trusty-mpm 0.7.0

//! `tm repair` command handler — recover from corrupt deploy state.
//!
//! Why: a crash between atomic stages (write-temp / rename) or a disk-full
//! during manifest serialisation can leave stale `.tmp` orphans or a malformed
//! manifest. Without a repair path the user sees confusing deploy failures and
//! must manually poke at `~/.claude/agents/`. This command provides a single,
//! safe recovery entry point.
//! What: `repair_deploy` removes `.tmp` orphans from `~/.claude/agents/` and
//! skill subdirs under `~/.claude/skills/`, validates both manifests, and —
//! with `--force` — resets a corrupt agent manifest to a clean empty state so
//! the next `tm install` performs a full re-deploy.
//! Test: `cli_parses_repair_deploy` covers argument parsing; the integration
//! test `repair_deploy_removes_stale_tmps` exercises the full flow.

use std::path::{Path, PathBuf};

use trusty_mpm::core::agent_manifest::{
    AgentManifest, MANIFEST_FILE, ManifestLoad, repair_stale_tmp,
};
use trusty_mpm::core::skill_manifest::{SKILL_MANIFEST_FILE, SkillManifest};

/// `tm repair deploy` handler.
///
/// Why: one safe, user-facing entry point to recover from the two crash
/// scenarios: a stale `.tmp` left after an interrupted atomic rename, and a
/// corrupt manifest left by an interrupted or truncated JSON write.
///
/// What: removes `*.tmp` orphans from `~/.claude/agents/` and all skill
/// subdirs under `~/.claude/skills/`, then validates both manifests. With
/// `--force`, resets a corrupt manifest to empty so the next `tm install`
/// performs a full re-deploy. Prints a line per action; exits 0 even when
/// only reporting corruption (so the caller can decide next steps).
///
/// Test: `cli_parses_repair_deploy`, integration `repair_removes_stale_tmps`.
pub(crate) fn repair_deploy(force: bool) -> anyhow::Result<()> {
    let home =
        dirs::home_dir().ok_or_else(|| anyhow::anyhow!("could not resolve home directory"))?;
    let claude_dir = home.join(".claude");
    let agents_dir = claude_dir.join("agents");
    let skills_dir = claude_dir.join("skills");

    // ── Step 1: remove stale .tmp files from agents directory ──────────────
    let agents_tmps = remove_tmp_orphans(&agents_dir)?;
    if agents_tmps.is_empty() {
        println!("agents: no stale .tmp files found");
    } else {
        for p in &agents_tmps {
            println!("agents: removed stale temp file {}", p.display());
        }
    }

    // ── Step 2: validate the agent manifest ────────────────────────────────
    let agent_manifest_path = agents_dir.join(MANIFEST_FILE);
    if agent_manifest_path.exists() {
        match AgentManifest::load_checked(&agents_dir) {
            ManifestLoad::Ok(_) => {
                println!("agents: manifest OK");
            }
            ManifestLoad::Corrupt(detail) => {
                eprintln!("agents: manifest CORRUPT — {detail}");
                if force {
                    // Write an empty, valid manifest so the next `tm install`
                    // performs a full re-deploy from the bundle source.
                    let empty = AgentManifest::default();
                    empty
                        .save(&agents_dir)
                        .map_err(|e| anyhow::anyhow!("failed to reset agent manifest: {e}"))?;
                    println!(
                        "agents: manifest reset to empty (--force). Run `tm install` to re-deploy."
                    );
                } else {
                    println!(
                        "agents: run `tm repair deploy --force` to reset and re-deploy, \
                         or `tm install --force` to force a full re-install."
                    );
                }
            }
        }
    } else {
        println!("agents: no manifest found (first deploy not yet run)");
    }

    // ── Step 3: remove stale .tmp files from skill subdirs ─────────────────
    let skill_tmps = remove_skill_tmp_orphans(&skills_dir)?;
    if skill_tmps.is_empty() {
        println!("skills: no stale .tmp files found");
    } else {
        for p in &skill_tmps {
            println!("skills: removed stale temp file {}", p.display());
        }
    }

    // ── Step 4: validate the skill manifest ────────────────────────────────
    let skill_manifest_path = skills_dir.join(SKILL_MANIFEST_FILE);
    if skill_manifest_path.exists() {
        match validate_skill_manifest(&skills_dir) {
            Ok(()) => println!("skills: manifest OK"),
            Err(detail) => {
                eprintln!("skills: manifest CORRUPT — {detail}");
                if force {
                    let empty = SkillManifest::default();
                    empty
                        .save(&skills_dir)
                        .map_err(|e| anyhow::anyhow!("failed to reset skill manifest: {e}"))?;
                    println!(
                        "skills: manifest reset to empty (--force). Run `tm install` to re-deploy."
                    );
                } else {
                    println!(
                        "skills: run `tm repair deploy --force` to reset and re-deploy, \
                         or `tm install --force` to force a full re-install."
                    );
                }
            }
        }
    } else {
        println!("skills: no manifest found (first deploy not yet run)");
    }

    Ok(())
}

/// Remove `*.tmp` orphans from `dir`, returning the paths that were removed.
///
/// Why: `atomic_write` stages via `<path>.tmp`; a crash after `fs::write` but
/// before `fs::rename` leaves a `.tmp` orphan that should be cleaned up.
/// What: reads `dir` (non-error if absent), removes any file whose name ends
/// with `.tmp`, and returns the list of removed paths.
/// Test: covered by `repair_removes_stale_tmps`.
fn remove_tmp_orphans(dir: &Path) -> anyhow::Result<Vec<PathBuf>> {
    let mut removed = Vec::new();
    if !dir.is_dir() {
        return Ok(removed);
    }
    for entry in std::fs::read_dir(dir)? {
        let entry = entry?;
        let name = entry.file_name();
        let name_str = name.to_string_lossy();
        if name_str.ends_with(".tmp") && entry.file_type()?.is_file() {
            let path = entry.path();
            // Use repair_stale_tmp to share the canonical removal logic.
            // The `.tmp` path here *is* the temp itself, so derive the
            // logical "base" path by stripping the `.tmp` extension.
            let base = path.with_extension("");
            repair_stale_tmp(&base)?;
            removed.push(path);
        }
    }
    Ok(removed)
}

/// Remove `*.tmp` orphans from all per-skill subdirs under `skills_dir`.
///
/// Why: skill files live under `<skills_dir>/<name>/SKILL.md`, and the
/// staging temp is `<skills_dir>/<name>/SKILL.tmp`. This helper walks one
/// level of subdirectory to cover all skill subdirs.
/// What: for each subdirectory of `skills_dir`, calls `remove_tmp_orphans`.
/// Test: covered by `repair_removes_stale_tmps`.
fn remove_skill_tmp_orphans(skills_dir: &Path) -> anyhow::Result<Vec<PathBuf>> {
    let mut all_removed = Vec::new();
    if !skills_dir.is_dir() {
        return Ok(all_removed);
    }
    // Also check the skills dir itself (top-level `.tmp` orphan from manifest write).
    let mut top = remove_tmp_orphans(skills_dir)?;
    all_removed.append(&mut top);

    for entry in std::fs::read_dir(skills_dir)? {
        let entry = entry?;
        if entry.file_type()?.is_dir() {
            let mut sub = remove_tmp_orphans(&entry.path())?;
            all_removed.append(&mut sub);
        }
    }
    Ok(all_removed)
}

/// Validate the skill manifest in `skills_dir`, returning `Err(detail)` if corrupt.
///
/// Why: `SkillManifest::load` silently defaults to empty on parse errors; for
/// the repair command we need to detect corruption explicitly.
/// What: reads the manifest file directly; a missing file is `Ok(())`; a
/// present but unparseable file is `Err(detail)`.
/// Test: covered by `repair_deploy_corrupt_skill_manifest_is_reported`.
fn validate_skill_manifest(skills_dir: &Path) -> Result<(), String> {
    let path = skills_dir.join(SKILL_MANIFEST_FILE);
    match std::fs::read_to_string(&path) {
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
        Err(e) => Err(format!("{}: {e}", path.display())),
        Ok(raw) => serde_json::from_str::<SkillManifest>(&raw)
            .map(|_| ())
            .map_err(|e| format!("{}: {e}", path.display())),
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::fs;
    use tempfile::TempDir;
    use trusty_mpm::core::agent_manifest::MANIFEST_FILE;

    /// Helper: create a minimal agent directory with a stale .tmp file.
    fn setup_agents_dir_with_stale_tmp(agents_dir: &Path) {
        fs::create_dir_all(agents_dir).unwrap();
        // Simulate a stale .tmp orphan from a crashed atomic write.
        fs::write(agents_dir.join("engineer.tmp"), "incomplete content").unwrap();
    }

    #[test]
    fn remove_tmp_orphans_removes_only_tmp_files() {
        // Only .tmp files must be removed; .md files must be left intact.
        let tmp = TempDir::new().unwrap();
        fs::write(tmp.path().join("engineer.md"), "good content").unwrap();
        fs::write(tmp.path().join("engineer.tmp"), "stale").unwrap();
        fs::write(tmp.path().join("other.tmp"), "stale2").unwrap();

        let removed = remove_tmp_orphans(tmp.path()).unwrap();
        assert_eq!(removed.len(), 2, "expected 2 .tmp files removed");
        assert!(
            tmp.path().join("engineer.md").exists(),
            ".md file must survive"
        );
        assert!(
            !tmp.path().join("engineer.tmp").exists(),
            ".tmp file must be removed"
        );
    }

    #[test]
    fn remove_tmp_orphans_is_no_op_on_missing_dir() {
        // A non-existent directory must not error — first deploy has no agents dir.
        let removed = remove_tmp_orphans(Path::new("/nonexistent/dir/agents")).unwrap();
        assert!(removed.is_empty());
    }

    #[test]
    fn validate_skill_manifest_ok_on_missing_file() {
        let tmp = TempDir::new().unwrap();
        assert!(validate_skill_manifest(tmp.path()).is_ok());
    }

    #[test]
    fn validate_skill_manifest_err_on_corrupt_file() {
        let tmp = TempDir::new().unwrap();
        fs::write(tmp.path().join(SKILL_MANIFEST_FILE), b"not valid json{{{").unwrap();
        assert!(validate_skill_manifest(tmp.path()).is_err());
    }

    #[test]
    fn repair_deploy_removes_stale_tmps() {
        // repair_deploy (via remove_tmp_orphans) must remove stale .tmp files
        // from the agents dir. We simulate a minimal environment by building
        // a temp tree with the expected directory layout.

        // NOTE: repair_deploy currently uses dirs::home_dir() directly, so
        // it cannot be pointed at a temp directory in a unit test. Instead,
        // we test the underlying helpers (remove_tmp_orphans, etc.) directly,
        // which is the appropriate unit-test boundary.
        let agents_dir = TempDir::new().unwrap();
        setup_agents_dir_with_stale_tmp(agents_dir.path());

        assert!(agents_dir.path().join("engineer.tmp").exists());
        let removed = remove_tmp_orphans(agents_dir.path()).unwrap();
        assert_eq!(removed.len(), 1);
        assert!(!agents_dir.path().join("engineer.tmp").exists());
    }

    #[test]
    fn repair_deploy_corrupt_manifest_is_reported_without_force() {
        // Without --force, a corrupt manifest must not be reset. We verify
        // the detection logic via AgentManifest::load_checked.
        let tmp = TempDir::new().unwrap();
        fs::write(tmp.path().join(MANIFEST_FILE), b"garbage{{{").unwrap();
        let result = AgentManifest::load_checked(tmp.path());
        assert!(
            matches!(result, ManifestLoad::Corrupt(_)),
            "corrupt manifest must be detected"
        );
        // File must still exist (not auto-reset without --force).
        assert!(tmp.path().join(MANIFEST_FILE).exists());
    }
}