kandev/apps/backend/internal/agent/runtime/lifecycle/default_scripts_test.go

package lifecycle

import (
	"os/exec"
	"path/filepath"
	"regexp"
	"strings"
	"testing"

	"github.com/kandev/kandev/internal/scriptengine"
	"github.com/kandev/kandev/internal/task/models"
)

// TestKandevBranchCheckoutPostlude_HasInvariantSteps asserts the kandev-
// managed postlude contains the steps needed to land on the session's
// feature branch. The postlude is appended to every user prepare script so
// stale stored scripts (created before the worktree-branch checkout was
// part of the default) still get the checkout.
func TestKandevBranchCheckoutPostlude_HasInvariantSteps(t *testing.T) {
	postlude := KandevBranchCheckoutPostlude()
	// Data placeholders are referenced BARE; the scriptengine providers
	// substitute a self-contained single-quoted token (shellQuote), so a
	// hostile branch name resolves to a quoted literal. The placeholders must
	// NOT be double-quoted here (double quotes would re-expose $(...)).
	want := []string{
		`if [ -d {{workspace.path}}/.git ]`,
		`[ -n {{worktree.branch}} ]`,
		`[ {{worktree.branch}} != {{repository.branch}} ]`,
		`cd {{workspace.path}}`,
		`git rev-parse --verify {{worktree.branch}}`,
		`git fetch --depth=1 origin {{worktree.branch}}`,
		`git checkout -b {{worktree.branch}} origin/{{worktree.branch}}`,
		`git checkout -b {{worktree.branch}}`,
		`|| true`,
	}
	for _, w := range want {
		if !strings.Contains(postlude, w) {
			t.Errorf("postlude missing %q", w)
		}
	}
	// Data placeholders must never be double-quoted: double quotes do not stop
	// $(...) / backtick command substitution, which is the RCE we fixed.
	if strings.Contains(postlude, `"{{worktree.branch}}"`) ||
		strings.Contains(postlude, `"{{repository.branch}}"`) ||
		strings.Contains(postlude, `"{{workspace.path}}`) {
		t.Errorf("postlude must not double-quote data placeholders:\n%s", postlude)
	}
	// The destructive `-B branch origin/branch` form orphaned local commits on
	// resume — verify it does NOT come back.
	forbidden := []string{
		`git checkout -B {{worktree.branch}} origin/{{worktree.branch}}`,
	}
	for _, f := range forbidden {
		if strings.Contains(postlude, f) {
			t.Errorf("postlude must not contain destructive form %q", f)
		}
	}
}

// TestKandevBranchCheckoutPostlude_LandsOnFeatureBranch executes the
// postlude as a real shell script against a temp git repo. It is the
// behaviour test that pairs with the static-content test above:
// it catches regressions where the snippet still parses as bash but
// no longer does the right thing (wrong refspec, missing -B, swallowed
// exit code, etc.).
//
// The three cases mirror the three branches inside the postlude:
//   - remote feature branch exists                → tracks origin/<branch>
//   - no remote, no local                         → creates local branch off HEAD
//   - local branch already checked out, no remote → idempotent (no error, same branch)
func TestKandevBranchCheckoutPostlude_LandsOnFeatureBranch(t *testing.T) {
	if _, err := exec.LookPath("git"); err != nil {
		t.Skip("git not available")
	}
	if _, err := exec.LookPath("bash"); err != nil {
		t.Skip("bash not available")
	}

	cases := []struct {
		name        string
		seedRemote  bool   // create a "feature" branch on origin before running
		seedLocal   bool   // pre-create the local branch (idempotency check)
		featureName string // branch name passed to the postlude
		baseName    string // base branch name (must match repository.branch)
		want        string // expected current branch after running
	}{
		{
			name:        "remote tip exists",
			seedRemote:  true,
			featureName: "feature/from-remote",
			baseName:    "main",
			want:        "feature/from-remote",
		},
		{
			name:        "no remote, no local",
			seedRemote:  false,
			featureName: "feature/from-scratch",
			baseName:    "main",
			want:        "feature/from-scratch",
		},
		{
			name:        "local already checked out",
			seedLocal:   true,
			featureName: "feature/already-here",
			baseName:    "main",
			want:        "feature/already-here",
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			workspace, originDir := setupPostludeRepo(t, tc.baseName)
			if tc.seedRemote {
				seedOriginBranch(t, originDir, tc.featureName)
			}
			if tc.seedLocal {
				runIn(t, workspace, "git", "checkout", "-b", tc.featureName)
			}

			script := strings.NewReplacer(
				"{{workspace.path}}", workspace,
				"{{worktree.branch}}", tc.featureName,
				"{{repository.branch}}", tc.baseName,
			).Replace(KandevBranchCheckoutPostlude())

			cmd := exec.Command("bash", "-e", "-c", script)
			out, err := cmd.CombinedOutput()
			if err != nil {
				t.Fatalf("bash -e postlude failed: %v\n%s", err, out)
			}

			gotBranch := strings.TrimSpace(string(runIn(t, workspace, "git", "branch", "--show-current")))
			if gotBranch != tc.want {
				t.Fatalf("after postlude branch = %q, want %q\nscript output:\n%s", gotBranch, tc.want, out)
			}
		})
	}
}

// setupPostludeRepo creates a fake origin (bare repo with one commit on
// baseBranch) and a workspace cloned from it, then leaves the workspace on
// baseBranch. Returns workspace path + origin (bare) path.
func setupPostludeRepo(t *testing.T, baseBranch string) (workspace, origin string) {
	t.Helper()
	root := t.TempDir()
	origin = filepath.Join(root, "origin.git")
	seed := filepath.Join(root, "seed")
	workspace = filepath.Join(root, "workspace")

	runIn(t, root, "git", "init", "--quiet", "--bare", "--initial-branch="+baseBranch, origin)
	runIn(t, root, "git", "init", "--quiet", "--initial-branch="+baseBranch, seed)
	runIn(t, seed, "git", "config", "user.email", "test@example.com")
	runIn(t, seed, "git", "config", "user.name", "Test")
	runIn(t, seed, "git", "commit", "--allow-empty", "-m", "init")
	runIn(t, seed, "git", "remote", "add", "origin", origin)
	runIn(t, seed, "git", "push", "--quiet", "origin", baseBranch)

	runIn(t, root, "git", "clone", "--quiet", "--branch", baseBranch, origin, workspace)
	runIn(t, workspace, "git", "config", "user.email", "test@example.com")
	runIn(t, workspace, "git", "config", "user.name", "Test")
	return workspace, origin
}

// seedOriginBranch creates `branch` on `origin` (the bare repo) so the
// postlude's `git fetch origin <branch>` succeeds. Uses a temporary clone of
// origin to push the new branch in.
func seedOriginBranch(t *testing.T, origin, branch string) {
	t.Helper()
	tmp := filepath.Join(t.TempDir(), "seed-origin-branch")
	runIn(t, "", "git", "clone", "--quiet", origin, tmp)
	runIn(t, tmp, "git", "config", "user.email", "test@example.com")
	runIn(t, tmp, "git", "config", "user.name", "Test")
	runIn(t, tmp, "git", "checkout", "-b", branch)
	runIn(t, tmp, "git", "commit", "--allow-empty", "-m", "feature")
	runIn(t, tmp, "git", "push", "--quiet", "origin", branch)
}

// runIn runs cmd with args in dir (or current dir when dir == "") and fails
// the test on non-zero exit. Returns stdout for callers that need it.
func runIn(t *testing.T, dir string, cmd string, args ...string) []byte {
	t.Helper()
	c := exec.Command(cmd, args...)
	if dir != "" {
		c.Dir = dir
	}
	out, err := c.CombinedOutput()
	if err != nil {
		t.Fatalf("%s %v: %v\n%s", cmd, args, err, out)
	}
	return out
}

// TestDefaultPrepareScripts_NoInlineFeatureBranchCheckout asserts that the
// clone-based remote default scripts no longer carry an inline worktree-
// branch checkout. The checkout is owned exclusively by the postlude
// (KandevBranchCheckoutPostlude) so old stored profiles and the current
// default can never disagree about how the feature branch is materialised.
func TestDefaultPrepareScripts_NoInlineFeatureBranchCheckout(t *testing.T) {
	executors := []string{"local_docker", "remote_docker", "sprites"}
	forbidden := []string{
		`if [ -n {{worktree.branch}} ] && [ {{worktree.branch}} != {{repository.branch}} ]; then`,
		`git checkout -B {{worktree.branch}} origin/{{worktree.branch}}`,
	}

	for _, executorType := range executors {
		t.Run(executorType, func(t *testing.T) {
			script := DefaultPrepareScript(executorType)
			if script == "" {
				t.Fatalf("DefaultPrepareScript(%q) returned empty", executorType)
			}
			for _, bad := range forbidden {
				if strings.Contains(script, bad) {
					t.Errorf("script for %q must not contain inline checkout %q (postlude owns it)", executorType, bad)
				}
			}
		})
	}
}

func TestDefaultPrepareScript_SSHMaterializesPrimaryWorkspace(t *testing.T) {
	script := DefaultPrepareScript(executorTypeSSH)
	if script == "" {
		t.Fatal("DefaultPrepareScript(\"ssh\") returned empty")
	}
	for _, want := range []string{
		"{{workspace.path}}",
		"{{repository.clone_url}}",
		"{{repository.branch}}",
		"{{repository.setup_script}}",
		"git init",
		"fetch --no-tags",
		"remote.origin.url",
	} {
		if !strings.Contains(script, want) {
			t.Errorf("SSH default prepare script missing %q", want)
		}
	}
	if strings.Contains(script, "git checkout -B {{worktree.branch}} origin/{{worktree.branch}}") {
		t.Fatal("SSH default prepare script must leave feature-branch selection to the postlude")
	}
}

// TestManagedScripts_BraceParameterExpansionsBeforeColon guards every managed
// script that can run under a user-selected login shell. zsh parses an
// unbraced `$name:r` as a modifier, so `refs/heads/$branch:refs/...` silently
// became `refs/heads/mainefs/...` on macOS SSH targets. Bracing is the only
// form that sh, bash, and zsh all read the same way.
func TestManagedScripts_BraceParameterExpansionsBeforeColon(t *testing.T) {
	unbraced := regexp.MustCompile(`\$[A-Za-z_][A-Za-z0-9_]*:`)
	destination := models.ContributionDestination{
		Version:  models.ContributionDestinationVersion,
		Provider: models.ContributionDestinationProviderGitHub,
		SourceRepository: models.ContributionDestinationRepository{
			Host: "github.com", Path: "kdlbs/kandev", ProviderID: "100", RemoteURL: "https://github.com/kdlbs/kandev.git",
		},
		TargetRepository: models.ContributionDestinationRepository{
			Host: "github.com", Path: "contributor/kandev", ProviderID: "200", RemoteURL: "https://github.com/contributor/kandev.git",
		},
	}
	destinationScript, err := scriptengine.ContributionDestinationSetupScriptAt(&destination, "/workspace")
	if err != nil {
		t.Fatalf("build contribution destination script: %v", err)
	}
	scripts := map[string]string{
		"branch checkout postlude": KandevBranchCheckoutPostlude(),
		"ssh remote contribution": strings.Join(
			append(sshRemoteContributionSetupLines(), sshRemoteContributionCheckoutLines()...), "\n"),
		"ssh contribution destination": destinationScript,
	}
	for _, executorType := range []string{"local", "worktree", "local_docker", "k8s", "sprites", executorTypeSSH} {
		scripts["default prepare script for "+executorType] = DefaultPrepareScript(executorType)
	}
	for name, script := range scripts {
		if script == "" {
			t.Fatalf("%s: empty script", name)
		}
		for index, line := range strings.Split(script, "\n") {
			if strings.HasPrefix(strings.TrimSpace(line), "#") {
				continue
			}
			if match := unbraced.FindString(line); match != "" {
				t.Errorf("%s line %d: %q must be written as ${name}: so zsh does not treat the colon as a modifier:\n%s",
					name, index+1, match, strings.TrimSpace(line))
			}
		}
	}
}