noxid-cli 0.2.0

use std::fs;
use std::path::{Path, PathBuf};
use std::process::Command;
use std::time::{SystemTime, UNIX_EPOCH};

fn temp_dir(name: &str) -> PathBuf {
    let nonce = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .expect("system clock")
        .as_nanos();
    let path = std::env::temp_dir().join(format!("noxid-{name}-{}-{nonce}", std::process::id()));
    fs::create_dir_all(&path).expect("temporary directory");
    path
}

// The agent benchmark harness must discriminate without any AI: the
// reference agent passes every task and the null agent fails every task.
#[test]
fn benchmark_harness_self_test_discriminates() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let output = Command::new("node")
        .arg(root.join("benchmarks/self-test.mjs"))
        .env("NOXID_BIN", env!("CARGO_BIN_EXE_noxid"))
        .output()
        .expect("Node.js is required for the benchmark harness self-test");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
}

#[test]
fn server_load_harness_smoke_meets_loose_ci_budgets() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let output = Command::new("node")
        .args([
            "tools/load-test.mjs",
            "--smoke",
            "--requests",
            "48",
            "--concurrency",
            "6",
            "--sse-connections",
            "4",
            "--queue-jobs",
            "24",
        ])
        .current_dir(&root)
        .output()
        .expect("Node.js is required for the server load harness smoke test");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
    let result = String::from_utf8(output.stdout).expect("load harness emits UTF-8 JSON");
    for contract in [
        "\"schemaVersion\":1",
        "\"kind\":\"noxid-server-load\"",
        "\"mode\":\"smoke\"",
        "\"completed\":96",
        "\"attempted\":4",
        "\"opened\":4",
        "\"queue\":{\"completed\":24",
        "\"smokeBudget\":{\"passed\":true",
    ] {
        assert!(
            result.contains(contract),
            "load result omitted {contract}: {result}"
        );
    }
}

#[test]
fn js_framework_benchmark_contract_is_deterministic() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let output = Command::new("node")
        .args([
            "--test",
            "benchmarks/js-framework-benchmark/tools/contract.test.mjs",
        ])
        .current_dir(&root)
        .output()
        .expect("Node.js is required for the js-framework-benchmark contract test");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
}

#[test]
fn js_framework_benchmark_t3_3b_results_are_machine_verifiable() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let output = Command::new("node")
        .arg("benchmarks/js-framework-benchmark/tools/t3-3b-results.mjs")
        .arg("--check")
        .current_dir(&root)
        .output()
        .expect("Node.js is required for the T3-3b evidence verifier");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
}

#[test]
fn js_framework_benchmark_production_bundle_smoke() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let output_dir = temp_dir("js-framework-benchmark-bundle");
    let output = Command::new(env!("CARGO_BIN_EXE_noxid"))
        .args(["bundle", "benchmarks/js-framework-benchmark", "--out-dir"])
        .arg(&output_dir)
        .current_dir(&root)
        .output()
        .expect("Noxid production bundle must run");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
    let index = fs::read_to_string(output_dir.join("index.html")).expect("bundled index.html");
    assert!(index.contains("/frameworks/keyed/noxid/dist/assets/"));
    assert!(index.contains("data-farm-resource=true"));
    assert!(output_dir.join("assets/global.css").is_file());
    assert!(
        fs::read_dir(output_dir.join("assets"))
            .expect("bundled assets")
            .filter_map(Result::ok)
            .any(|entry| entry.file_name().to_string_lossy().ends_with(".js")),
        "production bundle must contain executable JavaScript"
    );
    fs::remove_dir_all(output_dir).expect("remove temporary production bundle");
}

// The documentation site is itself a Noxid application; it must keep
// building (routes, layout, typed external modules, and the lazy playground).
#[test]
fn documentation_website_builds() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let out_dir = temp_dir("website-build");
    let output = Command::new(env!("CARGO_BIN_EXE_noxid"))
        .args(["build", "website", "--out-dir"])
        .arg(&out_dir)
        .current_dir(&root)
        .output()
        .expect("build documentation website");
    assert!(
        output.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&output.stdout),
        String::from_utf8_lossy(&output.stderr)
    );
    let stdout = String::from_utf8_lossy(&output.stdout);
    // The route count grows with the documentation; the endpoint set is the
    // contract this test pins.
    assert!(stdout.contains("route(s), 6 endpoint(s)"), "{stdout}");
    let security = fs::read_to_string(out_dir.join("server/security.manifest.json"))
        .expect("website endpoint security manifest");
    for contract in [
        "\"schemaVersion\":10",
        "\"surfaces\":{\"apiDocs\":true,\"mcp\":true}",
        "\"id\":\"endpoint:AuthCallback@1\"",
        "\"path\":\"/auth/callback\"",
        "\"id\":\"endpoint:LoadProgress@1\"",
        "\"id\":\"endpoint:RecordProgressProof@1\"",
        "\"id\":\"endpoint:SaveProgressSurvey@1\"",
        // WO-31: the Learn-gated demo agent and the one endpoint its
        // derived registry admits both reach the published manifest.
        "\"id\":\"endpoint:LearnSyllabus@1\"",
        "\"name\":\"LearnCoachAgent\"",
    ] {
        assert!(
            security.contains(contract),
            "security manifest omitted {contract}"
        );
    }
    let openapi = out_dir.join("api.openapi.json");
    assert!(openapi.is_file(), "website build omitted api.openapi.json");
    let api_context = Command::new("node")
        .arg(root.join("tools/openapi-to-llms.mjs"))
        .arg(&openapi)
        .current_dir(&root)
        .output()
        .expect("generate website API context from compiler OpenAPI");
    assert!(
        api_context.status.success(),
        "{}\n{}",
        String::from_utf8_lossy(&api_context.stdout),
        String::from_utf8_lossy(&api_context.stderr)
    );
    let api_context = String::from_utf8(api_context.stdout).expect("UTF-8 website API context");
    let expected_api_context = r#"## Website API (generated)

Generated from the website's compiler-emitted OpenAPI 3.1 artifact. Do not edit by hand.

- `AuthCallback` — `GET /auth/callback` — `AuthCallback(query { code: Optional<String> }) -> Boolean`
- `LearnSyllabus` — `POST /api/progress/syllabus` — `LearnSyllabus(body { topic: String }) -> String`
- `LearnerIdentity` — `GET /api/progress/learner` — `LearnerIdentity() -> String`
- `LoadProgress` — `GET /api/progress/load` — `LoadProgress() -> ProgressSnapshot`
- `RecordProgressProof` — `POST /api/progress/proof` — `RecordProgressProof(body { conceptId: ConceptId }) -> Boolean`
- `SaveProgressSurvey` — `PUT /api/progress/survey` — `SaveProgressSurvey(body { languages: Array<LanguageId>, intent: String }) -> Boolean`
"#;
    assert_eq!(api_context, expected_api_context);
    // WO-53: llms.txt is now an index; the flat concatenation lives in
    // llms-full.txt, and the compiler-derived API section is its own chunk.
    let llms_full =
        fs::read_to_string(root.join("llms-full.txt")).expect("generated llms-full.txt");
    assert!(
        llms_full.contains(api_context.trim()),
        "llms-full.txt omitted the compiler-derived website API section"
    );
    let llms_index = fs::read_to_string(root.join("llms.txt")).expect("generated llms.txt");
    assert!(
        llms_index.contains("llms/website-api.txt"),
        "llms.txt index did not list the website API chunk"
    );
    let api_chunk =
        fs::read_to_string(root.join("llms/website-api.txt")).expect("website API chunk");
    assert!(
        api_chunk.contains(api_context.trim()),
        "website API chunk omitted the compiler-derived section"
    );
    let host = fs::read_to_string(out_dir.join("server/host.js")).expect("website server host");
    for key in [
        "endpoint:LoadProgress@1",
        "endpoint:RecordProgressProof@1",
        "endpoint:SaveProgressSurvey@1",
        "action:LearnProgressPage.completeConcept",
    ] {
        assert!(host.contains(key), "website host omitted exact key {key}");
    }
    let execution = fs::read_to_string(out_dir.join("server/execution.manifest.json"))
        .expect("website execution manifest");
    for contract in [
        "\"id\":\"resource:LearnProgress\"",
        "\"action\":\"action:LearnProgressPage.completeConcept\"",
        "\"invalidates\":[\"resource:LearnProgress\"]",
        "\"middleware\":[\"middleware:learnSession\"]",
    ] {
        assert!(
            execution.contains(contract),
            "website live progress omitted {contract}"
        );
    }
    let routes = fs::read_to_string(out_dir.join("app.routes.json")).expect("website routes");
    assert!(!routes.contains("/auth/callback"));
    assert!(!out_dir.join("assets/AuthCallbackPage.js").exists());
    let playground = fs::read_to_string(out_dir.join("assets/NoxidPlaygroundPage.js"))
        .expect("playground route chunk");
    assert!(
        playground.contains("compileSource(source.get())"),
        "{playground}"
    );
    assert!(
        playground.contains("external-function:../../playground.js.compileSource"),
        "{playground}"
    );
    assert!(
        playground.contains("from \"./external/src/playground.js\""),
        "the route chunk must use a deployable project-relative external import: {playground}"
    );
    let emitted_loader = fs::read_to_string(out_dir.join("assets/external/src/playground.js"))
        .expect("copied route-local playground loader");
    assert!(
        emitted_loader.contains("[\"..\", \"..\", \"noxid-playground.wasm\"].join(\"/\")"),
        "{emitted_loader}"
    );
    assert!(
        out_dir.join("assets/noxid-playground.wasm").is_file(),
        "the docs build must ship its browser compiler"
    );
    assert!(
        !fs::read_to_string(out_dir.join("app.js"))
            .expect("application entry")
            .contains("playground.js"),
        "the wasm loader must remain out of the eager application entry"
    );
    let loader = fs::read_to_string(root.join("website/src/playground.js"))
        .expect("typed playground loader");
    assert!(
        loader.contains("[\"..\", \"..\", \"noxid-playground.wasm\"].join(\"/\")"),
        "the emitted external module must resolve the route-local wasm asset"
    );
    assert!(loader.contains("await loadCompiler();"));
    assert!(
        !loader.contains("MutationObserver") && !loader.contains("querySelector"),
        "playground behavior must remain compiler-visible through Noxid actions"
    );
    let contract = fs::read_to_string(root.join("website/src/playground.js.nox-contract"))
        .expect("playground external contract");
    assert!(contract.contains("module client"));
    assert!(contract.contains("impure compileSource(String): String"));
    let landing = fs::read_to_string(root.join("website/src/routes/+page.nox"))
        .expect("documentation landing route");
    assert!(landing.contains("href=\"/playground\""));
    fs::remove_dir_all(out_dir).expect("remove website build dir");
}

// Learn-track samples that declare scenarios must actually pass them:
// documentation claims proof, so documentation runs under noxid test.
#[test]
fn learn_docs_scenarios_pass() {
    let learn_dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../docs/learn");
    let out_dir = std::env::temp_dir().join(format!(
        "noxid-learn-scenarios-{}-{}",
        std::process::id(),
        std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .expect("clock")
            .as_nanos()
    ));
    std::fs::create_dir_all(&out_dir).expect("scenario sample dir");
    let mut executed = 0;
    for entry in std::fs::read_dir(&learn_dir).expect("learn docs") {
        let path = entry.expect("entry").path();
        if path.extension().and_then(|ext| ext.to_str()) != Some("md") {
            continue;
        }
        let markdown = std::fs::read_to_string(&path).expect("read page");
        let mut fence: Option<String> = None;
        let mut index = 0;
        for line in markdown.lines() {
            if let Some(source) = fence.as_mut() {
                if line == "```" {
                    let source = fence.take().expect("open fence");
                    if source.contains("scenario ") {
                        index += 1;
                        let sample = out_dir.join(format!(
                            "{}-{index}.nox",
                            path.file_stem().unwrap().to_string_lossy()
                        ));
                        std::fs::write(&sample, &source).expect("write sample");
                        let output = Command::new(env!("CARGO_BIN_EXE_noxid"))
                            .arg("test")
                            .arg(&sample)
                            .output()
                            .expect("run noxid test on learn sample");
                        assert!(
                            output.status.success(),
                            "{} sample {index} scenarios failed:\n{}\n{}",
                            path.display(),
                            String::from_utf8_lossy(&output.stdout),
                            String::from_utf8_lossy(&output.stderr)
                        );
                        executed += 1;
                    }
                } else {
                    source.push_str(line);
                    source.push('\n');
                }
            } else if line == "```noxid" {
                fence = Some(String::new());
            }
        }
    }
    assert!(
        executed >= 4,
        "expected scenario-bearing samples, ran {executed}"
    );
    std::fs::remove_dir_all(out_dir).expect("cleanup");
}

// The npm admission gate: an app import of an npm package must match a
// vetting record's version and integrity exactly; --strict-npm makes any
// gap a build error (WO-11).
#[test]
fn npm_admission_gate_enforces_vetting_records() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
    let strict = |expect_success: bool, marker: &str| {
        let output = Command::new(env!("CARGO_BIN_EXE_noxid"))
            .args(["build", "examples/routing-app", "--strict-npm", "--out-dir"])
            .arg(temp_dir("npm-gate"))
            .current_dir(&root)
            .output()
            .expect("run strict npm build");
        assert_eq!(
            output.status.success(),
            expect_success,
            "{marker}:\n{}\n{}",
            String::from_utf8_lossy(&output.stdout),
            String::from_utf8_lossy(&output.stderr)
        );
        String::from_utf8_lossy(&output.stderr).to_string()
    };
    let record = root.join("plugins/es-toolkit/VETTING.md");
    let original = fs::read_to_string(&record).expect("vetting record present");

    strict(true, "valid record must pass");

    fs::write(
        &record,
        original.replace("integrity: sha512-", "integrity: sha512-TAMPERED"),
    )
    .unwrap();
    let tampered = strict(false, "tampered integrity must fail");
    assert!(tampered.contains("NPM_IMPORT_UNVETTED"), "{tampered}");

    fs::remove_file(&record).unwrap();
    let missing = strict(false, "missing record must fail");
    assert!(missing.contains("noxid vet es-toolkit"), "{missing}");

    fs::write(&record, original).unwrap();
    strict(true, "restored record must pass");
}

// WO-53 context budgeting: llms.txt is a chunk index, not a 227 KB wall of
// text. Every chunk must fit a model's window (<= 24 KB), the index must list
// each chunk with its true byte size, and llms-full.txt must keep the full
// concatenation for tools that want it. Reads the committed artifacts.
#[test]
fn llms_txt_is_a_budgeted_chunk_index() {
    const CHUNK_CAP: u64 = 24 * 1024;
    let root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");

    let index = fs::read_to_string(root.join("llms.txt")).expect("llms.txt index");
    assert!(
        index.contains("This is an index."),
        "llms.txt is not the chunk index"
    );
    let full = fs::read_to_string(root.join("llms-full.txt")).expect("llms-full.txt");
    assert!(
        full.len() > 100_000,
        "llms-full.txt should keep the full concatenation, was {} bytes",
        full.len()
    );

    let chunks_dir = root.join("llms");
    let mut chunk_count = 0usize;
    let mut language_reference_parts = 0usize;
    for entry in fs::read_dir(&chunks_dir).expect("llms/ chunk directory") {
        let path = entry.expect("chunk entry").path();
        if path.extension().and_then(|value| value.to_str()) != Some("txt") {
            continue;
        }
        chunk_count += 1;
        let name = path.file_name().unwrap().to_string_lossy().into_owned();
        let size = fs::metadata(&path).expect("chunk metadata").len();
        assert!(
            size <= CHUNK_CAP,
            "chunk {name} is {size} bytes, over the {CHUNK_CAP}-byte budget"
        );
        // The index must list this chunk with its exact byte size.
        assert!(
            index.contains(&format!("- llms/{name} ({size} bytes) - ")),
            "llms.txt index is missing or mis-sizes chunk {name} ({size} bytes)"
        );
        // Every chunk's content is part of the full concatenation.
        let body = fs::read_to_string(&path).expect("chunk body");
        let core = body
            .lines()
            .find(|line| !line.trim().is_empty() && !line.starts_with("## "))
            .unwrap_or("");
        if !core.is_empty() {
            assert!(
                full.contains(core.trim()),
                "chunk {name} carries a line absent from llms-full.txt: {core}"
            );
        }
        if name.starts_with("language-reference") {
            language_reference_parts += 1;
        }
    }
    assert!(
        chunk_count >= 20,
        "expected one chunk per doc topic, found {chunk_count}"
    );
    assert!(
        language_reference_parts >= 2,
        "the oversized language reference must split into multiple parts, found {language_reference_parts}"
    );
}