tix-tracker 0.12.0

//! GitLab adapter: shells out to the `glab` CLI under
//! `contracts/external-tools.md` (GitLab row). Every contract fabricate
//! template's command shape is reproduced; the only additions are `--output
//! json` (needed to parse the create/list responses) and the token env
//! injection.
//!
//! Tokens are env-only and scrubbed as `<token>` from any surfaced output.

use serde::Deserialize;

use crate::error::{Result, TixError};
use crate::sync::{CommandOutcome, CommandRunner, RemoteIssue, Tool, TrackerAdapter, scrub_secret};

/// The `glab` adapter. Spawns `glab issue <create|update|close|list>` with
/// the configured project and, when a secret is configured, the
/// `GITLAB_TOKEN` env pair.
pub struct GitLabAdapter {
    runner: Box<dyn CommandRunner>,
    token: Option<String>,
    base_url: Option<String>,
    project: String,
}

impl GitLabAdapter {
    pub fn new(
        runner: impl CommandRunner + 'static,
        token: Option<String>,
        base_url: Option<String>,
        project: String,
    ) -> Self {
        GitLabAdapter {
            runner: Box::new(runner),
            token,
            base_url,
            project,
        }
    }

    fn project_arg(&self) -> (String, String) {
        ("--project".to_string(), self.project.clone())
    }

    fn hostname_args(&self) -> Vec<String> {
        match &self.base_url {
            Some(url) => vec!["--hostname".to_string(), url.clone()],
            None => Vec::new(),
        }
    }

    /// Environment injected into every child: the token env pair when a
    /// secret is configured (native glab auth otherwise — no env at all).
    fn child_env(&self) -> Vec<(String, String)> {
        match &self.token {
            Some(token) => vec![("GITLAB_TOKEN".to_string(), token.clone())],
            None => Vec::new(),
        }
    }

    fn run(&self, args: &[String]) -> Result<CommandOutcome> {
        self.runner
            .run(Tool::GitLab.binary(), args, &self.child_env())
    }

    /// Build a [`TixError::External`] for a failed tool invocation, scrubbing
    /// the token from any surfaced output.
    fn external(&self, context: &str, outcome: &CommandOutcome) -> TixError {
        let mut message = format!("{context}: {}", outcome.text().trim());
        if let Some(secret) = &self.token {
            message = scrub_secret(&message, secret);
        }
        TixError::External(message)
    }

    /// Parse `glab issue create` stdout as `{"iid": n}`.
    fn parse_iid(&self, outcome: &CommandOutcome) -> Result<String> {
        let stdout = &outcome.stdout;
        serde_json::from_str::<serde_json::Value>(stdout)
            .ok()
            .and_then(|value| {
                value
                    .get("iid")
                    .and_then(serde_json::Value::as_i64)
                    .map(|iid| iid.to_string())
            })
            .ok_or_else(|| {
                TixError::External(format!(
                    "`glab issue create` did not return JSON with a numeric `iid` field (expected {{\"iid\":…}}): {}",
                    scrub_secret(stdout.trim(), self.token.as_deref().unwrap_or(""))
                ))
            })
    }
}

impl TrackerAdapter for GitLabAdapter {
    fn tool(&self) -> Tool {
        Tool::GitLab
    }

    fn create_issue(
        &mut self,
        title: &str,
        body: &str,
        labels: &[String],
        assignee: Option<&str>,
        _priority: Option<&str>,
        _status: &str,
    ) -> Result<String> {
        let mut args: Vec<String> = Vec::new();
        args.push("issue".to_string());
        args.push("create".to_string());
        let (k, v) = self.project_arg();
        args.push(k);
        args.push(v);
        args.extend(self.hostname_args());
        args.push("--title".to_string());
        args.push(title.to_string());
        args.push("--description".to_string());
        args.push(body.to_string());
        if !labels.is_empty() {
            args.push("--label".to_string());
            args.push(labels.join(","));
        }
        if let Some(name) = assignee {
            args.push("--assignee".to_string());
            args.push(format!("@{name}"));
        }
        args.push("--yes".to_string());
        args.push("--output".to_string());
        args.push("json".to_string());
        let outcome = self.run(&args)?;
        if !outcome.success {
            return Err(self.external("`glab issue create` failed", &outcome));
        }
        self.parse_iid(&outcome)
    }

    fn update_issue(
        &mut self,
        remote_ref: &str,
        title: &str,
        body: &str,
        labels: &[String],
        assignee: Option<&str>,
        _priority: Option<&str>,
        _status: &str,
    ) -> Result<()> {
        let mut args: Vec<String> = Vec::new();
        args.push("issue".to_string());
        args.push("update".to_string());
        args.push(remote_ref.to_string());
        let (k, v) = self.project_arg();
        args.push(k);
        args.push(v);
        args.extend(self.hostname_args());
        args.push("--title".to_string());
        args.push(title.to_string());
        args.push("--description".to_string());
        args.push(body.to_string());
        if !labels.is_empty() {
            args.push("--label".to_string());
            args.push(labels.join(","));
        }
        if let Some(name) = assignee {
            args.push("--assignee".to_string());
            args.push(format!("@{name}"));
        }
        let outcome = self.run(&args)?;
        if !outcome.success {
            return Err(self.external("`glab issue update` failed", &outcome));
        }
        Ok(())
    }

    fn mark_done(&mut self, remote_ref: &str) -> Result<()> {
        let mut args: Vec<String> = Vec::new();
        args.push("issue".to_string());
        args.push("close".to_string());
        args.push(remote_ref.to_string());
        let (k, v) = self.project_arg();
        args.push(k);
        args.push(v);
        args.extend(self.hostname_args());
        let outcome = self.run(&args)?;
        if !outcome.success {
            return Err(self.external("`glab issue close` failed", &outcome));
        }
        Ok(())
    }

    fn list_open(&mut self) -> Result<Vec<RemoteIssue>> {
        let mut args: Vec<String> = Vec::new();
        args.push("issue".to_string());
        args.push("list".to_string());
        let (k, v) = self.project_arg();
        args.push(k);
        args.push(v);
        args.extend(self.hostname_args());
        args.push("--output".to_string());
        args.push("json".to_string());
        let outcome = self.run(&args)?;
        if !outcome.success {
            return Err(self.external("`glab issue list` failed", &outcome));
        }
        let issues: Vec<GlabIssue> = serde_json::from_str(&outcome.stdout).map_err(|e| {
            TixError::External(format!(
                "`glab issue list` did not return a JSON array: {e}\n{}",
                scrub_secret(&outcome.stdout, self.token.as_deref().unwrap_or(""))
            ))
        })?;
        Ok(issues
            .into_iter()
            .map(RemoteIssue::from)
            .filter(|i| i.state != "closed")
            .collect())
    }

    fn done_via_status(&self) -> bool {
        false
    }

    /// `glab issue update <ref> --blocking <refs>` (WP07 T030).
    ///
    /// The only relation affordance `glab` exposes on an issue update is
    /// `--blocking`, so a `blocks` edge is the only thing that can leave the
    /// machine — and that is decided by the shared seam, not here. What arrives
    /// is already filtered; this method only renders it.
    ///
    /// `--blocking` is not additive in `glab`: it *replaces* the issue's blocked-by
    /// set. So the full set is sent in one call rather than one call per edge,
    /// which is also one fewer chance to leave the remote half-configured.
    fn set_relations(
        &mut self,
        remote_ref: &str,
        relations: &[super::MappedRelation],
    ) -> Result<()> {
        let blocking: Vec<String> = relations
            .iter()
            .filter_map(|r| match r {
                super::MappedRelation::Remote { value, .. } => Some(value.clone()),
                super::MappedRelation::Unsupported(_) => None,
            })
            .collect();
        if blocking.is_empty() {
            // Nothing expressible. Sending an empty `--blocking` would *clear* the
            // remote's set, which is the opposite of leaving it alone — so a run
            // that cannot express anything must send nothing at all.
            return Ok(());
        }
        let mut args: Vec<String> = vec!["issue".into(), "update".into(), remote_ref.to_string()];
        let (k, v) = self.project_arg();
        args.push(k);
        args.push(v);
        args.extend(self.hostname_args());
        args.push("--blocking".to_string());
        args.push(blocking.join(","));
        let outcome = self.run(&args)?;
        if !outcome.success {
            return Err(self.external("`glab issue update --blocking` failed", &outcome));
        }
        Ok(())
    }

    /// GitLab's side of the project-association seam — and its answer is "nothing"
    /// (WP08 T036).
    ///
    /// `glab` names the one project an issue **lives in** (`--project <path>`,
    /// which this adapter already passes on every call) and exposes no membership
    /// flag, so there is no command line a membership list could be rendered as.
    /// Inventing one is precisely what T036 step 3 forbids, and sending a partial
    /// list would drop the rest of it, which C-005 forbids.
    ///
    /// So this returns without spawning anything, and the `debug_assert` states the
    /// invariant the seam holds it to: the table that decides representability
    /// (`PROJECT_WIRE_VERIFIED`) is empty, so a value cannot reach here — and
    /// flipping that table without an implementation here would be a silent drop,
    /// which is loud in every test build instead.
    fn set_projects(&mut self, _remote_ref: &str, projects: &[super::MappedProject]) -> Result<()> {
        debug_assert!(
            projects.is_empty(),
            "no `glab` command carries a project membership: flip \
             `PROJECT_WIRE_VERIFIED` only together with an implementation here"
        );
        Ok(())
    }

    /// GitLab's side of the epic-reference seam — and its answer is "nothing" (WP08,
    /// mission `epics-work-items-01M3BYW4`).
    ///
    /// `glab`'s issue carries at most one epic (`epic_iid`, which this adapter
    /// already reads as the issue's single parent) and exposes no flag to set it and
    /// no list form, so there is no command line an epic membership list could be
    /// rendered as. Inventing one is precisely what T038 step 3 forbids, and sending
    /// one member of a list would drop the rest, which C-007 forbids.
    ///
    /// So this returns without spawning anything, and the `debug_assert` states the
    /// invariant the seam holds it to: the table that decides representability
    /// (`EPIC_WIRE_VERIFIED`) is empty, so a value cannot reach here — and flipping
    /// that table without an implementation here would be a silent drop, which is
    /// loud in every test build instead.
    fn set_epics(&mut self, _remote_ref: &str, epics: &[super::MappedEpic]) -> Result<()> {
        debug_assert!(
            epics.is_empty(),
            "no `glab` command carries an epic membership: flip `EPIC_WIRE_VERIFIED` \
             only together with an implementation here"
        );
        Ok(())
    }
}

/// A single entry from `glab issue list --output json`.
#[derive(Debug, Deserialize)]
struct GlabIssue {
    iid: i64,
    #[serde(default)]
    title: String,
    #[serde(default)]
    description: Option<String>,
    #[serde(default)]
    labels: Vec<GlabLabel>,
    #[serde(default)]
    state: String,
    #[serde(default)]
    updated_at: Option<String>,
    #[serde(default)]
    assignees: Vec<GlabAssignee>,
    /// The parent epic's iid, when the remote reported one.
    ///
    /// GitLab's issue hierarchy is a **closed** field — an issue belongs to one
    /// epic or to none — so a single id is the whole of it.
    ///
    /// **Neither spelling is verified.** GitLab's payloads have carried both
    /// `epic_iid` and `parent_iid` depending on version and endpoint, and this
    /// repository cannot run `glab` to see which. Accepting either, under one field
    /// name, is the honest form: it does not assert a spelling it cannot check,
    /// and a payload that uses neither simply reports no parent. The wire verb
    /// stays gated behind `PARENT_WIRE_VERIFIED` regardless — reading a field is
    /// not the same claim as sending one.
    #[serde(default, alias = "epic_iid", alias = "parent_iid")]
    parent: Option<i64>,
    /// The project references the payload reported for this issue (WP08).
    ///
    /// Read through the shared, shape-tolerant [`crate::sync::remote_projects`]
    /// parser, because the field's exact shape is a claim about a program this
    /// repository cannot run — `glab issue list --output json` is not verified to
    /// carry one at all, and a payload that carries none simply yields no
    /// associations.
    ///
    /// **Read, never sent.** Nothing in this build sends a membership
    /// (`PROJECT_WIRE_VERIFIED` is empty and `glab` has no membership flag), so this
    /// is only ever what the remote already said. Reading a field is not the same
    /// claim as writing one, exactly as `parent` above records.
    #[serde(default)]
    projects: Option<serde_json::Value>,
    /// The epic references the payload reported for this issue (WP08, mission
    /// `epics-work-items-01M3BYW4`).
    ///
    /// Read through the shared, shape-tolerant [`crate::sync::remote_epics`] parser,
    /// because the field's exact shape is a claim about a program this repository
    /// cannot run — `glab issue list --output json` is not verified to carry one at
    /// all, and a payload that carries none simply yields no references.
    ///
    /// Distinct from `parent` above: `parent` is the issue **hierarchy** (a single
    /// remote iid resolved to a local number), while this is the epic **registry**
    /// reference list (ids matched against `tix.toml`). Reading a field is not the
    /// same claim as writing one.
    ///
    /// **Read, never sent.** Nothing in this build sends an epic reference
    /// (`EPIC_WIRE_VERIFIED` is empty and `glab` has no flag for one), so this is
    /// only ever what the remote already said.
    #[serde(default, alias = "epic_ids")]
    epics: Option<serde_json::Value>,
}

/// Labels arrive either as plain strings or as `{"id":..,"name":".."}`.
#[derive(Debug, Deserialize)]
#[serde(untagged)]
enum GlabLabel {
    Name(String),
    Named { name: String },
}

#[derive(Debug, Deserialize)]
struct GlabAssignee {
    #[serde(default)]
    username: String,
}

impl From<GlabIssue> for RemoteIssue {
    fn from(issue: GlabIssue) -> Self {
        RemoteIssue {
            id: issue.iid.to_string(),
            title: issue.title,
            description: issue.description.unwrap_or_default(),
            labels: issue
                .labels
                .into_iter()
                .map(|l| match l {
                    GlabLabel::Name(name) | GlabLabel::Named { name } => name,
                })
                .collect(),
            state: issue.state,
            updated_at: issue.updated_at,
            parent: issue.parent.map(|iid| iid.to_string()),
            projects: crate::sync::remote_projects(issue.projects.as_ref()),
            epics: crate::sync::remote_epics(issue.epics.as_ref()),
            assignee: issue
                .assignees
                .into_iter()
                .next()
                .map(|a| a.username)
                .filter(|u| !u.is_empty()),
        }
    }
}

/// A recorded adapter call: the argv plus the env pairs it was spawned with.
pub type RecordedCall = (Vec<String>, Vec<(String, String)>);

/// A fake runner for adapter unit tests: records argv plus env (for the
/// token scrub/injection assertions) and returns configured outcomes in
/// order, falling back to an empty success.
#[derive(Default)]
pub struct FakeRunner {
    calls: std::sync::Mutex<Vec<RecordedCall>>,
    responses: std::sync::Mutex<Vec<CommandOutcome>>,
}

impl FakeRunner {
    #[must_use]
    pub fn new(responses: Vec<CommandOutcome>) -> Self {
        FakeRunner {
            responses: std::sync::Mutex::new(responses),
            ..FakeRunner::default()
        }
    }

    pub fn take_calls(&self) -> Vec<RecordedCall> {
        self.calls.lock().unwrap().clone()
    }
}

impl CommandRunner for FakeRunner {
    fn run(
        &self,
        program: &str,
        args: &[String],
        env: &[(String, String)],
    ) -> Result<CommandOutcome> {
        self.calls.lock().unwrap().push((
            std::iter::once(program.to_string())
                .chain(args.iter().cloned())
                .collect(),
            env.to_vec(),
        ));
        let outcome = self
            .responses
            .lock()
            .unwrap()
            .pop()
            .unwrap_or(CommandOutcome {
                success: true,
                status: Some(0),
                stdout: String::new(),
                stderr: String::new(),
            });
        Ok(outcome)
    }

    fn as_any(&self) -> &dyn std::any::Any {
        self
    }
}

/// Response helpers shaped like `glab` JSON output.
impl CommandOutcome {
    #[must_use]
    pub fn glab_created(iid: i64) -> CommandOutcome {
        CommandOutcome {
            success: true,
            status: Some(0),
            stdout: format!(
                "{{\"iid\": {iid}, \"web_url\": \"https://gitlab.example/acme/tix/-/issues/{iid}\"}}"
            ),
            stderr: String::new(),
        }
    }

    #[must_use]
    pub fn glab_list(payload: &str) -> CommandOutcome {
        CommandOutcome {
            success: true,
            status: Some(0),
            stdout: payload.to_string(),
            stderr: String::new(),
        }
    }
}

#[cfg(test)]
mod tests {
    #[allow(clippy::wildcard_imports)]
    use super::*;

    fn adapter_with(
        runner: FakeRunner,
        token: Option<&str>,
        base_url: Option<&str>,
    ) -> GitLabAdapter {
        GitLabAdapter::new(
            runner,
            token.map(String::from),
            base_url.map(String::from),
            "acme/tix".into(),
        )
    }

    /// Read the recorded calls through the owned runner's downcast hook.
    fn recorded(adapter: &GitLabAdapter) -> Vec<RecordedCall> {
        adapter
            .runner
            .as_any()
            .downcast_ref::<FakeRunner>()
            .expect("adapter must hold a FakeRunner")
            .take_calls()
    }

    #[test]
    fn create_records_env_token_and_full_shape() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_created(42)]);
        let mut adapter = adapter_with(runner, Some("gl-token"), None);
        let id = adapter
            .create_issue(
                "Fix login",
                "body here",
                &["bug".into(), "auth".into()],
                Some("alice"),
                None,
                "opened",
            )
            .unwrap();
        assert_eq!(id, "42");
        let calls = recorded(&adapter);
        let (argv, env) = &calls[0];
        assert_eq!(argv[0], "glab");
        assert_eq!(argv[1], "issue");
        assert_eq!(argv[2], "create");
        let joined = argv.join(" ");
        assert!(joined.contains("--project acme/tix"));
        assert!(joined.contains("--title Fix login"));
        assert!(joined.contains("--description body here"));
        assert!(joined.contains("--label bug,auth"));
        assert!(joined.contains("--assignee @alice"));
        assert!(joined.contains("--yes"));
        assert!(joined.contains("--output json"));
        assert_eq!(env, &[("GITLAB_TOKEN".to_string(), "gl-token".to_string())]);
    }

    #[test]
    fn create_with_hostname_includes_hostname_flag() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_created(7)]);
        let mut adapter = adapter_with(runner, None, Some("gitlab.example.com"));
        adapter
            .create_issue("T", "b", &[], None, None, "opened")
            .unwrap();
        let joined = recorded(&adapter)[0].0.join(" ");
        assert!(joined.contains("--hostname gitlab.example.com"));
    }

    #[test]
    fn create_json_without_iid_is_a_parse_error() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_list("{}")]);
        let mut adapter = adapter_with(runner, None, None);
        let err = adapter
            .create_issue("T", "b", &[], None, None, "opened")
            .unwrap_err();
        assert!(matches!(err, TixError::External(_)));
        assert!(err.to_string().contains("iid"));
    }

    #[test]
    fn update_uses_iid_position_and_project() {
        let runner = FakeRunner::new(vec![]);
        let mut adapter = adapter_with(runner, None, None);
        adapter
            .update_issue("777", "New title", "new body", &[], None, None, "opened")
            .unwrap();
        let argv = &recorded(&adapter)[0].0;
        let joined = argv.join(" ");
        assert!(joined.starts_with("glab issue update 777 "));
        assert!(joined.contains("--project acme/tix"));
        assert!(joined.contains("--title New title"));
        assert!(joined.contains("--description new body"));
    }

    #[test]
    fn mark_done_calls_close() {
        let runner = FakeRunner::new(vec![]);
        let mut adapter = adapter_with(runner, None, None);
        adapter.mark_done("777").unwrap();
        let argv = &recorded(&adapter)[0].0;
        assert_eq!(
            argv,
            &["glab", "issue", "close", "777", "--project", "acme/tix"]
        );
    }

    #[test]
    fn list_open_parses_json_and_filters_closed() {
        let payload = r#"[
          {"iid":1,"title":"T1","description":"d1","labels":[{"name":"bug"}],"state":"opened","updated_at":"2026-05-11T10:00:00Z","assignees":[{"username":"alice"}]},
          {"iid":2,"title":"T2","state":"closed"}
        ]"#;
        let runner = FakeRunner::new(vec![CommandOutcome::glab_list(payload)]);
        let mut adapter = adapter_with(runner, None, None);
        let issues = adapter.list_open().unwrap();
        assert_eq!(issues.len(), 1);
        assert_eq!(issues[0].id, "1");
        assert_eq!(issues[0].title, "T1");
        assert_eq!(issues[0].labels, ["bug"]);
        assert_eq!(issues[0].state, "opened");
        assert_eq!(
            issues[0].updated_at.as_deref(),
            Some("2026-05-11T10:00:00Z")
        );
        assert_eq!(issues[0].assignee.as_deref(), Some("alice"));
    }

    #[test]
    fn list_accepts_string_labels_too() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_list(
            r#"[{"iid":9,"title":"T","labels":["docs","ops"],"state":"opened"}]"#,
        )]);
        let mut adapter = adapter_with(runner, None, None);
        let issues = adapter.list_open().unwrap();
        assert_eq!(issues[0].labels, ["docs", "ops"]);
    }

    #[test]
    fn failure_message_scrubs_token_from_tool_output() {
        let runner = FakeRunner::new(vec![CommandOutcome {
            success: false,
            status: Some(1),
            stdout: String::new(),
            stderr: "GITLAB_TOKEN=gl-token leaked".into(),
        }]);
        let mut adapter = adapter_with(runner, Some("gl-token"), None);
        let err = adapter
            .create_issue("T", "b", &[], None, None, "opened")
            .unwrap_err();
        let text = err.to_string();
        assert!(text.contains("<token>"), "expected redaction, got: {text}");
        assert!(!text.contains("gl-token"), "secret leaked: {text}");
    }

    /// WP08 T036: the project references a payload reports are **read**, in order,
    /// and **nothing is sent** for them — no `glab` command carries a membership.
    ///
    /// Asserted on the recorded argv too, not only on the return value: the question
    /// is what would have been sent, and the answer has to be "nothing".
    #[test]
    fn t036_project_references_are_read_in_order_and_never_sent() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_list(
            r#"[{"iid":5,"title":"T","state":"opened","projects":["p-1",{"id":"p-2","name":"Two"}]},
                {"iid":6,"title":"U","state":"opened"}]"#,
        )]);
        let mut adapter = adapter_with(runner, None, None);
        let issues = adapter.list_open().unwrap();
        assert_eq!(
            issues[0].projects,
            vec![
                crate::sync::RemoteProject {
                    id: "p-1".into(),
                    name: None
                },
                crate::sync::RemoteProject {
                    id: "p-2".into(),
                    name: Some("Two".into())
                },
            ],
            "the payload's order is preserved"
        );
        assert!(
            issues[1].projects.is_empty(),
            "a payload that reports no projects reports none"
        );

        let calls_before = recorded(&adapter).len();
        assert_eq!(calls_before, 1, "the list call, and nothing else");
        adapter.set_projects("5", &[]).unwrap();
        // Read the recording **after** the call. An assertion over the pre-call `list`
        // argv alone could never fail — a list command has no reason to carry a local
        // project id — so what actually catches a send here is the call count: a
        // membership that rendered a command line would add one, and the argv scan
        // below is the second half of the same claim rather than the load-bearing one.
        let calls = recorded(&adapter);
        assert_eq!(
            calls.len(),
            calls_before,
            "an empty membership set must not spawn any command"
        );
        let joined = calls
            .iter()
            .map(|(argv, _)| argv.join(" "))
            .collect::<Vec<_>>()
            .join("\n");
        assert!(
            !joined.contains("p-1") && !joined.contains("p-2"),
            "no local project id may reach the command line: {joined}"
        );
    }

    /// WP08 T038: the epic references a payload reports are **read**, in order, and
    /// **nothing is sent** for them — no `glab` command carries an epic membership.
    ///
    /// Asserted on the recorded argv too, not only on the return value: the question
    /// is what would have been sent, and the answer has to be "nothing".
    #[test]
    fn t038_epic_references_are_read_in_order_and_never_sent() {
        let runner = FakeRunner::new(vec![CommandOutcome::glab_list(
            r#"[{"iid":5,"title":"T","state":"opened","epics":["e-1",{"id":"e-2","name":"Two"}]},
                {"iid":6,"title":"U","state":"opened"}]"#,
        )]);
        let mut adapter = adapter_with(runner, None, None);
        let issues = adapter.list_open().unwrap();
        assert_eq!(
            issues[0].epics,
            vec![
                crate::sync::RemoteEpic {
                    id: "e-1".into(),
                    name: None
                },
                crate::sync::RemoteEpic {
                    id: "e-2".into(),
                    name: Some("Two".into())
                },
            ],
            "the payload's order is preserved"
        );
        assert!(
            issues[1].epics.is_empty(),
            "a payload that reports no epics reports none"
        );

        let calls_before = recorded(&adapter).len();
        assert_eq!(calls_before, 1, "the list call, and nothing else");
        adapter.set_epics("5", &[]).unwrap();
        // Read the recording **after** the call. An assertion over the pre-call `list`
        // argv alone could never fail — a list command has no reason to carry a local
        // epic id — so what actually catches a send here is the call count: a
        // membership that rendered a command line would add one (`FakeRunner` clones
        // rather than drains), and the argv scan below is the second half of the same
        // claim rather than the load-bearing one.
        let calls = recorded(&adapter);
        assert_eq!(
            calls.len(),
            calls_before,
            "an empty reference set must not spawn any command"
        );
        let joined = calls
            .iter()
            .map(|(argv, _)| argv.join(" "))
            .collect::<Vec<_>>()
            .join("\n");
        assert!(
            !joined.contains("e-1") && !joined.contains("e-2"),
            "no local epic id may reach the command line: {joined}"
        );
    }
}