#!/usr/bin/env bash
# Isolated live verification for CodexBar #1844 / PR #1848.
# Uses only synthetic credentials under a disposable HOME and keychain.
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"

log() { printf '[verify-1844] %s\n' "$*"; }

ARTIFACT="$(mktemp -d "${TMPDIR:-/tmp}/codexbar-1844-verify.XXXXXX")"
chmod 700 "$ARTIFACT"
HOME_FIXTURE="$ARTIFACT/home"
KEYCHAIN="$ARTIFACT/claude-fixture.keychain-db"
KEYCHAIN_PASSWORD="codexbar-1844-synthetic-fixture"
CONFIG="$ARTIFACT/config.json"
CLI="${CODEXBAR_CLI:-$ROOT/CodexBar.app/Contents/Helpers/CodexBarCLI}"
APP="${CODEXBAR_APP_BINARY:-$ROOT/CodexBar.app/Contents/MacOS/CodexBar}"
MCP_PAYLOAD='{"mcpOAuth":{"plugin:synthetic":{"accessToken":"synthetic-mcp-token"}}}'
EXPIRED_PAYLOAD='{"claudeAiOauth":{"accessToken":"synthetic-expired-token","expiresAt":1000,"scopes":["user:profile"],"refreshToken":"synthetic-refresh-token"}}'

if [[ ! -x "$CLI" ]]; then
  log "Missing packaged CLI: $CLI"
  log "Run ./Scripts/package_app.sh, then retry."
  exit 2
fi
if [[ ! -x "$APP" ]]; then
  log "Missing packaged app binary: $APP"
  exit 2
fi

cleanup() {
  /usr/bin/security delete-keychain "$KEYCHAIN" >/dev/null 2>&1 || true
}
trap cleanup EXIT

log "Artifacts: $ARTIFACT"
log "Phase 1: focused integration tests"
{
  swift test --filter ClaudeOAuthTests
  swift test --filter ClaudeUsageTests
  swift test --filter ClaudeOAuthDelegatedRefreshCoordinatorTests
  swift test --filter 'expired claude CLI owner blocks background'
  swift test --filter ClaudeOAuthCredentialsStoreSecurityCLITests
  swift test --filter ClaudeOAuthCredentialsStoreIsolatedSecurityCLITests
  swift test --filter ClaudeOAuthCredentialsStoreMCPOnlyGuardTests
} 2>&1 | tee "$ARTIFACT/integration-tests.log"
log "Phase 1 passed"

log "Phase 2: disposable HOME, keychain, credentials, config, and Claude CLI canary"
mkdir -p "$HOME_FIXTURE/.claude" "$HOME_FIXTURE/Library/Preferences" "$ARTIFACT/bin"
chmod 700 "$HOME_FIXTURE" "$HOME_FIXTURE/.claude" "$HOME_FIXTURE/Library" \
  "$HOME_FIXTURE/Library/Preferences" "$ARTIFACT/bin"
printf '%s\n' "$EXPIRED_PAYLOAD" >"$HOME_FIXTURE/.claude/.credentials.json"
chmod 600 "$HOME_FIXTURE/.claude/.credentials.json"
printf '%s\n' '{"version":1,"providers":[{"id":"claude","enabled":true,"source":"oauth"}]}' >"$CONFIG"
chmod 600 "$CONFIG"
printf '%s\n' \
  '#!/usr/bin/env bash' \
  'printf "args:" >>"$CODEXBAR_CLAUDE_INVOCATIONS"' \
  'printf " %q" "$@" >>"$CODEXBAR_CLAUDE_INVOCATIONS"' \
  'printf "\\n" >>"$CODEXBAR_CLAUDE_INVOCATIONS"' \
  'if [[ "$*" == "auth status --json" ]]; then printf "{\"loggedIn\":true}\\n"; exit 0; fi' \
  'if [[ "$*" == "--version" ]]; then printf "2.1.0\\n"; exit 0; fi' \
  'if IFS= read -r line; then' \
  '  printf "stdin:%s\\n" "$line" >>"$CODEXBAR_CLAUDE_INVOCATIONS"' \
  '  if [[ "$line" == *"/status"* ]]; then printf touched >"$CODEXBAR_CLAUDE_TOUCH_CANARY"; fi' \
  'fi' \
  'exit 99' \
  >"$ARTIFACT/bin/claude"
printf '%s\n' \
  '#!/usr/bin/env bash' \
  'printf touched >"$CODEXBAR_OPEN_TOUCH_CANARY"' \
  'exit 99' \
  >"$ARTIFACT/bin/open"
chmod 700 "$ARTIFACT/bin/claude" "$ARTIFACT/bin/open"

/usr/bin/security list-keychains -d user >"$ARTIFACT/keychains-before.txt"
/usr/bin/security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
/usr/bin/security set-keychain-settings -t 3600 "$KEYCHAIN"
/usr/bin/security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN"
/usr/bin/security add-generic-password \
  -a codexbar-verify-1844 \
  -s 'Claude Code-credentials' \
  -w "$MCP_PAYLOAD" \
  -A \
  "$KEYCHAIN"
/usr/bin/security list-keychains -d user >"$ARTIFACT/keychains-after.txt"
if ! cmp -s "$ARTIFACT/keychains-before.txt" "$ARTIFACT/keychains-after.txt"; then
  log "Phase 2 failed: creating the disposable keychain changed the user search list"
  exit 1
fi
/usr/bin/security find-generic-password \
  -s 'Claude Code-credentials' \
  -w \
  "$KEYCHAIN" >"$ARTIFACT/keychain-fixture.json"
cmp -s "$ARTIFACT/keychain-fixture.json" <(printf '%s\n' "$MCP_PAYLOAD")

PROC_LOG="$ARTIFACT/e2e-processes.log"
STDOUT="$ARTIFACT/e2e-stdout.json"
STDERR="$ARTIFACT/e2e-stderr.jsonl"
CANARY="$ARTIFACT/claude-status-canary"
INVOCATIONS="$ARTIFACT/claude-invocations.log"
OPEN_CANARY="$ARTIFACT/open-touch-canary"
: >"$PROC_LOG"
: >"$INVOCATIONS"

set +e
(
  env \
    HOME="$HOME_FIXTURE" \
    CFFIXED_USER_HOME="$HOME_FIXTURE" \
    CODEXBAR_CONFIG="$CONFIG" \
    CODEXBAR_DISABLE_KEYCHAIN_ACCESS=1 \
    CODEXBAR_CLAUDE_SECURITY_CLI_KEYCHAIN="$KEYCHAIN" \
    CODEXBAR_CLAUDE_TOUCH_CANARY="$CANARY" \
    CODEXBAR_CLAUDE_INVOCATIONS="$INVOCATIONS" \
    CODEXBAR_OPEN_TOUCH_CANARY="$OPEN_CANARY" \
    CODEXBAR_DEBUG_CLAUDE_OAUTH_FLOW=1 \
    CLAUDE_CLI_PATH="$ARTIFACT/bin/claude" \
    PATH="$ARTIFACT/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
    "$CLI" usage --provider claude --source oauth --format json --pretty --log-level debug \
      >"$STDOUT" 2>"$STDERR"
) &
PID=$!
while kill -0 "$PID" 2>/dev/null; do
  {
    date -u +%H:%M:%S
    pgrep -P "$PID" -l 2>/dev/null || true
  } >>"$PROC_LOG"
  sleep 0.02
done
wait "$PID"
CLI_STATUS=$?
set -e

{
  echo "# CodexBar #1844 isolated E2E verification"
  echo "date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
  echo "candidate: $(git rev-parse HEAD)"
  echo "packaged-cli: $CLI"
  echo "cli-exit: $CLI_STATUS"
  echo "default-keychain-search-list-unchanged: yes"
  echo "real-home-referenced: no"
  echo "claude-status-canary: $([[ -e "$CANARY" ]] && echo touched || echo untouched)"
  echo "open-touch-canary: $([[ -e "$OPEN_CANARY" ]] && echo touched || echo untouched)"
  echo
  echo "## stdout"
  cat "$STDOUT"
  echo
  echo "## stderr (filtered)"
  rg -i 'mcp|delegated|expired|oauth|touch|open|only prompt|user action' "$STDERR" || true
  echo
  echo "## Claude CLI invocations"
  cat "$INVOCATIONS"
  echo
  echo "## child processes"
  cat "$PROC_LOG"
} | tee "$ARTIFACT/E2E-REPORT.md"

if [[ "$CLI_STATUS" -eq 0 ]]; then
  log "Phase 2 failed: the MCP-only fixture unexpectedly produced successful OAuth usage"
  exit 1
fi
if [[ -e "$CANARY" ]]; then
  log "Phase 2 failed: delegated Claude CLI /status touch ran"
  exit 1
fi
if [[ -e "$OPEN_CANARY" ]]; then
  log "Phase 2 failed: browser/open helper ran"
  exit 1
fi
if rg -q '/usr/bin/open|(^|/)open$|firefox|Google Chrome|Safari' "$PROC_LOG" 2>/dev/null; then
  log "Phase 2 failed: an open helper or browser was a probe child"
  exit 1
fi
if ! rg -qi 'MCP OAuth state only|mcpOAuthOnlyKeychain|MCP OAuth' "$STDERR" "$STDOUT"; then
  log "Phase 2 failed: expected MCP-only fail-closed message not found"
  exit 1
fi

log "Phase 2 passed: exact packaged CLI failed closed without delegated /status touch or browser child"

log "Phase 3: isolated packaged app runtime smoke"
APP_PROC_LOG="$ARTIFACT/app-processes.log"
APP_STDOUT="$ARTIFACT/app-stdout.log"
APP_STDERR="$ARTIFACT/app-stderr.log"
: >"$APP_PROC_LOG"
: >"$INVOCATIONS"
(
  env \
    HOME="$HOME_FIXTURE" \
    CFFIXED_USER_HOME="$HOME_FIXTURE" \
    CODEXBAR_CONFIG="$CONFIG" \
    CODEXBAR_DISABLE_KEYCHAIN_ACCESS=1 \
    CODEXBAR_CLAUDE_SECURITY_CLI_KEYCHAIN="$KEYCHAIN" \
    CODEXBAR_CLAUDE_TOUCH_CANARY="$CANARY" \
    CODEXBAR_CLAUDE_INVOCATIONS="$INVOCATIONS" \
    CODEXBAR_OPEN_TOUCH_CANARY="$OPEN_CANARY" \
    CODEXBAR_DEBUG_CLAUDE_OAUTH_FLOW=1 \
    CLAUDE_CLI_PATH="$ARTIFACT/bin/claude" \
    PATH="$ARTIFACT/bin:/usr/bin:/bin:/usr/sbin:/sbin" \
    "$APP" >"$APP_STDOUT" 2>"$APP_STDERR"
) &
APP_PID=$!
APP_OBSERVED_CLI=0
POST_DISCOVERY_TICKS=0
for _ in $(seq 1 1000); do
  if ! kill -0 "$APP_PID" 2>/dev/null; then
    log "Phase 3 failed: packaged app exited before the isolated startup smoke completed"
    wait "$APP_PID" || true
    exit 1
  fi
  {
    date -u +%H:%M:%S
    pgrep -P "$APP_PID" -l 2>/dev/null || true
  } >>"$APP_PROC_LOG"
  if rg -q '^args: --version$' "$INVOCATIONS"; then
    APP_OBSERVED_CLI=1
    POST_DISCOVERY_TICKS=$((POST_DISCOVERY_TICKS + 1))
    if [[ "$POST_DISCOVERY_TICKS" -ge 250 ]]; then
      break
    fi
  fi
  sleep 0.02
done
kill "$APP_PID"
wait "$APP_PID" 2>/dev/null || true

if [[ "$APP_OBSERVED_CLI" -ne 1 ]]; then
  log "Phase 3 failed: packaged app never exercised the isolated Claude CLI fixture"
  exit 1
fi
if [[ -e "$CANARY" ]]; then
  log "Phase 3 failed: packaged app invoked delegated Claude CLI /status touch"
  exit 1
fi
if [[ -e "$OPEN_CANARY" ]]; then
  log "Phase 3 failed: packaged app invoked browser/open helper"
  exit 1
fi
if rg -q '/usr/bin/open|(^|/)open$|firefox|Google Chrome|Safari' "$APP_PROC_LOG" 2>/dev/null; then
  log "Phase 3 failed: an open helper or browser was an app child"
  exit 1
fi
{
  echo
  echo "## packaged app runtime"
  echo "app-binary: $APP"
  echo "isolated-claude-cli-discovery-observed: yes"
  echo "post-discovery-observation-seconds: 5"
  echo "app-stayed-running: yes"
  echo "claude-status-canary: untouched"
  echo "open-touch-canary: untouched"
  echo "browser-child: none"
  echo
  echo "## packaged app Claude CLI invocations"
  cat "$INVOCATIONS"
} | tee -a "$ARTIFACT/E2E-REPORT.md"

log "Phase 3 passed: packaged app exercised CLI discovery without delegated /status touch or browser child"
log "Report: $ARTIFACT/E2E-REPORT.md"