer() {
	dir := temp_repo('update_args')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	json_without_yes := run(dir, 'update', '--json')
	assert json_without_yes.code == 2
	assert json_without_yes.err.contains('needs --yes')
	assert run(dir, 'update', 'extra').code == 2
}

fn test_build_builds_koh_itself() {
	dir := temp_repo('selfbuild')
	defer { os.rmdir_all(dir) or {} }
	// Only what a build reads: the copy needs no history and no archive.
	for item in ['src', 'vendor', 'docs', 'v.mod', 'VERSION'] {
		os.cp_all(os.join_path(root, item), os.join_path(dir, item), true) or { panic(err) }
	}
	write(dir, 'koh.build', 'command = mkdir -p zig-out/bin && v -o zig-out/bin/koh3 src/koh.v
output = zig-out/bin/koh3
platforms = ${this_platform()}
')
	init_repo(dir)
	built := run(dir, 'build')
	assert built.code == 0, built.err
	assert built.out.contains('zig-out/bin/koh3')
	fresh := os.join_path(dir, 'zig-out/bin/koh3')
	assert os.exists(fresh)
	version := os.read_file(os.join_path(dir, 'VERSION'))!.trim_space()
	assert os.execute('${q(fresh)} --version').output.trim_space() == 'koh ${version}'
}

fn test_build_refuses_what_it_cannot_do() {
	dir := temp_repo('build_bad')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	missing := run(dir, 'build')
	assert missing.code == 1
	assert missing.err.contains('koh.build')

	write(dir, 'koh.build', 'command = true
output = out/demo
platforms = macos-aarch64
')
	no_version := run(dir, 'build')
	assert no_version.code == 1
	assert no_version.err.contains('VERSION')

	write(dir, 'VERSION', '1.2.3\n')
	not_listed := run(dir, 'build', '--platform', 'linux-aarch64')
	assert not_listed.code == 1
	assert not_listed.err.contains('does not build for')

	unknown := run(dir, 'build', '--platform', 'amiga')
	assert unknown.code == 1
	assert unknown.err.contains('amiga')

	both := run(dir, 'build', '--all', '--platform', 'macos-aarch64')
	assert both.code == 2
	assert both.err.contains('cannot be combined')

	write(dir, 'koh.build', 'command = true
output = out/demo
platforms = macos-aarch64, amiga
')
	bad_platform := run(dir, 'build')
	assert bad_platform.code == 1
	assert bad_platform.err.contains('amiga')

	write(dir, 'koh.build', 'command = sh -c \'echo "no toolchain" >&2; exit 1\'
output = out/demo
platforms = ${this_platform()}
')
	failed := run(dir, 'build')
	assert failed.code == 1
	assert failed.err.contains('no toolchain')
}

fn test_the_help_screen_lists_commands_and_no_flags() {
	dir := temp_repo('help')
	defer { os.rmdir_all(dir) or {} }
	help := run(dir, '--help')
	assert help.code == 0
	names := ['save', 'checkpoint', 'status', 'view', 'diff', 'undo', 'revert', 'load', 'offer',
		'steal']
	for name in names {
		assert help.out.contains('  ${name} '), name
	}
	assert help.out.contains('koh man <command>')
	assert help.out.contains('  status      where things stand\n')
	assert help.out.contains('  diff        what changed\n')
	assert help.out.contains('Asha Software · asha.software')
	// No flag text anywhere on the screen.
	assert !help.out.contains('--'), help.out
	lines := help.out.split_into_lines()
	for line in lines {
		assert line.runes().len <= 80, line
	}
	// Each command has its own paragraph, a blank line above it.
	for name in names {
		for i, line in lines {
			if line.starts_with('  ${name} ') {
				assert i > 0 && lines[i - 1] == '', line
			}
		}
	}
	// A bare `koh` keeps its stream and exit code; `-h` shows the same screen.
	bare := run(dir)
	assert bare.code == 2
	assert bare.out == ''
	assert bare.err.contains('koh man <command>')
	short := run(dir, '-h')
	assert short.code == 0
	assert short.out == help.out
}

// Colour on the screen follows NO_COLOR, as it does everywhere else.
fn test_the_help_screen_has_no_colour_when_it_is_off() {
	dir := temp_repo('help_plain')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('help_plain_home')
	defer { os.rmdir_all(home) or {} }
	out_path := os.join_path(os.temp_dir(), 'koh3-help-${os.getpid()}-${time.now().unix_nano()}')
	defer { os.rm(out_path) or {} }
	code := os.system('cd ${q(dir)} && HOME=${q(home)} NO_COLOR=1 ${q(binary)} --help > ${q(out_path)}')
	assert code == 0
	text := os.read_file(out_path) or { panic(err) }
	assert !text.contains('\x1b'), text
	assert text.contains('  save        snapshot your work')
}

// The binary embeds VERSION while saves bump v.mod; they drifted once.
fn test_version_matches_the_manifest() {
	dir := temp_repo('version')
	defer { os.rmdir_all(dir) or {} }
	version := run(dir, '--version').out.trim_space().all_after('koh ')
	manifest := os.read_file(os.join_path(root, 'v.mod')) or { panic(err) }
	assert manifest.contains("version: '${version}'"), version
}

fn test_save_checkpoint_and_status() {
	dir := temp_repo('save')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'tracked.txt', 'one\n')
	r := run(dir, 'save', 'first message', '--agent', 'agent-7', '--session', 'session-a', '--json')
	assert r.code == 0
	for key in ['id', 'parent', 'message', 'created_at', 'machine', 'is_checkpoint', 'agent', 'session',
		'files', 'size_bytes'] {
		read_json_has(r.out, key)
	}
	assert r.out.contains('"message":"first message"')
	assert r.out.contains('"agent":"agent-7"')
	assert r.out.contains('"session":"session-a"')
	assert r.out.contains('"is_checkpoint":false')
	assert run(dir, 'save', 'again').code == 1
	assert run(dir, 'save', 'again').err.contains('nothing has changed since the last save')
	assert run(dir, 'save').code == 2
	assert run(dir, 'save', 'x', '--bogus').code == 2
	cp := run(dir, 'checkpoint', 'still first', '--json')
	assert cp.code == 0
	assert cp.out.contains('"is_checkpoint":true')
	assert cp.out.contains('"parent":')
	clean := run(dir, 'status')
	assert clean.code == 0
	assert clean.out.contains('no changes')
	write(dir, 'tracked.txt', 'two\n')
	write(dir, 'new.txt', 'new\n')
	os.rm(os.join_path(dir, 'tracked.txt')) or { panic(err) }
	write(dir, '.kohignore', '*.log\n')
	status := run(dir, 'status')
	assert status.code == 0
	assert status.out.contains('+')
	assert status.out.contains('~') || status.out.contains('-')
	assert status.out.contains('added')
	js := run(dir, 'status', '--json')
	assert js.code == 0
	for key in ['head_id', 'head_msg', 'dirty', 'modified', 'added', 'deleted', 'ignore_changed',
		'saves', 'size_bytes', 'head_flagged'] {
		read_json_has(js.out, key)
	}
	assert js.out.contains('"ignore_changed":true')
	// What the shell prompt shows: saves on the line, the .koh size, the flag.
	assert js.out.contains('"saves":2')
	assert js.out.contains('"size_bytes":${os.file_size(os.join_path(dir, '.koh'))}')
	assert js.out.contains('"head_flagged":false')
	head := js.out.all_after('"head_id":"').all_before('"')
	assert run(dir, 'flag', head, '--reason', 'bad').code == 0
	assert run(dir, 'status', '--json').out.contains('"head_flagged":true')
}

fn test_status_requires_repo_and_ignore_rules() {
	dir := temp_repo('status')
	defer { os.rmdir_all(dir) or {} }
	assert run(dir, 'status').code == 1
	init_repo(dir)
	write(dir, '.kohignore', '*.log\nbuild/\n')
	write(dir, 'keep.txt', 'keep\n')
	write(dir, 'ignored.log', 'ignore\n')
	write(dir, 'build/output.txt', 'ignore\n')
	saved := run(dir, 'save', 'keep', '--json')
	assert saved.code == 0
	id := saved.out.all_after('"id":"')[..12]
	// Where things stand comes first, clean or not.
	clean := run(dir, 'status').out
	assert clean.contains('at [${id}] keep · '), clean
	assert clean.contains(' · 1 save\n'), clean
	assert clean.contains('no changes')
	write(dir, 'keep.txt', 'changed\n')
	assert run(dir, 'status').out.contains('at [${id}] keep · ')
	write(dir, 'keep.txt', 'keep\n')
	assert !run(dir, 'status').out.contains('ignored.log')
	assert !run(dir, 'status').out.contains('build/output.txt')
	assert !run(dir, 'status').out.contains('LOG.md')
}

fn test_status_and_save_report_unsafe_names_without_refusing_the_save() {
	dir := temp_repo('unsafe-names')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'safe.txt', 'safe\n')
	assert run(dir, 'save', 'safe').code == 0
	os.write_file('${dir}/bad\\name.txt', 'bad\n') or { panic(err) }
	os.write_file('${dir}/Icon\r', 'icon\n') or { panic(err) }

	status := run(dir, 'status', '--json')
	assert status.code == 0
	assert status.out.contains('"unsafe_paths":["Icon\\\\x0d","bad\\\\\\\\name.txt"]'), status.out
	saved := run(dir, 'checkpoint', 'unsafe names', '--json')
	assert saved.code == 0
	assert saved.out.contains('"unsafe_paths":["Icon\\\\x0d","bad\\\\\\\\name.txt"]'), saved.out
}

// LOG.md is a convenience written after the save lands. If it cannot be
// written, the save still happened, and an agent that retried on a failure
// would only be told nothing had changed.
fn test_a_save_succeeds_when_log_md_cannot_be_written() {
	dir := temp_repo('logmd')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	os.mkdir_all(os.join_path(dir, 'LOG.md')) or { panic(err) }
	write(dir, 'a.txt', 'one\n')
	r := run(dir, 'save', 'first', '--json')
	assert r.code == 0
	assert r.out.starts_with('{')
	assert r.err.contains('LOG.md')
	assert run(dir, 'view', '--json').out.contains('"message":"first"')
}

// A folder of ignored files can sit where a restored file should go. Koh
// never touches ignored files, so the restore must stop and say so, not drop
// the file inside the folder under a temporary name.
fn test_a_restore_refuses_a_folder_of_ignored_files_in_the_way() {
	dir := temp_repo('dir-in-way')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'out', 'a file\n')
	first := run(dir, 'save', 'out is a file', '--json').out.all_after('"id":"')[..12]
	os.rm(os.join_path(dir, 'out')) or { panic(err) }
	write(dir, 'out/build.log', 'ignored\n')
	assert run(dir, 'save', 'out is gone').code == 0
	r := run(dir, 'load', first, '--yes')
	assert r.code == 1
	assert r.err.contains('out')
	assert os.ls(os.join_path(dir, 'out'))! == ['build.log']
}

// Koh never follows a symlink, so a folder replaced by a link to somewhere
// else is not the repo's to write into: restoring through it would overwrite
// files outside the repo. The refusal comes before anything is recorded.
fn test_a_restore_never_writes_through_a_symlinked_folder() {
	dir := temp_repo('link-in-way')
	outside := temp_repo('link-target')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(outside) or {}
	}
	init_repo(dir)
	write(dir, 'docs/a.md', 'saved\n')
	first := run(dir, 'save', 'docs', '--json').out.all_after('"id":"')[..12]
	os.rmdir_all(os.join_path(dir, 'docs')) or { panic(err) }
	write(outside, 'a.md', 'precious\n')
	os.symlink(outside, os.join_path(dir, 'docs')) or { panic(err) }
	assert run(dir, 'save', 'docs is a link now').code == 0
	head := run(dir, 'status', '--json').out
	r := run(dir, 'load', first, '--yes')
	assert r.code == 1
	assert r.err.contains('docs')
	assert os.read_file(os.join_path(outside, 'a.md'))! == 'precious\n'
	assert run(dir, 'status', '--json').out == head
}

// A restore records its save first, then writes files. When the writing stops
// part way, the half-written tree is not somebody's work: saving it would
// record (and offer) a tree that undoes changes nobody asked to undo. Every
// command that would build on it points at revert, which finishes the job.
fn test_a_restore_cut_short_points_at_revert() {
	dir := temp_repo('cut-short')
	defer {
		os.chmod(os.join_path(dir, 'zz'), 0o755) or {}
		os.rmdir_all(dir) or {}
	}
	init_repo(dir)
	write(dir, 'zero', '0\n')
	assert run(dir, 'save', 'zero').code == 0
	write(dir, 'a.txt', 'v1\n')
	write(dir, 'zz/f', 'v1\n')
	assert run(dir, 'save', 'first').code == 0
	write(dir, 'a.txt', 'v2\n')
	write(dir, 'zz/f', 'v2\n')
	assert run(dir, 'save', 'second').code == 0
	// a.txt is written, then the read-only folder stops the restore: the
	// tree is genuinely half one save and half the other.
	os.chmod(os.join_path(dir, 'zz'), 0o555)!
	stopped := run(dir, 'undo', '--yes')
	assert stopped.code == 1
	assert stopped.err.contains('koh revert')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'
	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v2\n'
	// Even a status that cannot read the tree says what happened.
	os.chmod(os.join_path(dir, 'zz'), 0o000)!
	assert run(dir, 'status').err.contains('koh revert')
	os.chmod(os.join_path(dir, 'zz'), 0o755)!

	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":true')
	for args in [['save', 'half'], ['checkpoint', 'half'], ['undo', '--yes']] {
		r := run(dir, ...args)
		assert r.code == 1
		assert r.err.contains('koh revert')
	}
	assert run(dir, 'revert', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'v1\n'
	assert os.read_file(os.join_path(dir, 'zz/f'))! == 'v1\n'
	assert run(dir, 'status', '--json').out.contains('"restore_unfinished":false')
	write(dir, 'a.txt', 'v3\n')
	assert run(dir, 'save', 'carry on').code == 0
}

// Doctor clears peek folders left from earlier days, never one somebody may
// be reading right now.
fn test_doctor_sweeps_only_old_peek_folders() {
	dir := temp_repo('peek-sweep')
	// V's temp_dir is /tmp on macOS whatever TMPDIR says, so these live in
	// the real temp directory under names no save could have.
	fresh := os.join_path(os.temp_dir(), 'koh-peek-fresh${os.getpid()}')
	old := os.join_path(os.temp_dir(), 'koh-peek-old${os.getpid()}')
	linked := os.join_path(os.temp_dir(), 'koh-peek-link${os.getpid()}')
	target := temp_repo('peek-link-target')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(fresh) or {}
		os.rmdir_all(old) or {}
		os.rm(linked) or {}
		os.rmdir_all(target) or {}
	}
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	assert run(dir, 'save', 'one').code == 0
	os.mkdir_all(fresh) or { panic(err) }
	os.mkdir_all(old) or { panic(err) }
	two_days_ago := time.now().unix() - 2 * 86400
	os.utime(old, two_days_ago, two_days_ago) or { panic(err) }
	write(target, 'keep.txt', 'keep')
	os.utime(target, two_days_ago, two_days_ago) or { panic(err) }
	os.symlink(target, linked) or { panic(err) }
	assert run(dir, 'doctor', '--json').code == 0
	assert os.exists(old)
	assert run(dir, 'doctor', '--json', '--yes').code == 0
	assert os.exists(fresh)
	assert !os.exists(old)
	assert os.is_link(linked)
	assert os.read_file(os.join_path(target, 'keep.txt'))! == 'keep'
}

// A file saved long ago and ignored since holds work no save has. Loading the
// old save must not write over it; the document says a restore never touches
// ignored files.
fn test_a_restore_never_overwrites_an_ignored_file() {
	dir := temp_repo('ignored-restore')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, '.env', 'KEY=saved long ago\n')
	first := run(dir, 'save', 'with env', '--json').out.all_after('"id":"')[..12]
	write(dir, '.kohignore', '.env\n')
	assert run(dir, 'save', 'ignore env').code == 0
	write(dir, '.env', 'KEY=never saved\n')
	assert run(dir, 'load', first, '--yes').code == 0
	assert os.read_file(os.join_path(dir, '.env'))! == 'KEY=never saved\n'

	// Where the ignored file is missing, the restore still brings it back.
	other := temp_repo('ignored-restore-missing')
	defer { os.rmdir_all(other) or {} }
	init_repo(other)
	write(other, '.env', 'KEY=saved long ago\n')
	again := run(other, 'save', 'with env', '--json').out.all_after('"id":"')[..12]
	write(other, '.kohignore', '.env\n')
	assert run(other, 'save', 'ignore env').code == 0
	os.rm(os.join_path(other, '.env')) or { panic(err) }
	assert run(other, 'load', again, '--yes').code == 0
	assert os.read_file(os.join_path(other, '.env'))! == 'KEY=saved long ago\n'
}

// A going-back preview lists paths only. Running diff(1) per file to draw it
// cost 27 s for 5,000 changed files, so it must not run diff at all.
fn test_a_going_back_preview_does_not_run_diff() {
	dir := temp_repo('preview-nodiff')
	home := temp_repo('preview-nodiff-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	assert run_home(dir, home, 'save', 'one').code == 0
	write(dir, 'a.txt', 'two\n')
	assert run_home(dir, home, 'save', 'two').code == 0
	fake := os.join_path(home, 'bin')
	os.mkdir_all(fake) or { panic(err) }
	marker := os.join_path(home, 'diff-ran')
	os.write_file(os.join_path(fake, 'diff'), '#!/bin/sh\ntouch ${q(marker)}\nexit 2\n') or {
		panic(err)
	}
	os.chmod(os.join_path(fake, 'diff'), 0o755) or { panic(err) }
	assert run_home_with_path(dir, home, fake, 'undo', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert !os.exists(marker)
}

// A restore rewrites only what differs. Rewriting every file resets every
// mtime, so the next status has to hash the whole tree again.
fn test_a_restore_leaves_unchanged_files_alone() {
	dir := temp_repo('restore-skip')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	write(dir, 'same.txt', 'never changes\n')
	assert run(dir, 'save', 'one').code == 0
	write(dir, 'a.txt', 'two\n')
	assert run(dir, 'save', 'two').code == 0
	long_ago := i64(1700000000)
	os.utime(os.join_path(dir, 'same.txt'), long_ago, long_ago) or { panic(err) }
	assert run(dir, 'undo', '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert os.file_last_mod_unix(os.join_path(dir, 'same.txt')) == long_ago
}

// `save` records the executable bit, so `status` has to see it too, or a
// chmod would be invisible until it turned up in a save.
fn test_status_sees_an_executable_bit_change() {
	dir := temp_repo('chmod')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'run.sh', 'echo hi\n')
	assert run(dir, 'save', 'script').code == 0
	os.chmod(os.join_path(dir, 'run.sh'), 0o755) or { panic(err) }
	status := run(dir, 'status', '--json')
	assert status.out.contains('"dirty":true')
	assert status.out.contains('"modified":["run.sh"]')
}

fn test_view_and_diff() {
	dir := temp_repo('history')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	first := run(dir, 'save', 'one', '--session', 'alpha', '--json')
	id1 := first.out.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	second := run(dir, 'save', 'two', '--session', 'beta', '--json')
	id2 := second.out.all_after('"id":"')[..12]
	cp := run(dir, 'checkpoint', 'checkpoint', '--json')
	assert cp.code == 0
	printed := run(dir, 'view')
	assert printed.code == 0
	assert printed.out.contains('▸')
	assert printed.out.contains('◐')
	lj := run(dir, 'view', '--json')
	assert lj.code == 0
	assert lj.out.contains('"head_id"')
	assert lj.out.contains('"saves"')
	assert run(dir, 'view', '--since', 'today').out.contains('two')
	session := run(dir, 'view', '--session', 'alpha')
	assert session.out.contains('one')
	assert !session.out.contains('two')
	assert run(dir, 'view', '--since', '9999-01-01').out.contains('no saves in that range')
	write(dir, 'a.txt', 'three\n')
	d := run(dir, 'diff')
	assert d.code == 0
	assert d.out.contains('--- a/')
	assert d.out.contains('+++ b/')
	assert run(dir, 'diff', id1).code == 0
	assert run(dir, 'diff', id1, id2).code == 0
	dj := run(dir, 'diff', '--json')
	assert dj.code == 0
	assert dj.out.contains('"from"')
	assert dj.out.contains('"to"')
	assert dj.out.contains('"files"')
	assert dj.out.contains('"change":"modified"')
	assert run(dir, 'diff', 'not-a-real-id').code == 1
	assert run(dir, 'diff', id1, id2, 'third').code == 1
	write(dir, 'blob.bin', '\x00\x01\x02')
	diff_binary := run(dir, 'diff', '--json')
	assert diff_binary.out.contains('"binary":true')
	assert diff_binary.out.contains('Binary files differ')
}

fn test_undo_revert_and_load() {
	dir := temp_repo('restore')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	one := run(dir, 'save', 'one', '--json').out
	id1 := one.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	write(dir, 'gone.txt', 'gone\n')
	second := run(dir, 'save', 'two', '--json').out
	id2 := second.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'three\n')
	third := run(dir, 'save', 'three', '--json').out
	id3 := third.all_after('"id":"')[..12]
	// Unsaved work — here a file never saved — blocks every going-back but
	// revert, as in Koh 2: a restore must never overwrite what only the disk has.
	write(dir, 'never.txt', 'keep me\n')
	view_before := run(dir, 'view').out
	for args in [['undo', '--yes'], ['load', id1, '--yes'], ['pluck', id2, '--yes']] {
		blocked := run(dir, ...args)
		assert blocked.code == 1
		assert blocked.err.contains('unsaved changes')
	}
	assert run(dir, 'view').out == view_before
	os.rm(os.join_path(dir, 'never.txt')) or { panic(err) }
	write(dir, 'a.txt', 'edited, never saved\n')
	assert run(dir, 'undo', '--yes').err.contains('unsaved changes')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'edited, never saved\n'
	write(dir, 'a.txt', 'three\n')
	os.rm(os.join_path(dir, 'gone.txt')) or { panic(err) }
	assert run(dir, 'load', id1, '--yes').err.contains('unsaved changes')
	write(dir, 'gone.txt', 'gone\n')
	undo := run(dir, 'undo', '--yes', '--json')
	assert undo.code == 0
	if !undo.out.contains(id2) {
		panic('undo JSON did not name ${id2}: ${undo.out}')
	}
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert os.exists(os.join_path(dir, 'gone.txt'))
	assert run(dir, 'load', id3, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'three\n'
	assert run(dir, 'undo', '2', '--yes').code == 0
	assert run(dir, 'load', id2, '--yes').code == 0
	assert run(dir, 'undo', '99', '--yes').err.contains('nothing before')
	write(dir, 'a.txt', 'dirty\n')
	before := run(dir, 'view')
	refuse := run(dir, 'revert')
	assert refuse.code == 1
	assert refuse.err.contains('needs --yes when not interactive')
	assert run(dir, 'view').out == before.out
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'
	write(dir, 'untracked.txt', 'remove\n')
	rv := run(dir, 'revert', '--yes', '--json')
	assert rv.code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert !os.exists(os.join_path(dir, 'untracked.txt'))
	// The way back to the discarded work is named, not left to be found.
	kept := rv.out.all_after('"checkpoint":"')[..12]
	assert run(dir, 'load', kept, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'dirty\n'
	assert os.read_file(os.join_path(dir, 'untracked.txt'))! == 'remove\n'
	write(dir, 'a.txt', 'dirty again\n')
	assert run(dir, 'revert', '--yes').out.contains('koh load ')
	assert run(dir, 'revert', '--yes').out.contains('working tree already matches')
	assert run(dir, 'load', '--checkpoint', '--yes').code == 0
	assert run(dir, 'load', id2, '--json').code == 1
	assert run(dir, 'load', id2, '--json').err.contains('error')
	assert run(dir, 'load').code == 2
	assert run(dir, 'load', 'unknown-id', '--yes').code == 1
}

fn test_flag_and_flagged_view() {
	dir := temp_repo('flag')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'flag.txt', 'one\n')
	saved := run(dir, 'save', 'flag me', '--json')
	id := saved.out.all_after('"id":"')[..12]
	flagged := run(dir, 'flag', id, '--reason', 'unsafe', '--json')
	assert flagged.code == 0
	assert flagged.out.contains('"flagged":true')
	assert flagged.out.contains('"reason":"unsafe"')
	list := run(dir, 'flag', '--json')
	assert list.code == 0
	assert list.out.contains(id)
	assert list.out.contains('unsafe')
	assert run(dir, 'view').out.contains('⚑')
	assert run(dir, 'flag', '--clear', id).code == 0
	assert run(dir, 'flag').out.contains('nothing is flagged')
	assert run(dir, 'flag', 'unknown-id').code == 1
	assert run(dir, 'flag').code == 0
}

fn test_pluck_forward_reverse_dry_run_and_conflict() {
	dir := temp_repo('pluck')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'a.txt', 'one\n')
	first := run(dir, 'save', 'one', '--json').out
	id1 := first.all_after('"id":"')[..12]
	write(dir, 'a.txt', 'two\n')
	second := run(dir, 'save', 'two', '--json').out
	id2 := second.all_after('"id":"')[..12]
	assert run(dir, 'load', id1, '--yes').code == 0
	dry := run(dir, 'pluck', id2, '--dry-run')
	assert dry.code == 0
	assert dry.out.contains('a.txt')
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	assert run(dir, 'pluck', id2, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'two\n'
	assert run(dir, 'pluck', '--reverse', id2, '--yes').code == 0
	assert os.read_file(os.join_path(dir, 'a.txt'))! == 'one\n'
	write(dir, 'a.txt', 'different\n')
	assert run(dir, 'pluck', id2, '--dry-run').code == 1
	assert run(dir, 'save', 'different').code == 0
	conflict := run(dir, 'pluck', id2, '--yes')
	assert conflict.code == 1
	assert conflict.err.contains('a.txt')
	assert run(dir, 'pluck').code == 2
	assert run(dir, 'pluck', 'unknown-id').code == 1
}

fn test_peek_and_doctor() {
	dir := temp_repo('peek-doctor')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'peek.txt', 'peek me\n')
	assert run(dir, 'save', 'peekable').code == 0
	id := run(dir, 'view', '--json').out.all_after('"id":"')[..12]
	before_view := run(dir, 'view', '--json').out
	peek := run(dir, 'peek', id, '--json')
	assert peek.code == 0
	peek_path := peek.out.all_after('"path":"').before('"')
	assert peek.out.contains('"id":"${id}"')
	assert os.read_file(os.join_path(peek_path, 'peek.txt'))! == 'peek me\n'
	assert run(dir, 'status').out.contains('no changes')
	assert run(dir, 'view', '--json').out == before_view
	assert run(dir, 'peek').code == 2
	assert run(dir, 'peek', 'unknown-id').code == 1
	backup := os.join_path(dir, 'doctor.backup')
	healthy := run(dir, 'doctor')
	assert healthy.code == 0
	assert healthy.out.contains('is healthy')
	report := run(dir, 'doctor', '--json')
	assert report.code == 0
	for key in ['problems', 'objects', 'saves', 'checkpoints', 'cached_files', 'peek_folders_removed',
		'backup'] {
		read_json_has(report.out, key)
	}
	backed := run(dir, 'doctor', '--backup', backup)
	assert backed.code == 0
	assert os.exists(backup)
	assert backed.out.contains(backup)
	assert run(dir, 'doctor', '--backup', backup).code == 1
	assert run(dir, 'peek', id, '--json').code == 0
	// A peek made today is left for whoever is reading it.
	kept := run(dir, 'doctor', '--json')
	assert kept.code == 0
	assert os.exists(peek_path)
	os.rmdir_all(peek_path) or {}
}

fn test_strip_refuses_without_terminal() {
	dir := temp_repo('strip')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'secret.txt', 'keep\n')
	assert run(dir, 'save', 'secret').code == 0
	before_view := run(dir, 'view', '--json').out
	refused := run(dir, 'strip', 'secret.txt')
	assert refused.code == 1
	assert refused.err.contains('needs a terminal')
	assert run(dir, 'view', '--json').out == before_view
	assert os.read_file(os.join_path(dir, 'secret.txt'))! == 'keep\n'
	assert run(dir, 'view', '--json').out.contains('secret')
}

// A whole-history strip bans the path: `.kohignore` names it, once, and the file left on disk
// is never unsaved work or part of a save again.
fn test_strip_adds_the_path_to_kohignore_and_it_stays_out() {
	dir := temp_repo('strip-ignore')
	home := temp_repo('strip-ignore-home')
	defer { os.rmdir_all(dir) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(dir)
	write(dir, 'secret.txt', 'leaked\n')
	write(dir, 'keep.txt', 'fine\n')
	assert run_home(dir, home, 'save', 'leak').code == 0
	assert run(dir, 'strip', 'secret.txt', '--yes').code == 1
	assert run_pty_home(dir, home, [''], 'strip', 'secret.txt', '--yes').code == 1
	stripped := run_pty_home(dir, home, ['secret.txt'], 'strip', 'secret.txt', '--yes')
	assert stripped.code == 0, stripped.out
	assert stripped.out.contains('added /secret.txt to .kohignore')
	ignore_path := os.join_path(dir, '.kohignore')
	assert os.read_file(ignore_path)!.split_into_lines().filter(it == '/secret.txt').len == 1
	assert run_home(dir, home, 'save', 'ignore the stripped secret').code == 0
	write(dir, 'secret.txt', 'leaked again\n')
	assert run_home(dir, home, 'status', '--json').out.contains('"dirty":false')
	// Running the strip again (with no remote, it stays pending) adds no second line.
	again := run_pty_home(dir, home, [], 'strip', 'secret.txt')
	assert again.code == 0, again.out
	assert os.read_file(ignore_path)!.split_into_lines().filter(it == '/secret.txt').len == 1
}

// `koh view` is the one way into the history: the whole line by default,
// checkpoints alone with the flag, and the two lists never overlap.
fn test_view_shows_the_line_and_checkpoints_apart() {
	dir := temp_repo('view')
	defer { os.rmdir_all(dir) or {} }
	init_repo(dir)
	write(dir, 'view.txt', 'one\n')
	assert run(dir, 'save', 'plain save').code == 0
	assert run(dir, 'checkpoint', 'checkpoint save').code == 0
	line := run(dir, 'view')
	assert line.code == 0
	assert line.out.contains('plain save')
	assert line.out.contains('checkpoint save')
	checkpoints := run(dir, 'view', '--checkpoints')
	assert checkpoints.code == 0
	assert checkpoints.out.contains('checkpoint save')
	assert !checkpoints.out.contains('plain save')
	json_line := run(dir, 'view', '--json')
	assert json_line.code == 0
	assert json_line.out.contains('"is_checkpoint":false')
	assert json_line.out.contains('"is_checkpoint":true')
	json_checkpoints := run(dir, 'view', '--checkpoints', '--json')
	assert json_checkpoints.code == 0
	assert json_checkpoints.out.contains('"is_checkpoint":true')
	assert !json_checkpoints.out.contains('"is_checkpoint":false')
	// `view` takes no arguments, so a stray one is a usage error, and the names
	// it replaced are gone rather than hidden: the diagnostic says which.
	assert run(dir, 'view', 'extra').code == 2
	for gone in ['log', 'saves', 'checkpoints'] {
		refused := run(dir, gone)
		assert refused.code == 2
		assert refused.err.contains('unknown command "${gone}"')
	}
	// Every save is on the whole line exactly once, as the JSON says.
	assert line.out.split_into_lines().len == json_line.out.count('"id":"')
}

fn test_remote_configuration_is_isolated_and_atomic() {
	dir := temp_repo('remote')
	home := temp_repo('remote-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	empty := run_home(dir, home, 'remote', '--json')
	assert empty.code == 0
	assert empty.out.contains('"configured":false')
	target := os.join_path(home, 'remote-store')
	set := run_home(dir, home, 'remote', 'folder', target)
	assert set.code == 0
	assert os.is_dir(target)
	state := run_home(dir, home, 'remote', '--json')
	assert state.code == 0
	assert state.out.contains('"kind":"folder"')
	assert state.out.contains(target)
	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region').code == 1
	assert run_home(dir, home, 'remote', '--json').out.contains(target)
	assert run_home(dir, home, 'remote', 's3', 'http://127.0.0.1:1', 'bucket', 'region', '--yes').err.contains('KOH_ACCESS_KEY')
	assert run_home(dir, home, 'remote', '--forget').code == 1
	assert run_home(dir, home, 'remote', '--forget', '--json').code == 1
	assert run_pty_home(dir, home, [''], 'remote', '--forget').code == 1
	assert run_home(dir, home, 'remote', '--json').out.contains(target)
	assert run_home(dir, home, 'remote', 'folder', target + '-other').code == 1
	assert run_pty_home(dir, home, [''], 'remote', 'folder', target + '-other').code == 1
	assert !os.exists(target + '-other')
	assert run_pty_home(dir, home, ['Y'], 'remote', 'folder', target + '-other').code == 0
	assert run_pty_home(dir, home, ['Y'], 'remote', '--forget').code == 0
	assert run_home(dir, home, 'remote', '--json').out.contains('"configured":false')
}

// The files under ~/.config/koh can be written by hand instead of by
// `koh remote`, and are then read the same way.
fn test_remote_written_by_hand() {
	dir := temp_repo('remote-by-hand')
	home := temp_repo('remote-by-hand-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	config := os.join_path(home, '.config', 'koh')
	os.mkdir_all(config) or { panic(err) }
	target := os.join_path(home, 'remote-store')
	os.mkdir_all(target) or { panic(err) }
	os.write_file(os.join_path(config, 'remote'), 'kind = folder\npath = ${target}\n') or {
		panic(err)
	}
	assert run_home(dir, home, 'init').code == 0
	os.write_file(os.join_path(dir, 'a.txt'), 'a\n') or { panic(err) }
	assert run_home(dir, home, 'save', 'first').code == 0
	offered := run_home(dir, home, 'offer', '--json')
	assert offered.code == 0
	assert offered.out.contains('"head"')

	// Keys anyone else can read are refused before they are ever sent.
	os.write_file(os.join_path(config, 'remote'), 'kind=s3\nendpoint=http://127.0.0.1:1\nbucket=b\nregion=r\n') or {
		panic(err)
	}
	credentials := os.join_path(config, 'credentials')
	os.write_file(credentials, 'access_key=AK\nsecret_key=SK\n') or { panic(err) }
	os.chmod(credentials, 0o644) or { panic(err) }
	loose := run_home(dir, home, 'offer')
	assert loose.code == 1
	assert loose.err.contains('chmod 600')

	// A setting koh cannot read is replaced by setting the remote again.
	os.write_file(os.join_path(config, 'remote'), 'kind=ftp\n') or { panic(err) }
	unreadable := run_home(dir, home, 'offer')
	assert unreadable.code == 1
	assert unreadable.err.contains('not readable')
	assert run_home(dir, home, 'remote', 'folder', target, '--yes').code == 0
	assert run_home(dir, home, 'offer').code == 0
}

// A stolen repo belongs to the repo it was stolen from, whatever its folder is
// called later: renaming it must not start a second repo on the remote.
fn test_a_renamed_stolen_repo_keeps_offering_to_its_repo() {
	syncroot := temp_repo('rename-steal')
	home := temp_repo('rename-steal-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	assert run_home(b_parent, home, 'steal', 'proj').code == 0
	renamed := os.join_path(b_parent, 'renamed')
	os.mv(os.join_path(b_parent, 'proj'), renamed) or { panic(err) }
	write(renamed, 'b.txt', 'from B\n')
	assert run_home(renamed, home, 'save', 'B first').code == 0
	assert !os.exists(os.join_path(remote, 'renamed'))
	assert run_home(a, home, 'steal', '--yes').code == 0
	assert os.read_file(os.join_path(a, 'b.txt'))! == 'from B\n'
}

// A damaged object on the remote stops a steal, names the object, and leaves
// no half-made folder that would make the retry refuse.
fn test_steal_of_a_damaged_remote_leaves_nothing() {
	syncroot := temp_repo('damaged')
	home := temp_repo('damaged-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	objects := os.join_path(remote, 'proj', 'objects')
	for name in os.ls(objects) or { panic(err) } {
		os.chmod(os.join_path(objects, name), 0o644) or {}
		os.write_file(os.join_path(objects, name), 'junk') or { panic(err) }
	}
	stolen := run_home(b_parent, home, 'steal', 'proj')
	assert stolen.code == 1
	assert stolen.err.contains('is damaged')
	assert !os.exists(os.join_path(b_parent, 'proj'))
}

fn test_steal_drops_crafted_unsafe_paths_and_lands_the_rest() {
	syncroot := temp_repo('unsafe-remote')
	home := temp_repo('unsafe-remote-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'safe.txt', 'safe\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	id := run_home(a, home, 'save', 'crafted', '--json').out.all_after('"id":"')[..12]
	assert run_home(a, home, 'offer').code == 0
	record_path := os.join_path(remote, 'proj', 'saves', id)
	record := os.read_file(record_path) or { panic(err) }
	path_at := record.index('"path":"safe.txt"') or { panic('safe path missing from ${record}') }
	file_start := record[..path_at].last_index('{') or { panic('safe file start missing') }
	file_end := path_at + (record[path_at..].index('}') or { panic('safe file end missing') }) + 1
	file := record[file_start..file_end]
	mut files := [file]
	for path in ['../outside.txt', '/etc/koh-test', 'a/../../outside.txt', 'bad\\\\name',
		'control\\rname'] {
		files << file.replace('safe.txt', path)
	}
	os.write_file(record_path, record[..file_start] + files.join(',') + record[file_end..]) or {
		panic(err)
	}

	stolen := run_home(b_parent, home, 'steal', 'proj')
	assert stolen.code == 0, stolen.err
	for dropped in ['../outside.txt', 'bad\\\\name', 'control\\x0dname'] {
		assert (stolen.out + stolen.err).contains('dropped unsafe path ${dropped}'), stolen.out + stolen.err
	}
	assert os.read_file(os.join_path(b_parent, 'proj', 'safe.txt'))! == 'safe\n'
	assert !os.exists(os.join_path(b_parent, 'outside.txt'))
	assert !os.exists(os.join_path(b_parent, 'proj', 'bad', 'name'))
	assert !os.exists('${b_parent}/proj/control\rname')
}

fn test_offer_steal_folder_remote() {
	syncroot := temp_repo('sync')
	home := temp_repo('sync-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'a.txt', 'from A\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'A first').code == 0
	stolen := run_home(b_parent, home, 'steal', 'proj')
	assert stolen.code == 0
	b := os.join_path(b_parent, 'proj')
	assert os.read_file(os.join_path(b, 'a.txt'))! == 'from A\n'
	write(b, 'b.txt', 'from B\n')
	assert run_home(b, home, 'save', 'B first').code == 0
	write(a, 'a2.txt', 'second\n')
	assert run_home(a, home, 'save', 'A second').code == 0
	assert run_home(a, home, 'steal', '--yes').code == 0
	assert os.exists(os.join_path(a, 'b.txt'))
	assert run_home(b_parent, home, 'steal', '--list').out.contains('proj')
	// Kepr keeps its own files in the same remote; a folder without a `head` is no repo.
	os.mkdir_all(os.join_path(remote, '.kepr', 'media', 'proj')) or { panic(err) }
	os.write_file(os.join_path(remote, '.kepr', 'media', 'proj', 'a.png'), 'png') or { panic(err) }
	assert run_home(b_parent, home, 'steal', '--list', '--json').out.contains('"repos":["proj"]')
	write(a, 'clash.txt', 'base\n')
	assert run_home(a, home, 'save', 'clash base').code == 0
	assert run_home(b, home, 'steal', '--yes').code == 0
	write(a, 'clash.txt', 'A version\n')
	assert run_home(a, home, 'save', 'A clash').code == 0
	write(b, 'clash.txt', 'B version\n')
	assert run_home(b, home, 'save', 'B clash').code == 0
	refused := run_home(b, home, 'steal', '--yes')
	assert refused.code == 1
	assert refused.err.contains('--mine') || refused.err.contains('--theirs')
	b_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]
	theirs := run_home(b, home, 'steal', '--theirs', '--json', '--yes')
	assert theirs.code == 0
	// The pre-combine tree is off the line now; the way back must be named,
	// or an agent without the history view cannot find it.
	assert theirs.out.contains('"previous_head":"${b_head}"')
	assert theirs.out.contains('"kept_versions":["clash.txt:${b_head}"]')
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'
	assert run_home(b, home, 'load', b_head, '--yes').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B version\n'
	assert run_home(b, home, 'load', theirs.out.all_after('"head":"')[..12], '--yes').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'A version\n'
	write(a, 'clash.txt', 'A second\n')
	assert run_home(a, home, 'save', 'A second clash').code == 0
	write(b, 'clash.txt', 'B second\n')
	assert run_home(b, home, 'save', 'B second clash').code == 0
	assert run_home(b, home, 'steal', '--mine', '--yes').code == 0
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'B second\n'
	assert run_home(b, home, 'view').out.contains('combine: kept mine for')
}

fn test_guided_steal_walks_the_terminal_and_can_cancel() {
	syncroot := temp_repo('guided-steal')
	home := temp_repo('guided-steal-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	remote := os.join_path(syncroot, 'remote')
	a := os.join_path(syncroot, 'A', 'proj')
	b_parent := os.join_path(syncroot, 'B')
	os.mkdir_all(a) or { panic(err) }
	os.mkdir_all(b_parent) or { panic(err) }
	init_repo(a)
	write(a, 'clash.txt', 'base\n')
	write(a, 'other.txt', 'base\n')
	write(a, 'same.txt', 'base\n')
	write(a, 'remote-only.txt', 'base\n')
	write(a, 'local-only.txt', 'base\n')
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	assert run_home(a, home, 'save', 'base').code == 0
	fetched := run_home(b_parent, home, 'steal', 'proj')
	assert fetched.code == 0
	assert fetched.out.contains('1 save at'), fetched.out
	b := os.join_path(b_parent, 'proj')

	write(b, 'dirty.txt', 'mine\n')
	before := run_home(b, home, 'status', '--json').out
	quit := run_pty_home(b, home, ['q'], 'steal')
	assert quit.out.contains('steal proj')
	assert quit.out.contains('you have 1 unsaved file')
	assert quit.out.contains('dirty.txt')
	assert run_home(b, home, 'status', '--json').out == before
	// A save needs a message; an empty one stops, says so, and saves nothing.
	unsaid := run_pty_home(b, home, ['s', ''], 'steal')
	assert unsaid.code == 1
	assert unsaid.out.contains('no message — nothing was saved')
	assert run_home(b, home, 'status', '--json').out == before
	checkpoint := run_pty_home(b, home, ['c'], 'steal')
	assert checkpoint.code == 0, checkpoint.err
	assert run_home(b, home, 'view', '--checkpoints').out.contains('before steal')

	assert run_home(a, home, 'steal', '--yes').code == 0
	write(a, 'forward.txt', 'new\n')
	assert run_home(a, home, 'save', 'fast forward').code == 0
	unchanged := run_home(b, home, 'status', '--json').out
	all_before := run_home(b, home, 'view', '--json').out
	assert run_home(b, home, 'steal').code == 1
	assert run_pty_home(b, home, [''], 'steal').code == 1
	assert run_home(b, home, 'status', '--json').out == unchanged
	assert run_home(b, home, 'view', '--json').out == all_before
	forward := run_pty_home(b, home, ['Y'], 'steal')
	assert forward.out.contains('proj is up to date · 1 new save')
	assert forward.code == 0, forward.out
	write(a, 'clash.txt', 'remote\n')
	write(a, 'other.txt', 'remote\n')
	write(a, 'same.txt', 'identical\n')
	write(a, 'remote-only.txt', 'remote\n')
	assert run_home(a, home, 'save', 'remote change').code == 0
	write(b, 'clash.txt', 'mine\n')
	write(b, 'other.txt', 'mine\n')
	write(b, 'same.txt', 'identical\n')
	write(b, 'local-only.txt', 'mine\n')
	assert run_home(b, home, 'save', 'local change').code == 0
	local_head := run_home(b, home, 'status', '--json').out.all_after('"head_id":"')[..12]
	// `d` opens both changes in the pager, which Enter leaves; `?` explains the two sides.
	cancel := run_pty_home(b, home, ['d', '', '?', 'm', 'b', 't', 't', 'n'], 'steal')
	assert cancel.out.contains('your changes')
	assert cancel.out.contains('remote changes')
	assert cancel.out.contains('Nothing is lost either way')
	// The shared save's age, relative: seconds old here, so `now` unless the machine is slow.
	since := cancel.out.split_into_lines().filter(it.contains('both moved since'))
	assert since.len == 1
	assert since[0].trim_space().ends_with(' · now') || since[0].trim_space().ends_with(' ago'), since[0]
	assert cancel.out.contains('5 files changed')
	assert cancel.out.contains('2 combine by themselves')
	assert cancel.out.contains('1 changed the same way')
	assert cancel.out.contains('2 need you')
	assert cancel.out.contains('ready to combine')
	assert run_home(b, home, 'status', '--json').out.contains('"head_id":"${local_head}"')
	assert os.read_file(os.join_path(b, 'clash.txt'))! == 'mine\n'

	done := run_pty_home(b, home, ['y'], 'steal', '--theirs')
	assert done.out.contains('combined · offered to proj')
	assert done.out.contains('took theirs: clash.txt · other.txt')
	assert !done.out.contains('kept mine')
	assert done.out.contains('to undo all of it: koh load ${local_head}')
	assert done.out.contains('your clash.txt is in ${local_head}')
	assert !done.out.contains('\x1b')
	for line in done.out.split_into_lines() {
		assert line.runes().len <= 80, line
	}
}

// A steal brings in the whole history, flags included; both output forms must
// say which saves came in flagged, and why.
fn test_a_steal_reports_flagged_saves() {
	syncroot := temp_repo('steal-flags')
	home := temp_repo('steal-flags-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	a := os.join_path(syncroot, 'A', 'proj')
	os.mkdir_all(a) or { panic(err) }
	init_repo(a)
	assert run_home(a, home, 'remote', 'folder', os.join_path(syncroot, 'remote')).code == 0
	write(a, 'a.txt', 'one\n')
	id := run_home(a, home, 'save', 'risky', '--json').out.all_after('"id":"')[..12]
	assert run_home(a, home, 'flag', id, '--reason', 'broke the build').code == 0
	assert run_home(a, home, 'offer').code == 0
	for name in ['B', 'C'] {
		os.mkdir_all(os.join_path(syncroot, name)) or { panic(err) }
	}
	json_stolen := run_home(os.join_path(syncroot, 'B'), home, 'steal', 'proj', '--json')
	assert json_stolen.code == 0
	assert json_stolen.out.contains('"flagged":["${id}"]')
	text_stolen := run_home(os.join_path(syncroot, 'C'), home, 'steal', 'proj')
	assert text_stolen.code == 0
	assert text_stolen.out.contains('[${id}] came in flagged — broke the build')
}

// A folder remote on a disk or share that is not mounted is simply not there.
// Creating it would put the saves in a stand-in folder the other machine never
// sees; the offer must say what is wrong instead.
fn test_an_unmounted_folder_remote_is_not_recreated() {
	syncroot := temp_repo('unmounted')
	home := temp_repo('unmounted-home')
	defer {
		os.rmdir_all(syncroot) or {}
		os.rmdir_all(home) or {}
	}
	mount := os.join_path(syncroot, 'nas')
	remote := os.join_path(mount, 'koh')
	a := os.join_path(syncroot, 'proj')
	os.mkdir_all(a) or { panic(err) }
	init_repo(a)
	assert run_home(a, home, 'remote', 'folder', remote).code == 0
	write(a, 'a.txt', 'one\n')
	assert run_home(a, home, 'save', 'first').code == 0
	os.rename(mount, os.join_path(syncroot, 'nas-unplugged')) or { panic(err) }
	os.mkdir(mount) or { panic(err) }
	offered := run_home(a, home, 'offer')
	assert offered.code == 1
	assert offered.err.contains('mounted')
	assert !os.exists(remote)
	write(a, 'a.txt', 'two\n')
	saved := run_home(a, home, 'save', 'second')
	assert saved.code == 0
	assert saved.out.contains('mounted')
	assert !os.exists(remote)
}

fn test_man_and_koh2_migration_gate() {
	dir := temp_repo('man')
	home := temp_repo('man-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	whole := run_home(dir, home, 'man')
	assert whole.code == 0
	assert whole.out.contains('NAME')
	assert whole.out.contains('COMMANDS')
	assert whole.out.contains('STRICT KOH DISCIPLINE')
	assert whole.out.contains('Asha Software · asha.software')
	assert !whole.out.contains('\x1b') && !whole.out.contains('◆')
	strip := run_home(dir, home, 'man', 'strip')
	assert strip.code == 0
	assert strip.out.contains('strip')
	assert !strip.out.contains('koh save ')
	steal := run_home(dir, home, 'man', 'steal').out
	assert steal.starts_with('    koh steal') && steal.contains('koh steal my-project')
	assert run_home(dir, home, 'man', 'init').out.trim_space() == "koh init\n        Create `.koh` here, and a starter `.kohignore` if there isn't one."
	assert run_home(dir, home, 'man', 'nonsense').code == 2
	legacy := temp_repo('legacy')
	defer { os.rmdir_all(legacy) or {} }
	os.mkdir_all(os.join_path(legacy, '.koh')) or { panic(err) }
	fake := os.join_path(home, 'bin')
	os.mkdir_all(fake) or { panic(err) }
	fake_koh := os.join_path(fake, 'koh2')
	os.write_file(fake_koh, '#!/bin/sh\nprintf "handoff:%s\\n" "$*"\nexit 7\n') or { panic(err) }
	os.chmod(fake_koh, 0o755) or { panic(err) }
	for command in ['init', 'save', 'checkpoint', 'status', 'diff', 'undo', 'revert', 'load', 'flag',
		'pluck', 'peek', 'offer', 'view', 'strip', 'build', 'doctor', 'steal'] {
		refused := run_home_with_path(legacy, home, fake, command, '--json')
		assert refused.code == 1, command
		assert refused.out.trim_space() == '', command
		assert refused.err.contains('koh migrate'), refused.err
		assert !refused.err.contains('handing'), refused.err
		assert os.is_dir(os.join_path(legacy, '.koh'))
		assert !os.exists(os.join_path(legacy, '.koh-v2'))
	}
	// And one that belongs to the machine, not the repo, is Koh 3's own.
	remote := run_home_with_path(legacy, home, fake, 'remote')
	assert !remote.out.contains('handoff'), remote.out
	assert remote.err.contains('needs a terminal'), remote.err
}

fn run_home_with_path(repo string, home string, bin_dir string, args ...string) Result {
	stamp := '${os.getpid()}-${time.now().unix_nano()}'
	base := os.join_path(os.temp_dir(), 'koh3-cli-${stamp}')
	out_path := '${base}.out'
	err_path := '${base}.err'
	code_path := '${base}.code'
	mut command := 'HOME=${q(home)} PATH=${q(bin_dir + ':' + os.getenv('PATH'))} ${q(binary)}'
	for arg in args {
		command += ' ${q(arg)}'
	}
	shell := 'cd ${q(repo)} && ${command} </dev/null >${q(out_path)} 2>${q(err_path)}; printf "%s" \$? >${q(code_path)}'
	result := os.execute(shell)
	if result.exit_code != 0 {
		panic('could not run test command: ${result.output}')
	}
	code := os.read_file(code_path) or { panic(err) }
	out := os.read_file(out_path) or { '' }
	err := os.read_file(err_path) or { '' }
	os.rm(out_path) or {}
	os.rm(err_path) or {}
	os.rm(code_path) or {}
	return Result{
		code: code.int()
		out:  out
		err:  err
	}
}

// --- migration -------------------------------------------------------------

// koh2_binary finds Koh 2: `koh2` since the cutover, `koh` before it, and never Koh 3.
fn koh2_binary() string {
	for name in ['koh2', 'koh'] {
		path := os.find_abs_path_of_executable(name) or { continue }
		if os.execute('${os.quoted_path(path)} --version').output.starts_with('koh v2') {
			return path
		}
	}
	return ''
}

// run_koh2 runs the Koh 2 binary in a fixture; its own output is not under
// test here.
fn run_koh2(dir string, command string) {
	os.execute('cd ${q(dir)} && ${command} >/dev/null 2>&1')
}

fn save_ids(dir string) []string {
	mut ids := []string{}
	for name in os.ls(os.join_path(dir, '.koh', 'snapshots')) or { []string{} } {
		if name.ends_with('.json') {
			ids << name.trim_right('.json')
		}
	}
	ids.sort()
	return ids
}

fn test_migrate_converts_a_koh2_repo_and_keeps_every_save() {
	koh2 := koh2_binary()
	if koh2 == '' {
		println('skipping the migration tests: koh (Koh 2) is not on PATH')
		return
	}
	dir := temp_repo('migrate')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	// One file large enough to be an object, one small enough to be inlined.
	write(dir, 'code.txt', 'x'.repeat(700))
	write(dir, 'tiny.txt', 'tiny\n')
	run_koh2(dir, '${q(koh2)} save "first save"')
	run_koh2(dir, '${q(koh2)} checkpoint "before something"')
	write(dir, 'code.txt', 'y'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "second save"')
	original := save_ids(dir)
	assert original.len == 3

	// A version handed back must be readable.
	unreadable := run_home(dir, home, 'migrate', '--with', os.join_path(dir, 'no-such-backup'), '--yes')
	assert unreadable.code == 1 && unreadable.err.contains('cannot read'), unreadable.err
	// Off a terminal it asks nothing and changes nothing without --yes.
	unasked := run_home(dir, home, 'migrate')
	assert unasked.code == 1 && unasked.err.contains('needs --yes'), unasked.err
	assert os.is_dir(os.join_path(dir, '.koh'))
	report := run_home(dir, home, 'migrate', '--yes')
	assert report.code == 0
	assert report.out.contains('this will:')
	assert report.out.contains('migrated 3 saves')
	// The swap: `.koh` is a file, the old data is archived, nothing is left in the draft.
	assert os.is_file(os.join_path(dir, '.koh'))
	assert os.is_dir(os.join_path(dir, '.koh-v2'))
	assert os.is_file(os.join_path(dir, '.kohignore'))
	assert !os.exists(os.join_path(dir, '.koh-migrate'))

	// Every save kept its original ID, and the new repo is sound.
	listed := run_home(dir, home, 'view', '--json')
	assert listed.code == 0
	for id in original {
		assert listed.out.contains(id)
	}
	assert run_home(dir, home, 'doctor').code == 0
	assert run_home(dir, home, 'status').code == 0

	// Migrating again has nothing to convert.
	assert run_home(dir, home, 'migrate', '--yes').code == 1
}

fn test_migrate_refuses_a_tree_that_does_not_match_the_last_save() {
	koh2 := koh2_binary()
	if koh2 == '' {
		return
	}
	dir := temp_repo('migrate-dirty')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-dirty-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	write(dir, 'code.txt', 'x'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "only save"')
	write(dir, 'code.txt', 'unsaved change\n')

	refused := run_home(dir, home, 'migrate', '--yes')
	assert refused.code == 1
	assert refused.err.contains('save with koh2 first')
	// Nothing moved: still Koh 2, no archive, no draft file.
	assert os.is_dir(os.join_path(dir, '.koh'))
	assert !os.exists(os.join_path(dir, '.koh-v2'))
	assert !os.exists(os.join_path(dir, '.koh-migrate'))
}

// Koh 2 never saved a root `.kohconfig`, root `.kohignore.<remote>` rules or
// `*.bundle` files, so a clean Koh 2 repo may hold them. Most real repos have
// a `.kohconfig`; migrate must not call them unsaved work.
fn test_migrate_passes_over_the_files_koh2_never_saved() {
	koh2 := koh2_binary()
	if koh2 == '' {
		return
	}
	dir := temp_repo('migrate-koh2-ignores')
	defer { os.rmdir_all(dir) or {} }
	home := temp_repo('migrate-koh2-ignores-home')
	defer { os.rmdir_all(home) or {} }
	run_koh2(dir, '${q(koh2)} init')
	write(dir, 'code.txt', 'x'.repeat(700))
	run_koh2(dir, '${q(koh2)} save "only save"')
	write(dir, '.kohconfig', 'stable_days = 14\n')
	write(dir, '.kohignore.public', 'private/\n')
	write(dir, 'lib/app.bundle', 'bundle\n')
	write(dir, 'ios/Settings.bundle/Root.plist', 'settings\n')
	// Koh 2 keeps saving a file under a folder pattern added later, where
	// Koh 3 reads the same rule as covering the folder: the saved file is on
	// disk and matches, so the tree is clean.
	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')
	run_koh2(dir, '${q(koh2)} save --agent test --session test "add the dsym"')
	// Koh 2 skips *.bundle even when its rules no longer list it.
	ignore_path := os.join_path(dir, '.koh', 'ignore')
	rules := os.read_file(ignore_path)!.split_into_lines().filter(it != '*.bundle')
	os.write_file(ignore_path, rules.join('\n') + '\nnative/*.dSYM\n')!
	// A saved file the walk skips still has to match what was saved.
	write(dir, 'native/t.dSYM/Info.plist', 'changed\n')
	changed := run_home(dir, home, 'migrate', '--yes')
	assert changed.code == 1
	assert changed.err.contains('native/t.dSYM/Info.plist does not match')
	write(dir, 'native/t.dSYM/Info.plist', 'plist\n')
	assert os.execute('cd ${q(dir)} && ${q(koh2)} status --json').output.contains('"dirty":false')

	migrated := run_home(dir, home, 'migrate', '--yes')
	assert migrated.code == 0, migrated.err
	// They stay where they were, for the user to keep or delete.
	assert os.read_file(os.join_path(dir, '.kohconfig'))! == 'stable_days = 14\n'
}

struct FakeKepr {
	no_access bool
	// One reply the redemption must cope with: '500', 'garbage' or 'incomplete'.
	fail string
	// When set, /api/connect answers 307 here instead of a code reply.
	redirect_to string
mut:
	objects map[string][]u8
	// What the client asked for. A map, because the server holds its own copy of this struct.
	seen map[string]string
}

fn (mut h FakeKepr) handle(req http.Request) http.Response {
	if req.method == .post && req.url == '/api/connect' {
		h.seen['code'] = req.data
		if h.redirect_to != '' {
			return http.Response{
				status_code: 307
				status_msg:  'Temporary Redirect'
				header:      http.new_header(
					key:   .location
					value: h.redirect_to
				)
			}
		}
		if h.fail == '500' {
			return http.Response{ status_code: 500, status_msg: 'Internal Server Error' }
		}
		if h.fail == 'garbage' {
			return http.Response{ status_code: 200, status_msg: 'OK', body: 'not json at all' }
		}
		if h.fail == 'incomplete' {
			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://x","bucket":"","region":"","access_key_id":"","secret_access_key":""}' }
		}
		if req.data == 'code=good' && !h.no_access {
			return http.Response{ status_code: 200, status_msg: 'OK', body: '{"endpoint":"http://${req.header.get_custom('Host', http.HeaderQueryConfig{}) or { '' }}","bucket":"bucket","region":"test","access_key_id":"access","secret_access_key":"secret"}' }
		}
		return http.Response{ status_code: 404, status_msg: 'Not Found', body: '{"error":"no_code","message":"no code"}' }
	}
	if req.method == .get && req.url.starts_with('/connect') {
		h.seen['connect'] = req.url
		return http.Response{ status_code: if h.no_access { 404 } else { 302 }, status_msg: 'Found' }
	}
	key := req.url
	if key.starts_with('/bucket/') {
		match req.method {
			.put {
				if req.header.get_custom('If-None-Match', http.HeaderQueryConfig{}) or { '' } == '*' && key in h.objects {
					return http.Response{ status_code: 412, status_msg: 'Precondition Failed' }
				}
				h.objects[key] = req.data.bytes()
				return http.Response{ status_code: 200, status_msg: 'OK' }
			}
			.get {
				if body := h.objects[key] {
					return http.Response{
						status_code: 200
						status_msg:  'OK'
						body:        body.bytestr()
						header:      http.new_header(
							key:   .etag
							value: '"tag"'
						)
					}
				}
				return http.Response{ status_code: 404, status_msg: 'Not Found' }
			}
			.delete {
				h.objects.delete(key)
				return http.Response{ status_code: 204, status_msg: 'No Content' }
			}
			else {}
		}
	}
	return http.Response{ status_code: 404, status_msg: 'Not Found' }
}

fn start_fake_kepr(no_access bool, fail string, redirect_to string) !(int, &http.Server, &FakeKepr) {
	for port in 19401 .. 19411 {
		listener := net.listen_tcp(.ip, '127.0.0.1:${port}') or { continue }
		fake := &FakeKepr{
			no_access:   no_access
			fail:        fail
			redirect_to: redirect_to
			seen:        map[string]string{}
		}
		mut server := &http.Server{
			listener:             listener
			handler:              fake
			show_startup_message: false
		}
		spawn server.listen_and_serve()
		server.wait_till_running()!
		return port, server, fake
	}
	return error('no free fake Kepr port')
}

// A slash makes an argument an address, so half an address is an error and never a repo name.
fn test_steal_refuses_an_address_that_is_not_one() {
	outside := temp_repo('steal-address')
	home := temp_repo('steal-address-home')
	defer { os.rmdir_all(outside) or {} }
	defer { os.rmdir_all(home) or {} }
	// The repo half becomes a URL path segment and a folder here, so it is a name Kepr serves.
	for bad in ['kepr.uk/', '/shipped', 'kepr.uk/..', 'kepr.uk/.', 'kepr.uk/a b', 'kepr.uk/nina?x',
		'kepr.uk/nina#x', 'kepr.uk/nína'] {
		refused := run_home(outside, home, 'steal', bad)
		assert refused.code == 1, bad
		assert refused.err.contains('is not <host>/<repo>'), '${bad}: ${refused.err}'
	}
	assert run_home(outside, home, 'steal', 'one', 'two').code == 2
	assert run_home(outside, home, 'steal', '--list', 'extra').code == 2
}

fn test_remote_kepr_saves_and_refuses_without_changes() {
	repo := temp_repo('kepr')
	home := temp_repo('kepr-home')
	defer { os.rmdir_all(repo) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(repo)
	port, mut server, fake := start_fake_kepr(false, '', '')!
	defer { server.stop() }
	host := 'http://127.0.0.1:${port}'
	// A trailing slash is the same host, and the saved line keeps the normalised form.
	good := run_home(repo, home, 'remote', '${host}/', '--code', 'good')
	assert good.code == 0, good.err
	remote_path := os.join_path(home, '.config', 'koh', 'remote')
	credentials_path := os.join_path(home, '.config', 'koh', 'credentials')
	assert os.read_file(remote_path)! == '# written by koh remote — the remote for every repo on this machine\nkind=s3\nendpoint=${host}\nbucket=bucket\nregion=test\nkepr=${host}\n'
	assert os.read_file(credentials_path)! == '# written by koh remote — keep this file private\naccess_key=access\nsecret_key=secret\n'
	// The code went as a form field, and the connect page was never asked for: there was a code.
	assert (fake.seen['code'] or { '' }) == 'code=good'
	assert (fake.seen['connect'] or { '' }) == ''
	// A refused code, a missing terminal and a wrong reply all leave both files as they were.
	before := os.read_file(remote_path)!
	before_keys := os.read_file(credentials_path)!
	bad := run_home(repo, home, 'remote', host, '--yes', '--code', 'bad')
	assert bad.code == 1
	assert bad.err.contains('wrong or has expired')
	// The 404 could also mean a Kepr that hands out nothing, so the connect page is asked for
	// with this machine's name. (This machine's name holds no character needing an escape, so
	// that part of the query cannot be exercised here.)
	// `machine.name()` is `os.hostname() or { 'unknown' }`, so the query carries the same text.
	assert (fake.seen['connect'] or { '' }).contains('machine=${os.hostname() or { 'unknown' }}')
	no_terminal := run_home(repo, home, 'remote', host, '--yes')
	assert no_terminal.code == 1
	assert no_terminal.err.contains('needs a terminal')
	assert os.read_file(remote_path)! == before
	assert os.read_file(credentials_path)! == before_keys
}

fn test_remote_kepr_refuses_hosts_that_are_not_hosts() {
	repo := temp_repo('kepr-host')
	home := temp_repo('kepr-host-home')
	defer { os.rmdir_all(repo) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(repo)
	for host in ['kepr.uk/foo', 'https://kepr.uk?x=1', 'kepr.uk#frag', 'user@kepr.uk', 'kepr uk',
		'http://127.0.0.1:1/foo', 'https://'] {
		refused := run_home(repo, home, 'remote', host, '--yes', '--code', 'good')
		assert refused.code == 1, host
		assert refused.err.contains('is not a Kepr address'), '${host}: ${refused.err}'
	}
	// The reply carries the bucket's secret key, so plain http is only for this machine's own Kepr.
	for host in ['http://kepr.uk', 'http://10.0.0.2:3000', 'http://KEPR.uk:80'] {
		refused := run_home(repo, home, 'remote', host, '--yes', '--code', 'good')
		assert refused.code == 1, host
		assert refused.err.contains('needs https'), '${host}: ${refused.err}'
		stolen := run_home(home, home, 'steal', '${host}/nina')
		assert stolen.code == 1, host
		assert stolen.err.contains('needs https'), '${host}: ${stolen.err}'
	}
	// --code belongs to the host form alone.
	assert run_home(repo, home, 'remote', 's3', 'https://x', 'b', 'r', '--code', 'good').code == 2
	assert run_home(repo, home, 'remote', 'folder', '/tmp', '--code', 'good').code == 2
	assert run_home(repo, home, 'remote', '--code', 'good').code == 2
	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))
}

fn test_remote_kepr_refuses_what_is_not_a_code_reply() {
	repo := temp_repo('kepr-reply')
	home := temp_repo('kepr-reply-home')
	defer { os.rmdir_all(repo) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(repo)
	remote_path := os.join_path(home, '.config', 'koh', 'remote')
	for mode in ['500', 'garbage', 'incomplete'] {
		port, mut server, _ := start_fake_kepr(false, mode, '')!
		refused := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')
		server.stop()
		assert refused.code == 1, mode
		assert refused.err.contains('nothing was changed'), '${mode}: ${refused.err}'
		assert !os.exists(remote_path)
	}
	// A redirect would hand the code to wherever it points, so it is refused and never followed.
	target_port, mut target, target_fake := start_fake_kepr(false, '', '')!
	port, mut server, _ := start_fake_kepr(false, '', 'http://127.0.0.1:${target_port}/api/connect')!
	redirected := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'good')
	server.stop()
	target.stop()
	assert redirected.code == 1
	assert redirected.err.contains('refused the code')
	assert target_fake.seen.len == 0, 'the code was forwarded: ${target_fake.seen}'
	assert !os.exists(remote_path)
}

// An unreachable Kepr is a refusal too, and the settings are still untouched.
fn test_remote_kepr_that_cannot_be_reached_changes_nothing() {
	repo := temp_repo('kepr-down')
	home := temp_repo('kepr-down-home')
	defer { os.rmdir_all(repo) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(repo)
	refused := run_home(repo, home, 'remote', 'http://127.0.0.1:1', '--code', 'good')
	assert refused.code == 1
	assert refused.err.contains('could not reach Kepr')
	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))
}

fn test_remote_kepr_without_bucket_access_is_explained() {
	repo := temp_repo('kepr-no-access')
	home := temp_repo('kepr-no-access-home')
	defer { os.rmdir_all(repo) or {} }
	defer { os.rmdir_all(home) or {} }
	init_repo(repo)
	port, mut server, _ := start_fake_kepr(true, '', '')!
	defer { server.stop() }
	r := run_home(repo, home, 'remote', 'http://127.0.0.1:${port}', '--code', 'bad')
	assert r.code == 1
	assert r.err.contains("doesn't hand out bucket access")
	assert !os.exists(os.join_path(home, '.config', 'koh', 'remote'))
}

fn test_ignore_batch_preview_cancel_and_toggle() {
	repo := temp_repo('ignore-batch')
	home := temp_repo('ignore-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	assert run_home(repo, home, 'save', 'initial').code == 0
	write(repo, 'one/a.txt', 'a')
	write(repo, 'two/b.txt', 'b')
	write(repo, 'literal*.txt', 'literal')
	before := os.read_file(os.join_path(repo, '.kohignore'))!
	refused := run_home(repo, home, 'ignore', 'one', 'two', 'literal*.txt', '--json')
	assert refused.code == 1
	assert refused.out.contains('"changed":false')
	assert refused.out.contains('koh strip <path>')
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	cancel := run_pty_home(repo, home, [''], 'ignore', 'one', 'two', 'literal*.txt')
	assert cancel.code == 1
	assert cancel.out.contains('/one/') && cancel.out.contains('/two/')
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	assert run_home(repo, home, 'ignore', 'one').code == 1
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	assert run_pty_home(repo, home, ['y'], 'ignore', 'confirmed.txt').code == 0
	added := run_home(repo, home, 'ignore', 'one', './one', 'two', 'literal*.txt', '--yes', '--json')
	assert added.code == 0
	assert added.out.contains('"changed":true')
	text := os.read_file(os.join_path(repo, '.kohignore'))!
	assert text.count('/one/\n') == 1
	assert text.contains('/literal\\*.txt\n')
	status := run_home(repo, home, 'status', '--json')
	assert status.code == 0
	assert !status.out.contains('one/a.txt') && !status.out.contains('literal*.txt')
	assert run_home(repo, home, 'ignore', 'one', '--yes').code == 0
	assert run_home(repo, home, 'status', '--json').out.contains('one/a.txt')
	assert run_home(repo, home, 'ignore', 'two/b.txt', '--yes').code == 0
	assert !os.read_file(os.join_path(repo, '.kohignore'))!.contains('/two/')
}

fn test_ignore_global_rules_and_scope_overlap() {
	repo := temp_repo('ignore-global')
	other := temp_repo('ignore-other')
	home := temp_repo('ignore-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(other) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	assert run_home(repo, home, 'save', 'initial').code == 0
	assert run_home(other, home, 'init').code == 0
	assert run_home(other, home, 'save', 'initial').code == 0
	write(repo, 'cache/a', 'a')
	write(other, 'nested/cache/b', 'b')
	assert run_home(repo, home, 'ignore', 'cache', '--yes').code == 0
	assert run_home(repo, home, 'ignore', 'cache', '--global', '--yes').code == 0
	assert os.read_file(os.join_path(home, '.kohignore'))! == 'cache/\n'
	assert run_home(other, home, 'save', 'global rules applied').code == 1
	assert !run_home(other, home, 'status', '--json').out.contains('nested/cache/b')
	result := run_home(repo, home, 'ignore', 'cache', '--yes')
	assert result.code == 0 && result.out.contains('still ignored')
	assert !run_home(repo, home, 'status', '--json').out.contains('cache/a')
	assert run_home(repo, home, 'ignore', 'cache', '--global', '--yes').code == 0
	assert run_home(repo, home, 'status', '--json').out.contains('cache/a')
	assert run_home(other, home, 'status', '--json').out.contains('nested/cache/b')
	assert run_home(home, home, 'ignore', 'missing/', '--global', '--yes').code == 0
}

fn test_ignore_broad_rules_mixed_batch_and_invalid_paths() {
	repo := temp_repo('ignore-rules')
	home := temp_repo('ignore-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	assert run_home(repo, home, 'save', 'initial').code == 0
	write(repo, '.kohignore', '# keep this\n*.log\n/folder/\n')
	write(repo, 'folder/a', 'a')
	os.symlink(home, os.join_path(repo, 'link'))!
	before := os.read_file(os.join_path(repo, '.kohignore'))!
	for bad in ['../outside', '.koh', '.kohignore', '.', 'link/a', 'bad\nname'] {
		assert run_home(repo, home, 'ignore', 'good', bad, '--yes').code == 1
		assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	}
	mixed := run_home(repo, home, 'ignore', 'a.log', 'new.txt', '--yes')
	assert mixed.code == 0 && mixed.out.contains('other items')
	assert os.read_file(os.join_path(repo, '.kohignore'))! == '# keep this\n/folder/\n/new.txt\n'
	assert run_home(os.join_path(repo, 'folder'), home, 'ignore', 'a', '--yes').code == 0
	assert !os.read_file(os.join_path(repo, '.kohignore'))!.contains('/folder/')
	assert run_home(repo, home, 'ignore').code == 2
}

fn test_ignore_reads_symlinked_other_scope_and_subdirectory_rules() {
	repo := temp_repo('ignore-symlink')
	home := temp_repo('ignore-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	write(home, 'rules', 'cache/\n')
	os.symlink(os.join_path(home, 'rules'), os.join_path(home, '.kohignore'))!
	local := run_home(repo, home, 'ignore', 'cache/', '--yes')
	assert local.code == 0 && local.out.contains('still ignored')
	assert run_home(repo, home, 'ignore', 'cache/', '--global', '--yes').code == 1
	os.rm(os.join_path(home, '.kohignore'))!
	write(home, '.kohignore', 'cache/\n')
	write(repo, '.kohignore', '/sub/cache/\n')
	write(repo, 'sub/cache/a', 'a')
	global := run_home(os.join_path(repo, 'sub'), home, 'ignore', 'cache', '--global', '--yes')
	assert global.code == 0 && global.out.contains('still ignored')
	assert os.read_file(os.join_path(repo, '.kohignore'))! == '/sub/cache/\n'
	assert os.read_file(os.join_path(home, '.kohignore'))! == ''
}

fn test_ignore_refuses_stripped_paths_and_preserves_crlf_comments() {
	repo := temp_repo('ignore-stripped')
	home := temp_repo('ignore-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	write(repo, 'secret', 'secret')
	assert run_home(repo, home, 'save', 'initial').code == 0
	assert run_pty_home(repo, home, ['y', 'secret'], 'strip', 'secret').code == 0
	before := os.read_file(os.join_path(repo, '.kohignore'))!
	assert run_home(repo, home, 'ignore', 'secret', '--yes').code == 1
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	write(repo, '.kohignore', '# keep\r\n*.log\r\nlast')
	assert run_home(repo, home, 'ignore', 'one.log', '--yes').code == 0
	assert os.read_file(os.join_path(repo, '.kohignore'))! == '# keep\r\nlast'
}

fn test_strip_multiple_paths_confirms_entire_batch_before_changes() {
	repo := temp_repo('strip-batch')
	home := temp_repo('strip-home')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	write(repo, 'private/a', 'a')
	write(repo, 'secret.txt', 'secret')
	write(repo, 'keep.txt', 'keep')
	assert run_home(repo, home, 'save', 'initial').code == 0
	before := os.read_file(os.join_path(repo, '.kohignore'))!
	cancel := run_pty_home(repo, home, ['y', 'private', ''], 'strip', 'private/', 'secret.txt')
	assert cancel.code == 1
	assert cancel.out.contains('private') && cancel.out.contains('secret.txt')
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	assert run_home(repo, home, 'status', '--json').out.contains('"dirty":false')
	assert run_pty_home(repo, home, [], 'strip', 'private', '../bad').code == 1
	assert os.read_file(os.join_path(repo, '.kohignore'))! == before
	stripped := run_pty_home(repo, home, ['y', 'private', 'private/a', 'secret.txt'], 'strip', 'private/', 'private', 'private/a', 'secret.txt', '--json')
	assert stripped.code == 0, stripped.out
	assert stripped.out.contains('"strips":[')
	assert stripped.out.contains('"path":"private"') && stripped.out.contains('"path":"secret.txt"')
	assert os.read_file(os.join_path(repo, 'secret.txt'))! == 'secret'
	assert os.read_file(os.join_path(repo, 'private/a'))! == 'a'
	text := os.read_file(os.join_path(repo, '.kohignore'))!
	assert text.count('/private\n') == 1 && text.count('/secret.txt\n') == 1
	assert !text.contains('/private/a\n')
	assert run_home(repo, home, 'save', 'rules').code == 0
	assert run_home(repo, home, 'status', '--json').out.contains('"dirty":false')
}

fn test_strip_legacy_paths_and_trailing_slash_remote_retry() {
	repo := temp_repo('strip-legacy')
	home := temp_repo('strip-home')
	remote_dir := temp_repo('strip-remote')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
		os.rmdir_all(remote_dir) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	write(repo, 'secret', 'secret')
	assert run_home(repo, home, 'save', 'legacy').code == 0
	store := storage.open(repo)!
	store.db.exec("UPDATE save_files SET path = '../unsafe' WHERE path = 'secret'")!
	store.close()
	legacy := run_pty_home(repo, home, ['y', '../unsafe'], 'strip', '../unsafe')
	assert legacy.code == 0, legacy.out
	assert run_home(repo, home, 'doctor', '--json').code == 0
	write(repo, 'private/a', 'private')
	assert run_home(repo, home, 'remote', 'folder', remote_dir).code == 0
	assert run_home(repo, home, 'save', 'folder').code == 0
	old_store := storage.open(repo)!
	exchange.strip_local(old_store, 'private/', '')!
	old_store.close()
	retried := run_pty_home(repo, home, [], 'strip', 'private/')
	assert retried.code == 0 && retried.out.contains('already stripped'), retried.out
	checked := storage.open(repo)!
	defer { checked.close() }
	assert !exchange.strip_pending(checked, 'private/')
}

fn test_strip_batch_reports_each_ignore_write_failure() {
	repo := temp_repo('strip-rule-failure')
	home := temp_repo('strip-home')
	remote_dir := temp_repo('strip-rule-remote')
	defer {
		os.rmdir_all(repo) or {}
		os.rmdir_all(home) or {}
		os.rmdir_all(remote_dir) or {}
	}
	assert run_home(repo, home, 'init').code == 0
	write(repo, 'one', 'one')
	write(repo, 'two', 'two')
	assert run_home(repo, home, 'remote', 'folder', remote_dir).code == 0
	assert run_home(repo, home, 'save', 'initial').code == 0
	os.rename(os.join_path(repo, '.kohignore'), os.join_path(repo, 'rules-backup'))!
	os.mkdir(os.join_path(repo, '.kohignore'))!
	failed := run_pty_home(repo, home, ['y', 'one', 'two'], 'strip', 'one', 'two', '--json')
	assert failed.code == 1, failed.out
	assert failed.out.count('"ignore_failed":') == 2
	assert failed.out.contains('by hand') && failed.out.contains('history ban still applies')
	assert failed.out.contains('"path":"one"') && failed.out.contains('"path":"two"')
	store := storage.open(repo)!
	defer { store.close() }
	assert exchange.strip_scope(store, 'one', '')!.files == 0
	assert exchange.strip_scope(store, 'two', '')!.files == 0
	assert !exchange.strip_pending(store, 'one') && !exchange.strip_pending(store, 'two')
}

fn test_destructive_restore_enter_cancels_and_uppercase_y_confirms() {
	dir := temp_repo('restore-default-no')
	home := temp_repo('restore-default-no-home')
	defer {
		os.rmdir_all(dir) or {}
		os.rmdir_all(home) or {}
	}
	assert run_home(dir, home, 'init').code == 0
	write(dir, 'file.txt', 'old\n')
	assert run_home(dir, home, 'save', 'old').code == 0
	id := run_home(dir, home, 'status', '--json').out.all_after('"head_id":"')[..12]
	write(dir, 'file.txt', 'new\n')
	assert run_home(dir, home, 'save', 'new').code == 0
	before := run_home(dir, home, 'status', '--json').out
	current := before.all_after('"head_id":"')[..12]
	for args in [['undo'], ['load', id], ['pluck', current, '--reverse']] {
		cancel := run_pty_home(dir, home, [''], ...args)
		assert cancel.code == 1
		assert cancel.out.contains('continue? [y/N]')
		assert run_home(dir, home, 'status', '--json').out == before
		assert os.read_file(os.join_path(dir, 'file.txt'))! == 'new\n'
	}
	write(dir, 'file.txt', 'unsaved\n')
	assert run_pty_home(dir, home, [''], 'revert').code == 1
	assert os.read_file(os.join_path(dir, 'file.txt'))! == 'unsaved\n'
	assert run_pty_home(dir, home, ['Y'], 'revert').code == 0
	assert os.read_file(os.join_path(dir, 'file.txt'))! == 'new\n'
}

fn test_events_only_sync_requires_consent_and_noop_does_not() {
	base := temp_repo('event-consent')
	home := temp_repo('event-consent-home')
	defer {
		os.rmdir_all(base) or {}
		os.rmdir_all(home) or {}
	}
	a := os.join_path(base, 'A', 'proj')
	parent := os.join_path(base, 'B')
	os.mkdir_all(a)!
	os.mkdir_all(parent)!
	assert run_home(a, home, 'init').code == 0
	assert run_home(a, home, 'remote', 'folder', os.join_path(base, 'remote')).code == 0
	write(a, 'secret.txt', 'secret')
	assert run_home(a, home, 'save', 'base').code == 0
	assert run_home(parent, home, 'steal', 'proj').code == 0
	b := os.join_path(parent, 'proj')
	assert run_home(b, home, 'steal').code == 0
	assert run_home(b, home, 'offer').code == 0
	assert run_pty_home(a, home, ['y', 'secret.txt'], 'strip', 'secret.txt').code == 0
	before := run_home(b, home, 'view', '--json').out
	assert run_home(b, home, 'steal', '--json').code == 1
	assert run_pty_home(b, home, [''], 'steal').code == 1
	assert run_home(b, home, 'view', '--json').out == before
	store := storage.open(b)!
	held := store.db.prepare("SELECT COUNT(*) FROM save_files WHERE path = 'secret.txt'")!
	assert held.step()!
	assert held.int(0) > 0
	held.finalize()
	store.close()
	assert run_home(b, home, 'steal', '--yes').code == 0
	checked := storage.open(b)!
	removed := checked.db.prepare("SELECT COUNT(*) FROM save_files WHERE path = 'secret.txt'")!
	assert removed.step()!
	assert removed.int(0) == 0
	removed.finalize()
	checked.close()
}

fn test_doctor_reports_corruption_restores_and_dirty_work_in_one_document() {
	repo := temp_repo('doctor-health')
	init_repo(repo)
	write(repo, 'app', 'original')
	assert run(repo, 'save', 'baseline').code == 0
	write(repo, 'app', 'unsaved work')
	ordinary := run(repo, 'doctor', '--json')
	assert ordinary.code == 0
	assert ordinary.out.contains('"health":"healthy"')
	assert ordinary.out.contains('"modified":["app"]')
	assert ordinary.out.contains('"line_saves":1')
	assert ordinary.out.contains('"scope":')
	store := storage.open(repo)!
	store.db.exec('UPDATE objects SET size = size + 1')!
	store.set_state('restoring', 'yes')!
	store.close()
	broken := run(repo, 'doctor', '--json')
	assert broken.code == 1
	assert broken.out.contains('"health":"unhealthy"')
	assert broken.out.contains('stored size does not match')
	assert broken.out.contains('"restore_unfinished":true')
	assert broken.out.contains('"checks":')
	assert broken.out.contains('"root":')
	assert run(repo, 'doctor', 'unexpected').code == 2
}

fn test_doctor_checks_the_remote_by_default_and_offline_explicitly_skips_it() {
	repo := temp_repo('doctor-remote')
	home := temp_repo('doctor-remote-home')
	bucket := temp_repo('doctor-remote-bucket')
	assert run_home(repo, home, 'remote', 'folder', bucket).code == 0
	assert run_home(repo, home, 'init').code == 0
	write(repo, 'app', 'original')
	assert run_home(repo, home, 'save', 'baseline').code == 0
	before := run_home(repo, home, 'view', '--json').out
	healthy := run_home(repo, home, 'doctor', '--json')
	assert healthy.code == 0
	assert healthy.out.contains('remote history, events and objects')
	assert healthy.out.contains('"remote_saves":1')
	assert run_home(repo, home, 'view', '--json').out == before
	store := storage.open(repo)!
	name := store.state('remote_repo') or { panic('missing remote repo') }
	store.close()
	os.write_file(os.join_path(bucket, name, 'objects', storage.hash_hex('original'.bytes())),
		'corrupt')!
	bad := run_home(repo, home, 'doctor', '--json')
	assert bad.code == 1
	assert bad.out.contains('damaged remote object')
	assert bad.out.contains('"name":"SQLite integrity","status":"pass"')
	offline := run_home(repo, home, 'doctor', '--offline', '--json')
	assert offline.code == 0
	assert offline.out.contains('--offline requested')
	assert offline.out.contains('"status":"skipped"')
	fast := run_home(repo, home, 'doctor', '--fast', '--json')
	assert fast.code == 0
	assert fast.out.contains('--fast requested')
}

fn test_doctor_returns_a_report_when_the_database_cannot_be_opened() {
	repo := temp_repo('doctor-unreadable')
	init_repo(repo)
	os.write_file(os.join_path(repo, '.koh'), 'not a SQLite database')!
	result := run(repo, 'doctor', '--json')
	assert result.code == 1
	assert result.out.contains('"health":"unhealthy"')
	assert result.out.contains('"metadata_available":false')
	assert result.out.contains('"name":"database open","status":"fail"')
	assert result.out.contains('further checks could not run')
	assert result.err == ''
}