#!/bin/bash
# TDD file lock — runs as root before agent user takes over.
# Creates a root-owned immutable reference copy of tests/ and locks the
# working copy so the agent cannot write to any test file.
set -euo pipefail

if [ ! -d "/workspace/tests" ]; then
    echo "[tdd-file-lock] No /workspace/tests found — nothing to protect."
    exit 0
fi

echo "[tdd-file-lock] Locking test files (running as $(id))..."

# Root-owned reference copy — agent cannot chmod/write/delete these
mkdir -p /workspace/reference/tests
cp -r /workspace/tests/. /workspace/reference/tests/
chown -R root:root /workspace/reference/tests
find /workspace/reference/tests -type f -exec chmod 444 {} \;
find /workspace/reference/tests -type d -exec chmod 555 {} \;

# SHA256 checksums for post-task external verification
find /workspace/tests -name "*.py" | sort | xargs sha256sum > /workspace/.test-shas
chown root:root /workspace/.test-shas
chmod 444 /workspace/.test-shas

# Lock the working tests/ directory — files and dirs owned by root, no write for anyone
chown -R root:root /workspace/tests
find /workspace/tests -type f -exec chmod 444 {} \;
find /workspace/tests -type d -exec chmod 555 {} \;

TEST_COUNT=$(find /workspace/tests -name "*.py" | wc -l)
echo "[tdd-file-lock] Protected ${TEST_COUNT} test files."
echo "[tdd-file-lock] Immutable reference: /workspace/reference/tests/"
echo "[tdd-file-lock] SHA256 reference:    /workspace/.test-shas"