yosh 0.2.7

//! Integration tests for the wasmtime-based plugin runtime (v0.2.0).
//!
//! Replaces the dlopen-era tests; covers the spec §8 test plan. Cases that
//! require fixtures or APIs we don't yet have at the integration level
//! (cwasm cache invalidation paths, WASI lockdown via a hand-built bad
//! wasm) are covered by unit tests in `src/plugin/{cache,host,linker}.rs`
//! and `crates/yosh-plugin-manager/src/precompile.rs` instead. See the
//! task report for the full mapping.

#![cfg(feature = "test-helpers")]

use std::path::{Path, PathBuf};
use std::process::Command;
use std::sync::{Mutex, OnceLock};

use yosh::env::ShellEnv;
use yosh::plugin::{PluginExec, PluginManager, test_helpers};

/// Serialize all plugin tests. Plugin sub-crates use a static `Mutex` for
/// their `EVENT_LOG` etc., and our `set_var` sentinels share `ShellEnv`
/// state through env vars; running these in parallel within the same test
/// binary would interleave observations. The poison-recovery `unwrap_or_else`
/// matches the rest of the repo's lock-acquisition convention (see
/// `TODO.md` resolved item).
static TEST_LOCK: Mutex<()> = Mutex::new(());

fn lock_test() -> std::sync::MutexGuard<'static, ()> {
    TEST_LOCK.lock().unwrap_or_else(|e| e.into_inner())
}

static TEST_PLUGIN_WASM: OnceLock<PathBuf> = OnceLock::new();
static TRAP_PLUGIN_WASM: OnceLock<PathBuf> = OnceLock::new();
static SLOW_PLUGIN_WASM: OnceLock<PathBuf> = OnceLock::new();
static PERF_PLUGIN_WASM: OnceLock<PathBuf> = OnceLock::new();

fn workspace_root() -> PathBuf {
    Path::new(env!("CARGO_MANIFEST_DIR")).into()
}

fn ensure_built(crate_name: &str, slot: &OnceLock<PathBuf>) -> PathBuf {
    slot.get_or_init(|| {
        let status = Command::new("cargo")
            .args([
                "component",
                "build",
                "-p",
                crate_name,
                "--target",
                "wasm32-wasip2",
                "--release",
            ])
            .status()
            .expect("cargo component build failed (is cargo-component installed?)");
        assert!(status.success(), "{} build failed", crate_name);
        workspace_root().join(format!("target/wasm32-wasip2/release/{}.wasm", crate_name))
    })
    .clone()
}

fn test_plugin_wasm() -> PathBuf {
    ensure_built("test_plugin", &TEST_PLUGIN_WASM)
}

fn trap_plugin_wasm() -> PathBuf {
    ensure_built("trap_plugin", &TRAP_PLUGIN_WASM)
}

fn slow_plugin_wasm() -> PathBuf {
    ensure_built("slow_plugin", &SLOW_PLUGIN_WASM)
}

fn perf_plugin_wasm() -> PathBuf {
    ensure_built("perf_plugin", &PERF_PLUGIN_WASM)
}

fn fresh_env() -> ShellEnv {
    ShellEnv::new("yosh", vec![])
}

// ── Test cases ─────────────────────────────────────────────────────────

/// §8.1 — Capability allowlist applied to linker.
///
/// `test_plugin` requests `variables:read`, `variables:write`, `io`, and
/// the `pre_exec` / `on_cd` hook capabilities. We grant only `read` + `io`,
/// and exercise the `echo_var` command, which calls `host_variables_get`
/// (read) and `host_io_write` (io). Both are granted, so the call succeeds
/// with exit 0. The companion negative path — `set_var` denied — is exercised
/// in `t13_hook_dispatch_suppression` via the post-exec hook check.
#[test]
fn t01_capability_allowlist_applied_to_linker() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_VARIABLES_READ | yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin with restricted caps");

    env.vars
        .set("YOSH_TEST_VAR", "abc")
        .expect("set sentinel var");
    let exec = mgr.exec_command(&mut env, "echo_var", &["YOSH_TEST_VAR".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "echo_var with read+io grant must Handled(0), got {:?}",
        exec
    );
}

/// §8.2 — WASM trap isolation via `with_env`.
///
/// `trap_plugin::trap_now` calls `unreachable!()` which traps the wasm
/// guest. The host's `with_env` wrapper must (a) catch the trap, (b) emit
/// a "skipped" warning, and (c) mark the plugin instance invalidated so
/// subsequent dispatch attempts return `PluginExec::Failed` without
/// re-entering the broken store.
#[test]
fn t02_wasm_trap_isolation_via_with_env() {
    let _g = lock_test();
    let wasm = trap_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load trap_plugin");

    let r1 = mgr.exec_command(&mut env, "trap_now", &[]);
    assert!(
        matches!(r1, PluginExec::Failed),
        "first call must Failed (trap caught); got {:?}",
        r1
    );

    let r2 = mgr.exec_command(&mut env, "trap_now", &[]);
    assert!(
        matches!(r2, PluginExec::Failed),
        "second call must remain Failed (instance invalidated); got {:?}",
        r2
    );

    // Sanity: the host process is still alive (we got here).
}

/// §8.3 — `with_env` resets `env` on every exit path.
///
/// Verifies the `EnvGuard` RAII contract: after every dispatch, the
/// `Store<HostContext>::data().env` raw pointer must be null. We exercise
/// two consecutive dispatches and check the pointer between calls, so
/// any leak (e.g. forgetting to reset on the success path) would surface.
#[test]
fn t03_with_env_resets_env_after_dispatch() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load test_plugin");

    // After load (which dispatches `on_load` under `with_env`), env must
    // already be null.
    assert_eq!(
        test_helpers::env_pointer_is_null_in_store(&mgr),
        Some(true),
        "env pointer must be null after on_load returns"
    );

    env.vars.set("X", "1").expect("set X");
    let _ = mgr.exec_command(&mut env, "echo_var", &["X".into()]);
    assert_eq!(
        test_helpers::env_pointer_is_null_in_store(&mgr),
        Some(true),
        "env pointer must be null after first exec"
    );

    let _ = mgr.exec_command(&mut env, "echo_var", &["X".into()]);
    assert_eq!(
        test_helpers::env_pointer_is_null_in_store(&mgr),
        Some(true),
        "env pointer must be null after second exec"
    );
}

/// §8.4 (alternative path) — Metadata contract.
///
/// The §8.4 case "metadata cannot reach host APIs" is covered by the unit
/// tests in `src/plugin/host.rs::tests::metadata_contract_*` — they assert
/// the canonical invariant directly: every real host import returns
/// `Err(Denied)` when `HostContext.env` is null. That's strictly more
/// thorough than a contrived plugin whose `metadata` calls `cwd()`, and
/// avoids needing SDK plumbing to override the trait's default
/// `metadata` body.
///
/// This stub exists as breadcrumb so a future reader sees where §8.4
/// landed.
#[test]
fn t04_metadata_contract_covered_by_host_unit_tests() {
    // No-op assertion: see `src/plugin/host.rs::tests`.
    assert!(true);
}

/// §8.5 — `on_load` reaches host APIs.
///
/// `test_plugin::on_load` calls `record("on_load")`, appending to its
/// in-guest `EVENT_LOG`. We then call the `dump_events` command, which
/// uses `set_var` to write the event log into a host-visible variable.
/// If `on_load` had been denied access (or never invoked under
/// `with_env`), the log would be empty.
///
/// The test indirectly verifies the `with_env` engagement because
/// `dump_events` itself relies on `set_var` working — which proves that
/// the *current* call chain is bound. The on_load proof is the presence
/// of `"on_load"` in the dumped log.
#[test]
fn t05_on_load_has_host_api_access() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load test_plugin");

    let exec = mgr.exec_command(&mut env, "dump_events", &[]);
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "dump_events must Handled(0); got {:?}",
        exec
    );

    let log = env
        .vars
        .get("YOSH_TEST_EVENT_LOG")
        .map(|s| s.to_string())
        .unwrap_or_default();
    assert!(
        log.contains("on_load"),
        "event log must contain 'on_load' (was {:?})",
        log
    );
}

// §8.6–§8.9 — cwasm cache invalidation cases.
//
// At Task 6 time, the host's `load_one` always builds the component
// in-memory via `Component::new(&engine, &wasm_bytes)` (see comment in
// `src/plugin/mod.rs` step 2: "cwasm cache support is deferred"). Until
// the cwasm-deserialize path lands in the host, integration tests for
// these invalidation cases would exercise nothing. Coverage is provided
// by the cache.rs unit tests (`validate_cwasm` rejection cases for each
// tuple member, plus the manager's `precompile` round-trip in
// `crates/yosh-plugin-manager/src/precompile.rs::tests`).
//
// See DONE_WITH_CONCERNS in the task 6 report.

/// §8.10 — WASI surface lockdown.
///
/// Constructing a hand-crafted wasm component that imports
/// `wasi:cli/stdout` is significant fixture work; the linker-level guarantee
/// is already locked down by `src/plugin/linker.rs::tests::linker_construction_smoke`,
/// which exercises the deny path of every `yosh:plugin/*` import and
/// verifies the linker constructs successfully both with and without
/// capabilities. Adding a fixture wasm here would re-test the same
/// invariant (any `wasi:cli` import would fail with an unsatisfied-import
/// error from wasmtime).
///
/// Stub kept as a breadcrumb — see DONE_WITH_CONCERNS in the task 6
/// report.
#[test]
fn t10_wasi_lockdown_covered_by_linker_unit_test() {
    assert!(true);
}

/// §8.11 — Unknown capability strings emit warnings, not errors.
///
/// Without authoring a dedicated plugin whose `required-capabilities`
/// includes `"unknown:capability"`, this is observable only via stderr
/// capture during plugin load. Stderr capture from inside the test
/// process is brittle (ordering across the wasmtime engine init); the
/// host-side parse logic is unit-tested in
/// `crates/yosh-plugin-api/src/lib.rs::tests::parse_unknown_returns_none`
/// and in `src/plugin/mod.rs::parse_required_capabilities` (which logs +
/// continues, by inspection of the source).
#[test]
fn t11_unknown_capability_warning_covered_by_unit_tests() {
    // Parser unit tests confirm the data path; a full integration test
    // requires a custom plugin sub-crate just for this string.
    let result = yosh_plugin_api::parse_capability("variables:execute");
    assert!(result.is_none(), "unknown capability string returns None");
}

/// §8.12 — `required-but-not-granted` parity warning.
///
/// `test_plugin` requests `variables:write` (among others). Granting only
/// `variables:read` triggers the parity warning path in
/// `src/plugin/mod.rs::log_denied_capabilities`. The user-visible part of
/// this is stderr (which is brittle to capture); the data path that
/// computes `denied = requested & !effective` is verified here through
/// the plugin still loading and serving the granted operations.
#[test]
fn t12_required_vs_granted_parity_warning_data_path() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    // Grant only read+io. test_plugin requested write+pre_exec+on_cd too.
    // load_one's `denied` computation is exercised; the load must still
    // succeed and the granted operations must still work.
    let allowed = yosh_plugin_api::CAP_VARIABLES_READ | yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load with restricted caps must still succeed");

    env.vars.set("PARITY", "ok").expect("set sentinel");
    let exec = mgr.exec_command(&mut env, "echo_var", &["PARITY".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "granted read+io path still works"
    );
}

/// §8.13 — Hook dispatch suppression for non-overridden hooks.
///
/// `test_plugin::implemented_hooks` returns `[PreExec, OnCd]` —
/// `PostExec` is intentionally absent even though the SDK's WIT export
/// blanket-impls the `post_exec` interface method. The host's
/// `call_post_exec` checks `implements_hook(HookName::PostExec)` and skips
/// the dispatch, so the test_plugin's `hook_post_exec` (which sets a
/// sentinel var via `set_var`) is never executed.
///
/// We seed `YOSH_TEST_POST_EXEC_FIRED=0` first via the
/// `set_post_exec_marker` command, then call `call_post_exec`, then
/// dispatch `dump_events`. If post_exec had fired, the var would be `"1"`.
#[test]
fn t13_hook_dispatch_suppression_for_non_overridden_post_exec() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load test_plugin");

    // Seed the sentinel.
    let exec = mgr.exec_command(&mut env, "set_post_exec_marker", &[]);
    assert!(matches!(exec, PluginExec::Handled(0)));
    assert_eq!(
        env.vars.get("YOSH_TEST_POST_EXEC_FIRED"),
        Some("0"),
        "sentinel must be seeded to '0' before invocation"
    );

    // Dispatch post_exec. test_plugin does NOT list PostExec in
    // implemented_hooks → host skips the call.
    mgr.call_post_exec(&mut env, "echo hello", 0);

    // Sentinel must be unchanged.
    assert_eq!(
        env.vars.get("YOSH_TEST_POST_EXEC_FIRED"),
        Some("0"),
        "post_exec must NOT have fired (implemented_hooks lacks PostExec)"
    );

    // Also verify the event log lacks any post_exec entry.
    let exec = mgr.exec_command(&mut env, "dump_events", &[]);
    assert!(matches!(exec, PluginExec::Handled(0)));
    let log = env
        .vars
        .get("YOSH_TEST_EVENT_LOG")
        .map(|s| s.to_string())
        .unwrap_or_default();
    assert!(
        !log.contains("post_exec:"),
        "event log must NOT contain 'post_exec:' entry (was {:?})",
        log
    );
}

/// §8.13 (companion) — pre_exec IS dispatched when implemented.
///
/// `test_plugin` declares `PreExec` in `implemented_hooks` and grants
/// `hooks:pre_exec`. After `call_pre_exec`, the event log must contain a
/// `"pre_exec:..."` entry.
#[test]
fn t13b_implemented_hook_does_fire() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load test_plugin");

    mgr.call_pre_exec(&mut env, "ls -la");

    let exec = mgr.exec_command(&mut env, "dump_events", &[]);
    assert!(matches!(exec, PluginExec::Handled(0)));
    let log = env
        .vars
        .get("YOSH_TEST_EVENT_LOG")
        .map(|s| s.to_string())
        .unwrap_or_default();
    assert!(
        log.contains("pre_exec:ls -la"),
        "event log must contain 'pre_exec:ls -la' (was {:?})",
        log
    );
}

/// §8.14 — Compile-only WASI linker construction smoke.
///
/// Already covered by `src/plugin/linker.rs::tests::linker_construction_smoke`.
/// Stub kept as a breadcrumb.
#[test]
fn t14_linker_construction_smoke_covered_by_unit_test() {
    assert!(true);
}

// §8.15 — Boundary-crossing benchmark — see `benches/plugin_bench.rs`
// (added after Task 6; gated on `--features test-helpers`).

/// §8.6/§8.7/§8.8 — cwasm invalidation fallback (smoke).
///
/// Exercises the new `load_plugin_with_cache` host-side path: when the
/// cwasm at `cwasm_path` does not exist (as if it were just wiped from
/// the cache directory), `validate_cwasm` returns `CacheRejection::Missing`
/// and the host falls back to in-memory `Component::new`. The plugin must
/// still load and execute, with a stderr warning about the stale cache.
///
/// Full per-condition coverage (mode mismatch, key mismatch, sidecar
/// schema) lives in `src/plugin/cache.rs::tests`. This integration smoke
/// confirms the host's load_one routing through `validate_cwasm` works
/// end-to-end.
#[test]
fn t06_cwasm_missing_falls_back_to_in_memory() {
    use yosh::plugin::cache::CacheKey;

    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = ShellEnv::new("yosh", Vec::new());
    let mut mgr = PluginManager::new();

    // Construct an "expected" cache key that matches the on-disk wasm
    // (so the unconditional wasm-SHA verify in load_one passes) but a
    // cwasm path that does NOT exist on disk. The validator will reject
    // with CacheRejection::Missing and load_one falls back.
    let wasm_bytes = std::fs::read(&wasm).expect("read wasm");
    let wasm_sha = yosh::plugin::cache::sha256_hex(&wasm_bytes);
    let key = CacheKey::for_runtime(
        wasm_sha,
        yosh_plugin_manager::precompile::ENGINE_FINGERPRINT,
    );
    let nonexistent_cwasm = wasm.with_extension("nonexistent.cwasm");

    test_helpers::load_plugin_with_cache(
        &mut mgr,
        &wasm,
        &mut env,
        yosh_plugin_api::CAP_ALL,
        &nonexistent_cwasm,
        &key,
        &[],
    )
    .expect("load with stale cwasm path must fall back, not fail");

    // Plugin must still work via the in-memory fallback compile.
    let exec = mgr.exec_command(&mut env, "test_cmd", &["smoke".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "plugin must work after cwasm fallback"
    );
}

/// §8.9 — wasm SHA-256 mismatch refuses to load.
///
/// When the lockfile pins a `wasm_sha256` that doesn't match the on-disk
/// `.wasm`, `load_one` refuses BEFORE looking at the cwasm cache. This is
/// the spec §5 unconditional check.
#[test]
fn t09_wasm_sha_mismatch_refuses_to_load() {
    use yosh::plugin::cache::CacheKey;

    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = ShellEnv::new("yosh", Vec::new());
    let mut mgr = PluginManager::new();

    // Bogus expected SHA — does NOT match the on-disk wasm.
    let bogus_sha = "0".repeat(64);
    let key = CacheKey::for_runtime(
        bogus_sha,
        yosh_plugin_manager::precompile::ENGINE_FINGERPRINT,
    );
    let nonexistent_cwasm = wasm.with_extension("nonexistent.cwasm");

    let result = test_helpers::load_plugin_with_cache(
        &mut mgr,
        &wasm,
        &mut env,
        yosh_plugin_api::CAP_ALL,
        &nonexistent_cwasm,
        &key,
        &[],
    );
    assert!(result.is_err(), "load with bad expected SHA must fail");
    let msg = result.unwrap_err();
    assert!(
        msg.contains("wasm SHA-256 mismatch"),
        "error must mention SHA-256 mismatch (was {:?})",
        msg
    );
}

/// §8.5 — `files:read` granted: real read returns file contents.
///
/// Creates a tempfile with the canonical YOSH_TEST_CONTENT marker, loads
/// the plugin with `files:read` granted, and exercises `read-file`. The
/// plugin returns 0 only when the bytes match exactly, so a passing test
/// verifies both that the host import is wired and that bytes survive
/// the host→guest round trip.
#[test]
fn t15_files_read_granted_works() {
    let _g = lock_test();
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("hello.txt");
    std::fs::write(&path, b"YOSH_TEST_CONTENT\n").expect("write fixture");

    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_FILES_READ;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin with files:read");

    let exec = mgr.exec_command(
        &mut env,
        "read-file",
        &[path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "read-file with files:read grant must Handled(0), got {:?}",
        exec
    );
}

/// §8.5 — `files:read` not granted: deny stub returns Denied (exit 13).
#[test]
fn t16_files_read_denied_returns_error() {
    let _g = lock_test();
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("hello.txt");
    std::fs::write(&path, b"YOSH_TEST_CONTENT\n").expect("write fixture");

    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    // Grant something else so the plugin loads, but NOT files:read.
    let allowed = yosh_plugin_api::CAP_VARIABLES_READ;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin without files:read");

    let exec = mgr.exec_command(
        &mut env,
        "read-file",
        &[path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(exec, PluginExec::Handled(13)),
        "read-file without files:read grant must Handled(13) (Denied), got {:?}",
        exec
    );
}

/// §8.5 — `files:write` granted: real write produces the expected file.
#[test]
fn t17_files_write_granted_works() {
    let _g = lock_test();
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("out.txt");

    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_FILES_WRITE;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin with files:write");

    let exec = mgr.exec_command(
        &mut env,
        "write-file",
        &[path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "write-file with files:write grant must Handled(0), got {:?}",
        exec
    );

    let written = std::fs::read(&path).expect("read written file");
    assert_eq!(
        written, b"YOSH_TEST_CONTENT\n",
        "host-side read of plugin-written file must match canonical marker",
    );
}

/// §8.5 — `files:write` not granted: deny stub returns Denied (exit 13).
#[test]
fn t18_files_write_denied_returns_error() {
    let _g = lock_test();
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("out.txt");

    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_VARIABLES_READ;
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin without files:write");

    let exec = mgr.exec_command(
        &mut env,
        "write-file",
        &[path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(exec, PluginExec::Handled(13)),
        "write-file without files:write grant must Handled(13) (Denied), got {:?}",
        exec
    );

    assert!(!path.exists(), "deny stub must not create the file");
}

/// §8.5 — Read and write capabilities are independent: granting only
/// `files:read` leaves `files:write` functions on deny stubs.
#[test]
fn t19_files_read_only_blocks_write() {
    let _g = lock_test();
    let dir = tempfile::tempdir().expect("tempdir");
    let read_path = dir.path().join("in.txt");
    let write_path = dir.path().join("out.txt");
    std::fs::write(&read_path, b"YOSH_TEST_CONTENT\n").expect("write fixture");

    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_FILES_READ; // read only
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, allowed, &[])
        .expect("load test_plugin with files:read only");

    // Read should succeed.
    let r = mgr.exec_command(
        &mut env,
        "read-file",
        &[read_path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(r, PluginExec::Handled(0)),
        "read-file with files:read grant must Handled(0), got {:?}",
        r
    );

    // Write should be denied.
    let w = mgr.exec_command(
        &mut env,
        "write-file",
        &[write_path.to_string_lossy().into_owned()],
    );
    assert!(
        matches!(w, PluginExec::Handled(13)),
        "write-file without files:write grant must Handled(13), got {:?}",
        w
    );
    assert!(!write_path.exists(), "deny stub must not create the file");
}

/// §10 t20 — `commands:exec` granted with matching pattern works.
///
/// Note: spec §10 also asks for "assert stdout from echo". `run-echo`
/// already captures the spawned `echo` stdout via `sdk::exec` and
/// forwards it to host stdout via `print()`, but the integration
/// harness intentionally does not capture host stdout — `host_io_write`
/// goes straight to `std::io::stdout()`. The end-to-end exec path
/// (capability bit → pattern match → spawn → stdout capture in the
/// SDK) is covered by `host_commands_exec_runs_when_pattern_matches`
/// in `src/plugin/host.rs`, which asserts `out.stdout == b"hello\n"`
/// directly. Here we verify the integration glue by checking that
/// `run-echo` returns the child's exit code (0), which is reachable
/// only if every guard passed.
#[test]
fn t20_commands_exec_granted_with_pattern_works() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_COMMANDS_EXEC | yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        allowed,
        &["echo:*".to_string()],
    )
    .expect("load test_plugin with commands:exec + echo:* allowlist");

    let exec = mgr.exec_command(&mut env, "run-echo", &["hello".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(0)),
        "run-echo with allowed pattern must Handled(0), got {:?}",
        exec
    );
}

/// §10 t21 — `commands:exec` denied without capability bit.
#[test]
fn t21_commands_exec_denied_without_capability() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    // No CAP_COMMANDS_EXEC bit — even with a matching pattern, the deny
    // stub fires.
    let allowed = yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        allowed,
        &["echo:*".to_string()],
    )
    .expect("load without commands:exec");

    let exec = mgr.exec_command(&mut env, "run-echo", &["hi".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(100)),
        "run-echo without capability must map to exit 100 (Denied), got {:?}",
        exec
    );
}

/// §10 t22 — `commands:exec` granted but pattern doesn't match.
#[test]
fn t22_commands_exec_pattern_not_allowed_without_match() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_COMMANDS_EXEC | yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        allowed,
        // Allow `ls:*` but the plugin invokes `echo` — no match.
        &["ls:*".to_string()],
    )
    .expect("load with non-matching allowlist");

    let exec = mgr.exec_command(&mut env, "run-echo", &["hi".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(101)),
        "run-echo without matching pattern must map to exit 101 (PatternNotAllowed), got {:?}",
        exec
    );
}

/// §10 t23 — fixed-length allowlist pattern (no `:*` glob suffix) admits
/// only an exact-length argv. With pattern `["echo"]`, argv `["echo", "hi"]`
/// is rejected as PatternNotAllowed (exit 101). Distinguished from t22
/// (which uses a non-matching first element) by the fact that the prefix
/// matches but the trailing argument is the violation.
#[test]
fn t23_commands_exec_exact_pattern_rejects_extra_args() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_COMMANDS_EXEC | yosh_plugin_api::CAP_IO;
    test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        allowed,
        // Exact-length pattern: argv must be EXACTLY ["echo"].
        &["echo".to_string()],
    )
    .expect("load with exact-length allowlist");

    // `run-echo hi` produces argv = ["echo", "hi"]; pattern "echo" only
    // matches argv = ["echo"], so this is rejected.
    let exec = mgr.exec_command(&mut env, "run-echo", &["hi".into()]);
    assert!(
        matches!(exec, PluginExec::Handled(101)),
        "run-echo with extra args under exact pattern must map to exit 101, got {:?}",
        exec
    );
}

/// §10 t24 — invalid pattern fails plugin load.
#[test]
fn t24_commands_exec_invalid_pattern_fails_plugin_load() {
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    let allowed = yosh_plugin_api::CAP_COMMANDS_EXEC | yosh_plugin_api::CAP_IO;
    let result = test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        allowed,
        // Pattern body is empty after stripping `:*` — should error.
        &[":*".to_string()],
    );
    assert!(
        result.is_err(),
        "load_plugin_with_caps should fail on invalid pattern, got Ok"
    );
    let err = result.unwrap_err();
    assert!(
        err.contains("invalid allowed_commands pattern"),
        "error must mention the offending field, got: {}",
        err
    );
}

/// pre_prompt hook timeout — busy loop case.
///
/// Verifies that `call_pre_prompt` interrupts a busy-looping plugin via
/// the wasmtime epoch deadline, surfaces a hook-specific timeout
/// message, and invalidates the plugin so a second call short-circuits
/// via the existing "skipped (instance invalidated by earlier trap)"
/// path.
///
/// Stress: a 100ms timeout against a tight busy loop with a 50ms tick
/// interval. Worst-case wall-clock for the first call is ~150ms (timeout
/// + one tick window). The 1s upper bound below is deliberately loose —
/// we are asserting "bounded", not "fast".
#[test]
fn t25_pre_prompt_timeout_invalidates_slow_plugin() {
    use std::time::Instant;

    let _g = lock_test();
    let wasm = slow_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    // Tighten the deadline so the test runs fast. Calling this BEFORE
    // load_plugin_with_caps ensures any pre_prompt invocation made
    // during the load path (none today, but defensively) sees the
    // small budget too.
    test_helpers::set_pre_prompt_timeout_for_tests(&mut mgr, 100);

    test_helpers::load_plugin_with_caps(
        &mut mgr,
        &wasm,
        &mut env,
        yosh_plugin_api::CAP_HOOK_PRE_PROMPT | yosh_plugin_api::CAP_HOOK_PRE_EXEC,
        &[],
    )
    .expect("load slow_plugin with pre_prompt+pre_exec caps");

    let t0 = Instant::now();
    mgr.call_pre_prompt(&mut env);
    let first_elapsed = t0.elapsed();

    assert!(
        first_elapsed.as_millis() < 1_000,
        "first call_pre_prompt should be bounded by the deadline; got {:?}",
        first_elapsed
    );

    // Second call must short-circuit via the invalidated path. Its
    // wall-clock should be effectively zero — generous bound to avoid
    // CI flakes.
    let t1 = Instant::now();
    mgr.call_pre_prompt(&mut env);
    let second_elapsed = t1.elapsed();

    assert!(
        second_elapsed.as_millis() < 50,
        "second call_pre_prompt should be a fast skip; got {:?}",
        second_elapsed
    );
}

// NOTE: the post-call deadline-reset in `call_pre_prompt` (commit
// 154e96e — restore baseline so subsequent non-pre_prompt hooks on
// the same plugin retain their full budget) is exercised only
// indirectly today: every test that loads test_plugin (which doesn't
// implement pre_prompt) and then calls a non-pre_prompt hook would
// fail if the baseline weren't preserved on plugins that DO implement
// pre_prompt. A direct regression test would need a "fast pre_prompt
// + pre_exec" fixture (slow_plugin's pre_prompt busy-loops, so it
// can't model a successful return). Defer until that fixture exists.

/// perf_plugin commands exit with code 0.
///
/// `perf_plugin` provides lightweight test fixtures (noop_cmd, noop_var,
/// burst_var) used by performance benches. Verify that all three commands
/// are properly wired to return 0.
#[test]
fn perf_plugin_commands_exit_zero() {
    let _g = lock_test();
    let wasm = perf_plugin_wasm();
    let mut env = fresh_env();
    env.vars
        .set("PERF_VAR", "perf_value")
        .expect("set PERF_VAR");
    let mut mgr = PluginManager::new();

    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load perf_plugin");

    for cmd in ["noop_cmd", "noop_var", "burst_var"] {
        let result = mgr.exec_command(&mut env, cmd, &[]);
        assert!(
            matches!(result, PluginExec::Handled(0)),
            "{} should be Handled(0), got {:?}",
            cmd,
            result
        );
    }
}

/// Verify that three `[[plugin]]` entries pointing at the same wasm path
/// (aliased names) each produce an independent `Plugin` record when loaded
/// via `load_from_config`. The assumption is that `load_one` has no
/// name/path-collision guard; all three instances load and their hooks fire.
///
/// This is Task 4 of the plugin-perf-tuning plan (Phase 1 precondition).
#[test]
fn perf_plugin_three_aliases_load_independently() {
    use std::io::Write;

    let _guard = lock_test();
    let wasm = perf_plugin_wasm();

    let tmp = tempfile::tempdir().expect("tempdir");
    let lock_path = tmp.path().join("plugins.lock");
    let mut f = std::fs::File::create(&lock_path).expect("create lock");
    writeln!(
        f,
        r#"
[[plugin]]
name = "perf_a"
path = "{wasm}"
enabled = true
capabilities = ["variables:read", "hooks:pre_prompt", "hooks:pre_exec", "hooks:post_exec"]

[[plugin]]
name = "perf_b"
path = "{wasm}"
enabled = true
capabilities = ["variables:read", "hooks:pre_prompt", "hooks:pre_exec", "hooks:post_exec"]

[[plugin]]
name = "perf_c"
path = "{wasm}"
enabled = true
capabilities = ["variables:read", "hooks:pre_prompt", "hooks:pre_exec", "hooks:post_exec"]
"#,
        wasm = wasm.display()
    )
    .expect("write lock");
    drop(f);

    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    mgr.load_from_config(&lock_path, &mut env);

    // Hooks must dispatch without panic against all three instances. The
    // absence of a panic / trap is the observable assertion — perf_plugin
    // hooks have empty bodies by design.
    mgr.call_pre_prompt(&mut env);
    mgr.call_pre_exec(&mut env, "noop");
}

/// perf_plugin hooks dispatch without panic.
///
/// `perf_plugin` advertises `hook_pre_prompt`, `hook_pre_exec`, and
/// `hook_post_exec` as implemented. All three hooks have empty bodies
/// (they measure dispatch overhead only, not user work). This test
/// verifies that the hooks dispatch without trapping.
#[test]
fn perf_plugin_hooks_dispatch_without_panic() {
    let _g = lock_test();
    let wasm = perf_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();

    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, yosh_plugin_api::CAP_ALL, &[])
        .expect("load perf_plugin");

    // Hooks must dispatch without trapping. They have no observable
    // side effect by design (this is a perf fixture, not a behavior test);
    // the assertion is the absence of panic / trap.
    mgr.call_pre_prompt(&mut env);
    mgr.call_pre_exec(&mut env, "noop");
    mgr.call_post_exec(&mut env, "noop", 0);
}

#[test]
fn linker_cache_reuses_entry_for_same_mask() {
    // Two loads with identical caps must share one real-linker cache
    // entry. With the metadata-probe scratch entry (CAP_ALL) plus one
    // shared real-mask entry, the total is 2.
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    let caps = yosh_plugin_api::CAP_ALL;

    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, caps, &[]).expect("first load");
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, caps, &[]).expect("second load");

    let len = test_helpers::linker_cache_len(&mgr);
    assert_eq!(
        len, 2,
        "expected 2 entries (CAP_ALL scratch + shared real mask), got {len}",
    );
}

#[test]
fn linker_cache_separates_entries_for_distinct_masks() {
    // Two loads with different cap subsets must produce two real-linker
    // cache entries (plus one CAP_ALL scratch entry) for a total of 3.
    let _g = lock_test();
    let wasm = test_plugin_wasm();
    let mut env = fresh_env();
    let mut mgr = PluginManager::new();
    let caps_a = yosh_plugin_api::CAP_VARIABLES_READ;
    let caps_b = yosh_plugin_api::CAP_VARIABLES_READ | yosh_plugin_api::CAP_FILESYSTEM;

    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, caps_a, &[]).expect("load a");
    test_helpers::load_plugin_with_caps(&mut mgr, &wasm, &mut env, caps_b, &[]).expect("load b");

    let len = test_helpers::linker_cache_len(&mgr);
    assert_eq!(
        len, 3,
        "expected 3 entries (CAP_ALL scratch + 2 distinct real masks), got {len}",
    );
}