testlint_sdk/

test_uploader.rs

use chrono::Utc;
use flate2::write::GzEncoder;
use flate2::Compression;
use lazy_static::lazy_static;
use quick_xml::events::{attributes::Attribute, BytesEnd, BytesStart, BytesText, Event};
use quick_xml::{Reader, Writer};
use regex::Regex;
use sha2::{Digest, Sha256};
use std::fs;
use std::io::Cursor;
use std::path::Path;

#[cfg(test)]
use std::fs::File;
#[cfg(test)]
use std::io::Read;

// Cached regex patterns for path anonymization
lazy_static! {
    // Python-style: File "/path/to/file.py", line 123
    static ref PYTHON_FILE_RE: Regex = Regex::new(r#"File "([^"]+)""#).unwrap();

    // Java/JavaScript-style: at /path/to/file:123 or at /path/to/file.js:123:45
    static ref STACKTRACE_PATH_RE: Regex = Regex::new(r"(?:at |in )(/[^\s:]+|[A-Z]:[^\s:]+):").unwrap();

    // Generic absolute Unix paths in text
    static ref UNIX_PATH_RE: Regex = Regex::new(r"(/[^\s]+\.(?:py|js|ts|java|rs|go|cpp|c|h)[:\s\)])").unwrap();

    // Generic absolute Windows paths in text
    static ref WINDOWS_PATH_RE: Regex = Regex::new(r"([A-Z]:[^\s]+\.(?:py|js|ts|java|rs|go|cpp|c|h)[:\s\)])").unwrap();

    // XML attribute patterns for file paths
    static ref XML_FILENAME_RE: Regex = Regex::new(r#"filename="([^"]+)""#).unwrap();
    static ref XML_PATH_RE: Regex = Regex::new(r#"path="([^"]+)""#).unwrap();
    static ref XML_SOURCE_RE: Regex = Regex::new(r#"source="([^"]+)""#).unwrap();
}

// Coverage report structures (no longer using protobuf)
#[derive(Debug, Clone)]
pub struct CoverageReport {
    pub language: String,
    pub format: String,
    pub git_commit: String,
    pub git_branch: String,
    pub timestamp: String,
    pub environment: String,
    pub content: Option<CoverageContent>,
    pub file_path: String,
    pub content_type: String,
    pub file_size_bytes: u64,
}

#[derive(Debug, Clone)]
pub enum CoverageContent {
    TextContent(String),
    BinaryContent(Vec<u8>),
}

#[derive(Debug, Clone)]
pub struct CoverageBatch {
    pub reports: Vec<CoverageReport>,
    pub reported_at: String,
    pub agent_version: String,
}

#[derive(Debug, Clone)]
pub struct TestUploaderConfig {
    pub endpoint: String,
    pub api_key: Option<String>,
    pub format: UploadFormat,
    pub git_commit: Option<String>,
    pub git_branch: Option<String>,
    pub git_commit_timestamp: Option<String>, // ISO 8601 timestamp when commit was created
    pub environment: Option<String>,
    pub test_type: Option<String>,
    pub compression_level: u32,   // 0-9, where 0=none, 6=default, 9=best
    pub upload_timeout_secs: u64, // HTTP upload timeout in seconds (default: 60)
    pub max_retry_attempts: u32,  // Number of retry attempts for failed uploads (default: 3)
    pub retry_delay_ms: u64,      // Initial retry delay in milliseconds (default: 1000)
    pub anonymize_paths: bool,    // Anonymize file paths for privacy (default: true)
    pub project_root: Option<String>, // Project root for path relativization (auto-detected if not set)
}

#[derive(Debug, Clone)]
pub enum UploadFormat {
    Json,
    Protobuf,
}

impl Default for TestUploaderConfig {
    fn default() -> Self {
        // Use localhost in debug builds, production URL in release builds
        #[cfg(debug_assertions)]
        let default_endpoint = "http://localhost:8001/tests/upload";
        #[cfg(not(debug_assertions))]
        let default_endpoint = "https://api.testlint.com/tests/upload";

        Self {
            endpoint: default_endpoint.to_string(),
            api_key: None,
            format: UploadFormat::Protobuf,
            git_commit: None,
            git_branch: None,
            git_commit_timestamp: None,
            environment: Some("development".to_string()),
            test_type: Some("unit".to_string()),
            compression_level: 6,    // Standard compression (good balance)
            upload_timeout_secs: 60, // 1 minute for uploads
            max_retry_attempts: 3,   // 3 retry attempts
            retry_delay_ms: 1000,    // 1 second initial delay
            anonymize_paths: true,   // Anonymize paths by default for privacy
            project_root: None,      // Auto-detect from git or cwd
        }
    }
}

impl TestUploaderConfig {
    #[allow(clippy::too_many_arguments)]
    pub fn from_env_and_args(
        endpoint: Option<String>,
        api_key: Option<String>,
        format: Option<String>,
        git_commit: Option<String>,
        git_branch: Option<String>,
        git_commit_timestamp: Option<String>,
        environment: Option<String>,
        test_type: Option<String>,
        compression_level: Option<u32>,
    ) -> Self {
        let mut config = Self::default();

        // Override with environment variables
        if let Ok(env_endpoint) = std::env::var("TESTLINT_UPLOAD_ENDPOINT") {
            config.endpoint = env_endpoint;
        }
        if let Ok(env_api_key) = std::env::var("TESTLINT_UPLOAD_API_KEY") {
            config.api_key = Some(env_api_key);
        }
        if let Ok(env_format) = std::env::var("TESTLINT_UPLOAD_FORMAT") {
            config.format = match env_format.to_lowercase().as_str() {
                "json" => UploadFormat::Json,
                _ => UploadFormat::Protobuf,
            };
        }
        if let Ok(env_environment) = std::env::var("TESTLINT_UPLOAD_ENVIRONMENT") {
            config.environment = Some(env_environment);
        }
        if let Ok(env_test_type) = std::env::var("TESTLINT_UPLOAD_TEST_TYPE") {
            config.test_type = Some(env_test_type);
        }
        if let Ok(env_compression) = std::env::var("TESTLINT_UPLOAD_COMPRESSION") {
            if let Ok(level) = env_compression.parse::<u32>() {
                config.compression_level = level.min(9); // Cap at 9
            }
        }
        if let Ok(env_commit_timestamp) = std::env::var("TESTLINT_COMMIT_TIMESTAMP") {
            config.git_commit_timestamp = Some(env_commit_timestamp);
        }

        // Override with CLI arguments (highest priority)
        if let Some(ep) = endpoint {
            config.endpoint = ep;
        }
        if let Some(key) = api_key {
            config.api_key = Some(key);
        }
        if let Some(fmt) = format {
            config.format = match fmt.to_lowercase().as_str() {
                "json" => UploadFormat::Json,
                _ => UploadFormat::Protobuf,
            };
        }
        if let Some(commit) = git_commit {
            config.git_commit = Some(commit);
        }
        if let Some(branch) = git_branch {
            config.git_branch = Some(branch);
        }
        if let Some(timestamp) = git_commit_timestamp {
            config.git_commit_timestamp = Some(timestamp);
        }
        if let Some(env) = environment {
            config.environment = Some(env);
        }
        if let Some(test_type) = test_type {
            config.test_type = Some(test_type);
        }
        if let Some(level) = compression_level {
            config.compression_level = level.min(9); // Cap at 9
        }

        // Auto-detect git commit and branch if not provided
        if config.git_commit.is_none() {
            config.git_commit = Self::detect_git_commit();
        }
        if config.git_branch.is_none() {
            config.git_branch = Self::detect_git_branch();
        }
        // Auto-detect commit timestamp if not provided but commit is available
        if config.git_commit_timestamp.is_none() {
            if let Some(ref commit) = config.git_commit {
                config.git_commit_timestamp = Self::get_commit_timestamp(commit);
            }
        }

        config
    }

    /// Auto-detect current git commit hash
    fn detect_git_commit() -> Option<String> {
        std::process::Command::new("git")
            .args(["rev-parse", "HEAD"])
            .output()
            .ok()
            .and_then(|output| {
                if output.status.success() {
                    Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
                } else {
                    None
                }
            })
    }

    /// Get commit timestamp for a specific commit SHA
    fn get_commit_timestamp(commit_sha: &str) -> Option<String> {
        std::process::Command::new("git")
            .args(["show", "-s", "--format=%cI", commit_sha])
            .output()
            .ok()
            .and_then(|output| {
                if output.status.success() {
                    Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
                } else {
                    None
                }
            })
    }

    /// Auto-detect current git branch
    fn detect_git_branch() -> Option<String> {
        std::process::Command::new("git")
            .args(["rev-parse", "--abbrev-ref", "HEAD"])
            .output()
            .ok()
            .and_then(|output| {
                if output.status.success() {
                    Some(String::from_utf8_lossy(&output.stdout).trim().to_string())
                } else {
                    None
                }
            })
    }

    /// Auto-detect project root (git root or current directory)
    fn detect_project_root() -> Option<String> {
        // Try git root first
        if let Ok(output) = std::process::Command::new("git")
            .args(["rev-parse", "--show-toplevel"])
            .output()
        {
            if output.status.success() {
                return Some(String::from_utf8_lossy(&output.stdout).trim().to_string());
            }
        }

        // Fallback to current directory
        std::env::current_dir()
            .ok()
            .and_then(|p| p.to_str().map(|s| s.to_string()))
    }

    /// Get the project root, using provided value or auto-detecting
    pub fn get_project_root(&self) -> String {
        self.project_root
            .clone()
            .or_else(Self::detect_project_root)
            .unwrap_or_else(|| ".".to_string())
    }
}

pub struct TestUploader {
    config: TestUploaderConfig,
    client: reqwest::blocking::Client,
    upload_salt: String, // Random salt per upload for test name hashing
}

impl TestUploader {
    pub fn new(config: TestUploaderConfig) -> Result<Self, String> {
        let client = reqwest::blocking::Client::builder()
            .timeout(std::time::Duration::from_secs(30))
            .build()
            .expect("Failed to create HTTP client");

        // Register salt with server using the API client
        let upload_salt = Self::register_salt_with_server(&config)?;

        Ok(Self {
            config,
            client,
            upload_salt,
        })
    }

    /// Register salt with /tests/salt endpoint using the generated API client
    fn register_salt_with_server(config: &TestUploaderConfig) -> Result<String, String> {
        let commit_sha = config
            .git_commit
            .as_ref()
            .ok_or("No git commit specified")?;
        let api_key = config.api_key.as_ref().ok_or("No API key specified")?;

        // Generate a local salt to propose
        let proposed_salt = Self::generate_local_salt();

        // Build base URL from upload endpoint
        let base_url = config.endpoint.replace("/tests/upload", "");

        // Create API client with auth header
        let reqwest_client = reqwest::Client::builder()
            .default_headers({
                let mut headers = reqwest::header::HeaderMap::new();
                headers.insert(
                    reqwest::header::AUTHORIZATION,
                    reqwest::header::HeaderValue::from_str(&format!("Bearer {}", api_key))
                        .map_err(|e| format!("Invalid API key: {}", e))?,
                );
                headers
            })
            .build()
            .map_err(|e| format!("Failed to create HTTP client: {}", e))?;

        let api_client = crate::api_client::Client::new_with_client(&base_url, reqwest_client);

        // Use tokio runtime to run async call
        let rt = tokio::runtime::Runtime::new()
            .map_err(|e| format!("Failed to create tokio runtime: {}", e))?;

        let response = rt
            .block_on(async {
                api_client
                    .register_upload_salt_tests_salt_post()
                    .commit_sha(commit_sha)
                    .salt(&proposed_salt)
                    .send()
                    .await
            })
            .map_err(|e| format!("Failed to register salt: {}", e))?;

        Ok(response.into_inner().salt)
    }

    /// Generate a local salt
    fn generate_local_salt() -> String {
        use std::time::{SystemTime, UNIX_EPOCH};
        let timestamp = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_nanos();

        let mut hasher = Sha256::new();
        hasher.update(timestamp.to_le_bytes());
        hasher.update(std::process::id().to_le_bytes());
        format!("{:x}", hasher.finalize())
    }

    /// Create a TestUploader with a pre-specified salt (for testing/benchmarking only)
    #[doc(hidden)]
    pub fn new_with_salt(config: TestUploaderConfig, salt: String) -> Self {
        let client = reqwest::blocking::Client::builder()
            .timeout(std::time::Duration::from_secs(30))
            .build()
            .expect("Failed to create HTTP client");

        Self {
            config,
            client,
            upload_salt: salt,
        }
    }

    /// Anonymize file paths in coverage data for privacy
    /// Converts absolute paths to relative paths from project root
    ///
    /// **Note:** This is public for benchmarking only. Not part of stable API.
    #[doc(hidden)]
    pub fn anonymize_coverage_content(&self, content: &str, format: &str) -> String {
        if !self.config.anonymize_paths {
            return content.to_string();
        }

        let project_root = self.config.get_project_root();
        let project_root = std::path::Path::new(&project_root);

        match format {
            "coverage.py" | "jest" | "istanbul" => {
                // JSON-based formats - anonymize file paths in the JSON
                self.anonymize_json_paths(content, project_root)
            }
            "jacoco" | "cobertura" => {
                // XML-based formats - anonymize file paths in XML
                self.anonymize_xml_paths(content, project_root)
            }
            "lcov" | "golang" => {
                // LCOV format - anonymize SF: (source file) lines
                self.anonymize_lcov_paths(content, project_root)
            }
            _ => content.to_string(),
        }
    }

    /// Anonymize paths in JSON coverage data
    fn anonymize_json_paths(&self, content: &str, project_root: &Path) -> String {
        // Parse JSON and replace all absolute paths with relative ones
        if let Ok(mut json) = serde_json::from_str::<serde_json::Value>(content) {
            self.anonymize_json_value(&mut json, project_root);
            serde_json::to_string_pretty(&json).unwrap_or_else(|_| content.to_string())
        } else {
            content.to_string()
        }
    }

    /// Recursively anonymize paths in JSON values
    fn anonymize_json_value(&self, value: &mut serde_json::Value, project_root: &Path) {
        match value {
            serde_json::Value::Object(map) => {
                // First pass: identify and rename keys that look like file paths
                let keys_to_rename: Vec<(String, String)> = map
                    .keys()
                    .filter(|key| {
                        key.starts_with('/')
                            || key.contains(":\\")
                            || key.contains('/')
                            || key.contains('\\')
                    })
                    .map(|key| {
                        let relative_path = self.make_relative_path(key, project_root);
                        let hashed_path = self.hash_file_path(&relative_path);
                        (key.clone(), hashed_path)
                    })
                    .collect();

                // Apply the renames
                for (old_key, new_key) in keys_to_rename {
                    if let Some(val) = map.remove(&old_key) {
                        map.insert(new_key, val);
                    }
                }

                // Second pass: recurse into all values (now with updated keys)
                for val in map.values_mut() {
                    self.anonymize_json_value(val, project_root);
                }
            }
            serde_json::Value::Array(arr) => {
                for item in arr.iter_mut() {
                    self.anonymize_json_value(item, project_root);
                }
            }
            serde_json::Value::String(s) => {
                // Replace string if it looks like a file path
                if s.starts_with('/')
                    || s.contains(":\\")
                    || (s.contains('/') && !s.starts_with("http"))
                {
                    let relative_path = self.make_relative_path(s, project_root);
                    *s = self.hash_file_path(&relative_path);
                }
            }
            _ => {}
        }
    }

    /// Anonymize paths in XML coverage data
    fn anonymize_xml_paths(&self, content: &str, project_root: &Path) -> String {
        let mut result = content.to_string();

        // Process filename attribute
        result = XML_FILENAME_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let relative_path = self.make_relative_path(original_path, project_root);
                    let hashed_path = self.hash_file_path(&relative_path);
                    format!(r#"filename="{}""#, hashed_path)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        // Process path attribute
        result = XML_PATH_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let relative_path = self.make_relative_path(original_path, project_root);
                    let hashed_path = self.hash_file_path(&relative_path);
                    format!(r#"path="{}""#, hashed_path)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        // Process source attribute
        result = XML_SOURCE_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let relative_path = self.make_relative_path(original_path, project_root);
                    let hashed_path = self.hash_file_path(&relative_path);
                    format!(r#"source="{}""#, hashed_path)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        result
    }

    /// Anonymize paths in LCOV format coverage data
    fn anonymize_lcov_paths(&self, content: &str, project_root: &Path) -> String {
        // Pre-allocate string with estimated capacity to avoid reallocations
        let mut result = String::with_capacity(content.len());
        let mut first = true;

        for line in content.lines() {
            if !first {
                result.push('\n');
            }
            first = false;

            if line.starts_with("SF:") {
                let path = line.strip_prefix("SF:").unwrap_or(line);
                // First make relative, then hash
                let relative_path = self.make_relative_path(path, project_root);
                let hashed_path = self.hash_file_path(&relative_path);
                result.push_str("SF:");
                result.push_str(&hashed_path);
            } else if line.starts_with("TN:") && line.contains('/') {
                // Test name might contain path - anonymize it
                let test_name = line.strip_prefix("TN:").unwrap_or(line);
                let relative_path = self.make_relative_path(test_name, project_root);
                let hashed_path = self.hash_file_path(&relative_path);
                result.push_str("TN:");
                result.push_str(&hashed_path);
            } else {
                // Push unmodified line directly without allocation
                result.push_str(line);
            }
        }

        result
    }

    /// Convert absolute path to relative path from project root
    fn make_relative_path(&self, path_str: &str, project_root: &Path) -> String {
        let path = Path::new(path_str);

        // Try to make path relative to project root
        if let Ok(relative) = path.strip_prefix(project_root) {
            relative.to_string_lossy().to_string()
        } else {
            // Path is already relative from repo root, keep as-is
            path_str.to_string()
        }
    }

    /// Hash a file path for anonymization
    /// Creates a stable hash based on salt + commit_sha + file path
    ///
    /// **Note:** This is public for benchmarking only. Not part of stable API.
    #[doc(hidden)]
    pub fn hash_file_path(&self, file_path: &str) -> String {
        let git_commit = self.config.git_commit.as_deref().unwrap_or("unknown");

        // Create deterministic hash with salt: SHA256(salt + commit + file_path)
        // Write directly to hasher to avoid intermediate string allocation
        let mut hasher = Sha256::new();
        hasher.update(self.upload_salt.as_bytes());
        hasher.update(b"/");
        hasher.update(git_commit.as_bytes());
        hasher.update(b"/");
        hasher.update(file_path.as_bytes());
        let result = hasher.finalize();

        // Use full hash for maximum uniqueness and collision resistance
        format!("{:x}", result)
    }

    /// Hash a test name for anonymization
    /// Creates a stable hash based on salt + commit_sha + file path + test name
    ///
    /// **Note:** This is public for benchmarking only. Not part of stable API.
    #[doc(hidden)]
    pub fn hash_test_name(&self, test_name: &str, file_path: &str) -> String {
        let git_commit = self.config.git_commit.as_deref().unwrap_or("unknown");

        // Create deterministic hash with salt: SHA256(salt + commit + file + test_name)
        // Write directly to hasher to avoid intermediate string allocation
        let mut hasher = Sha256::new();
        hasher.update(self.upload_salt.as_bytes());
        hasher.update(b"/");
        hasher.update(git_commit.as_bytes());
        hasher.update(b"/");
        hasher.update(file_path.as_bytes());
        hasher.update(b"/");
        hasher.update(test_name.as_bytes());
        let result = hasher.finalize();

        // Use full hash for maximum uniqueness and collision resistance
        format!("test_{:x}", result)
    }

    /// Anonymize text content by replacing absolute paths with relative ones
    /// Used for error messages, stack traces, system-out, and system-err
    fn anonymize_text_content(&self, text: &str, project_root: &Path) -> String {
        let mut result = text.to_string();

        // Python-style: File "/path/to/file.py", line 123
        result = PYTHON_FILE_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let relative_path = self.make_relative_path(original_path, project_root);
                    format!(r#"File "{}""#, relative_path)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        // Java/JavaScript-style: at /path/to/file:123 or at /path/to/file.js:123:45
        result = STACKTRACE_PATH_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let relative_path = self.make_relative_path(original_path, project_root);
                    caps[0].replace(original_path, &relative_path)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        // Generic absolute Unix paths in text
        result = UNIX_PATH_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let suffix = original_path.chars().last().unwrap_or(' ');
                    let path_without_suffix = &original_path[..original_path.len() - 1];
                    let relative_path = self.make_relative_path(path_without_suffix, project_root);
                    format!("{}{}", relative_path, suffix)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        // Generic absolute Windows paths in text
        result = WINDOWS_PATH_RE
            .replace_all(&result, |caps: &regex::Captures| {
                if let Some(path_match) = caps.get(1) {
                    let original_path = path_match.as_str();
                    let suffix = original_path.chars().last().unwrap_or(' ');
                    let path_without_suffix = &original_path[..original_path.len() - 1];
                    let relative_path = self.make_relative_path(path_without_suffix, project_root);
                    format!("{}{}", relative_path, suffix)
                } else {
                    caps[0].to_string()
                }
            })
            .to_string();

        result
    }

    /// Anonymize JUnit XML test results for privacy
    /// Removes hostnames and anonymizes file paths and test names in test attributes
    pub fn anonymize_junit_xml(&self, xml_content: &[u8]) -> Vec<u8> {
        if !self.config.anonymize_paths {
            return xml_content.to_vec();
        }

        let project_root = self.config.get_project_root();
        let project_root = Path::new(&project_root);

        let mut reader = Reader::from_reader(xml_content);
        reader.config_mut().trim_text(false); // Preserve whitespace

        let mut writer = Writer::new(Cursor::new(Vec::new()));
        let mut buf = Vec::new();

        // Track which element we're inside for text content anonymization
        let mut inside_anonymize_element = None::<String>;

        loop {
            match reader.read_event_into(&mut buf) {
                Ok(Event::Eof) => break,

                Ok(Event::Start(ref e)) | Ok(Event::Empty(ref e)) => {
                    let elem_name = String::from_utf8_lossy(e.name().as_ref()).to_string();

                    // Track if we're entering an element whose text content should be anonymized
                    if matches!(
                        elem_name.as_str(),
                        "failure" | "error" | "system-out" | "system-err"
                    ) {
                        inside_anonymize_element = Some(elem_name.clone());
                    }

                    // Process and anonymize attributes
                    let mut new_elem = BytesStart::new(elem_name.clone());

                    // Keep track of file path for test name hashing
                    let mut file_path_for_hash = String::new();
                    let mut test_name = String::new();

                    // First pass: collect file path and test name
                    for attr in e.attributes().flatten() {
                        let key = String::from_utf8_lossy(attr.key.as_ref());
                        if key == "file" || key == "filepath" {
                            file_path_for_hash = String::from_utf8_lossy(&attr.value).to_string();
                        } else if key == "name" && elem_name == "testcase" {
                            test_name = String::from_utf8_lossy(&attr.value).to_string();
                        }
                    }

                    // Second pass: modify attributes
                    for attr in e.attributes().flatten() {
                        let key = String::from_utf8_lossy(attr.key.as_ref());
                        let value = String::from_utf8_lossy(&attr.value);

                        match key.as_ref() {
                            "hostname" => {
                                // Skip hostname attribute entirely
                                continue;
                            }
                            "file" | "filepath" => {
                                // Anonymize file paths
                                let relative_path = self.make_relative_path(&value, project_root);
                                new_elem.push_attribute(Attribute::from((
                                    key.as_bytes(),
                                    relative_path.as_bytes(),
                                )));
                            }
                            "classname" => {
                                // Anonymize classname if it looks like a file path
                                if value.contains('/') || value.contains('\\') {
                                    let relative_path =
                                        self.make_relative_path(&value, project_root);
                                    let anonymized = relative_path.replace(['/', '\\'], ".");
                                    new_elem.push_attribute(Attribute::from((
                                        key.as_bytes(),
                                        anonymized.as_bytes(),
                                    )));
                                } else {
                                    new_elem.push_attribute(attr);
                                }
                            }
                            "name" if elem_name == "testcase" => {
                                // Hash test name
                                let hashed_name =
                                    self.hash_test_name(&test_name, &file_path_for_hash);
                                new_elem.push_attribute(Attribute::from((
                                    key.as_bytes(),
                                    hashed_name.as_bytes(),
                                )));
                            }
                            _ => {
                                // Keep other attributes as-is
                                new_elem.push_attribute(attr);
                            }
                        }
                    }

                    // Write the modified element
                    if matches!(e, BytesStart { .. }) {
                        writer.write_event(Event::Start(new_elem)).ok();
                    } else {
                        writer.write_event(Event::Empty(new_elem)).ok();
                    }
                }

                Ok(Event::End(ref e)) => {
                    let elem_name = String::from_utf8_lossy(e.name().as_ref()).to_string();

                    // Check if we're exiting an element whose content we were anonymizing
                    if let Some(ref current_elem) = inside_anonymize_element {
                        if current_elem == &elem_name {
                            inside_anonymize_element = None;
                        }
                    }

                    writer
                        .write_event(Event::End(BytesEnd::new(elem_name)))
                        .ok();
                }

                Ok(Event::Text(ref e)) => {
                    // Anonymize text content if we're inside an error/failure/system element
                    if inside_anonymize_element.is_some() {
                        let text = reader.decoder().decode(e).unwrap_or_default().into_owned();
                        let anonymized = self.anonymize_text_content(&text, project_root);
                        writer
                            .write_event(Event::Text(BytesText::new(&anonymized)))
                            .ok();
                    } else {
                        writer.write_event(Event::Text(e.clone())).ok();
                    }
                }

                Ok(e) => {
                    // Pass through all other events unchanged
                    writer.write_event(e).ok();
                }

                Err(e) => {
                    eprintln!(
                        "Error parsing XML at position {}: {:?}",
                        reader.buffer_position(),
                        e
                    );
                    // On error, return original content
                    return xml_content.to_vec();
                }
            }

            buf.clear();
        }

        writer.into_inner().into_inner()
    }

    /// Upload a single coverage file
    pub fn upload_file(
        &self,
        file_path: &str,
        language: &str,
        coverage_format: &str,
    ) -> Result<(), String> {
        let reports = vec![self.read_coverage_file(file_path, language, coverage_format)?];
        self.upload_reports(reports)
    }

    /// Upload multiple coverage files
    pub fn upload_files(
        &self,
        files: Vec<(String, String, String)>, // (file_path, language, format)
    ) -> Result<(), String> {
        let mut reports = Vec::new();
        for (file_path, language, format) in files {
            reports.push(self.read_coverage_file(&file_path, &language, &format)?);
        }
        self.upload_reports(reports)
    }

    /// Upload JUnit XML test result files
    ///
    /// This method uploads JUnit XML test result files to the backend for analysis.
    /// It handles anonymization of file paths and test names if enabled in the config.
    ///
    /// # Arguments
    /// * `files` - Slice of PathBuf pointing to JUnit XML files to upload
    ///
    /// # Returns
    /// * `Ok(())` on successful upload
    /// * `Err(String)` with error message on failure
    pub fn upload_test_files(&self, files: &[std::path::PathBuf]) -> Result<(), String> {
        use std::path::PathBuf;

        // Validate files exist and are XML
        for file in files {
            if !file.exists() {
                return Err(format!("Test file not found: {}", file.display()));
            }
            if file.extension().map(|e| e.to_str()) != Some(Some("xml")) {
                return Err(format!("Test file must be an XML file: {}", file.display()));
            }
        }

        println!(
            "Uploading {} test result file(s) to {}",
            files.len(),
            self.config.endpoint
        );

        // Read and anonymize each file
        let mut test_contents: Vec<(PathBuf, Vec<u8>)> = Vec::new();
        for file in files {
            let content = std::fs::read(file)
                .map_err(|e| format!("Failed to read test file {}: {}", file.display(), e))?;

            // Anonymize JUnit XML for privacy (removes hostname, anonymizes paths and test names)
            let anonymized_content = self.anonymize_junit_xml(&content);
            test_contents.push((file.clone(), anonymized_content));
        }

        if self.config.anonymize_paths {
            println!("🔒 Anonymized file paths and test names in test results for privacy");
        }

        // Create tar.gz archive in memory
        let tarball_buffer = Vec::new();
        let encoder = GzEncoder::new(
            tarball_buffer,
            Compression::new(self.config.compression_level),
        );
        let mut tar_builder = tar::Builder::new(encoder);

        // Add each test file to the archive
        for (idx, (original_path, content)) in test_contents.iter().enumerate() {
            let filename = if files.len() == 1 {
                // Single file: use "test_results.xml"
                "test_results.xml".to_string()
            } else {
                // Multiple files: use "test_results_0.xml", "test_results_1.xml", etc.
                // Or use the original filename if unique
                let original_name = original_path
                    .file_name()
                    .and_then(|n| n.to_str())
                    .unwrap_or("test_results.xml");
                format!("test_results_{}.xml", idx).replace(
                    &format!("test_results_{}.xml", idx),
                    &format!("{}_{}", idx, original_name),
                )
            };

            let mut header = tar::Header::new_gnu();
            header.set_size(content.len() as u64);
            header.set_mode(0o644);
            header.set_cksum();

            tar_builder
                .append_data(&mut header, &filename, content.as_slice())
                .map_err(|e| format!("Failed to add file to tar: {}", e))?;
        }

        // Finish tar archive and get the encoder back
        let encoder = tar_builder
            .into_inner()
            .map_err(|e| format!("Failed to finish tar archive: {}", e))?;

        // Finish gzip compression and get the compressed data
        let tarball_data = encoder
            .finish()
            .map_err(|e| format!("Failed to finish gzip compression: {}", e))?;

        println!("📦 Created tarball: {} bytes", tarball_data.len());

        // Upload via multipart/form-data with "tests" field
        let commit_sha = self
            .config
            .git_commit
            .as_deref()
            .unwrap_or("unknown")
            .to_owned();

        let mut form = reqwest::blocking::multipart::Form::new()
            .part(
                "tests",
                reqwest::blocking::multipart::Part::bytes(tarball_data)
                    .file_name("tests.tar.gz")
                    .mime_str("application/gzip")
                    .map_err(|e| format!("Failed to set mime type: {}", e))?,
            )
            .text("commit_sha", commit_sha)
            .text(
                "branch",
                self.config.git_branch.as_deref().unwrap_or("").to_owned(),
            )
            .text(
                "environment",
                self.config
                    .environment
                    .as_deref()
                    .unwrap_or("development")
                    .to_owned(),
            )
            .text(
                "test_type",
                self.config
                    .test_type
                    .as_deref()
                    .unwrap_or("combined")
                    .to_owned(),
            )
            .text("agent_version", env!("CARGO_PKG_VERSION").to_string())
            .text("salt", self.upload_salt.clone());

        // Add commit timestamp if available
        if let Some(ref timestamp) = self.config.git_commit_timestamp {
            form = form.text("commit_timestamp", timestamp.clone());
        }

        let mut request = self
            .client
            .post(&self.config.endpoint)
            .multipart(form)
            .header(
                "User-Agent",
                format!("testlint-sdk/{}", env!("CARGO_PKG_VERSION")),
            );

        if let Some(ref api_key) = self.config.api_key {
            request = request.header("Authorization", format!("Bearer {}", api_key));
        }

        let response = request
            .send()
            .map_err(|e| format!("Failed to send test results: {}", e))?;

        if response.status().is_success() {
            println!("✓ Test results uploaded successfully");
            // Try to extract test_id from response
            if let Ok(text) = response.text() {
                if let Ok(json) = serde_json::from_str::<serde_json::Value>(&text) {
                    if let Some(test_id) = json.get("test_id").and_then(|v| v.as_str()) {
                        println!("  Test ID: {}", test_id);
                    }
                }
            }
            Ok(())
        } else {
            Err(format!(
                "Server returned error: {} - {}",
                response.status(),
                response.text().unwrap_or_default()
            ))
        }
    }

    /// Read coverage file and create CoverageReport
    fn read_coverage_file(
        &self,
        file_path: &str,
        language: &str,
        coverage_format: &str,
    ) -> Result<CoverageReport, String> {
        let path = Path::new(file_path);

        if !path.exists() {
            return Err(format!("Coverage file not found: {}", file_path));
        }

        let content =
            fs::read_to_string(path).map_err(|e| format!("Failed to read coverage file: {}", e))?;

        // Anonymize file paths in coverage data if enabled
        let anonymized_content = self.anonymize_coverage_content(&content, coverage_format);

        let file_size = anonymized_content.len() as u64;

        // Determine content type based on format
        let content_type = match coverage_format.to_lowercase().as_str() {
            "coverage.py" | "jest" | "istanbul" => "application/json",
            "jacoco" | "cobertura" => "application/xml",
            "lcov" | "golang" => "text/plain",
            _ => "text/plain",
        };

        let timestamp = Utc::now().to_rfc3339();

        if self.config.anonymize_paths {
            println!("🔒 Anonymized file paths in coverage data for privacy");
        }

        Ok(CoverageReport {
            language: language.to_string(),
            format: coverage_format.to_string(),
            git_commit: self.config.git_commit.clone().unwrap_or_default(),
            git_branch: self.config.git_branch.clone().unwrap_or_default(),
            timestamp,
            environment: self.config.environment.clone().unwrap_or_default(),
            content: Some(CoverageContent::TextContent(anonymized_content)),
            file_path: file_path.to_string(),
            content_type: content_type.to_string(),
            file_size_bytes: file_size,
        })
    }

    /// Upload coverage reports to backend
    fn upload_reports(&self, reports: Vec<CoverageReport>) -> Result<(), String> {
        let batch = CoverageBatch {
            reports,
            reported_at: Utc::now().to_rfc3339(),
            agent_version: env!("CARGO_PKG_VERSION").to_string(),
        };

        println!(
            "Uploading {} coverage report(s) to {}",
            batch.reports.len(),
            self.config.endpoint
        );

        // Create tar.gz file and upload via multipart
        self.upload_as_tarball(&batch)
    }

    /// Create tar.gz and upload via multipart/form-data
    fn upload_as_tarball(&self, batch: &CoverageBatch) -> Result<(), String> {
        // Create tar.gz directly in memory instead of using temporary file
        // This avoids double I/O (write-to-disk then read-from-disk)
        let tarball_buffer = Vec::new();
        let encoder = GzEncoder::new(
            tarball_buffer,
            Compression::new(self.config.compression_level),
        );
        let mut tar_builder = tar::Builder::new(encoder);

        // Add files to tar archive sequentially (tar format requires sequential writes)
        // Note: Benchmark testing showed parallel data preparation is 9-30x slower due to
        // thread spawning overhead being larger than the actual work (which is in microseconds)
        for (idx, report) in batch.reports.iter().enumerate() {
            // Get content as slice without cloning - append_data accepts &[u8]
            let (content_slice, content_len): (&[u8], usize) = match &report.content {
                Some(CoverageContent::TextContent(text)) => {
                    let bytes = text.as_bytes();
                    (bytes, bytes.len())
                }
                Some(CoverageContent::BinaryContent(bytes)) => (bytes.as_slice(), bytes.len()),
                None => (&[], 0),
            };

            // Determine filename based on format and language
            let extension = match report.format.as_str() {
                "coverage.py" | "jest" | "istanbul" => "json",
                "jacoco" | "cobertura" => "xml",
                "lcov" | "golang" => "lcov",
                _ => "txt",
            };

            let filename = format!("coverage_{}.{}", idx, extension);
            let mut header = tar::Header::new_gnu();
            header.set_size(content_len as u64);
            header.set_mode(0o644);
            header.set_cksum();

            tar_builder
                .append_data(&mut header, &filename, content_slice)
                .map_err(|e| format!("Failed to add file to tar: {}", e))?;
        }

        // Add JUnit XML test results file if it exists
        if let Some(first_report) = batch.reports.first() {
            let file_path = Path::new(&first_report.file_path);
            if let Some(parent_dir) = file_path.parent() {
                let junit_xml_path = parent_dir.join("test_results.xml");
                if junit_xml_path.exists() {
                    let junit_xml_content = fs::read(&junit_xml_path)
                        .map_err(|e| format!("Failed to read JUnit XML: {}", e))?;

                    // Anonymize JUnit XML for privacy (removes hostname, anonymizes paths)
                    let anonymized_junit = self.anonymize_junit_xml(&junit_xml_content);

                    let mut test_header = tar::Header::new_gnu();
                    test_header.set_size(anonymized_junit.len() as u64);
                    test_header.set_mode(0o644);
                    test_header.set_cksum();

                    tar_builder
                        .append_data(
                            &mut test_header,
                            "test_results.xml",
                            anonymized_junit.as_slice(),
                        )
                        .map_err(|e| format!("Failed to add JUnit XML to tar: {}", e))?;

                    if self.config.anonymize_paths {
                        println!(
                            "📝 Including JUnit XML test results ({} bytes, anonymized)",
                            anonymized_junit.len()
                        );
                    } else {
                        println!(
                            "📝 Including JUnit XML test results ({} bytes)",
                            anonymized_junit.len()
                        );
                    }
                }
            }
        }

        // Finish tar archive and get the encoder back
        let encoder = tar_builder
            .into_inner()
            .map_err(|e| format!("Failed to finish tar archive: {}", e))?;

        // Finish gzip compression and get the compressed data
        let tarball_data = encoder
            .finish()
            .map_err(|e| format!("Failed to finish gzip compression: {}", e))?;

        println!("📦 Created tarball: {} bytes", tarball_data.len());

        // Upload via multipart/form-data with metadata as form parameters
        let commit_sha = self
            .config
            .git_commit
            .as_deref()
            .unwrap_or("unknown")
            .to_owned();

        let mut form = reqwest::blocking::multipart::Form::new()
            .part(
                "file",
                reqwest::blocking::multipart::Part::bytes(tarball_data)
                    .file_name("coverage.tar.gz")
                    .mime_str("application/gzip")
                    .map_err(|e| format!("Failed to set mime type: {}", e))?,
            )
            .text("commit_sha", commit_sha.clone())
            .text(
                "branch_name",
                self.config
                    .git_branch
                    .as_deref()
                    .unwrap_or("unknown")
                    .to_owned(),
            )
            .text(
                "environment",
                self.config
                    .environment
                    .as_deref()
                    .unwrap_or("development")
                    .to_owned(),
            )
            .text(
                "test_type",
                self.config
                    .test_type
                    .as_deref()
                    .unwrap_or("unit")
                    .to_owned(),
            )
            .text("reported_at", batch.reported_at.clone())
            .text("agent_version", batch.agent_version.clone())
            .text("salt", self.upload_salt.clone())
            .text("anonymization_version", "1");

        // Add commit timestamp if available
        if let Some(ref timestamp) = self.config.git_commit_timestamp {
            form = form.text("commit_timestamp", timestamp.clone());
        }

        let mut request = self
            .client
            .post(&self.config.endpoint)
            .multipart(form)
            .header(
                "User-Agent",
                format!("testlint-sdk/{}", env!("CARGO_PKG_VERSION")),
            );

        if let Some(ref api_key) = self.config.api_key {
            request = request.header("Authorization", format!("Bearer {}", api_key));
        }

        let response = request
            .send()
            .map_err(|e| format!("Failed to send coverage report: {}", e))?;

        if response.status().is_success() {
            println!("✓ Coverage report uploaded successfully");
            Ok(())
        } else {
            Err(format!(
                "Server returned error: {} - {}",
                response.status(),
                response.text().unwrap_or_default()
            ))
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::path::Path;

    /// Helper to create a test uploader with anonymization enabled
    fn create_test_uploader(project_root: &str) -> TestUploader {
        let config = TestUploaderConfig {
            endpoint: "http://test.invalid/upload".to_string(),
            api_key: Some("test_key".to_string()),
            format: UploadFormat::Protobuf,
            git_commit: Some("abc123def456".to_string()),
            git_branch: Some("main".to_string()),
            git_commit_timestamp: None,
            environment: Some("test".to_string()),
            test_type: Some("unit".to_string()),
            compression_level: 6,
            upload_timeout_secs: 60,
            max_retry_attempts: 3,
            retry_delay_ms: 1000,
            anonymize_paths: true,
            project_root: Some(project_root.to_string()),
        };
        TestUploader::new_with_salt(config, "test_salt_12345".to_string())
    }

    /// Helper to create a test uploader with anonymization disabled
    fn create_test_uploader_no_anonymization(project_root: &str) -> TestUploader {
        let config = TestUploaderConfig {
            endpoint: "http://test.invalid/upload".to_string(),
            api_key: Some("test_key".to_string()),
            format: UploadFormat::Protobuf,
            git_commit: Some("abc123def456".to_string()),
            git_branch: Some("main".to_string()),
            git_commit_timestamp: None,
            environment: Some("test".to_string()),
            test_type: Some("unit".to_string()),
            compression_level: 6,
            upload_timeout_secs: 60,
            max_retry_attempts: 3,
            retry_delay_ms: 1000,
            anonymize_paths: false,
            project_root: Some(project_root.to_string()),
        };
        TestUploader::new_with_salt(config, "test_salt_12345".to_string())
    }

    #[test]
    fn test_config_default() {
        let config = TestUploaderConfig::default();
        // In debug builds, default is localhost; in release builds, it's production
        #[cfg(debug_assertions)]
        let expected_endpoint = "http://localhost:8001/tests/upload";
        #[cfg(not(debug_assertions))]
        let expected_endpoint = "https://api.testlint.com/tests/upload";

        assert_eq!(config.endpoint, expected_endpoint);
        assert_eq!(config.environment, Some("development".to_string()));
    }

    #[test]
    fn test_config_from_args() {
        let config = TestUploaderConfig::from_env_and_args(
            Some("https://custom.endpoint/coverage".to_string()),
            Some("test-key".to_string()),
            Some("json".to_string()),
            Some("abc123".to_string()),
            Some("main".to_string()),
            None, // git_commit_timestamp
            Some("production".to_string()),
            Some("e2e".to_string()),
            Some(9), // compression_level
        );

        assert_eq!(config.endpoint, "https://custom.endpoint/coverage");
        assert_eq!(config.api_key, Some("test-key".to_string()));
        assert_eq!(config.git_commit, Some("abc123".to_string()));
        assert_eq!(config.git_branch, Some("main".to_string()));
        assert_eq!(config.environment, Some("production".to_string()));
        assert_eq!(config.test_type, Some("e2e".to_string()));
    }

    #[test]
    fn test_tarball_integrity() -> Result<(), Box<dyn std::error::Error>> {
        use flate2::read::GzDecoder;
        use tar::Archive;

        // Create a test coverage report
        let temp_dir = tempfile::tempdir().expect("Failed to create temp dir");
        let coverage_file = temp_dir.path().join("coverage.json");
        let test_results_file = temp_dir.path().join("test_results.xml");

        // Write test coverage data
        let coverage_data = r#"{
            "files": {
                "test.py": {
                    "executed_lines": [1, 2, 3],
                    "missing_lines": [4, 5],
                    "summary": {
                        "covered_lines": 3,
                        "num_statements": 5,
                        "percent_covered": 60.0
                    }
                }
            },
            "totals": {
                "covered_lines": 3,
                "num_statements": 5,
                "percent_covered": 60.0
            }
        }"#;
        fs::write(&coverage_file, coverage_data).expect("Failed to write coverage file");

        // Write test JUnit XML data
        let junit_data = r#"<?xml version="1.0" encoding="utf-8"?>
<testsuites>
    <testsuite name="pytest" errors="0" failures="1" skipped="0" tests="3" time="0.123">
        <testcase classname="test_example" name="test_pass" time="0.001" />
        <testcase classname="test_example" name="test_fail" time="0.002">
            <failure message="assert False">test failed</failure>
        </testcase>
        <testcase classname="test_example" name="test_skip" time="0.000">
            <skipped message="skipped" />
        </testcase>
    </testsuite>
</testsuites>"#;
        fs::write(&test_results_file, junit_data).expect("Failed to write test results file");

        // Create uploader config
        let config = TestUploaderConfig {
            compression_level: 6,
            upload_timeout_secs: 60,
            max_retry_attempts: 3,
            retry_delay_ms: 1000,
            ..Default::default()
        };

        let uploader = TestUploader::new_with_salt(config, "test_salt_1234".to_string());

        // Create a coverage report
        let coverage_path = coverage_file
            .to_str()
            .ok_or("Invalid UTF-8 in coverage file path")?;
        let report = uploader
            .read_coverage_file(coverage_path, "python", "coverage.py")
            .expect("Failed to read coverage file");

        // Create batch and tarball
        let batch = CoverageBatch {
            reports: vec![report],
            reported_at: Utc::now().to_rfc3339(),
            agent_version: env!("CARGO_PKG_VERSION").to_string(),
        };

        // Create the tarball using the same logic as upload_as_tarball
        let temp_tar_dir = tempfile::tempdir().expect("Failed to create temp dir");
        let tarball_path = temp_tar_dir.path().join("test_coverage.tar.gz");

        let tar_file = File::create(&tarball_path).expect("Failed to create tarball");
        let encoder = GzEncoder::new(tar_file, Compression::best());
        let mut tar_builder = tar::Builder::new(encoder);

        // Add coverage file
        let content = match &batch.reports[0].content {
            Some(CoverageContent::TextContent(text)) => text.as_bytes().to_vec(),
            _ => panic!("Expected text content"),
        };

        let mut header = tar::Header::new_gnu();
        header.set_size(content.len() as u64);
        header.set_mode(0o644);
        header.set_cksum();
        tar_builder
            .append_data(&mut header, "coverage_0.json", content.as_slice())
            .expect("Failed to add coverage to tar");

        // Add JUnit XML
        let junit_content = fs::read(&test_results_file).expect("Failed to read JUnit XML");
        let mut junit_header = tar::Header::new_gnu();
        junit_header.set_size(junit_content.len() as u64);
        junit_header.set_mode(0o644);
        junit_header.set_cksum();
        tar_builder
            .append_data(
                &mut junit_header,
                "test_results.xml",
                junit_content.as_slice(),
            )
            .expect("Failed to add JUnit XML to tar");

        // Add metadata
        let metadata = serde_json::json!({
            "git_commit": "abc123",
            "git_branch": "main",
            "environment": "test",
            "test_type": "unit",
        });
        let metadata_bytes = serde_json::to_vec_pretty(&metadata).unwrap();
        let mut meta_header = tar::Header::new_gnu();
        meta_header.set_size(metadata_bytes.len() as u64);
        meta_header.set_mode(0o644);
        meta_header.set_cksum();
        tar_builder
            .append_data(&mut meta_header, "metadata.json", metadata_bytes.as_slice())
            .expect("Failed to add metadata to tar");

        // THIS IS THE CRITICAL FIX: Finish tar AND gzip properly
        let encoder = tar_builder
            .into_inner()
            .expect("Failed to get encoder from tar builder");
        encoder.finish().expect("Failed to finish gzip encoder");

        // Verify the tarball exists and has content
        assert!(tarball_path.exists(), "Tarball file should exist");
        let tarball_size = fs::metadata(&tarball_path)
            .expect("Failed to get tarball metadata")
            .len();
        assert!(tarball_size > 0, "Tarball should not be empty");
        println!("✓ Created tarball: {} bytes", tarball_size);

        // Now verify the tarball can be decompressed and extracted
        let tarball_file = File::open(&tarball_path).expect("Failed to open tarball");
        let decoder = GzDecoder::new(tarball_file);
        let mut archive = Archive::new(decoder);

        // Extract and verify all files
        let mut found_coverage = false;
        let mut found_junit = false;
        let mut found_metadata = false;

        for entry in archive.entries().expect("Failed to read archive entries") {
            let mut entry = entry.expect("Failed to read entry");
            let path = entry.path().expect("Failed to get entry path");
            let filename = path.to_str().ok_or("Invalid UTF-8 in tarball entry path")?;

            println!("✓ Found file in tarball: {}", filename);

            match filename {
                "coverage_0.json" => {
                    found_coverage = true;
                    let mut contents = String::new();
                    entry
                        .read_to_string(&mut contents)
                        .expect("Failed to read coverage file");
                    assert!(
                        contents.contains("test.py"),
                        "Coverage file should contain test.py"
                    );
                }
                "test_results.xml" => {
                    found_junit = true;
                    let mut contents = String::new();
                    entry
                        .read_to_string(&mut contents)
                        .expect("Failed to read JUnit XML file");
                    assert!(
                        contents.contains("testsuite"),
                        "JUnit XML should contain testsuite"
                    );
                    assert!(
                        contents.contains("test_fail"),
                        "JUnit XML should contain test cases"
                    );
                }
                "metadata.json" => {
                    found_metadata = true;
                    let mut contents = String::new();
                    entry
                        .read_to_string(&mut contents)
                        .expect("Failed to read metadata file");
                    assert!(
                        contents.contains("abc123"),
                        "Metadata should contain git commit"
                    );
                }
                _ => panic!("Unexpected file in tarball: {}", filename),
            }
        }

        // Verify all expected files were found
        assert!(found_coverage, "Coverage file should be in tarball");
        assert!(found_junit, "JUnit XML should be in tarball");
        assert!(found_metadata, "Metadata should be in tarball");

        println!("✓ All files verified in tarball");
        println!("✓ Tarball integrity test passed!");
        Ok(())
    }

    #[test]
    fn test_git_commit_detection() {
        // This test will pass if we're in a git repo, otherwise it returns None
        let commit = TestUploaderConfig::detect_git_commit();

        // If we got a commit, verify it's a valid SHA-1 hash (40 hex chars)
        if let Some(ref hash) = commit {
            assert_eq!(hash.len(), 40, "Git commit hash should be 40 characters");
            assert!(
                hash.chars().all(|c| c.is_ascii_hexdigit()),
                "Git commit hash should only contain hex digits"
            );
        }

        // The function should always return Some or None, never panic
        println!("Git commit detection: {:?}", commit);
    }

    #[test]
    fn test_git_branch_detection() {
        // This test will pass if we're in a git repo, otherwise it returns None
        let branch = TestUploaderConfig::detect_git_branch();

        // If we got a branch, verify it's not empty
        if let Some(ref branch_name) = branch {
            assert!(
                !branch_name.is_empty(),
                "Git branch name should not be empty"
            );
            assert!(
                !branch_name.contains('\n'),
                "Git branch name should not contain newlines"
            );
        }

        // The function should always return Some or None, never panic
        println!("Git branch detection: {:?}", branch);
    }

    #[test]
    fn test_config_auto_detects_git_info() {
        // Create config without providing git info
        let config = TestUploaderConfig::from_env_and_args(
            Some("https://test.endpoint/coverage".to_string()),
            Some("test-key".to_string()),
            None,
            None, // git_commit - should auto-detect
            None, // git_branch - should auto-detect
            None, // git_commit_timestamp
            None,
            None,
            None,
        );

        // If we're in a git repo, these should be auto-detected
        // If not, they'll be None which is also fine
        if config.git_commit.is_some() {
            let commit = config.git_commit.as_ref().unwrap();
            assert_eq!(
                commit.len(),
                40,
                "Auto-detected commit should be valid SHA-1"
            );
            println!("Auto-detected commit: {}", commit);
        }

        if config.git_branch.is_some() {
            let branch = config.git_branch.as_ref().unwrap();
            assert!(
                !branch.is_empty(),
                "Auto-detected branch should not be empty"
            );
            println!("Auto-detected branch: {}", branch);
        }
    }

    #[test]
    fn test_config_explicit_git_info_overrides_detection() {
        // Provide explicit git info - should NOT auto-detect
        let config = TestUploaderConfig::from_env_and_args(
            Some("https://test.endpoint/coverage".to_string()),
            Some("test-key".to_string()),
            None,
            Some("0123456789abcdef0123456789abcdef01234567".to_string()), // explicit commit
            Some("feature-branch".to_string()),                           // explicit branch
            None,                                                         // git_commit_timestamp
            None,
            None,
            None,
        );

        // Should use the explicit values, not auto-detect
        assert_eq!(
            config.git_commit,
            Some("0123456789abcdef0123456789abcdef01234567".to_string())
        );
        assert_eq!(config.git_branch, Some("feature-branch".to_string()));
    }

    // ==================== hash_file_path tests ====================

    #[test]
    fn test_hash_file_path_deterministic() {
        let uploader = create_test_uploader("/project");

        // Same input should produce same output
        let hash1 = uploader.hash_file_path("src/main.rs");
        let hash2 = uploader.hash_file_path("src/main.rs");
        assert_eq!(hash1, hash2, "Hashing should be deterministic");
    }

    #[test]
    fn test_hash_file_path_different_inputs_different_outputs() {
        let uploader = create_test_uploader("/project");

        let hash1 = uploader.hash_file_path("src/main.rs");
        let hash2 = uploader.hash_file_path("src/lib.rs");
        let hash3 = uploader.hash_file_path("tests/test.rs");

        assert_ne!(hash1, hash2, "Different files should have different hashes");
        assert_ne!(hash2, hash3, "Different files should have different hashes");
        assert_ne!(hash1, hash3, "Different files should have different hashes");
    }

    #[test]
    fn test_hash_file_path_is_hex_string() {
        let uploader = create_test_uploader("/project");

        let hash = uploader.hash_file_path("src/main.rs");

        // SHA256 produces 64 hex characters
        assert_eq!(hash.len(), 64, "Hash should be 64 hex characters");
        assert!(
            hash.chars().all(|c| c.is_ascii_hexdigit()),
            "Hash should only contain hex digits"
        );
    }

    #[test]
    fn test_hash_file_path_different_salt_different_hash() {
        let config1 = TestUploaderConfig {
            git_commit: Some("abc123".to_string()),
            project_root: Some("/project".to_string()),
            ..Default::default()
        };
        let config2 = config1.clone();

        let uploader1 = TestUploader::new_with_salt(config1, "salt_one".to_string());
        let uploader2 = TestUploader::new_with_salt(config2, "salt_two".to_string());

        let hash1 = uploader1.hash_file_path("src/main.rs");
        let hash2 = uploader2.hash_file_path("src/main.rs");

        assert_ne!(
            hash1, hash2,
            "Different salts should produce different hashes"
        );
    }

    // ==================== hash_test_name tests ====================

    #[test]
    fn test_hash_test_name_deterministic() {
        let uploader = create_test_uploader("/project");

        let hash1 = uploader.hash_test_name("test_something", "tests/test_main.py");
        let hash2 = uploader.hash_test_name("test_something", "tests/test_main.py");
        assert_eq!(hash1, hash2, "Test name hashing should be deterministic");
    }

    #[test]
    fn test_hash_test_name_includes_file_context() {
        let uploader = create_test_uploader("/project");

        // Same test name, different file should produce different hash
        let hash1 = uploader.hash_test_name("test_something", "tests/test_main.py");
        let hash2 = uploader.hash_test_name("test_something", "tests/test_other.py");

        assert_ne!(
            hash1, hash2,
            "Same test name in different files should have different hashes"
        );
    }

    #[test]
    fn test_hash_test_name_different_tests_different_hashes() {
        let uploader = create_test_uploader("/project");

        let hash1 = uploader.hash_test_name("test_one", "tests/test.py");
        let hash2 = uploader.hash_test_name("test_two", "tests/test.py");

        assert_ne!(
            hash1, hash2,
            "Different test names should have different hashes"
        );
    }

    #[test]
    fn test_hash_test_name_prefix() {
        let uploader = create_test_uploader("/project");

        let hash = uploader.hash_test_name("test_something", "tests/test.py");
        assert!(
            hash.starts_with("test_"),
            "Hashed test name should start with 'test_'"
        );
    }

    // ==================== make_relative_path tests ====================

    #[test]
    fn test_make_relative_path_absolute_to_relative() {
        let uploader = create_test_uploader("/home/user/project");
        let project_root = Path::new("/home/user/project");

        let relative = uploader.make_relative_path("/home/user/project/src/main.rs", project_root);
        assert_eq!(relative, "src/main.rs");
    }

    #[test]
    fn test_make_relative_path_already_relative() {
        let uploader = create_test_uploader("/home/user/project");
        let project_root = Path::new("/home/user/project");

        let relative = uploader.make_relative_path("src/main.rs", project_root);
        assert_eq!(
            relative, "src/main.rs",
            "Already relative paths should be unchanged"
        );
    }

    #[test]
    fn test_make_relative_path_outside_project() {
        let uploader = create_test_uploader("/home/user/project");
        let project_root = Path::new("/home/user/project");

        // Path outside project root should be kept as-is
        let result = uploader.make_relative_path("/other/path/file.rs", project_root);
        assert_eq!(result, "/other/path/file.rs");
    }

    #[test]
    fn test_make_relative_path_nested_path() {
        let uploader = create_test_uploader("/home/user/project");
        let project_root = Path::new("/home/user/project");

        let relative = uploader.make_relative_path(
            "/home/user/project/src/deeply/nested/module/file.rs",
            project_root,
        );
        assert_eq!(relative, "src/deeply/nested/module/file.rs");
    }

    // ==================== anonymize_lcov_paths tests ====================

    #[test]
    fn test_anonymize_lcov_paths_basic() {
        let uploader = create_test_uploader("/home/user/project");
        let project_root = Path::new("/home/user/project");

        let lcov_content = "TN:\nSF:/home/user/project/src/main.rs\nDA:1,1\nend_of_record";
        let result = uploader.anonymize_lcov_paths(lcov_content, project_root);

        // Should not contain absolute path
        assert!(
            !result.contains("/home/user/project/"),
            "Absolute path should be removed"
        );
        // Should still contain SF: prefix
        assert!(result.contains("SF:"), "SF: prefix should remain");
        // DA lines should be unchanged
        assert!(result.contains("DA:1,1"), "DA lines should be unchanged");
    }

    #[test]
    fn test_anonymize_lcov_paths_multiple_files() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let lcov_content = r#"TN:
SF:/project/src/main.rs
DA:1,1
DA:2,0
end_of_record
TN:
SF:/project/src/lib.rs
DA:1,5
end_of_record"#;

        let result = uploader.anonymize_lcov_paths(lcov_content, project_root);

        assert!(
            !result.contains("/project/src/main.rs"),
            "First absolute path should be hashed"
        );
        assert!(
            !result.contains("/project/src/lib.rs"),
            "Second absolute path should be hashed"
        );
        assert_eq!(result.matches("SF:").count(), 2, "Should have 2 SF: lines");
        assert_eq!(
            result.matches("end_of_record").count(),
            2,
            "Should have 2 end_of_record"
        );
    }

    #[test]
    fn test_anonymize_lcov_paths_preserves_non_path_lines() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let lcov_content = r#"TN:
SF:/project/src/main.rs
FN:10,my_function
FNDA:5,my_function
DA:10,5
DA:11,5
LF:2
LH:2
end_of_record"#;

        let result = uploader.anonymize_lcov_paths(lcov_content, project_root);

        assert!(
            result.contains("FN:10,my_function"),
            "FN lines should be preserved"
        );
        assert!(
            result.contains("FNDA:5,my_function"),
            "FNDA lines should be preserved"
        );
        assert!(result.contains("DA:10,5"), "DA lines should be preserved");
        assert!(result.contains("LF:2"), "LF lines should be preserved");
        assert!(result.contains("LH:2"), "LH lines should be preserved");
    }

    #[test]
    fn test_anonymize_lcov_paths_tn_with_path() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        // TN: can contain paths in some tools
        let lcov_content =
            "TN:/project/tests/test_main.py::test_func\nSF:/project/src/main.py\nend_of_record";
        let result = uploader.anonymize_lcov_paths(lcov_content, project_root);

        // TN: with path should be anonymized
        assert!(
            !result.contains("/project/tests/test_main.py"),
            "TN: with path should be anonymized"
        );
    }

    // ==================== anonymize_xml_paths tests ====================

    #[test]
    fn test_anonymize_xml_paths_filename_attribute() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let xml_content = r#"<coverage><class filename="/project/src/main.py" /></coverage>"#;
        let result = uploader.anonymize_xml_paths(xml_content, project_root);

        assert!(
            !result.contains("/project/src/main.py"),
            "filename attribute should be anonymized"
        );
        assert!(
            result.contains("filename="),
            "filename attribute key should remain"
        );
    }

    #[test]
    fn test_anonymize_xml_paths_path_attribute() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let xml_content = r#"<coverage><source path="/project/src" /></coverage>"#;
        let result = uploader.anonymize_xml_paths(xml_content, project_root);

        assert!(
            !result.contains("\"/project/src\""),
            "path attribute should be anonymized"
        );
        assert!(result.contains("path="), "path attribute key should remain");
    }

    #[test]
    fn test_anonymize_xml_paths_source_attribute() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let xml_content = r#"<coverage><sources><source="/project/src" /></sources></coverage>"#;
        let result = uploader.anonymize_xml_paths(xml_content, project_root);

        // source= attribute should be processed
        assert!(result.contains("source="), "source attribute should exist");
    }

    #[test]
    fn test_anonymize_xml_paths_preserves_structure() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let xml_content = r#"<?xml version="1.0" ?>
<coverage version="1.0">
    <packages>
        <package name="main" filename="/project/src/main.py">
            <classes>
                <class name="MyClass" filename="/project/src/main.py" line-rate="0.8"/>
            </classes>
        </package>
    </packages>
</coverage>"#;

        let result = uploader.anonymize_xml_paths(xml_content, project_root);

        assert!(
            result.contains("<coverage"),
            "XML structure should be preserved"
        );
        assert!(
            result.contains("</coverage>"),
            "XML structure should be preserved"
        );
        assert!(
            result.contains("line-rate=\"0.8\""),
            "Other attributes should be preserved"
        );
        assert!(
            result.contains("name=\"main\""),
            "Non-path attributes should be preserved"
        );
    }

    // ==================== anonymize_json_paths tests ====================

    #[test]
    fn test_anonymize_json_paths_file_keys() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let json_content = r#"{"files": {"/project/src/main.py": {"covered": 10}}}"#;
        let result = uploader.anonymize_json_paths(json_content, project_root);

        assert!(
            !result.contains("/project/src/main.py"),
            "File path key should be anonymized"
        );
        assert!(
            result.contains("covered"),
            "Other content should be preserved"
        );
    }

    #[test]
    fn test_anonymize_json_paths_string_values() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let json_content = r#"{"path": "/project/src/main.py", "lines": 100}"#;
        let result = uploader.anonymize_json_paths(json_content, project_root);

        assert!(
            !result.contains("/project/src/main.py"),
            "File path value should be anonymized"
        );
        assert!(result.contains("100"), "Numeric values should be preserved");
    }

    #[test]
    fn test_anonymize_json_paths_nested_objects() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let json_content = r#"{
            "meta": {"version": "1.0"},
            "files": {
                "/project/src/main.py": {
                    "summary": {"lines": 100, "path": "/project/src/main.py"}
                }
            }
        }"#;
        let result = uploader.anonymize_json_paths(json_content, project_root);

        // Should not contain any absolute paths
        assert!(
            !result.contains("/project/"),
            "All absolute paths should be anonymized"
        );
        assert!(
            result.contains("version"),
            "Non-path content should be preserved"
        );
    }

    #[test]
    fn test_anonymize_json_paths_array_values() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let json_content = r#"{"files": ["/project/a.py", "/project/b.py"]}"#;
        let result = uploader.anonymize_json_paths(json_content, project_root);

        assert!(
            !result.contains("/project/a.py"),
            "Array path values should be anonymized"
        );
        assert!(
            !result.contains("/project/b.py"),
            "Array path values should be anonymized"
        );
    }

    #[test]
    fn test_anonymize_json_paths_preserves_urls() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let json_content = r#"{"url": "https://example.com/path"}"#;
        let result = uploader.anonymize_json_paths(json_content, project_root);

        assert!(
            result.contains("https://example.com/path"),
            "URLs should not be anonymized"
        );
    }

    #[test]
    fn test_anonymize_json_paths_invalid_json() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let invalid_json = "not valid json {{{";
        let result = uploader.anonymize_json_paths(invalid_json, project_root);

        assert_eq!(
            result, invalid_json,
            "Invalid JSON should be returned unchanged"
        );
    }

    // ==================== anonymize_text_content tests ====================

    #[test]
    fn test_anonymize_text_content_python_traceback() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let text = r#"Traceback (most recent call last):
  File "/project/src/main.py", line 42, in test
    raise ValueError("test")
ValueError: test"#;

        let result = uploader.anonymize_text_content(text, project_root);

        assert!(
            !result.contains("/project/src/main.py"),
            "Python file path should be relativized"
        );
        assert!(
            result.contains("src/main.py"),
            "Relative path should be present"
        );
        assert!(
            result.contains("line 42"),
            "Line number should be preserved"
        );
    }

    #[test]
    fn test_anonymize_text_content_java_stacktrace() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let text = "at /project/src/Main.java:123\nat /project/src/Utils.java:456";

        let result = uploader.anonymize_text_content(text, project_root);

        assert!(
            !result.contains("/project/src/Main.java"),
            "Java file path should be relativized"
        );
        assert!(result.contains(":123"), "Line numbers should be preserved");
    }

    #[test]
    fn test_anonymize_text_content_javascript_stacktrace() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let text = "at /project/src/index.js:10:5";

        let result = uploader.anonymize_text_content(text, project_root);

        assert!(
            !result.contains("/project/src/index.js"),
            "JavaScript file path should be relativized"
        );
    }

    #[test]
    fn test_anonymize_text_content_generic_unix_path() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let text = "Error in /project/src/lib.rs: something failed";

        let result = uploader.anonymize_text_content(text, project_root);

        assert!(
            !result.contains("/project/src/lib.rs"),
            "Unix path should be relativized"
        );
    }

    #[test]
    fn test_anonymize_text_content_preserves_non_paths() {
        let uploader = create_test_uploader("/project");
        let project_root = Path::new("/project");

        let text = "Error: expected 5 but got 10";

        let result = uploader.anonymize_text_content(text, project_root);

        assert_eq!(result, text, "Non-path text should be unchanged");
    }

    // ==================== anonymize_coverage_content tests ====================

    #[test]
    fn test_anonymize_coverage_content_json_format() {
        let uploader = create_test_uploader("/project");

        let content = r#"{"files": {"/project/src/main.py": {}}}"#;
        let result = uploader.anonymize_coverage_content(content, "coverage.py");

        assert!(
            !result.contains("/project/"),
            "JSON paths should be anonymized for coverage.py"
        );
    }

    #[test]
    fn test_anonymize_coverage_content_lcov_format() {
        let uploader = create_test_uploader("/project");

        let content = "SF:/project/src/main.rs\nend_of_record";
        let result = uploader.anonymize_coverage_content(content, "lcov");

        assert!(
            !result.contains("/project/"),
            "LCOV paths should be anonymized"
        );
    }

    #[test]
    fn test_anonymize_coverage_content_xml_format() {
        let uploader = create_test_uploader("/project");

        let content = r#"<coverage filename="/project/src/main.py"/>"#;
        let result = uploader.anonymize_coverage_content(content, "cobertura");

        assert!(
            !result.contains("/project/"),
            "XML paths should be anonymized for cobertura"
        );
    }

    #[test]
    fn test_anonymize_coverage_content_unknown_format() {
        let uploader = create_test_uploader("/project");

        let content = "some content with /project/path";
        let result = uploader.anonymize_coverage_content(content, "unknown_format");

        assert_eq!(
            result, content,
            "Unknown format should return content unchanged"
        );
    }

    #[test]
    fn test_anonymize_coverage_content_disabled() {
        let uploader = create_test_uploader_no_anonymization("/project");

        let content = r#"{"files": {"/project/src/main.py": {}}}"#;
        let result = uploader.anonymize_coverage_content(content, "coverage.py");

        assert_eq!(
            result, content,
            "With anonymization disabled, content should be unchanged"
        );
    }

    // ==================== anonymize_junit_xml tests ====================

    #[test]
    fn test_anonymize_junit_xml_removes_hostname() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?><testsuite hostname="my-machine.local"><testcase name="test1"/></testsuite>"#;
        let result = uploader.anonymize_junit_xml(xml.as_bytes());
        let result_str = String::from_utf8_lossy(&result);

        assert!(
            !result_str.contains("hostname"),
            "hostname attribute should be removed"
        );
        assert!(
            !result_str.contains("my-machine.local"),
            "hostname value should be removed"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_hashes_test_names() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?><testsuite><testcase name="test_my_function" file="tests/test.py"/></testsuite>"#;
        let result = uploader.anonymize_junit_xml(xml.as_bytes());
        let result_str = String::from_utf8_lossy(&result);

        assert!(
            !result_str.contains(r#"name="test_my_function""#),
            "Original test name should be hashed"
        );
        assert!(
            result_str.contains(r#"name="test_"#),
            "Hashed test name should start with test_"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_relativizes_file_paths() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?><testsuite><testcase name="test1" file="/project/tests/test.py"/></testsuite>"#;
        let result = uploader.anonymize_junit_xml(xml.as_bytes());
        let result_str = String::from_utf8_lossy(&result);

        assert!(
            !result_str.contains("/project/tests/test.py"),
            "Absolute file path should be relativized"
        );
        assert!(
            result_str.contains("tests/test.py"),
            "Relative path should be present"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_handles_classname_paths() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?><testsuite><testcase name="test1" classname="/project/src/utils/Helper"/></testsuite>"#;
        let result = uploader.anonymize_junit_xml(xml.as_bytes());
        let result_str = String::from_utf8_lossy(&result);

        assert!(
            !result_str.contains("/project/src/utils/Helper"),
            "Classname with path should be anonymized"
        );
        // Should convert slashes to dots
        assert!(
            result_str.contains("src.utils.Helper"),
            "Classname paths should use dots: {}",
            result_str
        );
    }

    #[test]
    fn test_anonymize_junit_xml_preserves_structure() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?>
<testsuites>
    <testsuite name="MyTests" tests="2" failures="0">
        <testcase name="test1" time="0.123"/>
        <testcase name="test2" time="0.456">
            <failure message="assertion failed"/>
        </testcase>
    </testsuite>
</testsuites>"#;

        let result = uploader.anonymize_junit_xml(xml.as_bytes());
        let result_str = String::from_utf8_lossy(&result);

        assert!(
            result_str.contains("<testsuites>"),
            "Root element should be preserved"
        );
        assert!(
            result_str.contains("</testsuites>"),
            "Closing tag should be preserved"
        );
        assert!(
            result_str.contains("tests=\"2\""),
            "Test count should be preserved"
        );
        assert!(
            result_str.contains("failures=\"0\""),
            "Failure count should be preserved"
        );
        assert!(
            result_str.contains("<failure"),
            "Failure element should be preserved"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_disabled() {
        let uploader = create_test_uploader_no_anonymization("/project");

        let xml = r#"<?xml version="1.0"?><testsuite hostname="my-machine"><testcase name="test_func"/></testsuite>"#;
        let result = uploader.anonymize_junit_xml(xml.as_bytes());

        assert_eq!(
            result,
            xml.as_bytes(),
            "With anonymization disabled, XML should be unchanged"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_invalid_xml() {
        let uploader = create_test_uploader("/project");

        let invalid_xml = b"not valid xml <<<<";
        let result = uploader.anonymize_junit_xml(invalid_xml);

        assert_eq!(
            result, invalid_xml,
            "Invalid XML should be returned unchanged"
        );
    }

    #[test]
    fn test_anonymize_junit_xml_deterministic() {
        let uploader = create_test_uploader("/project");

        let xml = r#"<?xml version="1.0"?><testsuite><testcase name="test1" file="test.py"/></testsuite>"#;

        let result1 = uploader.anonymize_junit_xml(xml.as_bytes());
        let result2 = uploader.anonymize_junit_xml(xml.as_bytes());

        assert_eq!(result1, result2, "Anonymization should be deterministic");
    }

    // ==================== Additional edge cases ====================

    #[test]
    fn test_upload_format_enum() {
        // Test that UploadFormat can be cloned and compared via Debug
        let format1 = UploadFormat::Json;
        let format2 = UploadFormat::Protobuf;

        let format1_clone = format1.clone();
        assert!(matches!(format1_clone, UploadFormat::Json));
        assert!(matches!(format2, UploadFormat::Protobuf));
    }

    #[test]
    fn test_coverage_content_enum() {
        let text_content = CoverageContent::TextContent("hello".to_string());
        let binary_content = CoverageContent::BinaryContent(vec![1, 2, 3]);

        // Test that they can be cloned
        let _text_clone = text_content.clone();
        let _binary_clone = binary_content.clone();
    }

    #[test]
    fn test_coverage_report_struct() {
        let report = CoverageReport {
            language: "rust".to_string(),
            format: "lcov".to_string(),
            git_commit: "abc123".to_string(),
            git_branch: "main".to_string(),
            timestamp: "2024-01-01T00:00:00Z".to_string(),
            environment: "test".to_string(),
            content: Some(CoverageContent::TextContent("test".to_string())),
            file_path: "/path/to/file".to_string(),
            content_type: "text/plain".to_string(),
            file_size_bytes: 100,
        };

        let report_clone = report.clone();
        assert_eq!(report_clone.language, "rust");
        assert_eq!(report_clone.format, "lcov");
    }

    #[test]
    fn test_coverage_batch_struct() {
        let batch = CoverageBatch {
            reports: vec![],
            reported_at: "2024-01-01T00:00:00Z".to_string(),
            agent_version: "1.0.0".to_string(),
        };

        let batch_clone = batch.clone();
        assert_eq!(batch_clone.reported_at, "2024-01-01T00:00:00Z");
        assert_eq!(batch_clone.agent_version, "1.0.0");
    }

    #[test]
    fn test_config_compression_level_capped() {
        let config = TestUploaderConfig::from_env_and_args(
            None,
            None,
            None,
            None,
            None,
            None,
            None,
            None,
            Some(100), // Should be capped at 9
        );

        assert_eq!(
            config.compression_level, 9,
            "Compression level should be capped at 9"
        );
    }

    #[test]
    fn test_config_get_project_root_explicit() {
        let config = TestUploaderConfig {
            project_root: Some("/my/explicit/root".to_string()),
            ..Default::default()
        };

        assert_eq!(
            config.get_project_root(),
            "/my/explicit/root",
            "Explicit project root should be used"
        );
    }

    #[test]
    fn test_generate_local_salt() {
        let salt1 = TestUploader::generate_local_salt();
        let salt2 = TestUploader::generate_local_salt();

        // Salts should be different (timestamp + pid based)
        // Note: There's a very small chance they could be the same if called in same nanosecond
        assert_eq!(salt1.len(), 64, "Salt should be 64 hex characters (SHA256)");
        assert!(
            salt1.chars().all(|c| c.is_ascii_hexdigit()),
            "Salt should only contain hex digits"
        );

        // Most likely different, but not guaranteed
        // Just check format is correct
        assert_eq!(
            salt2.len(),
            64,
            "Second salt should also be 64 hex characters"
        );
    }
}