path: root/test/snapshot.zig

// pardes-snap: drive a pardes binary with a scripted input trace in a pty and
// capture the rendered grid at named sync points. The same script run against
// the prototype and the rewrite must produce byte-identical captures — this is
// the old-vs-new parity oracle for the rewrite.
//
//   zig build snap                        run all snapshots/*.snap, diff goldens
//   zig build snap -- --update            regenerate goldens from this binary
//   zig build snap -- snapshots/boot.snap one script
//   zig build snap -- --jobs=1            serial (default: 1.25 per cpu)
//   zig build snap -- --trace-stable      show what every `stable` waited on
//
// Scripts run one per forked child, in parallel; each child's report is held
// in a temp file and printed in script order at the end. The runner takes its
// own lockfile, so `zig build snap` never needs an `flock` wrapper: a second
// run waits for the first instead of trampling the fixed /tmp paths that the
// goldens record verbatim. A script that fails in the parallel pass is re-run
// alone before it counts as a failure.
//
// `stable` no longer burns its wall-clock window: it returns as soon as the
// app is provably done — screen unchanged, pty empty, and every process it
// forked asleep (see waitStable). That, the fan-out, and building the vendored
// C optimized (build.zig's c_optimize: 90% of a Debug startup used to be
// tree-sitter's query analyser at -O0) took the suite from 7m54s to ~4s. The
// app now reaches first paint in ~25ms, so what is left is mostly real work:
// bash spawns, their output, and the 40 `settle`s after `key esc`.
//
// Script commands (line-oriented, # comments):
//   file <name> <content>     create file in the script's cwd (before start)
//   lines <name> <n>          create file with n numbered lines
//   dirmk <name>              create a subdirectory
//   start <rows> <cols> [arg] fork the app in a pty (optional extra CLI arg)
//   wait <ms> <needle...>     pump until needle appears on the grid (fails hard)
//   settle <ms>               pump for a fixed duration
//   stable <quiet_ms> <timeout_ms>  pump until the grid stops changing
//   text <literal>            send literal bytes
//   send <escaped>            send with \e \r \n \t \\ \xNN escapes
//   key <names...>            enter esc tab bs space up down left right home end
//                             pgup pgdn c-<ch> a-<ch>   (after esc: settle, or
//                             vaxis reads the next byte in the same batch and
//                             parses it as alt-<ch>. The scripts said 700ms and
//                             it cost the suite 28s; there is no timer in vaxis
//                             to outlast — 20ms passes, they use 100ms)
//   press|release <[ctrl-]left|middle|right> <col> <row>   SGR mouse, 1-based
//   drag <btn> <col> <row>    motion with button held
//   motion <col> <row>        button-less motion (hover)
//   wheel <up|down> <col> <row>
//   resize <rows> <cols>
//   snap <label>              capture grid text + cursor
//   snapstyle <label>         capture per-cell style runs (fg,bg,attrs)
const std = @import("std");
const libc = std.c;
const ghostty_vt = @import("ghostty-vt");
const eh = @import("e2e_harness.zig");

// This harness parses the app's output with its OWN ghostty-vt, which narrates
// every sequence it does not implement — vaxis's startup capability probes
// alone cost four `debug(stream)`/`warning(stream)`/`debug(kitty_gfx)` lines
// per script, burying the PASS/FAIL report under 200 lines of chatter. Cut the
// libraries back to errors; the report itself goes through std.debug, so a
// failure stays loud either way.
pub const std_options: std.Options = .{ .log_level = .err };

extern "c" fn setenv(name: [*:0]const u8, value: [*:0]const u8, overwrite: c_int) c_int;
extern "c" fn execvp(file: [*:0]const u8, argv: [*:null]const ?[*:0]const u8) c_int;

const SNAP_BASE = "/tmp/pardes-snap";
var trace_stable = false;
/// set for the serial re-run pass; children widen their probes (see beCareful)
var careful = false;
const gpa = std.heap.page_allocator;

pub fn main(init: std.process.Init) !void {
    var arena_state = std.heap.ArenaAllocator.init(gpa);
    defer arena_state.deinit();
    const arena = arena_state.allocator();
    const args = try init.minimal.args.toSlice(init.arena.allocator());

    // argv: exe-under-test, then flags/scripts. All paths made absolute up
    // front because runScript chdirs into a per-script workdir.
    var cwd_buf: [4096]u8 = undefined;
    const cwd_p = libc.getcwd(&cwd_buf, cwd_buf.len) orelse fatal("getcwd failed", .{});
    const orig_cwd = std.mem.span(@as([*:0]u8, @ptrCast(cwd_p)));

    var exe: ?[]const u8 = null;
    var update = false;
    // Slight oversubscription: a script spends most of its life waiting on a
    // shell, not computing. Measured on 16 cores: 16 jobs 4.4s, 20 jobs 3.9s,
    // 24 jobs 3.7s but losing the idle-probe bet often enough that the re-run
    // pass costs more than the extra parallelism saves.
    const cpus = std.Thread.getCpuCount() catch 4;
    var jobs: usize = cpus + cpus / 4;
    var scripts: std.ArrayList([]const u8) = .empty;
    for (args[1..]) |a| {
        if (std.mem.eql(u8, a, "--update")) {
            update = true;
        } else if (std.mem.eql(u8, a, "--trace-stable")) {
            trace_stable = true;
        } else if (std.mem.startsWith(u8, a, "--jobs=")) {
            jobs = @max(1, try std.fmt.parseInt(usize, a["--jobs=".len..], 10));
        } else if (exe == null) {
            exe = try absPath(arena, orig_cwd, a);
        } else {
            try scripts.append(arena, try absPath(arena, orig_cwd, a));
        }
    }
    if (exe == null) fatal("usage: pardes-snap <exe> [scripts...] [--update] [--jobs=N]", .{});
    const exe_z = try arena.dupeZ(u8, exe.?);

    if (scripts.items.len == 0) {
        try listSnaps(arena, try absPath(arena, orig_cwd, "test/snapshots"), &scripts);
        std.mem.sort([]const u8, scripts.items, {}, struct {
            fn lt(_: void, x: []const u8, y: []const u8) bool {
                return std.mem.lessThan(u8, x, y);
            }
        }.lt);
    }
    if (scripts.items.len == 0) fatal("no .snap scripts found", .{});

    try mkdir(arena, SNAP_BASE, true);
    // one run at a time (this is the flock that used to be typed by hand)
    _ = lockOrWait(SNAP_BASE ++ "/.run.lock", "another pardes-snap run");

    const codes = try arena.alloc(u8, scripts.items.len);
    try runBatch(arena, exe_z, toBatch(arena, scripts.items), update, jobs, codes);

    // A failure in the parallel pass is more often contention than regression:
    // the app can lose a race with a kworker while 20 siblings fight for the
    // cpu. So a failure is re-run alone before it counts — first at the normal
    // probe settings, which is usually all an idle machine needs, and only if
    // it fails AGAIN with the probes widened (beCareful), which is slow but
    // decides. A wholesale failure is not flakiness, so past a handful there is
    // nothing to re-check.
    if (jobs > 1) {
        var round: usize = 0;
        while (round < 2) : (round += 1) {
            var retry: std.ArrayList(usize) = .empty;
            for (codes, 0..) |c, i| if (c != 0) try retry.append(arena, i);
            if (retry.items.len == 0 or retry.items.len > 10) break;
            const paths = try arena.alloc(Idx, retry.items.len);
            for (retry.items, paths, 0..) |i, *p, n| p.* = .{ .path = scripts.items[i], .code_idx = n };
            std.debug.print("re-running {d} failed script(s) serially{s}:", .{
                paths.len,
                if (round == 0) "" else " with wider settle probes",
            });
            for (paths) |p| std.debug.print(" {s}", .{std.fs.path.stem(p.path)});
            std.debug.print("\n", .{});
            careful = round > 0;
            const recodes = try arena.alloc(u8, paths.len);
            try runBatch(arena, exe_z, paths, update, 1, recodes);
            for (retry.items, recodes) |i, c| codes[i] = c;
        }
    }

    var failed: usize = 0;
    for (scripts.items, codes) |script_path, code| {
        const report = readFileAlloc(arena, reportPath(arena, script_path) catch "") catch "";
        std.debug.print("{s}", .{report});
        if (code != 0) {
            failed += 1;
            if (report.len == 0)
                std.debug.print("FAIL {s}: child died with no report\n", .{std.fs.path.stem(script_path)});
        }
    }
    if (failed > 0) {
        std.debug.print("{d}/{d} snapshot scripts FAILED\n", .{ failed, scripts.items.len });
        std.process.exit(1);
    }
    std.debug.print("all {d} snapshot scripts ok\n", .{scripts.items.len});
}

/// Run `scripts` `jobs` at a time, one forked child each, filling `codes` with
/// their exit codes. Forking rather than threading because runScript owns
/// process-global state — chdir into its workdir, HOME/TERM/PARDES_DUMP in the
/// environment — which siblings must not see. Each child's report goes to its
/// own file and is replayed in script order by the caller, so parallelism
/// never interleaves a diff.
// Scripts run in the order given — alphabetical. Sorting longest-first (from
// the durations the previous run left in its reports) is the textbook makespan
// fix and it measured WORSE here: 3.0s when clean, but bunching the heavy
// scripts at t=0 makes them contend, the idle probes lose their bet, and the
// re-run pass costs more than the tail ever did (13-20s runs). Left alone.
const Idx = struct { path: []const u8, code_idx: usize };

fn toBatch(arena: std.mem.Allocator, scripts: []const []const u8) []const Idx {
    const out = arena.alloc(Idx, scripts.len) catch return &.{};
    for (scripts, out, 0..) |path, *o, i| o.* = .{ .path = path, .code_idx = i };
    return out;
}

fn runBatch(
    arena: std.mem.Allocator,
    exe_z: [:0]const u8,
    scripts: []const Idx,
    update: bool,
    jobs: usize,
    codes: []u8,
) !void {
    const Job = struct { pid: libc.pid_t, idx: usize };
    var running: std.ArrayList(Job) = .empty;
    defer running.deinit(arena);
    var next: usize = 0;
    while (next < scripts.len or running.items.len > 0) {
        while (next < scripts.len and running.items.len < jobs) : (next += 1) {
            const idx = next;
            const pid = libc.fork();
            if (pid == 0) std.process.exit(runOne(arena, exe_z, scripts[idx].path, update));
            if (pid < 0) fatal("fork failed", .{});
            try running.append(arena, .{ .pid = pid, .idx = scripts[idx].code_idx });
        }
        var status: c_int = 0;
        const pid = libc.waitpid(-1, &status, 0);
        for (running.items, 0..) |j, i| {
            if (j.pid != pid) continue;
            // a killed child (crash in the harness itself) counts as a failure
            codes[j.idx] = if (status == 0) 0 else 1;
            _ = running.swapRemove(i);
            break;
        }
    }
}

/// One script, in its own process: run it, then diff or update its golden.
/// Everything it prints lands in its report file (dup2'd over stdout/stderr).
/// Returns the child's exit code.
fn runOne(arena: std.mem.Allocator, exe_z: [:0]const u8, script_path: []const u8, update: bool) u8 {
    if (careful) beCareful();
    const stem = std.fs.path.stem(script_path);
    const report_z = arena.dupeZ(u8, reportPath(arena, script_path) catch return 1) catch return 1;
    const fd = libc.open(report_z, .{ .ACCMODE = .WRONLY, .CREAT = true, .TRUNC = true }, @as(libc.mode_t, 0o644));
    if (fd >= 0) {
        _ = libc.dup2(fd, 1);
        _ = libc.dup2(fd, 2);
        _ = libc.close(fd);
    }
    const base_path = script_path[0 .. script_path.len - ".snap".len];
    const golden_path = std.fmt.allocPrint(arena, "{s}.golden", .{base_path}) catch return 1;
    const golden: ?[]u8 = readFileAlloc(arena, golden_path) catch null;
    const started = eh.nowMs();
    const out = runScript(arena, exe_z, script_path, stem) catch |e| {
        std.debug.print("FAIL {s}: script error {s}\n", .{ stem, @errorName(e) });
        return 1;
    };
    const took = eh.nowMs() - started;
    if (update) {
        eh.writeFile(arena.dupeZ(u8, golden_path) catch return 1, out) catch return 1;
        std.debug.print("UPDATED {s} ({d} bytes)\n", .{ stem, out.len });
        return 0;
    }
    if (golden == null) {
        std.debug.print("FAIL {s}: no golden (run with -- --update)\n", .{stem});
        return 1;
    }
    if (std.mem.eql(u8, golden.?, out)) {
        std.debug.print("PASS {s} ({d}ms)\n", .{ stem, took });
        return 0;
    }
    const actual_path = std.fmt.allocPrint(arena, "{s}.actual", .{base_path}) catch return 1;
    eh.writeFile(arena.dupeZ(u8, actual_path) catch return 1, out) catch {};
    std.debug.print("FAIL {s}: differs from golden (actual written to {s})\n", .{ stem, actual_path });
    printFirstDiff(golden.?, out);
    return 1;
}

fn reportPath(arena: std.mem.Allocator, script_path: []const u8) ![]const u8 {
    return std.fmt.allocPrint(arena, "{s}/{s}.report", .{ SNAP_BASE, std.fs.path.stem(script_path) });
}

/// Exclusive flock on `path`, announcing the wait if someone else holds it.
/// The fd is deliberately leaked: the lock lives until the process exits.
///
/// CLOEXEC is load-bearing. flock lives on the open file description, so an
/// inherited fd keeps the lock — and this process forks a pty full of app and
/// shell processes that can outlive it. Without CLOEXEC an orphaned bash holds
/// the lock forever and every later script blocks in flock().
fn lockOrWait(path: [*:0]const u8, what: []const u8) libc.fd_t {
    const fd = libc.open(path, .{ .ACCMODE = .WRONLY, .CREAT = true, .CLOEXEC = true }, @as(libc.mode_t, 0o644));
    if (fd < 0) fatal("cannot open lockfile {s}", .{path});
    if (libc.flock(fd, std.posix.LOCK.EX | std.posix.LOCK.NB) == 0) return fd;
    // polled rather than a blocking flock so a stuck holder is reported instead
    // of hanging the run until someone notices. The cap clears a full serial
    // run (--jobs=1 is ~6 minutes) with room to spare.
    std.debug.print("waiting for {s}...\n", .{what});
    var waited_ms: i64 = 0;
    while (waited_ms < 600_000) : (waited_ms += 100) {
        var none: [0]std.posix.pollfd = .{};
        _ = std.posix.poll(&none, 100) catch {};
        if (libc.flock(fd, std.posix.LOCK.EX | std.posix.LOCK.NB) == 0) return fd;
    }
    fatal("gave up after 10 minutes waiting for {s} ({s})", .{ what, path });
}

fn runScript(arena: std.mem.Allocator, exe_z: [:0]const u8, script_path: []const u8, stem: []const u8) ![]u8 {
    const src = try readFileAlloc(arena, script_path);

    // Fixed, recreated-per-run workdir: its PATH shows up in pane tags, so it
    // must be identical across runs and across old/new binaries.
    const base = try std.fmt.allocPrint(arena, "{s}/{s}", .{ SNAP_BASE, stem });
    rmrf(base);
    try mkdir(arena, SNAP_BASE, true);
    try mkdir(arena, base, false);
    const home = try std.fmt.allocPrint(arena, "{s}/home", .{base});
    const work = try std.fmt.allocPrint(arena, "{s}/cwd", .{base});
    try mkdir(arena, home, false);
    try mkdir(arena, work, false);
    // deterministic shell: fixed prompt, no history, no user rc leakage
    try eh.writeFile(try std.fmt.allocPrintSentinel(arena, "{s}/.bashrc", .{home}, 0), "PS1='$ '\nHISTFILE=\n");
    _ = setenv("HOME", try arena.dupeZ(u8, home), 1);
    _ = setenv("TERM", "xterm-256color", 1);
    _ = setenv("LC_ALL", "C", 1);
    // durations cannot live in a golden; the lsp introspection views print
    // `-` for them when this is set (see lsp_zls.zig hideTime)
    _ = setenv("PARDES_LSP_NOTIME", "1", 1);
    // Pin the dump path: live runs use a timestamped file under the user data
    // dir (dump.outPath), which would make the dump/load/restore goldens
    // nondeterministic. Per-SCRIPT, not one shared /tmp/pardes-dump.zon: four
    // scripts write it and read it back, and sharing it meant they could only
    // take turns — which cost more wall clock than the other 51 scripts put
    // together. Scripts name it `$DUMP`.
    const dump_path = try std.fmt.allocPrint(arena, "{s}/dump.zon", .{base});
    _ = setenv("PARDES_DUMP", try arena.dupeZ(u8, dump_path), 1);
    if (chdirRc(try arena.dupeZ(u8, work)) < 0) return error.ChdirFailed;

    var out: std.ArrayList(u8) = .empty;
    var h: ?eh.Harness = null;
    defer if (h) |*hp| hp.deinit();

    var lines_it = std.mem.splitScalar(u8, src, '\n');
    var lineno: usize = 0;
    while (lines_it.next()) |raw_line| {
        lineno += 1;
        const trimmed = std.mem.trim(u8, raw_line, " \t\r");
        if (trimmed.len == 0 or trimmed[0] == '#') continue;
        // `$DUMP` is the script's own PARDES_DUMP file (see above)
        const line = if (std.mem.indexOf(u8, trimmed, "$DUMP") == null) trimmed else blk: {
            const buf = try arena.alloc(u8, std.mem.replacementSize(u8, trimmed, "$DUMP", dump_path));
            _ = std.mem.replace(u8, trimmed, "$DUMP", dump_path, buf);
            break :blk buf;
        };
        var tok = std.mem.tokenizeScalar(u8, line, ' ');
        const cmd = tok.next().?;
        errdefer std.debug.print("  at {s}:{d}: {s}\n", .{ script_path, lineno, line });

        if (std.mem.eql(u8, cmd, "file")) {
            const name = tok.next() orelse return error.BadScript;
            try eh.writeFile(try arena.dupeZ(u8, name), try unescape(arena, tok.rest()));
        } else if (std.mem.eql(u8, cmd, "lines")) {
            const name = tok.next() orelse return error.BadScript;
            const n = try std.fmt.parseInt(usize, tok.next() orelse return error.BadScript, 10);
            var buf: std.ArrayList(u8) = .empty;
            for (1..n + 1) |i| try buf.appendSlice(arena, try std.fmt.allocPrint(arena, "line {d}\n", .{i}));
            try eh.writeFile(try arena.dupeZ(u8, name), buf.items);
        } else if (std.mem.eql(u8, cmd, "ppmdiag")) {
            // The diagonal-split test PPM from the old e2e (white over blue),
            // grown to 512x512 with the white half filled by a fixed LCG
            // noise. Both halves are load-bearing: the clean edge is what the
            // block/sextant glyphs match exactly, the noise is fine enough
            // (one source pixel per matcher subcell at this size) that the
            // ASCII bitmaps win instead — so the Ascii toggle visibly changes
            // the art, which a 64x64 image cannot show (its cells average
            // down to flat color and a block always wins).
            const name = tok.next() orelse return error.BadScript;
            var ppm: std.ArrayList(u8) = .empty;
            try ppm.appendSlice(arena, "P6\n512 512\n255\n");
            var seed: u64 = 12345;
            var py: usize = 0;
            while (py < 512) : (py += 1) {
                var px: usize = 0;
                while (px < 512) : (px += 1) {
                    seed = seed *% 1103515245 +% 12345;
                    const v: u8 = @truncate(seed >> 16);
                    try ppm.appendSlice(arena, if (px + py < 512) &[_]u8{ v, v, v } else &[_]u8{ 0, 0, 255 });
                }
            }
            try eh.writeFile(try arena.dupeZ(u8, name), ppm.items);
        } else if (std.mem.eql(u8, cmd, "dirmk")) {
            try mkdir(arena, tok.next() orelse return error.BadScript, false);
        } else if (std.mem.eql(u8, cmd, "start")) {
            const rows = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const cols = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            var extra: [6]?[*:0]const u8 = @splat(null);
            var nextra: usize = 0;
            while (tok.next()) |a| : (nextra += 1) {
                if (nextra >= extra.len) return error.BadScript;
                extra[nextra] = (try arena.dupeZ(u8, a)).ptr;
            }
            if (h) |*hp| hp.deinit(); // scripts may restart (e.g. dump then -l)
            h = try eh.Harness.initArgv(gpa, exe_z.ptr, rows, cols, extra[0..nextra]);
        } else if (std.mem.eql(u8, cmd, "snapfile")) {
            const label = tok.next() orelse return error.BadScript;
            const contents = try readFileAlloc(arena, tok.rest());
            try out.appendSlice(arena, try std.fmt.allocPrint(arena, "== file {s}\n", .{label}));
            // elide base64 payloads: they encode raw pty byte HISTORY, whose
            // micro-timing (prompt redraw cycles) legitimately differs between
            // implementations; the cleaned text fields are the contract.
            var flines = std.mem.splitScalar(u8, contents, '\n');
            while (flines.next()) |fl| {
                if (std.mem.indexOf(u8, fl, "_b64 = \"") != null) {
                    const eq = std.mem.indexOf(u8, fl, "=").?;
                    try out.appendSlice(arena, fl[0 .. eq + 1]);
                    try out.appendSlice(arena, " <elided>\n");
                } else {
                    try out.appendSlice(arena, fl);
                    try out.append(arena, '\n');
                }
            }
            try out.appendSlice(arena, "== end file\n");
        } else if (std.mem.eql(u8, cmd, "wait")) {
            const ms = try std.fmt.parseInt(i64, tok.next() orelse return error.BadScript, 10);
            try live(&h).expectWaitFor(tok.rest(), ms, "snapshot wait");
        } else if (std.mem.eql(u8, cmd, "settle")) {
            try live(&h).pump(try std.fmt.parseInt(i64, tok.next() orelse return error.BadScript, 10));
        } else if (std.mem.eql(u8, cmd, "stable")) {
            const quiet = try std.fmt.parseInt(i64, tok.next() orelse return error.BadScript, 10);
            const timeout = try std.fmt.parseInt(i64, tok.next() orelse return error.BadScript, 10);
            try waitStable(live(&h), quiet, timeout);
        } else if (std.mem.eql(u8, cmd, "text")) {
            try live(&h).send(tok.rest());
        } else if (std.mem.eql(u8, cmd, "send")) {
            try live(&h).send(try unescape(arena, tok.rest()));
        } else if (std.mem.eql(u8, cmd, "key")) {
            while (tok.next()) |name| try live(&h).send(keyBytes(name) orelse return error.BadKey);
        } else if (std.mem.eql(u8, cmd, "press") or std.mem.eql(u8, cmd, "release") or std.mem.eql(u8, cmd, "drag")) {
            const btn = buttonCode(tok.next() orelse return error.BadScript) orelse return error.BadScript;
            const col = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const row = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const b: u16 = if (std.mem.eql(u8, cmd, "drag")) btn + 32 else btn;
            const fin: u8 = if (std.mem.eql(u8, cmd, "release")) 'm' else 'M';
            try live(&h).send(try std.fmt.allocPrint(arena, "\x1b[<{d};{d};{d}{c}", .{ b, col, row, fin }));
        } else if (std.mem.eql(u8, cmd, "motion")) {
            const col = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const row = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            try live(&h).send(try std.fmt.allocPrint(arena, "\x1b[<35;{d};{d}M", .{ col, row }));
        } else if (std.mem.eql(u8, cmd, "wheel")) {
            const dir = tok.next() orelse return error.BadScript;
            const b: u16 = if (std.mem.eql(u8, dir, "up")) 64 else 65;
            const col = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const row = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            try live(&h).send(try std.fmt.allocPrint(arena, "\x1b[<{d};{d};{d}M", .{ b, col, row }));
        } else if (std.mem.eql(u8, cmd, "resize")) {
            const rows = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            const cols = try std.fmt.parseInt(u16, tok.next() orelse return error.BadScript, 10);
            try live(&h).resize(rows, cols);
        } else if (std.mem.eql(u8, cmd, "snap")) {
            try snapText(arena, &out, live(&h), tok.rest());
        } else if (std.mem.eql(u8, cmd, "snapstyle")) {
            try snapStyle(arena, &out, live(&h), tok.rest());
        } else {
            std.debug.print("unknown command {s}\n", .{cmd});
            return error.BadScript;
        }
    }
    return out.items;
}

fn live(h: *?eh.Harness) *eh.Harness {
    if (h.*) |*v| return v;
    fatal("script used the app before `start`", .{});
}

/// Pump until the captured state — grid text AND cursor — has not changed for
/// `quiet` ms (bounded by `timeout`). The one sync primitive that needs no
/// needle: used before every snap so old and new binaries are compared at
/// rest, not mid-repaint.
///
/// Same oracle as before, timed continuously instead of in fixed windows. The
/// old loop pumped a whole `quiet` window, compared, and pumped another — so
/// even an app that fell silent immediately cost 2 × 700ms, and 446 `stable`s
/// cost the suite ten minutes. This one sleeps in poll until the app writes,
/// and returns `quiet` ms after the LAST change. Waiting on the change rather
/// than on silence is what keeps it honest: pardes finishes a repaint with a
/// late cursor move, hundreds of ms after its last burst of text.
fn waitStable(h: *eh.Harness, quiet: i64, timeout: i64) !void {
    const t0 = eh.nowMs();
    const deadline = t0 + timeout;
    var prev = try stateKey(h);
    defer h.gpa.free(prev);
    var last_change = t0;
    var asleep_since: i64 = 0;
    while (true) {
        const now = eh.nowMs();
        const since = now - last_change;
        if (since >= quiet) {
            if (trace_stable) std.debug.print("[stable q={d}] window: last change +{d}ms, cost {d}ms\n", .{ quiet, last_change - t0, now - t0 });
            return;
        }
        // Fast path: the screen has held still, the pty is empty in both
        // directions (so the app has CONSUMED everything the script just sent
        // — otherwise an app still asleep in its event loop looks finished),
        // and nothing in its process tree is runnable. Held across two probes,
        // because a pane's shell can write and sleep a scheduler tick before
        // the app wakes to read it.
        if (since >= probe_after_ms and h.pending() == 0 and treeAsleep(h.pid)) {
            if (asleep_since == 0) {
                asleep_since = now;
            } else if (now - asleep_since >= probe_hold_ms) {
                if (trace_stable) std.debug.print("[stable q={d}] asleep: last change +{d}ms, cost {d}ms\n", .{ quiet, last_change - t0, now - t0 });
                return;
            }
        } else if (since >= probe_after_ms) {
            asleep_since = 0;
        }
        if (now >= deadline) return error.NeverStable;
        const nap = if (since >= probe_after_ms) probe_every_ms else probe_after_ms - since;
        if (!try h.pumpOnce(@min(nap, deadline - now))) continue;
        while (try h.pumpOnce(0)) {} // drain the burst before comparing
        const cur = try stateKey(h);
        if (std.mem.eql(u8, cur, prev)) {
            h.gpa.free(cur);
            continue;
        }
        h.gpa.free(prev);
        prev = cur;
        if (trace_stable) std.debug.print("[stable q={d}]   change at +{d}ms (gap {d}ms)\n", .{ quiet, eh.nowMs() - t0, eh.nowMs() - last_change });
        last_change = eh.nowMs();
        asleep_since = 0;
    }
}

// How long the screen must hold still before the sleep probe is trusted at all,
// how often it is taken, and how long it must stay true.
//
// The hold is the one number that cannot be reasoned down to zero. When the app
// writes to a pane's pty the kernel parks the bytes in a flip buffer and leaves
// the hand-off to a kworker: until that runs, the app is asleep, the shell is
// asleep, nothing is runnable and no /proc or ioctl query can see the round trip
// in flight (a pty master cannot even be reopened through /proc/<pid>/fd — it
// mints a fresh pty). So the hold is a bet on kworker latency, and a loaded
// machine loses it. The parallel pass bets small; the serial re-run that decides
// the verdict bets big.
var probe_after_ms: i64 = 10;
const probe_every_ms: i64 = 5;
var probe_hold_ms: i64 = 50;

/// Widen the probes for the re-run pass: nothing else is competing then, so the
/// extra wait is cheap, and its verdict is the one that gets reported.
fn beCareful() void {
    probe_after_ms = 40;
    probe_hold_ms = 300;
}

/// Is every process in the app's tree asleep? Walks /proc from the app's pid
/// through `children`, checking every thread's run state: `R` (runnable) or
/// `D` (uninterruptible) anywhere means work is still in flight — a repaint,
/// a fork, a shell mid-command — so a quiet pty proves nothing. Anything else
/// (`S`, or a zombie waiting to be reaped) is idle.
///
/// This is what replaces the wall-clock window: the app finishes a keystroke
/// in ~10ms, and the scripts' 400-700ms `stable` windows were insurance
/// against not being able to tell "finished" from "paused mid-fork".
fn treeAsleep(root: libc.pid_t) bool {
    var stack: [64]libc.pid_t = undefined;
    stack[0] = root;
    var n: usize = 1;
    var path_buf: [64:0]u8 = undefined;
    var buf: [4096]u8 = undefined;
    while (n > 0) {
        n -= 1;
        const pid = stack[n];
        const dir_path = std.fmt.bufPrintZ(&path_buf, "/proc/{d}/task", .{pid}) catch continue;
        const dir = libc.opendir(dir_path) orelse continue; // exited between steps
        defer _ = libc.closedir(dir);
        while (libc.readdir(dir)) |d| {
            const tid = std.mem.sliceTo(@as([*:0]const u8, @ptrCast(&d.name)), 0);
            if (tid[0] == '.') continue;
            const stat = readProc(&buf, std.fmt.bufPrintZ(&path_buf, "/proc/{d}/task/{s}/stat", .{ pid, tid }) catch continue) orelse continue;
            // "pid (comm) S ..." — comm can hold spaces and parens, so the
            // state is the char two past the LAST ')'
            const close = std.mem.lastIndexOfScalar(u8, stat, ')') orelse continue;
            if (close + 2 >= stat.len) continue;
            switch (stat[close + 2]) {
                // R/D: still working. Z: just exited, so its parent is about to
                // be woken to reap it and carry on — a pane's shell sitting in
                // wait4 over a zombie `ls` looks asleep, but the prompt it is
                // about to print is what hides the echoed command line in the
                // goldens.
                'R', 'D', 'Z' => return false,
                else => {},
            }
            const kids = readProc(&buf, std.fmt.bufPrintZ(&path_buf, "/proc/{d}/task/{s}/children", .{ pid, tid }) catch continue) orelse continue;
            var it = std.mem.tokenizeAny(u8, kids, " \n");
            while (it.next()) |k| {
                if (n >= stack.len) return false; // deeper than we can walk: assume busy
                stack[n] = std.fmt.parseInt(libc.pid_t, k, 10) catch continue;
                n += 1;
            }
        }
    }
    return true;
}

/// Read a small /proc file into `buf` (procfs needs one read, no stat).
fn readProc(buf: []u8, path: [*:0]const u8) ?[]const u8 {
    const fd = libc.open(path, .{ .ACCMODE = .RDONLY, .CLOEXEC = true });
    if (fd < 0) return null;
    defer _ = libc.close(fd);
    const got = libc.read(fd, buf.ptr, buf.len);
    if (got <= 0) return null;
    return buf[0..@intCast(got)];
}

/// What a `snap` capture is made of: the grid text plus the cursor cell.
fn stateKey(h: *eh.Harness) ![]u8 {
    const text = try h.screenText();
    defer h.gpa.free(text);
    const c = h.cursor();
    return std.fmt.allocPrint(h.gpa, "{d},{d}\n{s}", .{ c.x, c.y, text });
}

fn snapText(arena: std.mem.Allocator, out: *std.ArrayList(u8), h: *eh.Harness, label: []const u8) !void {
    const text = try h.screenText();
    defer h.gpa.free(text);
    const c = h.cursor();
    try out.appendSlice(arena, try std.fmt.allocPrint(arena, "== snap {s} grid={d}x{d} cursor={d},{d}\n", .{ label, h.cols, h.rows, c.x, c.y }));
    var it = std.mem.splitScalar(u8, text, '\n');
    var row: usize = 0;
    while (row < h.rows) : (row += 1) {
        const line = it.next() orelse "";
        try out.append(arena, '|');
        try out.appendSlice(arena, std.mem.trimEnd(u8, line, " "));
        try out.append(arena, '\n');
    }
}

/// Per-row style runs from the harness emulator: `|y: x0-x1 fg,bg,attrs ...`.
/// fg/bg: d (default) | pN (palette) | #rrggbb. attrs: b f i k r v x + u U ~ . -
/// for underline single/double/curly/dotted/dashed.
fn snapStyle(arena: std.mem.Allocator, out: *std.ArrayList(u8), h: *eh.Harness, label: []const u8) !void {
    try out.appendSlice(arena, try std.fmt.allocPrint(arena, "== style {s}\n", .{label}));
    var y: u16 = 0;
    while (y < h.rows) : (y += 1) {
        try out.appendSlice(arena, try std.fmt.allocPrint(arena, "|{d}:", .{y}));
        var run_buf: [64]u8 = undefined;
        var key_buf: [64]u8 = undefined;
        var run_key: []const u8 = "";
        var run_start: u16 = 0;
        var x: u16 = 0;
        while (x <= h.cols) : (x += 1) {
            const key: []const u8 = if (x == h.cols) "\x00end" else cellKey(h, x, y, &key_buf);
            if (x == 0) {
                run_key = try arena.dupe(u8, key);
                continue;
            }
            if (std.mem.eql(u8, key, run_key)) continue;
            try out.appendSlice(arena, try std.fmt.bufPrint(&run_buf, " {d}-{d} ", .{ run_start, x - 1 }));
            try out.appendSlice(arena, run_key);
            run_key = try arena.dupe(u8, key);
            run_start = x;
        }
        try out.append(arena, '\n');
    }
}

fn cellKey(h: *eh.Harness, x: u16, y: u16, buf: *[64]u8) []const u8 {
    const ci = h.term.screens.active.pages.getCell(.{ .viewport = .{ .x = x, .y = y } }) orelse return "d,d,";
    if (ci.cell.wide == .spacer_tail) return "d,d,";
    const style = ci.style();
    var n: usize = 0;
    var tmp: [16]u8 = undefined;
    const fg = colorStr(style.fg_color, &tmp);
    @memcpy(buf[n..][0..fg.len], fg);
    n += fg.len;
    buf[n] = ',';
    n += 1;
    var tmp2: [16]u8 = undefined;
    const bg: []const u8 = switch (ci.cell.content_tag) {
        .bg_color_palette => std.fmt.bufPrint(&tmp2, "p{d}", .{ci.cell.content.color_palette.data}) catch "?",
        .bg_color_rgb => blk: {
            const rgb = ci.cell.content.color_rgb;
            break :blk std.fmt.bufPrint(&tmp2, "#{x:0>2}{x:0>2}{x:0>2}", .{ rgb.r, rgb.g, rgb.b }) catch "?";
        },
        else => colorStr(style.bg_color, &tmp2),
    };
    @memcpy(buf[n..][0..bg.len], bg);
    n += bg.len;
    buf[n] = ',';
    n += 1;
    if (style.flags.bold) {
        buf[n] = 'b';
        n += 1;
    }
    if (style.flags.faint) {
        buf[n] = 'f';
        n += 1;
    }
    if (style.flags.italic) {
        buf[n] = 'i';
        n += 1;
    }
    if (style.flags.blink) {
        buf[n] = 'k';
        n += 1;
    }
    if (style.flags.inverse) {
        buf[n] = 'r';
        n += 1;
    }
    if (style.flags.invisible) {
        buf[n] = 'v';
        n += 1;
    }
    if (style.flags.strikethrough) {
        buf[n] = 'x';
        n += 1;
    }
    const ul: []const u8 = switch (style.flags.underline) {
        .none => "",
        .single => "u",
        .double => "U",
        .curly => "~",
        .dotted => ".",
        .dashed => "-",
    };
    @memcpy(buf[n..][0..ul.len], ul);
    n += ul.len;
    return buf[0..n];
}

fn colorStr(color: ghostty_vt.Style.Color, buf: *[16]u8) []const u8 {
    return switch (color) {
        .none => "d",
        .palette => |idx| std.fmt.bufPrint(buf, "p{d}", .{idx}) catch "?",
        .rgb => |rgb| std.fmt.bufPrint(buf, "#{x:0>2}{x:0>2}{x:0>2}", .{ rgb.r, rgb.g, rgb.b }) catch "?",
    };
}

fn keyBytes(name: []const u8) ?[]const u8 {
    const map = .{
        .{ "enter", "\r" },     .{ "esc", "\x1b" },     .{ "tab", "\t" },
        .{ "bs", "\x7f" },      .{ "space", " " },      .{ "up", "\x1b[A" },
        .{ "down", "\x1b[B" },  .{ "right", "\x1b[C" }, .{ "left", "\x1b[D" },
        .{ "home", "\x1b[H" },  .{ "end", "\x1b[F" },   .{ "pgup", "\x1b[5~" },
        .{ "pgdn", "\x1b[6~" },
    };
    inline for (map) |e| if (std.mem.eql(u8, name, e[0])) return e[1];
    const S = struct {
        var buf: [2]u8 = undefined;
    };
    if (name.len == 1) {
        S.buf[0] = name[0];
        return S.buf[0..1];
    }
    if (name.len == 3 and name[1] == '-') {
        if (name[0] == 'c' and name[2] >= 'a' and name[2] <= 'z') {
            S.buf[0] = name[2] - 'a' + 1;
            return S.buf[0..1];
        }
        if (name[0] == 'a') {
            S.buf = .{ 0x1b, name[2] };
            return S.buf[0..2];
        }
    }
    return null;
}

/// SGR button code, with an optional `ctrl-` prefix folded in as bit 4 —
/// which is exactly how a terminal encodes a modified click, and how vaxis
/// decodes one (Parser.zig mouse_bits.ctrl = 0b00010000).
fn buttonCode(name: []const u8) ?u16 {
    if (std.mem.startsWith(u8, name, "ctrl-")) {
        const base = buttonCode(name["ctrl-".len..]) orelse return null;
        return base + 16;
    }
    if (std.mem.eql(u8, name, "left")) return 0;
    if (std.mem.eql(u8, name, "middle")) return 1;
    if (std.mem.eql(u8, name, "right")) return 2;
    return null;
}

fn unescape(arena: std.mem.Allocator, s: []const u8) ![]const u8 {
    var buf: std.ArrayList(u8) = .empty;
    var i: usize = 0;
    while (i < s.len) : (i += 1) {
        if (s[i] != '\\' or i + 1 >= s.len) {
            try buf.append(arena, s[i]);
            continue;
        }
        i += 1;
        switch (s[i]) {
            'e' => try buf.append(arena, 0x1b),
            'r' => try buf.append(arena, '\r'),
            'n' => try buf.append(arena, '\n'),
            't' => try buf.append(arena, '\t'),
            '\\' => try buf.append(arena, '\\'),
            'x' => {
                if (i + 2 >= s.len) return error.BadEscape;
                try buf.append(arena, try std.fmt.parseInt(u8, s[i + 1 .. i + 3], 16));
                i += 2;
            },
            else => return error.BadEscape,
        }
    }
    return buf.items;
}

fn absPath(arena: std.mem.Allocator, cwd: []const u8, p: []const u8) ![]const u8 {
    if (p.len > 0 and p[0] == '/') return try arena.dupe(u8, p);
    return try std.fmt.allocPrint(arena, "{s}/{s}", .{ cwd, p });
}

fn listSnaps(arena: std.mem.Allocator, dir_path: []const u8, scripts: *std.ArrayList([]const u8)) !void {
    const dir_z = try arena.dupeZ(u8, dir_path);
    const dir = libc.opendir(dir_z) orelse fatal("no snapshots/ dir at {s}", .{dir_path});
    defer _ = libc.closedir(dir);
    while (libc.readdir(dir)) |d| {
        const name = std.mem.sliceTo(@as([*:0]const u8, @ptrCast(&d.name)), 0);
        if (std.mem.endsWith(u8, name, ".snap"))
            try scripts.append(arena, try std.fmt.allocPrint(arena, "{s}/{s}", .{ dir_path, name }));
    }
}

fn readFileAlloc(arena: std.mem.Allocator, path: []const u8) ![]u8 {
    const path_z = try arena.dupeZ(u8, path);
    const fd = libc.open(path_z, .{ .ACCMODE = .RDONLY });
    if (fd < 0) return error.OpenFailed;
    defer _ = libc.close(fd);
    var buf: std.ArrayList(u8) = .empty;
    var chunk: [16384]u8 = undefined;
    while (true) {
        const n = libc.read(fd, &chunk, chunk.len);
        if (n < 0) {
            if (libc.errno(n) == .INTR) continue;
            return error.ReadFailed;
        }
        if (n == 0) break;
        try buf.appendSlice(arena, chunk[0..@intCast(n)]);
    }
    return buf.items;
}

fn mkdir(arena: std.mem.Allocator, path: []const u8, exist_ok: bool) !void {
    const path_z = try arena.dupeZ(u8, path);
    const rc = libc.mkdir(path_z, 0o755);
    if (rc != 0) {
        if (exist_ok and libc.errno(rc) == .EXIST) return;
        return error.MkdirFailed;
    }
}

fn chdirRc(path_z: [:0]const u8) c_int {
    return libc.chdir(path_z.ptr);
}

fn rmrf(path: []const u8) void {
    var path_buf: [4096:0]u8 = undefined;
    if (path.len >= path_buf.len) return;
    @memcpy(path_buf[0..path.len], path);
    path_buf[path.len] = 0;
    const pid = libc.fork();
    if (pid == 0) {
        const argv: [4:null]?[*:0]const u8 = .{ "rm", "-rf", @as([*:0]const u8, @ptrCast(&path_buf)), null };
        _ = execvp("rm", &argv);
        libc._exit(127);
    }
    if (pid < 0) return;
    var status: c_int = 0;
    _ = libc.waitpid(pid, &status, 0);
}

fn printFirstDiff(golden: []const u8, actual: []const u8) void {
    var gi = std.mem.splitScalar(u8, golden, '\n');
    var ai = std.mem.splitScalar(u8, actual, '\n');
    var n: usize = 1;
    while (true) : (n += 1) {
        const g = gi.next();
        const a = ai.next();
        if (g == null and a == null) return;
        if (g != null and a != null and std.mem.eql(u8, g.?, a.?)) continue;
        std.debug.print("  first diff at golden line {d}:\n  -{s}\n  +{s}\n", .{ n, g orelse "<eof>", a orelse "<eof>" });
        return;
    }
}

fn fatal(comptime fmt: []const u8, args: anytype) noreturn {
    std.debug.print(fmt ++ "\n", args);
    std.process.exit(1);
}