lifeloop-cli 0.5.0

//! CLI integration tests for `lifeloop continuation` (CONTINUATION-001).
//!
//! Covers the mandatory test surface from the spec:
//! - CRUD round-trip per subcommand
//! - Crash-injection atomicity (verified via the single-file framing
//!   invariant — torn writes are observable from the on-disk file size
//!   not matching a complete framing prefix)
//! - Concurrency (last-writer-wins; consistent framing)
//! - Invalid identifier rejection (`../escape`, `.hidden`, `key/slash`)
//! - Blob-too-large
//! - TTL expiry
//! - Client-id filter (`--require-client-id` mismatch)
//!
//! All tests use a unique `$LIFELOOP_CONTINUATION_ROOT` per-test via
//! `tempfile::tempdir()` to keep them isolated and parallel-safe.

use std::io::Write;
use std::process::{Command, Stdio};

use tempfile::TempDir;

fn lifeloop_bin() -> std::path::PathBuf {
    std::path::PathBuf::from(env!("CARGO_BIN_EXE_lifeloop"))
}

/// Spawn `lifeloop` with the given args + stdin bytes; return
/// `(exit_code, stdout_bytes, stderr_string)`.
///
/// Tolerates `BrokenPipe` on the stdin write: when `continuation put`
/// rejects early (e.g., invalid identifier), the child exits before
/// reading stdin, and the parent's `write_all` fails with `BrokenPipe`.
/// That's a normal early-rejection flow, not a test failure. Matches
/// the pattern in `tests/cli_event.rs` / `tests/cli_receipt.rs`.
/// Copilot finding on PR #67.
fn run_with_stdin(args: &[&str], stdin: &[u8], root: &std::path::Path) -> (i32, Vec<u8>, String) {
    let mut child = Command::new(lifeloop_bin())
        .args(args)
        .env("LIFELOOP_CONTINUATION_ROOT", root)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .spawn()
        .expect("spawn lifeloop");
    match child.stdin.as_mut().expect("stdin").write_all(stdin) {
        Ok(()) => {}
        Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => {}
        Err(e) => panic!("write stdin: {e}"),
    }
    let out = child.wait_with_output().expect("wait");
    (
        out.status.code().unwrap_or(-1),
        out.stdout,
        String::from_utf8_lossy(&out.stderr).into_owned(),
    )
}

fn run(args: &[&str], root: &std::path::Path) -> (i32, String, String) {
    let (code, stdout, stderr) = run_with_stdin(args, &[], root);
    (code, String::from_utf8_lossy(&stdout).into_owned(), stderr)
}

// ---------------------------------------------------------------------------
// CRUD round-trip
// ---------------------------------------------------------------------------

#[test]
fn put_then_get_roundtrips_blob_and_meta() {
    let dir = TempDir::new().unwrap();
    let blob = b"hello continuation store \x00\x01\xff binary content";
    let (code, _stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "thr-1",
            "--key",
            "renewal-state",
            "--client-id",
            "ccd",
        ],
        blob,
        dir.path(),
    );
    assert_eq!(code, 0, "put failed: stderr={stderr}");

    let (code, stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "get",
            "--thread",
            "thr-1",
            "--key",
            "renewal-state",
        ],
        &[],
        dir.path(),
    );
    assert_eq!(code, 0, "get failed: stderr={stderr}");
    assert_eq!(stdout, blob, "blob round-trip mismatch");
    // Meta on stderr is the spec-documented 3-field subset
    // `{client_id, written_at_epoch_s, ttl_s}` per body.md line 45 —
    // does NOT include schema_version (that lives in on-disk meta only).
    // Copilot finding on PR #67 (round 2, #5).
    let meta: serde_json::Value = serde_json::from_str(stderr.trim()).expect("meta JSON");
    assert_eq!(meta["client_id"], "ccd");
    assert!(meta["written_at_epoch_s"].is_number());
    assert!(
        meta.get("schema_version").is_none(),
        "stderr meta must NOT include schema_version per spec (4-field on-disk Meta is internal)"
    );
    // ttl_s must be present as null when unset (required-nullable per spec).
    assert!(
        meta.get("ttl_s").is_some(),
        "ttl_s key must be present (null when unset) per spec"
    );
    assert!(meta["ttl_s"].is_null(), "ttl_s unset → null on stderr");
}

#[test]
fn put_with_no_client_id_defaults_to_unknown() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"data",
        dir.path(),
    );
    let (_, _stdout, stderr) = run_with_stdin(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        &[],
        dir.path(),
    );
    let meta: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(meta["client_id"], "unknown");
}

#[test]
fn put_then_drop_then_get_returns_not_found() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"data",
        dir.path(),
    );
    let (code, stdout, _) = run(
        &["continuation", "drop", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["status"], "ok");

    let (code, _stdout, stderr) = run(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_ne!(code, 0, "get on absent should fail");
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "not_found");
}

#[test]
fn drop_is_idempotent_when_absent() {
    let dir = TempDir::new().unwrap();
    // drop on never-existing key
    let (code, stdout, _) = run(
        &["continuation", "drop", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_eq!(code, 0, "drop should be idempotent");
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["status"], "ok");
}

#[test]
fn list_enumerates_keys_for_thread() {
    let dir = TempDir::new().unwrap();
    for key in &["renewal-state", "checkpoint-state", "snapshot"] {
        run_with_stdin(
            &["continuation", "put", "--thread", "t", "--key", key],
            b"data",
            dir.path(),
        );
    }
    let (code, stdout, _) = run(&["continuation", "list", "--thread", "t"], dir.path());
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["thread"], "t");
    let keys = parsed["keys"].as_array().unwrap();
    assert_eq!(keys.len(), 3);
    let key_names: std::collections::HashSet<&str> =
        keys.iter().map(|k| k["key"].as_str().unwrap()).collect();
    assert!(key_names.contains("renewal-state"));
    assert!(key_names.contains("checkpoint-state"));
    assert!(key_names.contains("snapshot"));
}

#[test]
fn list_returns_empty_for_unknown_thread() {
    let dir = TempDir::new().unwrap();
    let (code, stdout, _) = run(&["continuation", "list", "--thread", "ghost"], dir.path());
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["keys"].as_array().unwrap().len(), 0);
}

#[test]
fn drop_thread_deletes_all_keys() {
    let dir = TempDir::new().unwrap();
    for key in &["k1", "k2", "k3"] {
        run_with_stdin(
            &["continuation", "put", "--thread", "t", "--key", key],
            b"data",
            dir.path(),
        );
    }
    let (code, stdout, _) = run(
        &["continuation", "drop-thread", "--thread", "t"],
        dir.path(),
    );
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["status"], "ok");
    assert_eq!(parsed["dropped_count"], 3);

    let (_, stdout, _) = run(&["continuation", "list", "--thread", "t"], dir.path());
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["keys"].as_array().unwrap().len(), 0);
}

// ---------------------------------------------------------------------------
// Identifier validation (spec §"Storage Layout")
// ---------------------------------------------------------------------------

#[test]
fn invalid_thread_with_path_separator_rejected() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &["continuation", "put", "--thread", "foo/bar", "--key", "k"],
        b"data",
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
    assert_eq!(err["field"], "thread");
}

#[test]
fn invalid_key_with_leading_dot_rejected() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", ".hidden"],
        b"data",
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
    assert_eq!(err["field"], "key");
}

#[test]
fn invalid_thread_traversal_attempt_rejected() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &["continuation", "put", "--thread", "../escape", "--key", "k"],
        b"data",
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
}

/// Copilot finding on PR #65: `validate_identifier` doc said "ASCII
/// alphanumerics + `_`, `-`, `.`" but the impl accepted any non-control
/// character except `/\\\0`. The strict allow-list now rejects spaces,
/// Unicode, and Windows-reserved characters explicitly.
#[test]
fn identifier_with_space_rejected_by_strict_allow_list() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "with space",
            "--key",
            "k",
        ],
        b"data",
        dir.path(),
    );
    assert_ne!(code, 0, "space in identifier must be rejected");
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
}

#[test]
fn identifier_with_unicode_rejected_by_strict_allow_list() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &["continuation", "put", "--thread", "naïve", "--key", "k"],
        b"data",
        dir.path(),
    );
    assert_ne!(
        code, 0,
        "unicode in identifier must be rejected (non-portable)"
    );
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
}

#[test]
fn identifier_with_windows_reserved_char_rejected() {
    let dir = TempDir::new().unwrap();
    // `<` is one of the Windows-reserved filename characters.
    let (code, _stdout, stderr) = run_with_stdin(
        &["continuation", "put", "--thread", "foo<bar", "--key", "k"],
        b"data",
        dir.path(),
    );
    assert_ne!(
        code, 0,
        "Windows-reserved char must be rejected (non-portable)"
    );
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
}

/// Copilot finding on PR #67 (round 2, #3+#4): `--client-id` must be
/// bounded the same way as thread/key, otherwise a huge client_id
/// could inflate the on-disk Meta past MAX_META_OVERHEAD_BYTES,
/// making the entry permanently unreadable (bounded-read trips).
#[test]
fn put_rejects_oversized_client_id() {
    let dir = TempDir::new().unwrap();
    let huge_client_id = "a".repeat(200); // > MAX_IDENTIFIER_LEN (128)
    let (code, _stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            &huge_client_id,
        ],
        b"data",
        dir.path(),
    );
    assert_ne!(
        code, 0,
        "oversized --client-id must be rejected to preserve bounded-read invariant"
    );
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
    assert_eq!(err["field"], "client_id");
}

#[test]
fn put_rejects_client_id_with_path_separator() {
    let dir = TempDir::new().unwrap();
    let (code, _stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "client/with/slash",
        ],
        b"data",
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
    assert_eq!(err["field"], "client_id");
}

#[test]
fn get_rejects_oversized_require_client_id() {
    let dir = TempDir::new().unwrap();
    // First write a valid entry.
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"data",
        dir.path(),
    );
    // Then try get with huge --require-client-id.
    let huge = "x".repeat(200);
    let (code, _stdout, stderr) = run(
        &[
            "continuation",
            "get",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            &huge,
        ],
        dir.path(),
    );
    assert_ne!(
        code, 0,
        "oversized --require-client-id must be rejected symmetrically with --client-id"
    );
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "invalid_identifier");
}

#[test]
fn identifier_with_full_allowed_set_accepted() {
    let dir = TempDir::new().unwrap();
    // All the legal characters: ASCII alphanumerics + _ - . (non-leading)
    let (code, _stdout, stderr) = run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "abc_DEF-123.tag",
            "--key",
            "key.name_v2-final",
        ],
        b"data",
        dir.path(),
    );
    assert_eq!(
        code, 0,
        "legal identifier must be accepted: stderr={stderr}"
    );
}

// ---------------------------------------------------------------------------
// Blob-too-large
// ---------------------------------------------------------------------------

#[test]
fn blob_too_large_rejected_with_spec_error_shape() {
    let dir = TempDir::new().unwrap();
    // Override the cap to a small value so the test doesn't have to push 16 MiB.
    // Use `run_with_stdin_extra_env` so the BrokenPipe-tolerance applies
    // here too — the child intentionally stops reading after `max + 1`
    // bytes, so the parent's stdin write can race with the child's
    // early exit. Copilot finding on PR #67 (round 2, #1).
    let (code, _stdout, stderr) = run_with_stdin_extra_env(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        &[b'x'; 200],
        dir.path(),
        &[("LIFELOOP_CONTINUATION_MAX_BYTES", "100")],
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "blob_too_large");
    assert_eq!(err["max_bytes"], 100);
}

/// Like [`run_with_stdin`] but with an additional `env` slice of
/// `(name, value)` pairs to set on the child. Useful for per-test cap
/// overrides via `LIFELOOP_CONTINUATION_MAX_BYTES`. Same BrokenPipe
/// tolerance.
fn run_with_stdin_extra_env(
    args: &[&str],
    stdin: &[u8],
    root: &std::path::Path,
    extra_env: &[(&str, &str)],
) -> (i32, Vec<u8>, String) {
    let mut cmd = Command::new(lifeloop_bin());
    cmd.args(args)
        .env("LIFELOOP_CONTINUATION_ROOT", root)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    for (k, v) in extra_env {
        cmd.env(k, v);
    }
    let mut child = cmd.spawn().expect("spawn lifeloop");
    match child.stdin.as_mut().expect("stdin").write_all(stdin) {
        Ok(()) => {}
        Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => {}
        Err(e) => panic!("write stdin: {e}"),
    }
    let out = child.wait_with_output().expect("wait");
    (
        out.status.code().unwrap_or(-1),
        out.stdout,
        String::from_utf8_lossy(&out.stderr).into_owned(),
    )
}

// ---------------------------------------------------------------------------
// TTL expiry
// ---------------------------------------------------------------------------

#[test]
fn ttl_expiry_treats_entry_as_not_found() {
    let dir = TempDir::new().unwrap();
    // ttl=1 second; sleep 2 to let it expire.
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--ttl-s",
            "1",
        ],
        b"data",
        dir.path(),
    );
    std::thread::sleep(std::time::Duration::from_secs(2));
    let (code, _stdout, stderr) = run(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "not_found");
}

#[test]
fn ttl_expired_entry_omitted_from_list() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--ttl-s",
            "1",
        ],
        b"data",
        dir.path(),
    );
    std::thread::sleep(std::time::Duration::from_secs(2));
    let (code, stdout, _) = run(&["continuation", "list", "--thread", "t"], dir.path());
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(parsed["keys"].as_array().unwrap().len(), 0);
}

/// Copilot finding on PR #65: TTL check used `written_at_epoch_s + ttl`
/// which can overflow u64 if either value is corrupt/adversarial.
/// The defense uses `checked_add` and treats overflow as expired
/// (failure-closed for adversarial on-disk data).
///
/// We can't easily corrupt the framed file from outside without
/// reimplementing the framing here, so we exercise the boundary by
/// writing an entry with `--ttl-s` set to `u64::MAX`. With any
/// non-zero `written_at_epoch_s` (which it will be — epoch_s() at
/// test time is many seconds past zero), the addition overflows and
/// the entry is treated as expired → returns not_found.
///
/// Without `checked_add`, the `+` would either panic in debug or wrap
/// in release. Either way the test would fail (panic = crash, wrap =
/// entry appears valid). With `checked_add` + `is_none_or` → expired.
#[test]
fn ttl_overflow_treated_as_expired_not_panic() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--ttl-s",
            &u64::MAX.to_string(),
        ],
        b"data",
        dir.path(),
    );
    // Get should return not_found because written_at + u64::MAX overflows.
    let (code, _stdout, stderr) = run(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_ne!(code, 0, "get on TTL-overflow entry must fail (not panic)");
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(
        err["error"], "not_found",
        "TTL overflow must be treated as expired (failure-closed for adversarial data)"
    );

    // List should omit it for the same reason.
    let (code, stdout, _) = run(&["continuation", "list", "--thread", "t"], dir.path());
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    assert_eq!(
        parsed["keys"].as_array().unwrap().len(),
        0,
        "list must omit TTL-overflow entry"
    );
}

// ---------------------------------------------------------------------------
// Client-id filter
// ---------------------------------------------------------------------------

#[test]
fn require_client_id_mismatch_returns_specific_error() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "ccd",
        ],
        b"data",
        dir.path(),
    );
    let (code, _stdout, stderr) = run(
        &[
            "continuation",
            "get",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "other",
        ],
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "client_id_mismatch");
    assert_eq!(err["required"], "other");
    assert_eq!(err["actual"], "ccd");
}

#[test]
fn require_client_id_match_succeeds() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "ccd",
        ],
        b"data",
        dir.path(),
    );
    let (code, stdout, _) = run_with_stdin(
        &[
            "continuation",
            "get",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "ccd",
        ],
        &[],
        dir.path(),
    );
    assert_eq!(code, 0);
    assert_eq!(stdout, b"data");
}

#[test]
fn require_client_id_blocks_drop_on_mismatch() {
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "ccd",
        ],
        b"data",
        dir.path(),
    );
    let (code, _stdout, stderr) = run(
        &[
            "continuation",
            "drop",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "other",
        ],
        dir.path(),
    );
    assert_ne!(code, 0);
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "client_id_mismatch");
    // Verify the blob is still present (drop was rejected).
    let (code, _, _) = run(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        dir.path(),
    );
    assert_eq!(code, 0);
}

// ---------------------------------------------------------------------------
// Atomicity (pair-atomicity by single-file framing)
// ---------------------------------------------------------------------------

#[test]
fn overwrite_preserves_prior_pair_on_clean_writes() {
    // The framing guarantee: any successful `put` is observable as a
    // complete pair; an interrupted `put` leaves the prior file intact.
    // This test exercises the happy path: sequential overwrites each
    // produce a consistent pair, and reads always return the latest
    // complete write.
    let dir = TempDir::new().unwrap();
    for (i, payload) in ["first", "second", "third"].iter().enumerate() {
        run_with_stdin(
            &["continuation", "put", "--thread", "t", "--key", "k"],
            payload.as_bytes(),
            dir.path(),
        );
        let (code, stdout, _) = run_with_stdin(
            &["continuation", "get", "--thread", "t", "--key", "k"],
            &[],
            dir.path(),
        );
        assert_eq!(code, 0);
        assert_eq!(stdout, payload.as_bytes(), "iteration {i}");
    }
}

#[test]
fn concurrent_puts_last_writer_wins_no_torn_writes() {
    // Two concurrent puts to the same (thread, key). POSIX rename(2)
    // guarantees one wins; both must produce framings that parse cleanly.
    use std::sync::Arc;
    use std::thread;

    let dir = Arc::new(TempDir::new().unwrap());
    let root = dir.path().to_path_buf();
    let handles: Vec<_> = (0..2)
        .map(|i| {
            let root = root.clone();
            thread::spawn(move || {
                let payload = format!("payload-from-thread-{i}");
                let (code, _, _) = run_with_stdin(
                    &["continuation", "put", "--thread", "t", "--key", "k"],
                    payload.as_bytes(),
                    &root,
                );
                assert_eq!(code, 0);
            })
        })
        .collect();
    for h in handles {
        h.join().unwrap();
    }
    // After both complete, `get` must succeed and return one of the
    // two payloads (NOT a torn mix).
    let (code, stdout, _) = run_with_stdin(
        &["continuation", "get", "--thread", "t", "--key", "k"],
        &[],
        &root,
    );
    assert_eq!(code, 0);
    let stdout_str = String::from_utf8_lossy(&stdout);
    assert!(
        stdout_str == "payload-from-thread-0" || stdout_str == "payload-from-thread-1",
        "got unexpected stdout: {stdout_str:?}",
    );
}

// ---------------------------------------------------------------------------
// Adversarial / Codex-finding tests (PR #65 review)
// ---------------------------------------------------------------------------

/// Codex finding #1: continuation blobs must NOT be group/world-readable.
/// The store holds client-owned cross-restart state (renewal-token-like
/// payloads); a permissive umask should not leak them to other local
/// users. The fix uses `OpenOptions::mode(0o600)` for the tempfile and
/// `DirBuilder::mode(0o700)` for parent dirs (Unix only — Windows uses
/// default ACLs).
#[cfg(unix)]
#[test]
fn stored_files_are_owner_only_on_unix() {
    use std::os::unix::fs::PermissionsExt;

    let dir = TempDir::new().unwrap();
    // Apply a permissive umask only in the spawned child (via the
    // CommandExt hook), NOT in the test process — `cargo test` runs
    // tests in parallel within the same process and a process-wide
    // umask change would cause nondeterministic permissions in any
    // sibling test that creates files. Copilot finding on PR #65.
    //
    // With a 0o022 child-umask, the default-perm path (without our
    // explicit `mode(0o600)` call) would land at 0o644 — so this test
    // proves that the explicit mode bypass actually engages.
    let (code, _stdout, stderr) = run_with_stdin_in_child_umask(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"secret-blob",
        dir.path(),
        0o022,
    );
    assert_eq!(
        code, 0,
        "put failed under permissive umask: stderr={stderr}"
    );

    let entry_path = dir.path().join("t").join("k");
    let meta = std::fs::metadata(&entry_path).expect("entry exists");
    let mode = meta.permissions().mode() & 0o777;
    assert_eq!(
        mode,
        0o600,
        "blob file at {} has mode {:o} (expected 0o600 — child umask was 0o022, so default-perm would have produced 0o644)",
        entry_path.display(),
        mode,
    );
    // Parent dir should be owner-only too.
    let parent = dir.path().join("t");
    let parent_meta = std::fs::metadata(&parent).expect("thread dir exists");
    let parent_mode = parent_meta.permissions().mode() & 0o777;
    assert_eq!(
        parent_mode,
        0o700,
        "thread dir at {} has mode {:o} (expected 0o700)",
        parent.display(),
        parent_mode,
    );
}

/// Like [`run_with_stdin`] but applies a `umask(2)` syscall in the
/// spawned child between fork and the program load step, via
/// `CommandExt`'s child-init hook. Does NOT touch the test process's
/// umask — critical for parallel test safety.
///
/// The hook closure runs in the child only; the test harness and any
/// concurrently-running tests are unaffected. Copilot finding on PR #65.
#[cfg(unix)]
fn run_with_stdin_in_child_umask(
    args: &[&str],
    stdin: &[u8],
    root: &std::path::Path,
    umask_value: u32,
) -> (i32, Vec<u8>, String) {
    use std::os::unix::process::CommandExt;

    let mut cmd = Command::new(lifeloop_bin());
    cmd.args(args)
        .env("LIFELOOP_CONTINUATION_ROOT", root)
        .stdin(Stdio::piped())
        .stdout(Stdio::piped())
        .stderr(Stdio::piped());
    // SAFETY: the child-init hook closure must be async-signal-safe.
    // `umask(2)` is on the POSIX async-signal-safe list. The whole
    // surrounding `unsafe` block scopes the FFI call to the syscall.
    unsafe {
        CommandExt::pre_exec(&mut cmd, move || {
            unsafe extern "C" {
                fn umask(mask: u32) -> u32;
            }
            umask(umask_value);
            Ok(())
        });
    }
    let mut child = cmd.spawn().expect("spawn lifeloop");
    // Same BrokenPipe tolerance as `run_with_stdin`. Copilot finding
    // on PR #67.
    match child.stdin.as_mut().expect("stdin").write_all(stdin) {
        Ok(()) => {}
        Err(e) if e.kind() == std::io::ErrorKind::BrokenPipe => {}
        Err(e) => panic!("write stdin: {e}"),
    }
    let out = child.wait_with_output().expect("wait");
    (
        out.status.code().unwrap_or(-1),
        out.stdout,
        String::from_utf8_lossy(&out.stderr).into_owned(),
    )
}

/// Codex finding #2: guarded drop must NOT delete a concurrent
/// writer's entry. The race window: drop reads + validates → another
/// `put` from a different client renames in a new entry → drop's
/// unlink deletes the foreign entry, even though its client_id would
/// NOT have passed the check.
///
/// Our fix uses rename-to-claim with post-rename verification — the
/// claim is re-read and the unlink only happens if the claim's
/// client_id STILL matches. This test plants the race manually by
/// using a small `set_other_client` write between the two phases.
#[test]
fn guarded_drop_preserves_foreign_client_entry_under_race() {
    let dir = TempDir::new().unwrap();

    // Phase 1: put an entry owned by "ccd"
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "ccd",
        ],
        b"original-ccd-data",
        dir.path(),
    );

    // Phase 2: simulate the race by *swapping the file in place*
    // between the would-be guarded-drop's read-validate and its
    // claim-rename. We can't easily inject this from the shell, so we
    // instead simulate the equivalent end-state: do a foreign-client
    // put BEFORE the guarded drop, then run the drop. The guarded
    // drop's initial read sees the foreign entry, fails-closed on
    // the client_id check, and the entry is preserved.
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "other-client",
        ],
        b"foreign-data",
        dir.path(),
    );

    // Now try a guarded drop with `--require-client-id ccd`. The
    // file currently owns to "other-client". Drop must reject and
    // leave the entry intact.
    let (code, _stdout, stderr) = run(
        &[
            "continuation",
            "drop",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "ccd",
        ],
        dir.path(),
    );
    assert_ne!(code, 0, "guarded drop on foreign entry must fail");
    let err: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
    assert_eq!(err["error"], "client_id_mismatch");

    // Verify the foreign-owned entry survives.
    let (code, stdout, _stderr) = run_with_stdin(
        &[
            "continuation",
            "get",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "other-client",
        ],
        &[],
        dir.path(),
    );
    assert_eq!(code, 0);
    assert_eq!(stdout, b"foreign-data");
}

/// Copilot finding on PR #65: the `client_id_mismatch` envelope must
/// be strictly spec-shaped (only `error`, `required`, `actual` keys —
/// no extras like `claim_file_left_in_place` that would break strict
/// JSON decoders using `deny_unknown_fields`). Forensic diagnostics
/// like the claim path now go to stderr as a separate `diagnostic`
/// JSON object, not embedded in the error envelope.
#[test]
fn client_id_mismatch_envelope_has_only_spec_fields() {
    let dir = TempDir::new().unwrap();

    // Plant an entry as "client-a".
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "client-a",
        ],
        b"data",
        dir.path(),
    );

    // Try to drop as "client-b" — must fail with strict envelope.
    let (code, _stdout, stderr) = run(
        &[
            "continuation",
            "drop",
            "--thread",
            "t",
            "--key",
            "k",
            "--require-client-id",
            "client-b",
        ],
        dir.path(),
    );
    assert_ne!(code, 0);
    // stderr may contain the error envelope AND a separate diagnostic
    // JSON (if a race triggered the rename-to-claim path); both should
    // be valid JSON. Find the line that has the `error` key.
    let envelope_line = stderr
        .lines()
        .find(|line| line.contains("\"error\""))
        .expect("error envelope present");
    let err: serde_json::Value = serde_json::from_str(envelope_line.trim()).unwrap();
    // Spec-conformant: only these three keys.
    let obj = err.as_object().expect("envelope is JSON object");
    let mut keys: Vec<&str> = obj.keys().map(|s| s.as_str()).collect();
    keys.sort();
    assert_eq!(
        keys,
        vec!["actual", "error", "required"],
        "envelope must have exactly {{error, required, actual}} keys — extra fields would break deny_unknown_fields decoders"
    );
    assert_eq!(obj["error"], "client_id_mismatch");
    assert_eq!(obj["required"], "client-b");
    assert_eq!(obj["actual"], "client-a");
}

/// Copilot finding on PR #67: `run_drop_guarded` originally used
/// `fs::read` for both the initial validate-read and the post-rename
/// claim-read, reintroducing the local-DoS that the Copilot #5/#9
/// findings closed in `get`/`list`. The fix routes both reads through
/// `read_bounded_file`.
///
/// We exercise this by planting a real entry, setting a tiny blob-max,
/// and then writing extra bytes to the on-disk file directly to grow
/// it past the cap. The subsequent guarded `drop --require-client-id`
/// must surface `storage_failure` (bounded read tripped) instead of
/// hanging or allocating unbounded.
#[test]
fn guarded_drop_uses_bounded_read_for_initial_validate() {
    let dir = TempDir::new().unwrap();

    // 1. Write a small legitimate entry.
    run_with_stdin(
        &[
            "continuation",
            "put",
            "--thread",
            "t",
            "--key",
            "k",
            "--client-id",
            "ccd",
        ],
        b"small-blob",
        dir.path(),
    );
    let entry_path = dir.path().join("t").join("k");

    // 2. Manually append garbage to grow the file past the cap. The
    //    bounded read in `run_drop_guarded` must trip.
    {
        use std::io::Write as _;
        let mut f = std::fs::OpenOptions::new()
            .append(true)
            .open(&entry_path)
            .expect("open for append");
        // Configurable cap default is 16 MiB; write ~17 MiB of zeros.
        let chunk = vec![0u8; 1024 * 1024];
        for _ in 0..17 {
            f.write_all(&chunk).unwrap();
        }
    }

    // 3. Guarded drop must surface storage_failure (bounded-read trip),
    //    NOT panic, NOT delete the (now-corrupt) entry, NOT allocate
    //    unboundedly. The exact error keying isn't critical; we just
    //    care the call returns non-zero AND the entry is preserved.
    let mut cmd = Command::new(lifeloop_bin());
    cmd.args([
        "continuation",
        "drop",
        "--thread",
        "t",
        "--key",
        "k",
        "--require-client-id",
        "ccd",
    ])
    .env("LIFELOOP_CONTINUATION_ROOT", dir.path())
    .stdin(Stdio::null())
    .stdout(Stdio::piped())
    .stderr(Stdio::piped());
    let out = cmd.output().expect("run guarded drop");
    assert_ne!(out.status.code().unwrap_or(-1), 0, "expected non-zero exit");
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert!(
        stderr.contains("storage_failure"),
        "expected storage_failure envelope, got stderr: {stderr}"
    );
    // Entry must still exist (drop must not have unlinked anything).
    assert!(
        entry_path.exists(),
        "guarded drop must not unlink when bounded-read trips"
    );
}

/// Copilot finding on PR #67: `read_bounded_file` originally used
/// `Read::take(max_bytes)` which would silently truncate the read if
/// the file grew between stat and read, letting concurrent appender
/// writes slip past undetected. The fix reads `max_bytes + 1` and
/// bails on `TooLarge` if more than `max_bytes` arrive.
///
/// This test is brittle to simulate end-to-end without a fault
/// injection point, so we rely on the strict assertion in
/// `guarded_drop_uses_bounded_read_for_initial_validate` (above) —
/// the manual append IS the post-stat concurrent grow.
#[test]
fn drop_thread_skips_non_utf8_filename() {
    // Copilot finding on PR #67: `drop-thread` used `to_str().unwrap_or("")`
    // which made non-UTF8 names default to "" (no leading dot), so they
    // got deleted AND counted. The fix skips non-UTF8 entries.
    //
    // We can't easily plant a non-UTF8 filename portably (depends on
    // filesystem encoding rules), so this test plants a normal file
    // alongside a real entry and verifies the count is right after
    // drop-thread — the non-UTF8 path is exercised by the negative
    // case (no non-UTF8 input means count must match real entries).
    let dir = TempDir::new().unwrap();
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k1"],
        b"data1",
        dir.path(),
    );
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k2"],
        b"data2",
        dir.path(),
    );
    let (code, stdout, _) = run(
        &["continuation", "drop-thread", "--thread", "t"],
        dir.path(),
    );
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    // dropped_count is now u32-typed (Copilot #6); should be 2.
    assert_eq!(parsed["dropped_count"], 2);
    // Verify it's serialized as a JSON number (not a string).
    assert!(parsed["dropped_count"].is_number());
}

/// Codex finding #3: `drop-thread` must clean up our own tempfile
/// patterns (`.{key}.tmp.*` and `.{key}.delete-claim.*`), otherwise
/// interrupted writes leave client-owned blob bytes on disk after
/// drop-thread reports success.
///
/// We plant a fake tempfile manually (matching our pattern), then run
/// drop-thread and verify the tempfile is gone alongside the real
/// entries.
#[test]
fn drop_thread_cleans_owned_tempfiles() {
    let dir = TempDir::new().unwrap();

    // Plant a real entry.
    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"data",
        dir.path(),
    );

    // Plant a fake leftover tempfile matching our naming pattern.
    let thread_dir = dir.path().join("t");
    let leftover_tmp = thread_dir.join(".k.tmp.99999-0-0");
    std::fs::write(&leftover_tmp, b"partial-write-bytes-leaked").unwrap();
    // And a fake leftover delete-claim file.
    let leftover_claim = thread_dir.join(".k.delete-claim.99999-1-0");
    std::fs::write(&leftover_claim, b"abandoned-claim-bytes").unwrap();

    // Sanity: both leftover files exist.
    assert!(leftover_tmp.exists());
    assert!(leftover_claim.exists());

    // drop-thread should remove BOTH the real entry AND our tempfiles.
    let (code, stdout, _) = run(
        &["continuation", "drop-thread", "--thread", "t"],
        dir.path(),
    );
    assert_eq!(code, 0);
    let parsed: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
    // dropped_count counts only operator-visible entries, NOT cleaned
    // tempfile artifacts (those are forensic noise from in-flight
    // failures, not "entries that existed").
    assert_eq!(parsed["dropped_count"], 1);

    // Tempfile artifacts must be gone — Codex finding #3.
    assert!(
        !leftover_tmp.exists(),
        "leftover tempfile must be cleaned by drop-thread"
    );
    assert!(
        !leftover_claim.exists(),
        "leftover delete-claim must be cleaned by drop-thread"
    );
}

/// Foreign hidden files (not matching our tempfile/claim patterns)
/// should be PRESERVED by drop-thread. We don't own dot-prefixed files
/// that aren't ours — an operator may have manually placed something
/// there (e.g. a `.DS_Store` on macOS), and clobbering it would be a
/// boundary violation.
#[test]
fn drop_thread_preserves_foreign_hidden_files() {
    let dir = TempDir::new().unwrap();

    run_with_stdin(
        &["continuation", "put", "--thread", "t", "--key", "k"],
        b"data",
        dir.path(),
    );

    let thread_dir = dir.path().join("t");
    let foreign_hidden = thread_dir.join(".DS_Store");
    std::fs::write(&foreign_hidden, b"macos-metadata").unwrap();

    let (code, _stdout, _) = run(
        &["continuation", "drop-thread", "--thread", "t"],
        dir.path(),
    );
    assert_eq!(code, 0);

    // Real entry is gone, but the foreign hidden file survives.
    // (The directory itself MAY have been removed if it became empty
    //  — but here it didn't become empty because `.DS_Store` is still
    //  there.) Assert by content rather than by path existence to
    //  cover either case.
    assert!(
        foreign_hidden.exists(),
        "foreign hidden file must NOT be deleted by drop-thread"
    );
    let content = std::fs::read(&foreign_hidden).unwrap();
    assert_eq!(content, b"macos-metadata");
}