from pathlib import Path
import json
root = Path('/mnt/storage/src/mosaic-stack-rocko-178')
out = Path(__file__).resolve().parent
cases = []
def add(name, path, before, after, test, pattern, check):
    text = (root / path).read_text()
    assert text.count(before) == 1, (name, text.count(before))
    cases.append(dict(name=name, path=path, before=before, after=after, test=test, pattern=pattern, check=check))
serve = 'packages/webui/src/serve.mjs'
cli = 'packages/webui/src/cli.mjs'
http = 'packages/webui/tests/proof.test.mjs'
startup = 'packages/webui/tests/proof-cli.test.mjs'
service = 'scripts/webui-service.sh'
add('M01-auth-before-proof',serve,'    // The proof precedes every auth-header read, including the wrong-Host fence.',"    if (named && req.headersDistinct[preview.header]?.[0] !== preview.user) return json(res, 401, { error: 'sign-in required' });\n    // The proof precedes every auth-header read, including the wrong-Host fence.",http,'refuses missing wrong short','proof refusal precedes auth')
add('M02-wrong-equal-length',serve,' || !timingSafeEqual(value, proof.value)','',http,'refuses missing wrong short','same-length incorrect proof refuses')
add('M03-missing-proof',serve,'if (!value || value.length !== proof.value.length || !timingSafeEqual(value, proof.value))','if (value && (value.length !== proof.value.length || !timingSafeEqual(value, proof.value)))',http,'refuses missing wrong short','absent proof refuses')
add('M04-loopback-proof',serve,'if (!named && values) return json','if (false) return json',http,'header is refused on other Hosts','proof on nonpublic Host refuses')
add('M05-mode-0644',serve,'[0o600, 0o400].includes(st.mode & 0o7777)','[0o600, 0o400, 0o644].includes(st.mode & 0o7777)',startup,'startup refuses','0644 file refused')
add('M06-log-refusal',serve,"return json(res, 401, { error: 'proxy proof required' });","log(proof.value.toString('ascii')); return json(res, 401, { error: 'proxy proof required' });",http,'refuses missing wrong short','refusal log never includes proof')
add('M07-no-follow',serve,' | constants.O_NOFOLLOW','',startup,'startup refuses','fixture symlink refused')
add('M08-owner',serve,' || st.uid !== process.getuid()','',startup,'startup refuses','another uid refused')
add('M09-line-bytes',serve,'line.length < 32 || /[^A-Za-z0-9_-]/.test(line)','false',startup,'startup refuses','short/newline/bad-byte file refused')
add('M10-duplicate-proof',serve,"values?.length === 1 ? Buffer.from(values[0], 'utf8') : null","values?.length ? Buffer.from(values[0], 'utf8') : null",http,'refuses missing wrong short','duplicate header refused')
add('M11-tester-proof',serve,'if (tester && testerProofHeader && Object.hasOwn(req.headers, testerProofHeader.toLowerCase()))','if (false)',http,'header is refused on other Hosts','tester proof header refused')
add('M12-main-wiring',cli,'preview: options.preview, proof, send,','preview: options.preview, send,',startup,'CLI applies proof','actual CLI main listener checks proof')
add('M13-tester-wiring',cli,'testerProofHeader: proof?.header ?? null,','',startup,'CLI applies proof','actual CLI tester rejects proof header')
add('M14-service-location',service,'case "$proof_path" in "$REPO"|"$REPO"/*|"$copies_path"|"$copies_path"/*) die "proxy proof file must be outside the repository and copies" ;; esac',':', 'packages/webui/tests/service.test.mjs','proxy proof render refuses','render refuses repository/copy path')
add('M15-service-propagation',service,'flags="$flags --proof-header $PROOF_HEADER --proof-file $PROOF_FILE"',':','packages/webui/tests/service.test.mjs','proxy proof render carries','render carries both flags')
add('M16-release-preservation','scripts/stack-release.sh','    RUN_CONSOLE=("${P_CONSOLE[@]}")','    RUN_CONSOLE=("${P_CONSOLE[@]:0:4}")','packages/cli/tests/stack-release.test.mjs','T178 proxy proof header','pointer/unit preserve pair through re-pin and rollback')
add('M17-render-no-open',service,"        proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"","        cat -- \"$PROOF_FILE\" >/dev/null\n        proof_mode=\"$(stat -c '%a' -- \"$PROOF_FILE\")\"",'render-no-open.py','','render never opens or reads the fixture')
cases[-1]['command']=['python3',str(out/'render-no-open.py')]
add('M18-proof-send-status',service,'( --proof-header [^ ]+ --proof-file /[^ ]+)?','','packages/webui/tests/service.test.mjs','proxy proof status','proof flags retain send-on status')
add('Y2-render-owner',service,'[ "$proof_uid" = "$(id -u)" ]','true','packages/webui/tests/service.test.mjs','proxy proof render refuses','C1 render owner check')
add('Y3-render-auth-collision',service,'|"${AUTH_HEADER,,}"','','packages/webui/tests/service.test.mjs','proxy proof render refuses','C1 auth header case-insensitive collision')
add('Y4-render-absolute-path',service,'        case "$PROOF_FILE" in /*) ;; *) die "proxy proof file must be an absolute path" ;; esac','        :','packages/webui/tests/service.test.mjs','proxy proof render refuses','C1 absolute file path check')
add('Y5-render-path-charset',service,'        case "$PROOF_FILE" in *[!A-Za-z0-9/._+-]*) die "proxy proof path cannot be carried by the unit" ;; esac','        :','packages/webui/tests/service.test.mjs','proxy proof render refuses','C1 file path character check')
add('Y8-render-header-grammar',service,'        [[ "$PROOF_HEADER" =~ ^[A-Za-z0-9][A-Za-z0-9-]{0,63}$ ]] || die "invalid proxy proof header"','        :','packages/webui/tests/service.test.mjs','proxy proof render refuses','C1 proof header grammar')
add('Y6-empty-loopback-proof',serve,'if (!named && values)','if (!named && values?.[0])',http,'header is refused on other Hosts','N2 empty proof header presence on loopback')
(out/'mutant-sites.json').write_text(json.dumps(cases, indent=2)+'\n')
print('PREFLIGHT', len(cases), 'exact-once sites')