// tests/lib/fix-round-4-5b2-a-scripts.test.mjs
// The form of fix round 4.5b2 part A's shell scripts and mutation module (plan
// .claude/projects/2026-10-31-guard-4-5b2-part-a, Step 5, 5d): the red
// wrapper, the regression script, the bypass corpus, the end-to-end run and
// the mutations.
// Untagged on purpose and listed in no red wrapper's FILES: these checks are
// not a part-A fix.
//   - each script exists, is ASCII only, passes /bin/bash -n and uses no
//     bash 4 form;
//   - the red wrapper hands the shared red script exactly one --other-ids,
//     whose words are the 4-5a IDS= words, then part 1's, part 2's, part 3's
//     and part 4's, --ids RXT CNT SFX ESR EVL KIA HDR SIS, exactly the two
//     tagged test files, and no argument naming the keep file or its tag (run
//     from a temp root next to a stub red-round.sh that prints its arguments,
//     the method of tests/lib/red-script.test.mjs);
//   - with the 4-5a, the part-1, the part-2, the part-3 or the part-4 wrapper
//     lacking its IDS= line, the red wrapper exits 2 with a setup failure and
//     never runs the shared script;
//   - red-mutate.mjs list prints exactly the three part-A mutations.

import { test } from 'node:test';
import { strict as assert } from 'node:assert';
import { spawnSync } from 'node:child_process';
import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { dirname, join } from 'node:path';
import { fileURLToPath } from 'node:url';
import { childEnv } from '../helpers/child-env.mjs';

const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');

const RED = 'tests/fix-round-4-5b2-a-red.sh';
const REGRESSION = 'tests/fix-round-4-5b2-a-regression.sh';
const CORPUS = 'tests/guard-bypass-corpus-4-5b2-a.sh';
const E2E = 'tests/e2e-fix-round-4-5b2-a.sh';
const MUTATIONS = 'tests/fix-round-4-5b2-a-mutations.mjs';
const WRAP_A = 'tests/fix-round-4-5a-red.sh';
const WRAP_B = 'tests/fix-round-4-5b-red.sh';
const WRAP_C = 'tests/fix-round-4-5b-part-2-red.sh';
const WRAP_D = 'tests/fix-round-4-5b-part-3-red.sh';
const WRAP_E = 'tests/fix-round-4-5b-part-4-red.sh';
const OLDER = [WRAP_A, WRAP_B, WRAP_C, WRAP_D, WRAP_E];
const PARTA_IDS = ['RXT', 'CNT', 'SFX', 'ESR', 'EVL', 'KIA', 'HDR', 'SIS'];
const PARTA_FILES = ['tests/hooks/bash-guard-4-5b2-a.test.mjs', 'tests/lib/fix-round-4-5b2-a-prose.test.mjs'];
/** The shared script's options that take a value; every other argument after them is a test file. */
const VALUE_OPTIONS = ['--base', '--ids', '--other-ids', '--mutations'];

/** A repo file's bytes; the file must exist. */
function bytes(rel) {
  assert.ok(existsSync(join(ROOT, rel)), `missing file ${rel}`);
  return readFileSync(join(ROOT, rel));
}

/** The words of a wrapper's one IDS='...' line. */
function idsOf(rel) {
  const lines = bytes(rel).toString('utf8').split('\n').filter((l) => l.startsWith('IDS='));
  assert.equal(lines.length, 1, `expected one IDS= line in ${rel}; found ${lines.length}`);
  const m = lines[0].match(/^IDS='([^']*)'$/);
  assert.ok(m, `the IDS= line of ${rel} is not one single-quoted list: ${lines[0]}`);
  return m[1].split(/\s+/).filter(Boolean);
}

test('part-A scripts: each exists, is ASCII only, passes /bin/bash -n and uses no bash 4 form', () => {
  for (const rel of [RED, REGRESSION, CORPUS, E2E]) {
    const buf = bytes(rel);
    assert.equal(buf.findIndex((b) => b > 127), -1, `${rel} is not ASCII only`);
    const r = spawnSync('/bin/bash', ['-n', join(ROOT, rel)], { encoding: 'utf8', env: childEnv() });
    assert.equal(r.status, 0, `${rel} does not pass /bin/bash -n: ${r.stderr}`);
    const text = buf.toString('utf8');
    for (const bash4 of [/\bdeclare -A\b/, /\bmapfile\b/, /\breadarray\b/, /\|&/]) {
      assert.doesNotMatch(text, bash4, `${rel} uses ${bash4}, which bash 3.2 lacks`);
    }
  }
});

/** A stand-in for the shared script: one ARG: line per argument, exit 0. */
const STUB = `#!/bin/bash
for a in "$@"; do printf 'ARG:%s\\n' "$a"; done
exit 0
`;

/** A temp root with the part-A wrapper, the five older wrappers and the stub as tests/helpers/red-round.sh. */
function stubRoot(base) {
  const dir = join(base, 'root');
  mkdirSync(join(dir, 'tests', 'helpers'), { recursive: true });
  for (const rel of [RED, ...OLDER]) writeFileSync(join(dir, rel), bytes(rel));
  writeFileSync(join(dir, 'tests', 'helpers', 'red-round.sh'), STUB, { mode: 0o755 });
  return dir;
}

/** The part-A wrapper run from a temp root: status, output and the arguments the stub saw. */
function runWrapper(dir) {
  const r = spawnSync('/bin/bash', [join(dir, RED)], { cwd: tmpdir(), encoding: 'utf8', timeout: 30000, env: childEnv() });
  const argv = (r.stdout || '').split('\n').filter((l) => l.startsWith('ARG:')).map((l) => l.slice(4));
  return { status: r.status, out: `${r.stdout}${r.stderr}`, stderr: r.stderr || '', argv };
}

/** The arguments that are neither an option nor an option's value: the test files. */
function filesOf(argv) {
  const files = [];
  for (let i = 0; i < argv.length; i += 1) {
    if (VALUE_OPTIONS.includes(argv[i])) { i += 1; continue; }
    if (argv[i].startsWith('--')) continue;
    files.push(argv[i]);
  }
  return files;
}

test('part-A scripts: the red wrapper passes one --other-ids with the five older rounds\' ids in order, its own eight ids and its two tagged files', () => {
  const text = bytes(RED).toString('utf8');
  const execLines = text.split('\n').filter((l) => /^exec /.test(l));
  assert.equal(execLines.length, 1, `${RED} must hold one exec line; found ${execLines.length}`);
  assert.equal(execLines[0].split('--other-ids').length - 1, 1, `${RED}: the exec line must pass --other-ids exactly once: ${execLines[0]}`);

  const base = mkdtempSync(join(tmpdir(), 'partA-red-wrap-'));
  try {
    const r = runWrapper(stubRoot(base));
    assert.equal(r.status, 0, `${RED} did not run the shared script:\n${r.out}`);
    const at = r.argv.map((a, i) => (a === '--other-ids' ? i : -1)).filter((i) => i >= 0);
    assert.equal(at.length, 1, `${RED} handed the shared script --other-ids ${at.length} times:\n${r.out}`);
    const other = (r.argv[at[0] + 1] || '').split(/\s+/).filter(Boolean);
    assert.deepEqual(other, OLDER.flatMap((rel) => idsOf(rel)),
      `${RED}: --other-ids is not the IDS= words of ${OLDER.join(', then ')}\n${r.out}`);
    const idsAt = r.argv.indexOf('--ids');
    assert.ok(idsAt >= 0, `${RED} passed no --ids:\n${r.out}`);
    assert.deepEqual(r.argv[idsAt + 1].split(/\s+/).filter(Boolean), PARTA_IDS, `${RED}: --ids is not ${PARTA_IDS.join(' ')}\n${r.out}`);
    assert.deepEqual(filesOf(r.argv), PARTA_FILES, `${RED}: the test files are not exactly ${PARTA_FILES.join(' and ')}\n${r.out}`);
    for (const a of r.argv) {
      assert.ok(!a.includes('-known') && !a.includes('KNA'), `${RED} passed an argument naming the keep file or its tag: ${a}\n${r.out}`);
    }
  } finally {
    rmSync(base, { recursive: true, force: true });
  }
});

test('part-A scripts: the red wrapper exits 2 with a setup failure when an older wrapper has no IDS= line', () => {
  for (const missing of OLDER) {
    const base = mkdtempSync(join(tmpdir(), 'partA-red-noids-'));
    try {
      const dir = stubRoot(base);
      const text = bytes(missing).toString('utf8');
      writeFileSync(join(dir, missing), text.split('\n').filter((l) => !l.startsWith('IDS=')).join('\n'));
      const r = runWrapper(dir);
      assert.equal(r.status, 2, `${RED}: ${missing} without an IDS= line is not exit 2\n${r.out}`);
      assert.match(r.stderr, /setup failure/, `${RED}: no setup failure line when ${missing} has no IDS= line\n${r.out}`);
      assert.ok(r.stderr.includes(missing), `${RED}: the setup failure line does not name ${missing}\n${r.out}`);
      assert.deepEqual(r.argv, [], `${RED} ran the shared script though ${missing} has no IDS= line\n${r.out}`);
    } finally {
      rmSync(base, { recursive: true, force: true });
    }
  }
});

test('part-A scripts: red-mutate.mjs list prints exactly the three part-A mutations', () => {
  assert.ok(existsSync(join(ROOT, MUTATIONS)), `missing file ${MUTATIONS}`);
  const r = spawnSync(process.execPath, [join(ROOT, 'tests', 'helpers', 'red-mutate.mjs'), 'list', MUTATIONS],
    { cwd: ROOT, encoding: 'utf8', timeout: 30000, env: childEnv() });
  assert.equal(r.status, 0, `red-mutate.mjs list ${MUTATIONS} exited ${r.status}:\n${r.stdout}${r.stderr}`);
  const lines = (r.stdout || '').split('\n').filter((l) => l !== '');
  assert.deepEqual(lines, ['RXT-try RXT', 'CNT-regex CNT', 'HDR-header HDR'],
    `red-mutate.mjs list ${MUTATIONS} does not print exactly the three part-A mutations:\n${r.stdout}${r.stderr}`);
});