import { describe, expect, it, beforeEach, afterEach } from 'vitest';

// Test that the ACP stdio transport uses buildChildEnv() instead of process.env.
// We can't easily test the actual spawn, but we can verify the import is correct
// by checking the module's source code pattern.

describe('ACP stdio transport env sanitization', () => {
  const originalEnv = process.env;

  beforeEach(() => {
    // Plant a fake API key in process.env
    process.env = { ...originalEnv, ANTHROPIC_API_KEY: 'sk-ant-test-secret-123' };
  });

  afterEach(() => {
    process.env = originalEnv;
  });

  it('buildChildEnv strips API keys from child environment', async () => {
    // Import buildChildEnv directly to verify it strips secrets
    const { buildChildEnv } = await import('@wrongstack/core');
    const childEnv = buildChildEnv();

    // API keys should NOT be forwarded
    expect(childEnv['ANTHROPIC_API_KEY']).toBeUndefined();
    expect(childEnv['OPENAI_API_KEY']).toBeUndefined();

    // System vars SHOULD be forwarded. The home-directory variable is
    // platform-specific: POSIX uses HOME, Windows uses USERPROFILE (HOME is
    // often unset there).
    expect(childEnv['PATH']).toBeDefined();
    const homeVar = process.platform === 'win32' ? 'USERPROFILE' : 'HOME';
    expect(childEnv[homeVar]).toBeDefined();
  });

  it('buildChildEnv preserves non-secret env vars', async () => {
    process.env['MY_CUSTOM_VAR'] = 'safe-value';
    const { buildChildEnv } = await import('@wrongstack/core');
    const childEnv = buildChildEnv();

    // Non-secret custom vars should pass through
    // (MY_CUSTOM_VAR doesn't match any secret pattern)
    // Note: it may or may not pass through depending on the allowlist.
    // The key assertion is that API keys are stripped.
    expect(childEnv['ANTHROPIC_API_KEY']).toBeUndefined();
  });

  it('passthrough mode forwards all env vars including secrets', async () => {
    process.env['WRONGSTACK_CHILD_ENV_PASSTHROUGH'] = '1';
    process.env['CI'] = ''; // Clear CI to enable passthrough
    const { buildChildEnv } = await import('@wrongstack/core');
    const childEnv = buildChildEnv();

    // In passthrough mode, everything should be forwarded
    expect(childEnv['ANTHROPIC_API_KEY']).toBe('sk-ant-test-secret-123');

    delete process.env['WRONGSTACK_CHILD_ENV_PASSTHROUGH'];
  });
});
