import * as NodeServices from "@effect/platform-node/NodeServices";import { assert, describe, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as FileSystem from "effect/FileSystem";import * as Layer from "effect/Layer";import * as Sink from "effect/Sink";import * as Stream from "effect/Stream";import { ChildProcessSpawner } from "effect/unstable/process"; import {  acquireDevShare,  claimDevShareLease,  cleanupOwnedDevShare,  type DevShareError,  DevShareLeaseClaimError,  DevServeFailedError,  shareDevServer,  unshareDevServer,} from "./dev-share.ts"; const TAILNET_STATUS = JSON.stringify({ Self: { DNSName: "host.example.ts.net." } });const NO_HANDLER_STDERR = "error: failed to remove web serve: handler does not exist"; interface CallResult {  readonly exitCode: number;  readonly stderr?: string;} const encode = (value: string) => Stream.make(new TextEncoder().encode(value)); /** * Answers `tailscale status --json` with a valid tailnet name, and lets each * test set the outcome of the `off` (pre-clear) and `serve` calls separately — * they are the same subcommand and are told apart by the trailing `off`. */const spawnerLayer = (input: {  readonly off?: CallResult;  readonly serve?: CallResult;  readonly onOff?: Effect.Effect<void>;  readonly calls?: Array<ReadonlyArray<string>>;}) =>  Layer.succeed(    ChildProcessSpawner.ChildProcessSpawner,    ChildProcessSpawner.make((command) => {      const args = "args" in command ? (command.args as ReadonlyArray<string>) : [];      input.calls?.push(args);      const result: CallResult = args.includes("status")        ? { exitCode: 0 }        : args.includes("off")          ? (input.off ?? { exitCode: 0 })          : (input.serve ?? { exitCode: 0 });       return Effect.succeed(        ChildProcessSpawner.makeHandle({          pid: ChildProcessSpawner.ProcessId(1),          exitCode: (args.includes("off") ? (input.onOff ?? Effect.void) : Effect.void).pipe(            Effect.as(ChildProcessSpawner.ExitCode(result.exitCode)),          ),          isRunning: Effect.succeed(false),          kill: () => Effect.void,          unref: Effect.succeed(Effect.void),          stdin: Sink.drain,          stdout: args.includes("status") ? encode(TAILNET_STATUS) : Stream.empty,          stderr: result.stderr ? encode(result.stderr) : Stream.empty,          all: Stream.empty,          getInputFd: () => Sink.drain,          getOutputFd: () => Stream.empty,        }),      );    }),  ); describe("unshareDevServer", () => {  it.effect("treats a removed mapping as cleared", () =>    Effect.gen(function* () {      const result = yield* unshareDevServer(5788).pipe(        Effect.provide(spawnerLayer({ off: { exitCode: 0 } })),      );      assert.isTrue(result.cleared);    }),  );   // `tailscale serve … off` exits 1 when the port had no mapping, which is the  // normal first-share case — the port is clear, so this must not be an error.  it.effect("treats a missing handler as cleared", () =>    Effect.gen(function* () {      const result = yield* unshareDevServer(5788).pipe(        Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })),      );      assert.isTrue(result.cleared);    }),  );   it.effect("reports a genuine removal failure as not cleared", () =>    Effect.gen(function* () {      const result = yield* unshareDevServer(5788).pipe(        Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })),      );      assert.isFalse(result.cleared);      assert.include(result.explanation, "permission denied");      // Structured, so a wrapping error can keep the real chain.      assert.equal(result.cause?._tag, "TailscaleCommandExitError");    }),  );}); describe("shareDevServer", () => {  it.effect("returns the tailnet URL for the same port", () =>    Effect.gen(function* () {      const shared = yield* shareDevServer({ webPort: 5788 }).pipe(        Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })),      );       assert.equal(shared.host, "host.example.ts.net");      assert.equal(shared.url, "https://host.example.ts.net:5788/");    }),  );   // The stale-mapping clear runs before serve, so a failure here leaves the  // port serving nothing. Saying only "serve failed" would let an operator  // assume their previous mapping survived.  it.effect("reports that the prior mapping was cleared when serve fails", () =>    Effect.gen(function* () {      const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(        Effect.provide(          spawnerLayer({            off: { exitCode: 0 },            serve: { exitCode: 1, stderr: "port already in use" },          }),        ),        Effect.flip,      );       assert.instanceOf(error, DevServeFailedError);      assert.equal(error.stage, "serve");      assert.equal(error.webPort, 5788);      // The underlying failure is preserved rather than flattened to a string.      assert.equal(        (error.cause as { _tag?: string } | undefined)?._tag,        "TailscaleCommandExitError",      );      // Unclassifiable stderr is never quoted (it can carry auth keys), so the      // message points at the command instead of echoing the CLI.      assert.notInclude(error.message, "port already in use");      assert.include(error.message, "run the command by hand");      assert.include(error.message, "no longer served");      assert.include(error.message, "5788");    }),  );   // A recognized failure gets our own wording for it — enough to act on  // without passing CLI text through.  it.effect("explains a recognized serve failure without quoting stderr", () =>    Effect.gen(function* () {      const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(        Effect.provide(          spawnerLayer({            off: { exitCode: 0 },            serve: {              exitCode: 1,              stderr: "permission denied for tskey-auth-secret-token-value",            },          }),        ),        Effect.flip,      );       assert.instanceOf(error, DevServeFailedError);      assert.equal(error.stage, "serve");      assert.include(error.message, "permission denied");      assert.include(error.message, "elevated privileges");      assert.notInclude(error.message, "tskey-auth-secret-token-value");    }),  );   // Serving over routes we could not remove yields a URL that loads but whose  // /ws and /api quietly point at a dead backend.  it.effect("refuses to serve when the existing mapping could not be cleared", () =>    Effect.gen(function* () {      const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(        Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })),        Effect.flip,      );       assert.instanceOf(error, DevServeFailedError);      // A distinct stage: the prior mapping survived, so nothing was replaced.      assert.equal(error.stage, "clear-existing");      assert.include(error.message, "could not clear the existing mapping");      assert.include(error.message, "permission denied");    }),  );}); it.layer(NodeServices.layer)("dev share cleanup ownership", (it) => {  it.effect("claims ownership via an atomic rename", () =>    Effect.gen(function* () {      const leasePath = "/leases/5788.owner";      const tempDirectory = "/leases/5788.owner.temp";      const writes: Array<readonly [path: string, contents: string]> = [];      const renames: Array<readonly [from: string, to: string]> = [];       yield* claimDevShareLease({ leasePath, ownerId: "new-runner", webPort: 5788 }).pipe(        Effect.provideService(          FileSystem.FileSystem,          FileSystem.makeNoop({            makeDirectory: () => Effect.void,            makeTempDirectoryScoped: (options) => {              assert.equal(options?.directory, "/leases");              assert.equal(options?.prefix, "5788.owner.");              return Effect.succeed(tempDirectory);            },            writeFileString: (path, contents) => {              writes.push([path, contents]);              return Effect.void;            },            rename: (from, to) => {              renames.push([from, to]);              return Effect.void;            },          }),        ),      );       assert.deepEqual(writes, [[`${tempDirectory}/owner.tmp`, "new-runner"]]);      assert.deepEqual(renames, [[`${tempDirectory}/owner.tmp`, leasePath]]);    }),  );   it.effect("keeps the prior owner when clearing its mapping fails", () =>    Effect.gen(function* () {      const fileSystem = yield* FileSystem.FileSystem;      const directory = yield* fileSystem.makeTempDirectoryScoped({        prefix: "t3-dev-share-lease-",      });      const leasePath = `${directory}/5788.owner`;      const calls: Array<ReadonlyArray<string>> = [];       yield* fileSystem.writeFileString(leasePath, "old-runner");      yield* acquireDevShare({        leasePath,        ownerId: "new-runner",        webPort: 5788,      }).pipe(        Effect.provide(          spawnerLayer({            calls,            off: { exitCode: 1, stderr: "permission denied" },          }),        ),        Effect.flip,      );       assert.equal(yield* fileSystem.readFileString(leasePath), "old-runner");      assert.equal(calls.filter((args) => args.includes("off")).length, 1);    }),  );   it.effect("claims ownership after clearing and before publishing", () =>    Effect.gen(function* () {      const fileSystem = yield* FileSystem.FileSystem;      const directory = yield* fileSystem.makeTempDirectoryScoped({        prefix: "t3-dev-share-lease-",      });      const leasePath = `${directory}/5788.owner`;       yield* fileSystem.writeFileString(leasePath, "old-runner");      yield* acquireDevShare({        leasePath,        ownerId: "new-runner",        webPort: 5788,      }).pipe(        Effect.provide(          spawnerLayer({            off: { exitCode: 0 },            serve: { exitCode: 1, stderr: "permission denied" },          }),        ),        Effect.flip,      );       assert.equal(yield* fileSystem.readFileString(leasePath), "new-runner");    }),  );   it.effect("restores the mapping when ownership cannot be claimed", () =>    Effect.gen(function* () {      const fileSystem = yield* FileSystem.FileSystem;      const directory = yield* fileSystem.makeTempDirectoryScoped({        prefix: "t3-dev-share-lease-",      });      const blockedDirectory = `${directory}/not-a-directory`;      const calls: Array<ReadonlyArray<string>> = [];       yield* fileSystem.writeFileString(blockedDirectory, "blocked");      const error = yield* acquireDevShare({        leasePath: `${blockedDirectory}/5788.owner`,        ownerId: "new-runner",        webPort: 5788,      }).pipe(Effect.provide(spawnerLayer({ calls })), Effect.flip);       assert.instanceOf(error, DevShareLeaseClaimError);      assert.isTrue(calls.some((args) => args.includes("off")));      assert.isTrue(calls.some((args) => args.includes("http://127.0.0.1:5788")));    }),  );   it.effect("restores a newer runner's mapping when ownership changes during cleanup", () =>    Effect.gen(function* () {      const fileSystem = yield* FileSystem.FileSystem;      const directory = yield* fileSystem.makeTempDirectoryScoped({        prefix: "t3-dev-share-lease-",      });      const leasePath = `${directory}/5788.owner`;      const oldLease = { leasePath, ownerId: "old-runner", webPort: 5788 };      const calls: Array<ReadonlyArray<string>> = [];       yield* claimDevShareLease(oldLease);      const result = yield* cleanupOwnedDevShare(oldLease).pipe(        Effect.provide(          spawnerLayer({            calls,            onOff: fileSystem.writeFileString(leasePath, "new-runner").pipe(Effect.orDie),          }),        ),      );       assert.equal(result.status, "restored");      assert.isTrue(calls.some((args) => args.includes("off")));      assert.isTrue(calls.some((args) => args.includes("http://127.0.0.1:5788")));    }),  );   it.effect("leaves the mapping alone when a newer runner already owns it", () =>    Effect.gen(function* () {      const fileSystem = yield* FileSystem.FileSystem;      const directory = yield* fileSystem.makeTempDirectoryScoped({        prefix: "t3-dev-share-lease-",      });      const leasePath = `${directory}/5788.owner`;      const oldLease = { leasePath, ownerId: "old-runner", webPort: 5788 };      const calls: Array<ReadonlyArray<string>> = [];       yield* claimDevShareLease(oldLease);      yield* claimDevShareLease({ ...oldLease, ownerId: "new-runner" });      const result = yield* cleanupOwnedDevShare(oldLease).pipe(        Effect.provide(spawnerLayer({ calls })),      );       assert.equal(result.status, "superseded");      assert.isEmpty(calls);    }),  );});