stoke/test/cli.test.js

const { test } = require('node:test');
const assert = require('node:assert/strict');
const { execFileSync, spawn, spawnSync } = require('node:child_process');
const fs = require('node:fs');
const http = require('node:http');
const os = require('node:os');
const path = require('node:path');

const CLI = path.join(__dirname, '..', 'src', 'cli.js');
const pkg = require('../package.json');

function run(args, env = {}) {
  return spawnSync(process.execPath, [CLI, ...args], {
    encoding: 'utf8',
    env: { ...process.env, ...env },
  });
}

test('--version matches package.json', () => {
  const out = execFileSync(process.execPath, [CLI, '--version'], { encoding: 'utf8' });
  assert.equal(out.trim(), pkg.version);
});

test('--help lists every top-level command', () => {
  const out = execFileSync(process.execPath, [CLI, '--help'], { encoding: 'utf8' });
  for (const cmd of ['auth', 'repo', 'issue', 'pr', 'release', 'label', 'branch', 'collaborator', 'org', 'user', 'api']) {
    assert.match(out, new RegExp(`^\\s+${cmd}`, 'm'), `missing command: ${cmd}`);
  }
});

test('unauthenticated commands fail with a login hint', () => {
  const missing = path.join(os.tmpdir(), `stoke-none-${process.pid}.json`);
  const res = run(['repo', 'list'], { STOKE_CONFIG_FILE: missing });
  assert.equal(res.status, 1);
  assert.match(res.stderr, /stoke auth login/);
});

test('global --config flag overrides the config location', () => {
  // Point --config at a nonexistent file: auth status must report
  // "Not authenticated" instead of silently using the default config.
  const missing = path.join(os.tmpdir(), `stoke-missing-${process.pid}.json`);
  const res = run(['--config', missing, 'auth', 'status']);
  assert.equal(res.status, 1);
  assert.match(res.stdout, /Not authenticated/);
});

test('auth status exits 1 when not authenticated', () => {
  const missing = path.join(os.tmpdir(), `stoke-none-${process.pid}.json`);
  const res = run(['auth', 'status'], { STOKE_CONFIG_FILE: missing });
  assert.equal(res.status, 1);
  assert.match(res.stdout, /Not authenticated/);
});

test('invalid --limit is rejected before any network call', () => {
  const res = run(['repo', 'list', '-l', 'abc']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Limit must be a non-negative integer/);
});

test('invalid --team-id is rejected before any network call', () => {
  const res = run(['org', 'team', 'member-add', '--team-id', 'zero', '-u', 'x']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Id must be a positive integer/);
});

test('pr merge validates --number before any network call', () => {
  const res = run(['pr', 'merge', '-o', 'o', '-r', 'r', '-n', 'seven']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Id must be a positive integer/);
});

test('issue create --body-file reports unreadable files cleanly', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(
      ['issue', 'create', '-o', 'o', '-r', 'r', '-t', 't', '--body-file', '/nonexistent/body.md'],
      { STOKE_CONFIG_FILE: cfg },
    );
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Could not read body file/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr show validates --number before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'show', '-o', 'o', '-r', 'r', '-n', 'zero'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Id must be a positive integer/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr comment rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'comment', '-o', 'o', '-r', 'r', '-n', '1'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr comment rejects a whitespace-only body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'comment', '-o', 'o', '-r', 'r', '-n', '1', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review rejects an invalid event before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'nope'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Invalid review event/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review accepts approved as an alias for approve before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    // Network fails; must not fail at event validation.
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'APPROVED'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.doesNotMatch(res.stderr, /Invalid review event/);
    assert.doesNotMatch(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review request-changes rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'request-changes'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review comment rejects a whitespace-only body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'comment', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review approve allows an empty body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['pr', 'review', '-o', 'o', '-r', 'r', '-n', '1', '--event', 'approve'], { STOKE_CONFIG_FILE: cfg });
    // It fails at the network call, not at validation.
    assert.equal(res.status, 1);
    assert.doesNotMatch(res.stderr, /requires a non-empty body/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('label create rejects an invalid color before any network call', () => {
  const res = run(['label', 'create', '-o', 'o', '-r', 'r', '--name', 'x', '--color', 'red']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Color must be 6 hex digits/);
});

test('label delete requires one of --id or --name before any network call', () => {
  const res = run(['label', 'delete', '-o', 'o', '-r', 'r']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /One of --id or --name is required/);
});

test('api rejects an endpoint without a leading slash before any network call', () => {
  const res = run(['api', 'repos/o/r']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Endpoint must start with \//);
});

test('api rejects an unsupported method before any network call', () => {
  const res = run(['api', '/user', '-X', 'HEAD']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /Unsupported method/);
});

test('api rejects --paginate with a non-GET method before any network call', () => {
  const res = run(['api', '/user', '-X', 'POST', '--paginate']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /--paginate only works with GET/);
});

test('api rejects GET with --input before any network call', () => {
  const res = run(['api', '/user', '-X', 'GET', '--input', '{}']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /GET requests cannot carry a body/);
});

test('label delete rejects --id and --name together before any network call', () => {
  const res = run(['label', 'delete', '-o', 'o', '-r', 'r', '--id', '3', '--name', 'x']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /either --id or --name, not both/);
});

test('api rejects invalid JSON input before any network call', () => {
  const res = run(['api', '/user', '--input', '{nope']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /not valid JSON/);
});

test('api sends the token and prints the JSON response', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-api.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    let authHeader = null;
    const server = http.createServer((req, res) => {
      authHeader = req.headers.authorization;
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ login: 'bot' }));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(['api', '/user'], { STOKE_CONFIG_FILE: cfg });
        clearTimeout(timer);
        server.close(() => resolve({ res, authHeader }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.res.status, 0, result.res.stderr);
    assert.equal(result.authHeader, 'token tok');
    assert.deepEqual(JSON.parse(result.res.stdout), { login: 'bot' });
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('label add fails closed on an unknown label name', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-lbl.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify([{ id: 1, name: 'bug', color: 'd73a4a' }]));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['label', 'add', '-o', 'o', '-r', 'r', '-n', '7', '--name', 'ghost'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve(res));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.status, 1);
    assert.match(result.stderr, /Label not found in o\/r: ghost/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

function spawnAsync(args, env = {}) {
  return new Promise((resolve, reject) => {
    const child = spawn(process.execPath, [CLI, ...args], {
      env: { ...process.env, ...env },
    });
    let stdout = '';
    let stderr = '';
    child.stdout.setEncoding('utf8');
    child.stderr.setEncoding('utf8');
    child.stdout.on('data', (chunk) => { stdout += chunk; });
    child.stderr.on('data', (chunk) => { stderr += chunk; });
    child.on('error', reject);
    child.on('close', (status) => resolve({ status, stdout, stderr }));
  });
}

test('pr review preserves exact body-file whitespace through the CLI boundary', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  const bodyFile = path.join(os.tmpdir(), `stoke-body-${process.pid}.md`);
  const rawBody = '    leading spaces\nline\ntrailing newline\n';

  fs.writeFileSync(bodyFile, rawBody, 'utf8');

  const TIMEOUT_MS = 5000;
  let timer;
  const captured = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };

    const server = http.createServer((req, res) => {
      let data = '';
      req.setEncoding('utf8');
      req.on('data', (chunk) => { data += chunk; });
      req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 99, html_url: 'https://forge.test/reviews/99' }));
        clearTimeout(timer);
        server.close(() => resolve({ url: req.url, body: data, cliStatus: null }));
      });
    });

    timer = setTimeout(() => fail(new Error(`CLI boundary test timed out after ${TIMEOUT_MS}ms`)), TIMEOUT_MS);

    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'request-changes', '--body-file', bodyFile],
          { STOKE_CONFIG_FILE: cfg },
        );
        if (res.status !== 0) {
          fail(new Error(`CLI failed (status ${res.status}): ${res.stderr}`));
          return;
        }
        // Capture is resolved from the HTTP handler; assert exit 0 here via side channel.
        // If the handler already resolved, attach status for the outer asserts.
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(captured.url, '/api/v1/repos/o/r/pulls/7/reviews');
    const json = JSON.parse(captured.body);
    assert.equal(json.event, 'REQUEST_CHANGES');
    assert.equal(json.body, rawBody);
  } finally {
    fs.unlinkSync(cfg);
    fs.unlinkSync(bodyFile);
  }
});

test('pr review prints the review URL from the API response', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-url.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      let data = '';
      req.on('data', (c) => { data += c; });
      req.on('end', () => {
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 42, html_url: 'https://forge.test/pulls/7#issuecomment-42' }));
      });
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'approve', '-b', 'LGTM'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve(res));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.status, 0, result.stderr);
    assert.match(result.stdout, /Review submitted on !7: APPROVED/);
    assert.match(result.stdout, /URL: https:\/\/forge\.test\/pulls\/7#issuecomment-42/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

// Runs `auth login` against a stub Forgejo server and captures the body of
// the token-creation request. GETs answer as /user; the POST to
// /users/{name}/tokens is what carries the scopes under test.
function runLoginWithServer(extraArgs) {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-${runLoginWithServer.n}.json`);
  runLoginWithServer.n += 1;
  const TIMEOUT_MS = 5000;
  let timer;
  return new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    let tokenBody = null;
    const server = http.createServer((req, res) => {
      if (req.method === 'POST' && req.url.startsWith('/api/v1/users/')) {
        let data = '';
        req.on('data', (c) => { data += c; });
        req.on('end', () => {
          tokenBody = JSON.parse(data);
          res.writeHead(201, { 'Content-Type': 'application/json' });
          res.end(JSON.stringify({ id: 1, name: tokenBody.name, sha1: 'tok123' }));
        });
        return;
      }
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ login: 'alice', username: 'alice', email: 'alice@forge.test' }));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      try {
        const res = await spawnAsync(
          ['auth', 'login', '-u', `http://127.0.0.1:${port}`, '-n', 'alice', '-p', 'secret', ...extraArgs],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve({ res, tokenBody, cfg }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));
}
runLoginWithServer.n = 0;

test('auth login creates a token with the reduced default scopes', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer([]);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, [
      'read:issue', 'write:issue',
      'read:repository', 'write:repository',
      'read:user',
      'read:organization',
    ]);
    assert.match(res.stdout, /Scopes: read:issue, write:issue, read:repository, write:repository, read:user, read:organization/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login --full-scopes restores the full scope set', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer(['--full-scopes']);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, [
      'read:activitypub', 'write:activitypub',
      'read:issue', 'write:issue',
      'read:misc', 'write:misc',
      'read:organization', 'write:organization',
      'read:package', 'write:package',
      'read:repository', 'write:repository',
      'read:user', 'write:user',
    ]);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login --scopes parses a comma-separated list', async () => {
  const { res, tokenBody, cfg } = await runLoginWithServer(['--scopes', 'read:issue, write:repository ,read:user']);
  try {
    assert.equal(res.status, 0, res.stderr);
    assert.deepEqual(tokenBody.scopes, ['read:issue', 'write:repository', 'read:user']);
    assert.match(res.stdout, /Scopes: read:issue, write:repository, read:user/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth login rejects --full-scopes together with --scopes before any network call', () => {
  const res = run(['auth', 'login', '--full-scopes', '--scopes', 'read:issue']);
  assert.equal(res.status, 1);
  assert.match(res.stderr, /either --full-scopes or --scopes, not both/);
});

test('issue show validates --number before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['issue', 'show', '-o', 'o', '-r', 'r', '-n', 'zero'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Id must be a positive integer/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('issue comment rejects a missing body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['issue', 'comment', '-o', 'o', '-r', 'r', '-n', '1'], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('issue comment rejects a whitespace-only body before any network call', () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}.json`);
  fs.writeFileSync(cfg, JSON.stringify({ url: 'https://forge.test', token: 'tok' }));
  try {
    const res = run(['issue', 'comment', '-o', 'o', '-r', 'r', '-n', '1', '-b', '   '], { STOKE_CONFIG_FILE: cfg });
    assert.equal(res.status, 1);
    assert.match(res.stderr, /Comment body is required/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('issue comment posts to the issue comments endpoint', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-ic.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    let request = null;
    const server = http.createServer((req, res) => {
      let data = '';
      req.on('data', (c) => { data += c; });
      req.on('end', () => {
        request = { url: req.url, body: data };
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 9, html_url: 'https://forge.test/issues/7#issuecomment-9' }));
      });
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(
          ['issue', 'comment', '-o', 'o', '-r', 'r', '-n', '7', '-b', 'Confirmed.'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve({ res, request }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.res.status, 0, result.res.stderr);
    assert.equal(result.request.url, '/api/v1/repos/o/r/issues/7/comments');
    assert.equal(JSON.parse(result.request.body).body, 'Confirmed.');
    assert.match(result.res.stdout, /Comment added to #7\./);
    assert.match(result.res.stdout, /URL: https:\/\/forge\.test\/issues\/7#issuecomment-9/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('read commands print the raw API JSON with --json', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-json.json`);
  const payloads = {
    '/api/v1/user': { login: 'bot' },
    '/api/v1/user/repos': [{ full_name: 'o/r' }],
    '/api/v1/repos/o/r/issues': [{ number: 7, title: 'Bug' }],
    '/api/v1/repos/o/r/issues/7': { number: 7, title: 'Bug', state: 'open' },
    '/api/v1/repos/o/r/pulls': [{ number: 3, title: 'Fix' }],
    '/api/v1/repos/o/r/pulls/3': { number: 3, title: 'Fix', state: 'open' },
  };
  const commands = [
    [['auth', 'status', '--json'], { login: 'bot' }],
    [['repo', 'list', '--json'], [{ full_name: 'o/r' }]],
    [['issue', 'list', '-o', 'o', '-r', 'r', '--json'], [{ number: 7, title: 'Bug' }]],
    [['issue', 'show', '-o', 'o', '-r', 'r', '-n', '7', '--json'], { number: 7, title: 'Bug', state: 'open' }],
    [['pr', 'list', '-o', 'o', '-r', 'r', '--json'], [{ number: 3, title: 'Fix' }]],
    [['pr', 'show', '-o', 'o', '-r', 'r', '-n', '3', '--json'], { number: 3, title: 'Fix', state: 'open' }],
  ];
  const TIMEOUT_MS = 5000;
  let timer;
  const results = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      const pathname = new URL(req.url, 'http://localhost').pathname;
      const payload = payloads[pathname];
      if (!payload) {
        res.writeHead(404, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ message: `no mock for ${pathname}` }));
        return;
      }
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify(payload));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const out = [];
        for (const [args] of commands) {
          out.push(await spawnAsync(args, { STOKE_CONFIG_FILE: cfg }));
        }
        clearTimeout(timer);
        server.close(() => resolve(out));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    results.forEach((res, i) => {
      const [args, expected] = commands[i];
      assert.equal(res.status, 0, `${args.join(' ')}: ${res.stderr}`);
      assert.deepEqual(JSON.parse(res.stdout), expected);
    });
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('pr review --commit sends commit_id only when given', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-commit.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const bodies = [];
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      let data = '';
      req.on('data', (c) => { data += c; });
      req.on('end', () => {
        bodies.push(JSON.parse(data));
        res.writeHead(200, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ id: 42 }));
      });
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const withCommit = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'approve', '--commit', 'abc123'],
          { STOKE_CONFIG_FILE: cfg },
        );
        const withoutCommit = await spawnAsync(
          ['pr', 'review', '-o', 'o', '-r', 'r', '-n', '7', '--event', 'approve'],
          { STOKE_CONFIG_FILE: cfg },
        );
        clearTimeout(timer);
        server.close(() => resolve({ withCommit, withoutCommit }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.withCommit.status, 0, result.withCommit.stderr);
    assert.equal(result.withoutCommit.status, 0, result.withoutCommit.stderr);
    assert.equal(bodies[0].commit_id, 'abc123');
    assert.ok(!('commit_id' in bodies[1]));
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth status prints the login field instead of undefined', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-status.json`);
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const server = http.createServer((req, res) => {
      res.writeHead(200, { 'Content-Type': 'application/json' });
      res.end(JSON.stringify({ login: 'bot', email: 'bot@forge.test' }));
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok' }));
      try {
        const res = await spawnAsync(['auth', 'status'], { STOKE_CONFIG_FILE: cfg });
        clearTimeout(timer);
        server.close(() => resolve(res));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.status, 0, result.stderr);
    assert.match(result.stdout, /Login:\s+bot/);
    assert.match(result.stdout, /Username:\s+bot/);
    assert.doesNotMatch(result.stdout, /undefined/);
  } finally {
    fs.unlinkSync(cfg);
  }
});

test('auth logout warns that a manually supplied token stays active on the server', () => {
  // tokenId: null is what `auth login -t/--token-file` stores.
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-logout.json`);
  fs.writeFileSync(cfg, JSON.stringify({
    url: 'https://forge.test', login: 'alice', username: 'alice', token: 'tok', tokenId: null,
  }));
  const res = run(['auth', 'logout'], { STOKE_CONFIG_FILE: cfg });
  assert.equal(res.status, 0, res.stderr);
  assert.match(res.stdout, /Settings > Applications/);
  assert.match(res.stdout, /Local credentials removed/);
  assert.equal(fs.existsSync(cfg), false, 'config must be removed');
});

test('repo import-batch fails the item with a missing source token but continues the batch', async () => {
  const cfg = path.join(os.tmpdir(), `stoke-cfg-${process.pid}-batch.json`);
  const manifest = path.join(os.tmpdir(), `stoke-manifest-${process.pid}.json`);
  // A PATH without `gh` and no GITHUB_TOKEN makes token resolution fail for
  // the first (tokenless) GitHub item; the second carries its own token.
  const emptyBin = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-empty-bin-'));
  fs.writeFileSync(manifest, JSON.stringify([
    { name: 'bad', from: 'https://github.com/o/bad.git' },
    { name: 'good', from: 'https://github.com/o/good.git', github_token: 'gh-tok' },
  ]));
  const TIMEOUT_MS = 5000;
  let timer;
  const result = await new Promise((resolve, reject) => {
    const fail = (err) => {
      clearTimeout(timer);
      try { server.close(); } catch { /* already closed */ }
      reject(err instanceof Error ? err : new Error(String(err)));
    };
    const migrated = [];
    const server = http.createServer((req, res) => {
      let data = '';
      req.on('data', (c) => { data += c; });
      req.on('end', () => {
        migrated.push(JSON.parse(data).repo_name);
        res.writeHead(201, { 'Content-Type': 'application/json' });
        res.end(JSON.stringify({ full_name: `o/${JSON.parse(data).repo_name}`, html_url: 'https://forge.test/o/r' }));
      });
    });
    timer = setTimeout(() => fail(new Error('timeout')), TIMEOUT_MS);
    server.listen(0, '127.0.0.1', async () => {
      const { port } = server.address();
      fs.writeFileSync(cfg, JSON.stringify({ url: `http://127.0.0.1:${port}`, token: 'tok', login: 'o' }));
      // Empty PATH hides `gh`; empty GITHUB_TOKEN is falsy for the CLI.
      const env = { STOKE_CONFIG_FILE: cfg, PATH: emptyBin, GITHUB_TOKEN: '' };
      try {
        const res = await spawnAsync(['repo', 'import-batch', '-f', manifest], env);
        clearTimeout(timer);
        server.close(() => resolve({ res, migrated }));
      } catch (err) {
        fail(err);
      }
    });
  }).finally(() => clearTimeout(timer));

  try {
    assert.equal(result.res.status, 1, 'partial batch must exit 1');
    assert.match(result.res.stderr, /Failed to import bad: No GitHub token found/);
    assert.match(result.res.stdout, /Imported: o\/good/);
    assert.match(result.res.stdout, /Batch complete: 1\/2 imported/);
    assert.deepEqual(result.migrated, ['good'], 'only the valid item may reach the server');
  } finally {
    fs.unlinkSync(cfg);
    fs.unlinkSync(manifest);
    fs.rmSync(emptyBin, { recursive: true, force: true });
  }
});