import { spawnSync } from "node:child_process";
import { mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join } from "node:path";
import { afterEach, describe, expect, it } from "vitest";
import { parse } from "yaml";
import { cloudHomeConfiguration } from "../server/cloud-home.ts";
import { cloudHomeChildEnvironments } from "../server/cloud-home-start.ts";

// The published images: the self-hosted server (the default target) and the
// Cloud home. A pull downloads every layer whose digest changed, and a layer's
// digest changes when anything beneath it does.
const dockerfile = readFileSync(new URL("../Dockerfile", import.meta.url), "utf8");
const workflow = parse(readFileSync(new URL("../.github/workflows/docker.yml", import.meta.url), "utf8"));

interface Step { op: string; args: string }
interface Stage { name: string; from: string; platform?: string; steps: Step[] }

function stages(text: string): Stage[] {
  const all: Stage[] = [];
  let pending = "";
  for (const line of text.split("\n")) {
    if (/^\s*#/.test(line) || (!pending && !line.trim())) continue;
    pending += line.endsWith("\\") ? `${line.slice(0, -1)} ` : line;
    if (line.endsWith("\\")) continue;
    const [, op, args] = /^\s*(\S+)\s*([\s\S]*)$/.exec(pending)!;
    pending = "";
    if (op.toUpperCase() === "FROM") {
      const [, platform, from, name] = /^(?:--platform=(\S+)\s+)?(\S+)(?:\s+AS\s+(\S+))?$/i.exec(args.trim())!;
      all.push({ name: name ?? `#${all.length}`, from, platform, steps: [] });
    } else all.at(-1)?.steps.push({ op: op.toUpperCase(), args: args.trim() });
  }
  return all;
}

const all = stages(dockerfile);
/** Every instruction a target's image is built from, its parents' first. */
function chain(target: string): Step[] {
  const stage = all.find(s => s.name === target);
  if (!stage) throw new Error(`the Dockerfile has no ${target} stage`);
  return [...(all.some(s => s.name === stage.from) ? chain(stage.from) : []), ...stage.steps];
}
const shipped = () => all.filter(s => s.name !== "build" && s.name !== "edge" && s.name !== "tunnel").flatMap(s => s.steps);
const npmInstall = (step: Step) => step.op === "RUN" && /\bnpm install\b/.test(step.args);
const browserRun = () => chain("runtime").find(step => step.op === "RUN" && step.args.includes("agent-browser install"))!;
const grokRun = (steps: Step[]) => steps.findIndex(step => step.op === "RUN" && step.args.includes("https://x.ai/cli/install.sh"));
// The keys step parses Chrome for Testing's JSON with jq, as on GitHub's runners.
const jq = process.platform === "win32" ? "" : spawnSync("sh", ["-c", "command -v jq"], { encoding: "utf8" }).stdout.trim();

const temporaryDirectories: string[] = [];
afterEach(() => {
  for (const directory of temporaryDirectories.splice(0)) rmSync(directory, { recursive: true, force: true });
});

describe("container images", () => {
  it("keeps the self-hosted server the default target, and Cloud home a target of the same file", () => {
    expect(all.at(-1)!.name).toBe("server");
    expect(all.find(s => s.name === "cloud-home")!.from).toBe("runtime");
    expect(all.find(s => s.name === "server")!.from).toBe("runtime");
    // the build arg docker-compose.yml passes keeps its name and empty default
    expect(chain("server")).toContainEqual({ op: "ARG", args: 'ENGINES=""' });
  });

  it("puts the browser and the engines beneath the per-commit app files, so a code change leaves them as they were", () => {
    for (const target of ["server", "cloud-home"]) {
      const steps = chain(target);
      const heavy = steps.flatMap((step, i) => (npmInstall(step) ? [i] : []));
      const app = steps.flatMap((step, i) => (step.op === "COPY" && !/--from=(?:edge|tunnel) /.test(step.args) ? [i] : []));
      // agent-browser + Chrome, then (Cloud home only) pnpm in the tools layer, then the engines, then the app files
      // (and the Cloud home's Caddyfile)
      expect(heavy, target).toHaveLength(target === "cloud-home" ? 3 : 2);
      const fromBuild = steps.flatMap((step, i) => (step.op === "COPY" && step.args.includes("--from=build") ? [i] : []));
      expect(fromBuild, target).toHaveLength(4);
      expect(Math.max(...heavy), target).toBeLessThan(Math.min(...app));
      // The Data engine's native tree (DuckDB, resvg) changes on a version bump,
      // not per commit, so it is copied before the per-commit app files.
      const native = steps.findIndex(step => step.op === "COPY" && step.args.includes("/dist-native/duckdb/"));
      expect(native, target).toBeGreaterThan(-1);
      expect(native, target).toBeLessThan(Math.min(...fromBuild.filter(i => i !== native)));
    }
  });

  it("leaves no npm or compile cache in a layer: each install removes its own in the same step", () => {
    const installs = shipped().filter(npmInstall);
    expect(installs.length).toBeGreaterThanOrEqual(3);
    for (const { args } of installs) {
      const cache = /--cache (\S+)/.exec(args)?.[1] ?? /\bHOME=(\S+) npm install\b/.exec(args)?.[1];
      expect(cache, args).toMatch(/^\/tmp\//);
      // Every `rm -rf` in the step counts: the Cloud home's tools layer clears apt's lists before its pnpm install.
      const removed = [...args.matchAll(/\brm -rf ([^;&|]+)/g)].flatMap((match) => match[1]!.trim().split(/\s+/));
      expect(removed, args).toEqual(expect.arrayContaining([cache, "/tmp/node-compile-cache"]));
    }
  });

  it("ships Caddy once, without its file capability, and the app files once, root's without a rewrite", () => {
    for (const { args } of shipped()) expect(args).not.toMatch(/\bch(own|mod) -R\b/);
    // modes are fixed where the files are built, in a stage that is not shipped
    const build = all.find(s => s.name === "build")!.steps.find(step => step.op === "RUN" && step.args.startsWith("pnpm build:server"))!;
    expect(build.args).toMatch(/ && chmod -R go-w dist dist-server skills$/);
    // a plain copy to a fresh inode drops the privileged-port capability and the 1001 owner
    expect(all.find(s => s.name === "edge")!.steps).toContainEqual({ op: "RUN", args: "cp /usr/bin/caddy /caddy" });
    const home = chain("cloud-home");
    expect(home.filter(step => step.args.includes("/usr/local/bin/caddy") && step.op === "COPY")).toEqual([
      { op: "COPY", args: "--from=edge /caddy /usr/local/bin/caddy" },
    ]);
    // pinned, so beneath the engines: an engine release does not re-pull it
    expect(home.findIndex(step => step.args.startsWith("--from=edge "))).toBeLessThan(home.findLastIndex(npmInstall));
    expect(home.filter(step => step.op === "RUN" && /\b(cp|mv)\b[^&]*caddy/.test(step.args))).toEqual([]);
    // The tunnel's connector: the release scripts/prepare-cloudflared.mjs pins and checks, once, beneath the engines.
    expect(all.find(s => s.name === "tunnel")!.steps.find(step => step.op === "RUN")!.args).toMatch(/^node \/stage\/prepare-cloudflared\.mjs --current --root \/stage /);
    expect(home.filter(step => step.args.includes("/usr/local/bin/cloudflared") && step.op === "COPY")).toEqual([
      { op: "COPY", args: "--from=tunnel /cloudflared /usr/local/bin/cloudflared" },
    ]);
    expect(home.findIndex(step => step.args.startsWith("--from=tunnel "))).toBeLessThan(home.findLastIndex(npmInstall));
    expect(home.filter(step => step.args.includes("--from=build")).map(step => step.args)).toEqual([
      "/src/dist-native/duckdb/target ./duckdb", "/src/dist-server ./dist-server", "/src/dist ./dist", "/src/skills ./skills",
    ].map(path => `--from=build ${path}`));
    expect(chain("server").filter(step => step.args.includes("--from=build")).every(step => step.args.startsWith("--from=build --chown=maus:maus "))).toBe(true);
  });

  it("installs the pinned Grok in Cloud home only, beneath the engines and the app, from a home the same step removes", () => {
    const home = chain("cloud-home");
    const grok = grokRun(home);
    expect(grok).toBeGreaterThan(-1);
    expect(home.slice(0, grok)).toContainEqual({ op: "ARG", args: "GROK_VERSION=1.0.41" });
    // pinned, so an engine release or a code change does not re-pull it
    expect(grok).toBeLessThan(home.findLastIndex(npmInstall));
    expect(grok).toBeGreaterThan(home.indexOf(browserRun()));
    expect(grok).toBeLessThan(home.findIndex(step => step.args.includes("--from=build")));
    const { args } = home[grok];
    // the installer and the version check write only to a throwaway home, gone by the end of the step
    expect(args.match(/\bHOME=\S+/g)).toEqual(["HOME=/tmp/grok-install", "HOME=/tmp/grok-install"]);
    expect(args).toMatch(/ && install -m 0755 "\$\(readlink -f \/tmp\/grok-install\/\.grok\/bin\/grok\)" \/usr\/local\/bin\/grok /);
    expect(args).toContain('grep -qF "grok $GROK_VERSION "');
    expect(args).toMatch(/ && rm -rf \/tmp\/grok-install; +fi$/);
    expect(grokRun(chain("server"))).toBe(-1);
  });

  it("scans the saved images for every throwaway build directory, and for one Grok", () => {
    const scan = (workflow.jobs["build-and-smoke"].steps as { name?: string; run?: string }[])
      .find(step => step.name?.startsWith("Prove each image ships its files once"))!.run!;
    const cache = new RegExp(/cache = re\.compile\(r"(.*)"\)/.exec(scan)![1]);
    const removed = shipped().flatMap(step => [...step.args.matchAll(/\brm -rf ([^;&|]+)/g)].flatMap(match => match[1].trim().split(/\s+/)));
    const throwaway = [...new Set(removed.filter(path => path.startsWith("/tmp/")))].sort();
    expect(throwaway).toEqual(["/tmp/grok-install", "/tmp/node-compile-cache", "/tmp/npm-cache", "/tmp/omb-build-home", "/tmp/uv-install"]);
    for (const path of throwaway) expect(cache.test(`${path.slice(1)}/leftover`), path).toBe(true);
    expect(scan).toContain('grok = files["usr/local/bin/grok"]');
  });

  it("keeps each image's runtime contract", () => {
    const last = (steps: Step[], op: string) => steps.filter(step => step.op === op).at(-1)?.args;
    const server = chain("server");
    expect(last(server, "USER")).toBe("maus");
    expect(last(server, "VOLUME")).toBe('["/data"]');
    expect(last(server, "CMD")).toBe('["node", "dist-server/server-launcher.js"]');
    expect(last(server, "HEALTHCHECK")).toContain("http://127.0.0.1:8799/api/health");
    const home = chain("cloud-home");
    expect(last(home, "USER")).toBe("root");
    expect(last(home, "VOLUME")).toBe('["/data"]');
    expect(last(home, "EXPOSE")).toBe("8080");
    expect(last(home, "CMD")).toBe('["node", "/app/dist-server/cloud-home-start.js"]');
    expect(last(home, "HEALTHCHECK")).toContain("http://127.0.0.1:8080/api/health");
    expect(last(chain("runtime"), "ENV")).toMatch(/^AGENT_BROWSER_EXECUTABLE_PATH=\/opt\/openmausbot-browser\/chrome .*NODE_ENV=production$/);
  });

  it("hands the Cloud home's server every setting the image's ENV gives it", () => {
    // The root supervisor passes the server an allow-listed environment; a setting the image sets but the list drops is
    // lost silently (OMB_DUCKDB_DIR was: the server then found neither the 1Password SDK nor DuckDB in /app/duckdb).
    const image: Record<string, string> = {};
    for (const step of chain("cloud-home").filter(step => step.op === "ENV")) {
      for (const [, name, value] of step.args.matchAll(/(?:^|\s)([A-Z][A-Z0-9_]*)=(\S*)/g)) image[name] = value;
    }
    expect(image.OMB_DUCKDB_DIR).toBe("/app/duckdb");
    const contract = { OMB_CLOUD_ROLE: "home", OMB_CLOUD_MACHINE_ID: "3f9c2a4e-8b1d-4c6e-9a7f-2d5e8c1b0a93", OMB_CLOUD_ADMIN_URL: "https://cloud.example.test",
      OMB_PUBLIC_URL: "https://omb-u-1a2b3c4d5e6f.fly.dev", OMB_CLOUD_BOOTSTRAP_SECRET: "S".repeat(43) };
    const { server } = cloudHomeChildEnvironments(cloudHomeConfiguration(contract)!, { ...image, ...contract }, "/data");
    // The launcher sets HOME, the ports and the data folder itself; everything else must come through unchanged.
    for (const name of Object.keys(image)) expect(server, name).toHaveProperty(name);
    expect(server.OMB_DUCKDB_DIR).toBe("/app/duckdb");
  });

  it("never runs a build step with HOME on the volume, so nothing lands in what a fresh volume starts with", () => {
    for (const target of ["server", "cloud-home"]) {
      const steps = chain(target);
      const home = steps.findIndex(step => step.op === "ENV" && /(^|\s)HOME=\/data\b/.test(step.args));
      expect(home, target).toBeGreaterThan(-1);
      expect(steps.slice(home).filter(step => step.op === "RUN"), target).toEqual([]);
    }
  });

  it.skipIf(process.platform === "win32")("keeps only agent-browser's native binary, and refuses when the command is not one", () => {
    const { args } = browserRun();
    const start = args.indexOf("native=");
    const end = args.indexOf("&& agent-browser --version", start);
    expect(start).toBeGreaterThan(args.indexOf("agent-browser install"));
    expect(end).toBeGreaterThan(start);
    const prune = args.slice(start, end);
    const run = (target: string, elf = true) => {
      const root = mkdtempSync(join(tmpdir(), "omb-agent-browser-"));
      temporaryDirectories.push(root);
      const bin = join(root, "lib/node_modules/agent-browser/bin");
      mkdirSync(bin, { recursive: true });
      mkdirSync(join(root, "bin"));
      const names = ["agent-browser-darwin-arm64", "agent-browser-linux-arm64", "agent-browser-linux-musl-x64", "agent-browser-linux-x64", "agent-browser-win32-x64.exe", "agent-browser.js"];
      for (const name of names) writeFileSync(join(bin, name), name === "agent-browser-linux-x64" && elf ? "\x7fELF\x02\x01" : "#!/usr/bin/env node\n", { mode: 0o755 });
      symlinkSync(join(bin, target), join(root, "bin/agent-browser"));
      const result = spawnSync("sh", ["-c", prune], { env: { PATH: `${join(root, "bin")}:/usr/bin:/bin` }, encoding: "utf8" });
      return { status: result.status, left: readdirSync(bin).sort(), names };
    };
    expect(run("agent-browser-linux-x64")).toMatchObject({ status: 0, left: ["agent-browser-linux-x64", "agent-browser.js"] });
    // npm linking the JS wrapper instead must stop the build, not delete every native binary
    const wrapper = run("agent-browser.js");
    expect(wrapper.status).not.toBe(0);
    expect(wrapper.left).toEqual(wrapper.names);
    const script = run("agent-browser-linux-x64", false);
    expect(script.status).not.toBe(0);
    expect(script.left).toEqual(script.names);
  });

  it("builds the server image for linux/arm64 too: the DuckDB tree and the browser follow the image's CPU", () => {
    // The JavaScript build runs once on the build host; only the native tree is per CPU, staged after it.
    const build = all.find(s => s.name === "build")!;
    expect(build.platform).toBe("$BUILDPLATFORM");
    const declared = build.steps.findIndex(step => step.op === "ARG" && step.args === "TARGETARCH");
    expect(declared).toBeGreaterThan(build.steps.findIndex(step => step.op === "RUN" && step.args.startsWith("pnpm build:server")));
    const stage = build.steps.find(step => step.op === "RUN" && step.args.includes("prepare-duckdb.mjs"))!;
    expect(build.steps.indexOf(stage)).toBeGreaterThan(declared);
    if (process.platform !== "win32") {
      for (const [targetArch, arch] of [["amd64", "x64"], ["arm64", "arm64"], ["", "x64"]]) {
        const root = mkdtempSync(join(tmpdir(), "omb-duckdb-arch-"));
        temporaryDirectories.push(root);
        mkdirSync(join(root, "scripts"));
        // A stand-in for the staging script: it stages the CPU it is told to, and records which.
        writeFileSync(join(root, "scripts/prepare-duckdb.mjs"), 'import { mkdirSync, writeFileSync } from "node:fs"; const d = `dist-native/duckdb/linux-${process.env.OMB_DUCKDB_ARCH}`; mkdirSync(d, { recursive: true }); writeFileSync(`${d}/arch`, process.env.OMB_DUCKDB_ARCH);');
        const result = spawnSync("sh", ["-c", stage.args], { cwd: root, env: { PATH: process.env.PATH, TARGETARCH: targetArch }, encoding: "utf8" });
        expect(result.status, `${targetArch}: ${result.stderr}`).toBe(0);
        expect(readdirSync(join(root, "dist-native/duckdb")), targetArch).toEqual(["target"]);
        expect(readFileSync(join(root, "dist-native/duckdb/target/arch"), "utf8"), targetArch).toBe(arch);
      }
    }
    // Chrome for Testing has no Linux ARM64 build: an arm64 image takes Debian's Chromium at the same path.
    const runtime = chain("runtime");
    expect(runtime.slice(0, runtime.indexOf(browserRun()))).toContainEqual({ op: "ARG", args: "TARGETARCH" });
    expect(browserRun().args).toMatch(/if \[ "\$TARGETARCH" = arm64 \]; then .*apt-get install -y --no-install-recommends chromium .*ln -s \/usr\/lib\/chromium\/chromium \/opt\/openmausbot-browser\/chrome; +else .*agent-browser install .*; +fi/);
    // Published for both CPUs; the Cloud home (Fly, amd64) stays as it is.
    const steps = workflow.jobs.publish.steps as { id?: string; uses?: string; with?: Record<string, string> }[];
    const server = steps.findIndex(step => step.uses?.startsWith("docker/build-push-action@") && step.id !== "home");
    const qemu = steps.findIndex(step => step.uses?.startsWith("docker/setup-qemu-action@"));
    expect(qemu).toBeGreaterThan(-1);
    expect(qemu).toBeLessThan(server);
    expect(steps[server].with!.platforms).toBe("linux/amd64,linux/arm64");
    expect(steps.find(step => step.id === "home")!.with).not.toHaveProperty("platforms");
    // and an arm64 runner proves the arm64 image boots, serves and browses before anything is published
    const arm = workflow.jobs["arm64-smoke"];
    expect(arm["runs-on"]).toBe("ubuntu-24.04-arm");
    expect(workflow.jobs.publish.needs).toEqual(expect.arrayContaining(["build-and-smoke", "arm64-smoke"]));
    const armRun = (arm.steps as { run?: string }[]).map(step => step.run ?? "").join("\n");
    expect(armRun).toContain("/api/health");
    expect(armRun).toContain("agent-browser --session ci-browser open");
  });

  it("builds Cloud home from the same Dockerfile in CI, with its own layer cache", () => {
    const smoke = workflow.jobs["build-and-smoke"].steps.map((step: { run?: string }) => step.run ?? "").join("\n");
    expect(smoke).toContain("docker build --target cloud-home --build-arg CLOUD_HOME_ENGINES= -t omb-cloud-home:ci .");
    const steps = workflow.jobs.publish.steps as { id?: string; uses?: string; with?: Record<string, string> }[];
    const server = steps.find(step => step.uses?.startsWith("docker/build-push-action@") && step.id !== "home")!;
    const home = steps.find(step => step.id === "home")!;
    expect(home.with).not.toHaveProperty("file");
    expect(home.with!.target).toBe("cloud-home");
    expect(home.with!["build-args"]).not.toContain("BASE_IMAGE");
    expect(home.with!["cache-from"].split("\n")).toEqual(expect.arrayContaining(["type=gha", "type=gha,scope=cloud-home"]));
    expect(home.with!["cache-to"]).toBe("type=gha,scope=cloud-home,mode=max");
    // Both builds key the browser layer on the same Chrome, so they share it.
    for (const build of [server, home]) expect(build.with!["build-args"]).toContain("CHROME_CACHE_TAG=${{ steps.keys.outputs.chrome }}");
    // and the arm64 one on Debian's newest Chromium, so a security update rebuilds it
    for (const build of [server, home]) expect(build.with!["build-args"]).toContain("CHROMIUM_CACHE_TAG=${{ steps.keys.outputs.chromium }}");
    expect(home.with!["build-args"]).toContain("CLOUD_HOME_ENGINES=${{ steps.keys.outputs.engines }}");
    expect(home.with!["build-args"]).toContain("ENGINES_CACHE_TAG=${{ steps.keys.outputs.engines_tag }}");
  });

  it("keys the browser and engine layers on the versions they install, so a release rebuilds them", () => {
    const runtime = all.find(s => s.name === "runtime")!.steps;
    const declared = runtime.findIndex(step => step.op === "ARG" && step.args.startsWith("CHROME_CACHE_TAG="));
    // declared after the apt step, so a Chrome release rebuilds only the browser layer
    expect(declared).toBeGreaterThan(runtime.findIndex(step => step.op === "RUN" && step.args.startsWith("apt-get update")));
    expect(declared).toBeLessThan(runtime.indexOf(browserRun()));
    expect(browserRun().args).toContain("${CHROME_CACHE_TAG");
    expect(runtime.findIndex(step => step.op === "ARG" && step.args.startsWith("CHROMIUM_CACHE_TAG="))).toBeLessThan(runtime.indexOf(browserRun()));
    expect(browserRun().args).toContain("${CHROMIUM_CACHE_TAG");
    const home = all.find(s => s.name === "cloud-home")!.steps;
    expect(home).toContainEqual({ op: "ARG", args: 'CLOUD_HOME_ENGINES="@anthropic-ai/claude-code @openai/codex"' });
    // the engines' install, not the tools layer's pinned pnpm beneath it
    const engines = home.find(step => npmInstall(step) && step.args.includes("$CLOUD_HOME_ENGINES"));
    expect(engines?.args).toContain("${ENGINES_CACHE_TAG");
    const keys = (workflow.jobs.publish.steps as { id?: string; env?: Record<string, string> }[]).find(step => step.id === "keys")!;
    expect(keys.env!.CLOUD_HOME_ENGINES).toBe("@anthropic-ai/claude-code @openai/codex");
  });

  it.skipIf(!jq)("resolves the current Chrome and engine releases, and keys on the date when a lookup fails", () => {
    const keys = (workflow.jobs.publish.steps as { id?: string; run?: string; env?: Record<string, string> }[]).find(step => step.id === "keys")!;
    const resolve = (ok: boolean) => {
      const root = mkdtempSync(join(tmpdir(), "omb-docker-keys-"));
      temporaryDirectories.push(root);
      const fake = (name: string, body: string) => writeFileSync(join(root, name), `#!/bin/sh\n${ok ? body : "exit 1"}\n`, { mode: 0o755 });
      fake("curl", `case "$*" in *madison*) printf ' chromium | 150.0.7871.100-1~deb12u1 | bookworm          | arm64\\n chromium | 156.0.8078.73-1~deb12u1  | bookworm-security | arm64\\n';; *) echo '{"channels":{"Stable":{"version":"154.0.8037.92","downloads":{}}}}';; esac`);
      fake("npm", `case "$2" in @anthropic-ai/claude-code@latest) echo 2.1.291;; @openai/codex@latest) echo 0.160.1;; *) exit 1;; esac`);
      const output = join(root, "output");
      writeFileSync(output, "");
      const result = spawnSync("bash", ["-e", "-c", keys.run!], {
        env: { ...keys.env, PATH: `${root}:${dirname(jq)}:/usr/bin:/bin`, GITHUB_OUTPUT: output }, encoding: "utf8",
      });
      expect(result.status, result.stderr).toBe(0);
      return Object.fromEntries(readFileSync(output, "utf8").trim().split("\n").map(line => [line.slice(0, line.indexOf("=")), line.slice(line.indexOf("=") + 1)]));
    };
    expect(resolve(true)).toEqual({
      chrome: "154.0.8037.92",
      chromium: "156.0.8078.73-1~deb12u1",
      engines: "@anthropic-ai/claude-code@2.1.291 @openai/codex@0.160.1",
      engines_tag: "",
    });
    const today = `date-${new Date().toISOString().slice(0, 10)}`;
    expect(resolve(false)).toEqual({ chrome: today, chromium: today, engines: "@anthropic-ai/claude-code @openai/codex", engines_tag: today });
  });

  // An init collects browser processes whose parents exit, and Chrome gets the
  // shared memory OpenMausBot's desktop containers give it.
  it("runs every compose service of the server image with an init and Chrome's shared memory", () => {
    for (const file of ["../compose.yaml", "../deploy/docker-compose.yml", "../deploy/podman/compose.yaml"]) {
      const service = parse(readFileSync(new URL(file, import.meta.url), "utf8")).services.omb;
      expect(service.init, file).toBe(true);
      expect(service.shm_size, file).toBe("512m");
    }
  });

  // Caddy in the server's network (network_mode: service:omb) stayed in the old, dead one whenever the server's
  // container restarted alone, and HTTPS was refused while both looked healthy. It reaches the server over sockets in
  // a volume both mount instead, and the Caddyfile names the paths the server listens on.
  it("runs Caddy in its own container, reaching the server's sockets, never in the server's network", () => {
    for (const [file, caddyfile] of [["../compose.yaml", "../deploy/local/Caddyfile"], ["../deploy/docker-compose.yml", "../deploy/Caddyfile"]]) {
      const { services, volumes } = parse(readFileSync(new URL(file, import.meta.url), "utf8"));
      expect(services.caddy.network_mode, file).toBeUndefined();
      // `OMB_PHONE_RELAY=1` in .env reaches the server, never Caddy.
      expect(Object.keys(services.omb.environment), file).toContain("OMB_PHONE_RELAY");
      expect(Object.keys(services.caddy.environment ?? {}), file).not.toContain("OMB_PHONE_RELAY");
      expect(services.omb.ports, file).toBeUndefined();
      expect(services.caddy.ports.length, file).toBeGreaterThan(0);
      expect(services.omb.volumes, file).toContain("edge:/run/openmausbot");
      expect(services.caddy.volumes, file).toContain("edge:/run/openmausbot");
      expect(volumes.edge.driver_opts.type, file).toBe("tmpfs");
      const { OMB_TUNNEL_SOCKET: api, OMB_WEBHOOK_SOCKET: hooks } = services.omb.environment;
      expect([api, hooks], file).toEqual(["/run/openmausbot/http.sock", "/run/openmausbot/hooks.sock"]);
      const proxied = [...readFileSync(new URL(caddyfile, import.meta.url), "utf8").matchAll(/reverse_proxy (\S+)/g)].map((m) => m[1]);
      expect(proxied, caddyfile).toEqual([`unix/${hooks}`, `unix/${api}`]);
    }
  });
});