// Node wrapper (marketplace convention: node --test) around the bash
// selftest, which owns every mailbox assertion. The selftest runs against a
// throwaway mailbox (mktemp) and exits non-zero on any failing check.
import { test } from 'node:test';
import assert from 'node:assert';
import { execFileSync } from 'node:child_process';
import { mkdtempSync, mkdirSync, writeFileSync, existsSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { basename, dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';

const root = join(dirname(fileURLToPath(import.meta.url)), '..');
const hook = join(root, 'hooks', 'scripts', 'session-start.mjs');

test('coord bash selftest passes', () => {
  execFileSync('bash', [join(root, 'scripts', 'coord-selftest.sh')], { encoding: 'utf8' });
});

// The engine refuses to invent an identity from the cwd, but the hook is the
// FOURTH place repo identity is derived, and a rule enforced in three of four
// places is not a rule: as long as the hook resolved the name itself and passed
// --repo, the engine's guard was bypassed on the only path that runs in
// production. These two tests pin the hook as a pure wrapper - it must not
// resolve identity at all, so the engine's rules apply where they matter.
function runHook(cwd, mailbox) {
  const out = execFileSync('node', [hook], {
    cwd,
    env: { ...process.env, CLAUDE_COORD_DIR: mailbox },
    encoding: 'utf8',
  });
  return JSON.parse(out);
}

function seedMailbox(mailbox, repo, body) {
  mkdirSync(join(mailbox, repo, 'inbox'), { recursive: true });
  writeFileSync(join(mailbox, repo, 'inbox', '20260101T000000Z-1-from-someone.md'),
    `---\nfrom: someone\nto: ${repo}\nsubject: seeded\ndate: 2026-01-01T00:00:00Z\n---\n${body}\n`);
}

test('hook does not invent a repo identity from the working directory', () => {
  const mailbox = mkdtempSync(join(tmpdir(), 'coord-mb-'));
  const nonGit = mkdtempSync(join(tmpdir(), 'coord-nogit-'));
  // A mailbox that happens to carry the cwd's basename. A hook that falls back
  // to basename(cwd) reads it; a hook that leaves identity to the engine does
  // not. This is the ~/repos case that delivered mail as the repo "repos".
  seedMailbox(mailbox, basename(nonGit), 'CWD-IDENTITY-LEAK');

  const parsed = runHook(nonGit, mailbox);
  assert.equal(parsed.continue, true);
  const ctx = parsed.hookSpecificOutput?.additionalContext ?? '';
  assert.ok(!ctx.includes('CWD-IDENTITY-LEAK'),
    'hook read a mailbox named after the cwd outside any git repo');
});

test('hook lets the engine derive identity, so the mailbox claim is recorded', () => {
  const mailbox = mkdtempSync(join(tmpdir(), 'coord-mb-'));
  const repoDir = mkdtempSync(join(tmpdir(), 'coord-repo-'));
  execFileSync('git', ['-C', repoDir, 'init', '-q'], { stdio: 'ignore' });
  seedMailbox(mailbox, basename(repoDir), 'GIT-IDENTITY-OK');

  const parsed = runHook(repoDir, mailbox);
  const ctx = parsed.hookSpecificOutput?.additionalContext ?? '';
  assert.ok(ctx.includes('GIT-IDENTITY-OK'), 'hook did not deliver the pending message');
  // .origin is written only when coord-inbox.sh resolved the repo itself. Its
  // presence is the observable proof that the hook stopped overriding identity,
  // and its absence is why the collision warning would never fire in production.
  assert.ok(existsSync(join(mailbox, basename(repoDir), '.origin')),
    'engine never derived the identity: the hook passed --repo and suppressed the claim');
});