import { describe, expect, test } from "bun:test";
import { spawnSync } from "node:child_process";
import { readFileSync } from "node:fs";
import { createRequire } from "node:module";

import { runAgentRunCommand, agentRunHelpText } from "./agentrun/entry";
import { cicdHelp as branchFollowerHelp, runCicdCommand as runBranchFollowerCommand } from "./cicd-branch-follower";
import { branchFollowerReadOnlyNext } from "./cicd-branch-follower-authority";
import { cicdGiteaActionsPocHelp, runGiteaActionsPocCommand } from "./cicd-gitea-actions-poc";
import { unsupported as unsupportedAgentRunCommand } from "./agentrun/utils";
import {
  PAC_AUTOMATIC_DELIVERY_REFERENCE,
  decideCicdDeliveryMutation,
  gitRepositoryIdentity,
  pacReadOnlyNext,
  readCicdDeliveryAuthorityCatalog,
  resolveCicdDeliveryAuthority,
  resolveCicdDeliveryAuthorityFromCatalog,
  type CicdDeliveryAuthorityCatalog,
} from "./cicd-delivery-authority";
import { hwlabNodeHelp } from "./hwlab-node-help";
import { runHwlabNodeCommand } from "./hwlab-node/entry";
import {
  guardedSentinelDeliveryAction,
  runWebProbeSentinelCommand,
  webProbeSentinelDeliveryAuthorityFromCatalog,
} from "./hwlab-node-web-sentinel-cicd";
import { parseNodeScopedDelegatedOptions } from "./hwlab-node/plan";
import { parseNodeWebProbeSentinelOptions } from "./hwlab-node/web-probe-observe";
import { nodeRuntimeVisiblePipelineRunDiagnostics, summarizeNodeRuntimeControlPlaneStatus } from "./hwlab-node/render";
import { renderControlPlaneResult, renderPublishCurrentResult } from "./hwlab-node-web-sentinel-cicd-shared";
import { resolvePacHistoryConsumerSelection, runPlatformInfraPipelinesAsCodeCommand } from "./platform-infra-pipelines-as-code";
import { giteaHelp, runPlatformInfraGiteaCommand } from "./platform-infra-gitea";
import { platformInfraHelp } from "./platform-infra/entry";
import {
  authorizeSentinelPacInternalPublish,
  readSentinelPacInternalPublishCapability,
  type SentinelPacInternalPublishCapability,
} from "./sentinel-pac-execution-context";
import type { BranchFollowerRegistry, FollowerSpec, ParsedOptions } from "./cicd-types";

const mutationCommand = /\b(?:apply|closeout|trigger-current|refresh|sync|flush|webhook-test)\b/u;
const pacEvaluator = createRequire(import.meta.url)("../native/cicd/pac-status-evaluator.cjs") as {
  classifyPacPipelineRun: (consumer: Record<string, unknown>, item: Record<string, unknown>) => Record<string, unknown>;
};

describe("YAML 组合的 CI/CD delivery authority", () => {
  test("组合 PaC 与 Gitea YAML，覆盖所有实际 consumer 且 id 唯一", () => {
    const catalog = readCicdDeliveryAuthorityCatalog();
    expect(catalog.consumers).toHaveLength(8);
    expect(new Set(catalog.consumers.map((item) => item.consumerId)).size).toBe(8);
    for (const consumerId of ["agentrun-nc01-v02", "hwlab-nc01-v03", "sentinel-nc01-v03", "unidesk-host", "platform-infra-gitea-nc01"]) {
      const authority = resolveCicdDeliveryAuthority({ consumerId });
      expect(authority.kind).toBe("pac-pr-merge");
      expect(authority.mutationHintsAllowed).toBe(false);
    }
  });

  test("repository identity 从通用 Git remote 解析，不依赖仓库特例", () => {
    expect(gitRepositoryIdentity("git@github.com:acme/widgets.git")).toBe("acme/widgets");
    expect(gitRepositoryIdentity("https://example.test/acme/widgets.git")).toBe("acme/widgets");
    expect(gitRepositoryIdentity("not-a-repository")).toBeNull();
  });

  test("未知、冲突和歧义 authority 均 fail-closed", () => {
    expect(resolveCicdDeliveryAuthority({ node: "NC01", lane: "v03" })).toMatchObject({
      kind: "unknown",
      reason: "authority-ambiguous",
      mutationHintsAllowed: false,
    });
    expect(resolveCicdDeliveryAuthority({ consumerId: "hwlab-nc01-v03", node: "JD01" })).toMatchObject({
      kind: "unknown",
      reason: "authority-identity-mismatch",
      mutationHintsAllowed: false,
    });
    expect(resolveCicdDeliveryAuthority({ declaredSourceAuthorityMode: "giteaSnapshot", declaredConfigRef: "fixture.yaml" })).toMatchObject({
      kind: "unknown",
      reason: "authority-not-declared",
      mutationHintsAllowed: false,
    });
    expect(resolveCicdDeliveryAuthority({
      node: "NC01",
      lane: "nc01-v02",
      sourceRepository: "acme/drifted",
      sourceBranch: "v0.2",
      declaredSourceAuthorityMode: "gitMirrorSnapshot",
      declaredConfigRef: "config/agentrun.yaml",
    })).toMatchObject({
      kind: "unknown",
      reason: "authority-identity-mismatch",
      mutationHintsAllowed: false,
    });
  });

  test("只有显式 legacy-manual authority 允许旧 mutation 实现", () => {
    const catalog: CicdDeliveryAuthorityCatalog = {
      consumers: [{
        consumerId: "arbitrary-pac",
        node: "NODE-A",
        lane: "lane-a",
        namespace: "ci-a",
        pipelineRunPrefix: "widgets-a-",
        repositoryRef: "repo-a",
        sourceRepository: "acme/widgets",
        sourceBranch: "main",
        sourceSnapshotPrefix: "refs/unidesk/snapshots/widgets/main",
        giteaOwner: "mirrors",
        giteaRepository: "acme-widgets",
        giteaRepositoryUrl: "https://gitea.example.test/mirrors/acme-widgets",
        pacControllerVersion: "v0.48.0",
        configRefs: ["pac.yaml", "gitea.yaml"],
      }],
      configRefs: ["pac.yaml", "gitea.yaml"],
    };
    const legacy = resolveCicdDeliveryAuthorityFromCatalog(catalog, {
      node: "NODE-B",
      lane: "lane-b",
      sourceRepository: "acme/legacy",
      sourceBranch: "release",
      declaredSourceAuthorityMode: "gitMirrorSnapshot",
      declaredConfigRef: "legacy-lanes.yaml",
    });
    expect(legacy).toMatchObject({ kind: "legacy-manual", mutationHintsAllowed: true });
    expect(decideCicdDeliveryMutation(legacy, {
      command: "fixture trigger-current",
      statusCommand: "fixture status",
      action: "trigger-current",
      node: "NODE-B",
      lane: "lane-b",
    })).toMatchObject({ allowed: true });
  });

  test("只读 Next 只有 status/history 和稳定自动链修复引用", () => {
    const next = pacReadOnlyNext("NC01", "hwlab-nc01-v03");
    expect(Object.keys(next).sort()).toEqual(["fixAutomaticDelivery", "history", "status", "valuesPrinted"]);
    expect(JSON.stringify(next)).not.toMatch(mutationCommand);
    expect(PAC_AUTOMATIC_DELIVERY_REFERENCE).toBe("docs/reference/platform-infra.md#gitea-与-pipelines-as-code-边界");
    expect(PAC_AUTOMATIC_DELIVERY_REFERENCE).not.toContain("issues/");
  });
});

describe("migrated CLI 执行 guard 与提示清理", () => {
  test("AgentRun migrated trigger/refresh/mirror mutation 在远端调用前结构化拒绝", async () => {
    const commands = [
      ["control-plane", "trigger-current", "--node", "NC01", "--lane", "nc01-v02", "--confirm"],
      ["control-plane", "refresh", "--node", "NC01", "--lane", "nc01-v02", "--confirm"],
      ["git-mirror", "sync", "--node", "NC01", "--lane", "nc01-v02", "--confirm", "--wait"],
      ["git-mirror", "flush", "--node", "NC01", "--lane", "nc01-v02", "--confirm", "--wait"],
    ];
    for (const args of commands) {
      const result = await runAgentRunCommand({} as never, args) as Record<string, unknown>;
      expect(result).toMatchObject({ ok: false, mode: "pac-pr-merge-mutation-blocked", mutation: false });
      expect(JSON.stringify(result.next)).not.toMatch(mutationCommand);
    }
  });

  test("HWLAB migrated delivery mutation 在异步 job 创建前结构化拒绝", async () => {
    const commands = [
      ["control-plane", "trigger-current", "--node", "NC01", "--lane", "v03", "--confirm"],
      ["control-plane", "refresh", "--node", "NC01", "--lane", "v03", "--confirm"],
      ["control-plane", "sync", "--node", "NC01", "--lane", "v03", "--confirm"],
      ["control-plane", "source-workspace", "sync", "--node", "NC01", "--lane", "v03", "--confirm"],
      ["git-mirror", "sync", "--node", "NC01", "--lane", "v03", "--confirm", "--wait"],
      ["git-mirror", "flush", "--node", "NC01", "--lane", "v03", "--confirm", "--wait"],
    ];
    for (const args of commands) {
      const result = await runHwlabNodeCommand({} as never, args) as Record<string, unknown>;
      expect(result).toMatchObject({ ok: false, mode: "pac-pr-merge-mutation-blocked", mutation: false });
      expect(JSON.stringify(result.next)).not.toMatch(mutationCommand);
    }
  });

  test("Web sentinel migrated delivery mutation 在 state load 和异步 job 前拒绝", () => {
    const spec = parseNodeScopedDelegatedOptions("control-plane", ["status", "--node", "NC01", "--lane", "v03"]).spec;
    const sourceOverride = { sourceCommit: null, sourceStageRef: null, sourceMirrorCommit: null, sourceAuthority: null };
    const commands = [
      { kind: "image", action: "build", node: "NC01", lane: "v03", sentinelId: null, dryRun: true, confirm: false, wait: false, timeoutSeconds: 30, sourceOverride },
      { kind: "control-plane", action: "trigger-current", node: "NC01", lane: "v03", sentinelId: null, dryRun: true, confirm: false, wait: false, timeoutSeconds: 30, rerun: false, manualRecovery: false, reason: null, sourceOverride },
      { kind: "publish", action: "publish-current", node: "NC01", lane: "v03", sentinelId: null, dryRun: true, confirm: false, wait: false, timeoutSeconds: 30, rerun: false, manualRecovery: true, reason: "explicit recovery", sourceOverride },
    ];
    for (const options of commands) {
      const result = runWebProbeSentinelCommand(spec, options as never) as unknown as Record<string, unknown>;
      expect(result).toMatchObject({ ok: false, mode: "pac-pr-merge-mutation-blocked", mutation: false });
      expect(Object.keys(result.next as Record<string, unknown>).sort()).toEqual([
        "controlPlaneStatus",
        "fixAutomaticDelivery",
        "history",
        "pacHistory",
        "pacStatus",
        "status",
      ]);
      expect(JSON.stringify(result.next)).not.toMatch(mutationCommand);
    }
  });

  test("Web sentinel 稳定 PaC consumer 漂移或缺失时保持 unknown，不降级为 legacy", () => {
    const spec = parseNodeScopedDelegatedOptions("control-plane", ["status", "--node", "NC01", "--lane", "v03"]).spec;
    const catalog = readCicdDeliveryAuthorityCatalog();
    const consumerId = "sentinel-nc01-v03";
    const drifted: CicdDeliveryAuthorityCatalog = {
      ...catalog,
      consumers: catalog.consumers.map((consumer) => consumer.consumerId === consumerId
        ? { ...consumer, node: "DRIFTED" }
        : consumer),
    };
    const missing: CicdDeliveryAuthorityCatalog = {
      ...catalog,
      consumers: catalog.consumers.filter((consumer) => consumer.consumerId !== consumerId),
    };
    for (const fixture of [drifted, missing]) {
      const authority = webProbeSentinelDeliveryAuthorityFromCatalog(spec, fixture);
      expect(authority).toMatchObject({ kind: "unknown", mutationHintsAllowed: false });
      const decision = decideCicdDeliveryMutation(authority, {
        command: "web-probe sentinel publish-current",
        statusCommand: "web-probe sentinel control-plane status",
        action: "sentinel-publish-current",
        node: spec.nodeId,
        lane: spec.lane,
      });
      expect(decision).toMatchObject({ allowed: false });
      if (!decision.allowed) expect(JSON.stringify(decision.result.next)).not.toMatch(mutationCommand);
    }
  });

  test("Web sentinel 内部 publish capability 默认关闭，启用后仍因 admission provenance 缺失而拒绝", () => {
    const authority = resolveCicdDeliveryAuthority({ consumerId: "sentinel-nc01-v03" });
    expect(authority.kind).toBe("pac-pr-merge");
    const options = {
      kind: "publish",
      action: "publish-current",
      node: "NC01",
      lane: "v03",
      sentinelId: "nc01-web-probe-sentinel",
      dryRun: false,
      confirm: true,
      wait: true,
      timeoutSeconds: 180,
      rerun: false,
      manualRecovery: false,
      reason: null,
      internalExecution: "pac-controller",
      sourceOverride: { sourceCommit: "a".repeat(40), sourceStageRef: null, sourceMirrorCommit: null, sourceAuthority: "gitea-snapshot" },
    } as const;
    const capability = readSentinelPacInternalPublishCapability();
    expect(capability).toMatchObject({ enabled: false, admissionProvenance: "unavailable" });
    expect(authorizeSentinelPacInternalPublish(options, authority, capability)).toMatchObject({
      allowed: false,
      reason: "capability-disabled",
    });
    const enabled: SentinelPacInternalPublishCapability = { ...capability, enabled: true };
    expect(authorizeSentinelPacInternalPublish(options, authority, enabled)).toMatchObject({
      allowed: false,
      reason: "admission-provenance-unavailable",
    });
    expect(authorizeSentinelPacInternalPublish({ ...options, internalExecution: null }, authority, enabled)).toMatchObject({
      allowed: false,
      reason: "operator-entrypoint",
    });
  });

  test("Web sentinel 保持旧自动入口，不把 default SA、Pod env 或可写 metadata 当 creator proof", () => {
    const pacYaml = readFileSync("config/platform-infra/pipelines-as-code.yaml", "utf8");
    expect(pacYaml).toContain("sentinelInternalPublish:");
    expect(pacYaml).toContain("enabled: false");
    expect(pacYaml).toContain("issues/1769");
    expect(pacYaml).toContain("service_account: default");
    for (const node of ["jd01", "nc01"] as const) {
      const source = readFileSync(`.tekton/web-probe-sentinel-${node}-pac.yaml`, "utf8");
      expect(source).toContain("serviceAccountName: default");
      expect(source).toContain("web-probe sentinel publish-current \\");
      expect(source).not.toContain("pac-publish-current");
      expect(source).not.toContain("UNIDESK_PAC_INTERNAL_ENTRYPOINT");
      expect(source).not.toContain("UNIDESK_PAC_POD_UID");
    }
    const parsed = parseNodeWebProbeSentinelOptions([
      "pac-publish-current",
      "--node", "NC01",
      "--lane", "v03",
      "--sentinel", "nc01-web-probe-sentinel",
      "--confirm",
      "--wait",
      "--source-commit", "a".repeat(40),
      "--source-stage-ref", `refs/unidesk/snapshots/gitea-actions/unidesk-master-nc01/${"a".repeat(40)}`,
      "--source-authority", "gitea-snapshot",
    ]);
    expect(parsed.sentinel).toMatchObject({ kind: "publish", internalExecution: "pac-controller", manualRecovery: false });
  });

  test("PaC 外层事件与内层 deterministic publish 分开归类，只有外层可驱动 delivery", () => {
    const consumer = { repository: "sentinel-nc01-v03", pipelineRunPrefix: "hwlab-web-probe-sentinel-nc01-", pipeline: "hwlab-web-probe-sentinel-nc01" };
    const outer = {
      metadata: {
        name: "hwlab-web-probe-sentinel-nc01-9h49j",
        labels: {
          "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
          "pipelinesascode.tekton.dev/event-type": "push",
          "pipelinesascode.tekton.dev/repository": "sentinel-nc01-v03",
        },
        annotations: { "pipelinesascode.tekton.dev/git-provider": "gitea" },
      },
    };
    const inner = {
      metadata: {
        name: "hwlab-web-probe-sentinel-nc01-web-probe-sentinel-b125fb358d46",
        labels: {
          "app.kubernetes.io/part-of": "hwlab-web-probe-sentinel",
          "unidesk.ai/ci-system": "tekton",
        },
        annotations: {
          "unidesk.ai/source-authority": "gitea-snapshot",
          "unidesk.ai/publish-gitops": "true",
        },
      },
    };
    expect(pacEvaluator.classifyPacPipelineRun(consumer, outer)).toMatchObject({
      deliveryClass: "outer-pac-event",
      deliveryAuthorityEligible: true,
      admissionProvenanceVerified: false,
      metadataObservationOnly: true,
    });
    expect(pacEvaluator.classifyPacPipelineRun(consumer, inner)).toMatchObject({
      deliveryClass: "inner-deterministic-publish",
      deliveryAuthorityEligible: false,
      parentPipelineRun: null,
      parentRelation: "unproven",
    });

    const catalog = readCicdDeliveryAuthorityCatalog();
    for (const consumerId of ["agentrun-nc01-v02", "hwlab-nc01-v03", "sentinel-nc01-v03", "unidesk-host"]) {
      const configured = catalog.consumers.find((item) => item.consumerId === consumerId);
      if (configured === undefined) throw new Error(`missing classification fixture ${consumerId}`);
      const classified = pacEvaluator.classifyPacPipelineRun({
        repository: configured.repositoryRef,
        pipelineRunPrefix: configured.pipelineRunPrefix,
      }, {
        metadata: {
          name: `${configured.pipelineRunPrefix}-outer-fixture`,
          labels: {
            "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
            "pipelinesascode.tekton.dev/event-type": "push",
            "pipelinesascode.tekton.dev/repository": configured.repositoryRef,
          },
          annotations: { "pipelinesascode.tekton.dev/git-provider": "gitea" },
        },
      });
      expect(classified).toMatchObject({ deliveryClass: "outer-pac-event", deliveryAuthorityEligible: true });
    }
  });

  test("Web sentinel 业务观测和仪表盘动作不被 delivery guard 误阻断", () => {
    for (const options of [
      { kind: "dashboard", action: "trigger" },
      { kind: "validate", action: "validate" },
      { kind: "maintenance", action: "status" },
      { kind: "control-plane", action: "status" },
      { kind: "image", action: "status" },
    ]) {
      expect(guardedSentinelDeliveryAction(options as never)).toBeNull();
    }
  });

  test("HWLAB degraded summary 不再返回 flush 或 triggerCurrent", () => {
    const scoped = parseNodeScopedDelegatedOptions("control-plane", ["status", "--node", "NC01", "--lane", "v03"]);
    const summary = summarizeNodeRuntimeControlPlaneStatus({ ok: false, degradedReason: "git-mirror-pending-flush" }, scoped);
    expect(summary.nextAction).toBe("bun scripts/cli.ts platform-infra pipelines-as-code status --target NC01 --consumer hwlab-nc01-v03");
    expect(summary.next).not.toHaveProperty("triggerCurrent");
    expect(summary.next).not.toHaveProperty("gitMirrorFlush");
    expect(JSON.stringify(summary.next)).not.toMatch(mutationCommand);
  });

  test("HWLAB migrated PipelineRun diagnostics 不泄漏 rerun Next 或文本提示", () => {
    const authority = resolveCicdDeliveryAuthority({ consumerId: "hwlab-nc01-v03" });
    const diagnostics = nodeRuntimeVisiblePipelineRunDiagnostics({
      failureSummary: { nextAction: "choose controlled rerun" },
      next: { rerun: "bun scripts/cli.ts hwlab nodes control-plane trigger-current --confirm --rerun" },
    }, authority);
    expect(diagnostics?.next).toBeNull();
    expect(JSON.stringify(diagnostics)).not.toContain("trigger-current");
    expect(JSON.stringify(diagnostics)).not.toContain("controlled rerun");
    expect(JSON.stringify(diagnostics)).toContain("不得人工 rerun");
  });

  test("默认 help 只暴露观察入口，legacy/platform 写入口只在 scoped help", async () => {
    const agentRunDefault = agentRunHelpText(["control-plane", "--help"]);
    const hwlabDefault = JSON.stringify(hwlabNodeHelp());
    const pacDefault = JSON.stringify(await runPlatformInfraPipelinesAsCodeCommand({} as never, ["help"]));
    const giteaDefault = JSON.stringify(giteaHelp());
    expect(agentRunDefault).not.toMatch(mutationCommand);
    expect(hwlabDefault).not.toMatch(mutationCommand);
    expect(pacDefault).not.toMatch(mutationCommand);
    expect(giteaDefault).not.toMatch(mutationCommand);
    expect(agentRunHelpText(["control-plane", "legacy-cicd", "--help"])).toContain("trigger-current");
    expect(JSON.stringify(hwlabNodeHelp("legacy-cicd"))).toContain("git-mirror flush");
    expect(JSON.stringify(await runPlatformInfraPipelinesAsCodeCommand({} as never, ["help", "platform-bootstrap"]))).toContain("pipelines-as-code apply");
    expect(JSON.stringify(giteaHelp("platform-bootstrap"))).toContain("platform-infra gitea apply");
  });

  test("所有 PaC consumer 与 AgentRun/HWLAB plan 均只返回 authority-aware 只读 Next", async () => {
    const results = [
      await runAgentRunCommand({} as never, ["control-plane", "plan", "--node", "NC01", "--lane", "nc01-v02", "--raw"]),
      await runHwlabNodeCommand({} as never, ["control-plane", "plan", "--node", "NC01", "--lane", "v03", "--raw"]),
      ...await Promise.all(readCicdDeliveryAuthorityCatalog().consumers.map((consumer) => (
        runPlatformInfraPipelinesAsCodeCommand({} as never, ["plan", "--target", consumer.node, "--consumer", consumer.consumerId, "--raw"])
      ))),
    ] as Record<string, unknown>[];
    for (const result of results) {
      const next = result.next as Record<string, unknown>;
      expect(Object.keys(next).sort()).toEqual(["fixAutomaticDelivery", "history", "status", "valuesPrinted"]);
      expect(JSON.stringify(next)).not.toMatch(mutationCommand);
    }
  });

  test("Gitea 与 mirror 默认 plan 只返回只读 Next", async () => {
    const plans = [
      await runPlatformInfraGiteaCommand({} as never, ["plan", "--target", "NC01", "--raw"]),
      await runPlatformInfraGiteaCommand({} as never, ["mirror", "plan", "--target", "NC01", "--raw"]),
    ] as Record<string, unknown>[];
    for (const plan of plans) {
      expect(plan.mutation).toBe(false);
      expect(JSON.stringify(plan.next)).not.toMatch(mutationCommand);
      expect(JSON.stringify(plan.next)).toContain("status");
      expect(JSON.stringify(plan.next)).toContain(PAC_AUTOMATIC_DELIVERY_REFERENCE);
    }
  });

  test("PaC history detail 只按唯一 consumer 生成 Next，四类前缀无默认 consumer 回退", () => {
    const ids = ["sentinel-nc01-v03", "unidesk-host", "agentrun-nc01-v02", "hwlab-nc01-v03"];
    const consumers = readCicdDeliveryAuthorityCatalog().consumers.filter((consumer) => ids.includes(consumer.consumerId)).map((consumer) => ({
      id: consumer.consumerId,
      node: consumer.node,
      pipelineRunPrefix: consumer.pipelineRunPrefix,
    }));
    for (const consumer of consumers) {
      const detailId = `${consumer.pipelineRunPrefix}-fixture`;
      expect(resolvePacHistoryConsumerSelection(consumers, "NC01", null, detailId)).toEqual({
        selectedConsumerIds: [consumer.id],
        nextConsumerId: consumer.id,
      });
    }
    expect(() => resolvePacHistoryConsumerSelection(consumers, "NC01", null, "no-matching-pipelinerun")).toThrow("matched 0");
    expect(() => resolvePacHistoryConsumerSelection([
      { id: "a", node: "NC01", pipelineRunPrefix: "overlap-" },
      { id: "b", node: "NC01", pipelineRunPrefix: "overlap-run" },
    ], "NC01", null, "overlap-run-1")).toThrow("matched 2");
    expect(() => resolvePacHistoryConsumerSelection(consumers, "NC01", "hwlab-nc01-v03", "hwlab-web-probe-sentinel-nc01-fixture")).toThrow("belongs to sentinel-nc01-v03");
  });

  test("PaC、HWLAB scoped help 的真实 CLI 路由可达且默认入口不泄漏 delivery mutation", () => {
    const pacDefault = runCliJson(["platform-infra", "pipelines-as-code", "--help"]);
    const pacBootstrap = runCliJson(["platform-infra", "pipelines-as-code", "help", "platform-bootstrap"]);
    const pacCompatibility = runCliJson(["platform-infra", "pipelines-as-code", "help", "compatibility-diagnostics"]);
    const hwlabPlatform = runCliJson(["hwlab", "nodes", "control-plane", "platform-maintenance", "--help"]);
    const hwlabLegacy = runCliJson(["hwlab", "nodes", "control-plane", "legacy-cicd", "--help"]);
    expect(JSON.stringify(pacDefault.data)).not.toMatch(mutationCommand);
    expect(JSON.stringify(pacBootstrap.data)).toContain("pipelines-as-code apply");
    expect(JSON.stringify(pacCompatibility.data)).not.toMatch(/webhook-test|trigger-current|\bsync\b|\bflush\b|apply --/u);
    expect((hwlabPlatform.data as Record<string, unknown>).command).toBe("hwlab nodes control-plane platform-maintenance");
    expect((hwlabLegacy.data as Record<string, unknown>).command).toBe("hwlab nodes control-plane legacy-cicd");
  });

  test("PaC webhook-test 已从公开路由与远端执行器移除", async () => {
    const result = await runPlatformInfraPipelinesAsCodeCommand({} as never, ["webhook-test", "--target", "NC01", "--confirm"]) as Record<string, unknown>;
    expect(result).toMatchObject({ ok: false, error: "unsupported-platform-infra-pipelines-as-code-command" });
    expect(JSON.stringify(result.help)).not.toContain("webhook-test");
    expect(readFileSync("scripts/src/platform-infra-pipelines-as-code-remote.sh", "utf8")).not.toContain("webhook-test");
  });

  test("Gitea webhook-test 已从公开路由与远端执行器移除", async () => {
    const result = await runPlatformInfraGiteaCommand({} as never, ["mirror", "webhook", "test", "--target", "NC01", "--confirm"]) as Record<string, unknown>;
    expect(result).toMatchObject({ ok: false, error: "unsupported-platform-infra-gitea-mirror-webhook-command" });
    expect(readFileSync("scripts/src/platform-infra-gitea-remote.sh", "utf8")).not.toContain("mirror-webhook-test");
  });

  test("Sentinel migrated 文本输出只渲染实际只读 status/history/fix，不打印空 mutation 标签", () => {
    const next = {
      status: "bun scripts/cli.ts web-probe sentinel control-plane status --node NC01 --lane v03",
      history: "bun scripts/cli.ts platform-infra pipelines-as-code history --target NC01 --consumer sentinel-nc01-v03",
      fixAutomaticDelivery: PAC_AUTOMATIC_DELIVERY_REFERENCE,
    };
    for (const renderedText of [
      renderPublishCurrentResult({ command: "fixture publish", ok: false, next }),
      renderControlPlaneResult({ command: "fixture status", ok: false, next }),
    ]) {
      expect(renderedText).toContain("status:");
      expect(renderedText).toContain("history:");
      expect(renderedText).toContain("fix-automatic-delivery:");
      expect(renderedText).not.toMatch(/pac-closeout:|manual-recovery:|trigger-current:|apply:|sync:|flush:/u);
    }
  });

  test("retired branch-follower 写操作和默认 cleanup 在任何远端执行前结构化拒绝", async () => {
    const commands = [
      ["branch-follower", "apply", "--confirm", "--json"],
      ["branch-follower", "run-once", "--follower", "hwlab-jd01-v03", "--confirm", "--wait", "--json"],
      ["branch-follower", "job", "--follower", "agentrun-jd01-v02", "--job", "image-build", "--json"],
      ["branch-follower", "gate", "--follower", "hwlab-jd01-v03", "--gate", "runtime-closeout", "--confirm", "--json"],
      ["branch-follower", "debug-step", "--follower", "web-probe-sentinel-master", "--step", "state-write", "--confirm", "--json"],
      ["branch-follower", "cleanup-state", "--all", "--confirm", "--json"],
    ];
    for (const args of commands) {
      const rendered = await runBranchFollowerCommand(null, args);
      const payload = JSON.parse(rendered.renderedText) as Record<string, unknown>;
      expect(payload).toMatchObject({ ok: false, mutation: false });
      expect(JSON.stringify(payload.next)).not.toMatch(mutationCommand);
    }
    const forged = await runBranchFollowerCommand(null, ["branch-follower", "legacy-cicd", "apply", "--config", "/tmp/forged-legacy.yaml", "--confirm", "--json"]);
    expect(JSON.parse(forged.renderedText)).toMatchObject({
      ok: false,
      mutation: false,
      mode: "noncanonical-branch-follower-config-mutation-blocked",
    });
    expect(Object.keys((JSON.parse(forged.renderedText) as { next: Record<string, unknown> }).next).sort()).toEqual([
      "fixAutomaticDelivery",
      "status",
      "valuesPrinted",
    ]);
    await expect(runBranchFollowerCommand(null, ["branch-follower", "plan", "--json"])).rejects.toThrow("default surface is read-only");
  });

  test("branch-follower unknown 与多 node scope 不猜测 JD01 PaC 入口", () => {
    const options = { followerId: null } as ParsedOptions;
    const unknownRegistry = {
      followers: [{
        id: "unknown-fixture",
        deliveryAuthority: "unknown",
        source: { repository: "acme/unknown", branch: "main" },
        target: { node: "NODE-X", lane: "lane-x" },
      } as FollowerSpec],
    } as BranchFollowerRegistry;
    const unknownNext = branchFollowerReadOnlyNext(unknownRegistry, options);
    expect(Object.keys(unknownNext).sort()).toEqual(["events", "fixAutomaticDelivery", "logs", "status", "valuesPrinted"]);
    expect(JSON.stringify(unknownNext)).not.toContain("JD01");

    const catalog = readCicdDeliveryAuthorityCatalog();
    const consumers = ["hwlab-jd01-v03", "hwlab-nc01-v03"].map((id) => {
      const consumer = catalog.consumers.find((item) => item.consumerId === id);
      if (consumer === undefined) throw new Error(`missing fixture consumer ${id}`);
      return {
        id: `${id}-retired-follower`,
        deliveryAuthority: "retired-readonly",
        source: { repository: consumer.sourceRepository, branch: consumer.sourceBranch },
        target: { node: consumer.node, lane: consumer.lane },
      } as FollowerSpec;
    });
    const multiNodeNext = branchFollowerReadOnlyNext({ followers: consumers } as BranchFollowerRegistry, options);
    expect(Object.keys(multiNodeNext).sort()).toEqual(["events", "fixAutomaticDelivery", "logs", "status", "valuesPrinted"]);
    expect(JSON.stringify(multiNodeNext)).not.toContain("--target JD01");
  });

  test("retired branch-follower 与 Gitea Actions POC 默认帮助只读", async () => {
    expect(JSON.stringify(branchFollowerHelp())).not.toMatch(mutationCommand);
    expect(JSON.stringify(cicdGiteaActionsPocHelp())).not.toMatch(mutationCommand);
    await expect(runGiteaActionsPocCommand(null, ["apply"])).rejects.toThrow("intentionally unavailable");
  });

  test("platform-infra 默认 delivery 帮助和 AgentRun 失败帮助不暴露人工推进", () => {
    const platformHelp = platformInfraHelp() as { usage: string[] };
    const deliveryUsage = platformHelp.usage.filter((line) => line.includes("gitea") || line.includes("pipelines-as-code"));
    expect(JSON.stringify(deliveryUsage)).not.toMatch(mutationCommand);
    expect(deliveryUsage).toContain("bun scripts/cli.ts platform-infra gitea mirror webhook status --target NC01");
    expect(deliveryUsage).toContain("bun scripts/cli.ts platform-infra pipelines-as-code help platform-bootstrap");
    const agentRunOperations = unsupportedAgentRunCommand(["unexpected"]).renderedText.split("Operations:")[1] ?? "";
    expect(agentRunOperations).not.toMatch(mutationCommand);
    const root = runCliJson(["--help"]);
    expect(JSON.stringify(root)).not.toMatch(/platform-infra gitea apply|platform-infra gitea mirror sync/u);
  });
});

function runCliJson(args: string[]): { ok: boolean; command: string; data: unknown } {
  const result = spawnSync("bun", ["scripts/cli.ts", ...args], {
    cwd: process.cwd(),
    encoding: "utf8",
    timeout: 15_000,
  });
  if (result.status !== 0) throw new Error(`CLI ${args.join(" ")} failed: ${result.stderr}`);
  return JSON.parse(result.stdout) as { ok: boolean; command: string; data: unknown };
}