test.bats

#!/usr/bin/env bats

export SYSTEM_NAME="$(uname -s | tr '[:upper:]' '[:lower:]')"

ARCH="$(uname -m)"
case "$ARCH" in
  x86_64) ARCH="amd64" ;;
  aarch64) ARCH="arm64" ;;
  arm64) ARCH="arm64" ;;
esac
export DOCKER_ORCHESTRATE="${BATS_TEST_DIRNAME}/build/${SYSTEM_NAME}/docker-orchestrate-${ARCH}"

flunk() {
  {
    if [[ "$#" -eq 0 ]]; then
      cat -
    else
      echo "$*"
    fi
  }
  return 1
}

assert_equal() {
  if [[ "$1" != "$2" ]]; then
    {
      echo "expected: $1"
      echo "actual:   $2"
    } | flunk
  fi
}

assert_exit_status() {
  exit_status="$1"
  if [[ "$status" -ne "$exit_status" ]]; then
    {
      echo "expected exit status: $exit_status"
      echo "actual exit status:   $status"
    } | flunk
    flunk
  fi
}

assert_failure() {
  if [[ "$status" -eq 0 ]]; then
    flunk "expected failed exit status"
  elif [[ "$#" -gt 0 ]]; then
    assert_output "$1"
  fi
}

assert_success() {
  if [[ "$status" -ne 0 ]]; then
    flunk "command failed with exit status $status"
  elif [[ "$#" -gt 0 ]]; then
    assert_output "$1"
  fi
}

assert_output() {
  local expected
  if [[ $# -eq 0 ]]; then
    expected="$(cat -)"
  else
    expected="$1"
  fi
  assert_equal "$expected" "$output"
}

assert_output_contains() {
  local input="$output"
  local expected="$1"
  local count="${2:-1}"
  local found=0
  until [ "${input/$expected/}" = "$input" ]; do
    input="${input/$expected/}"
    found=$((found + 1))
  done
  assert_equal "$count" "$found"
}

assert_output_not_exists() {
  [[ -z "$output" ]] || flunk "expected no output, found some"
}

# reset_image_prune removes any containers and images left behind by the
# image-prune fixture so those tests start from a clean slate and do not leak
# images into one another.
reset_image_prune() {
  docker rm -f $(docker ps -aq --filter "label=com.docker.compose.project=bats-image-prune") >/dev/null 2>&1 || true
  docker image rm -f $(docker images -aq --filter "label=com.docker.compose.project=bats-image-prune") >/dev/null 2>&1 || true
}

setup_file() {
  docker pull nginx:latest
}

setup() {
  rm -f /tmp/orch-*
}

teardown() {
  for project in $(docker compose ls -a -q 2>/dev/null | grep "^bats-"); do
    docker compose -p "$project" down --remove-orphans --volumes --timeout 5 2>/dev/null || true
  done

  rm -f /tmp/orch-*
}

@test "default" {
  run true
  echo "output: $output"
  echo "status: $status"
  assert_success
}

@test "pre-stop host command detached continues running after exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-pre-stop"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-stop web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-stop --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # started marker should exist (command was launched)
  [ -f /tmp/orch-detached-pre-stop-started ]

  # completed marker should NOT exist yet (still running in background)
  [ ! -f /tmp/orch-detached-pre-stop-completed ]

  # poll for the detached command to finish (up to 25s)
  for i in $(seq 1 25); do
    [ -f /tmp/orch-detached-pre-stop-completed ] && break
    sleep 1
  done

  # completed marker should now exist (process ran to completion independently)
  [ -f /tmp/orch-detached-pre-stop-completed ]
}

@test "post-stop host command detached continues running after exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-post-stop"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-post-stop web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-post-stop --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # started marker should exist (command was launched)
  [ -f /tmp/orch-detached-post-stop-started ]

  # completed marker should NOT exist yet (still running in background)
  [ ! -f /tmp/orch-detached-post-stop-completed ]

  # poll for the detached command to finish (up to 25s)
  for i in $(seq 1 25); do
    [ -f /tmp/orch-detached-post-stop-completed ] && break
    sleep 1
  done

  # completed marker should now exist (process ran to completion independently)
  [ -f /tmp/orch-detached-post-stop-completed ]
}

@test "both pre-stop and post-stop detached commands continue running after exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-both"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-both web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-both --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # both started markers should exist
  [ -f /tmp/orch-detached-both-pre-started ]
  [ -f /tmp/orch-detached-both-post-started ]

  # neither completed marker should exist yet
  [ ! -f /tmp/orch-detached-both-pre-completed ]
  [ ! -f /tmp/orch-detached-both-post-completed ]

  # poll for both detached commands to finish (up to 25s)
  for i in $(seq 1 25); do
    [ -f /tmp/orch-detached-both-pre-completed ] && [ -f /tmp/orch-detached-both-post-completed ] && break
    sleep 1
  done

  # both completed markers should now exist
  [ -f /tmp/orch-detached-both-pre-completed ]
  [ -f /tmp/orch-detached-both-post-completed ]
}

@test "non-detached commands complete before exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/non-detached-baseline"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-sync web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-sync --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # both started AND completed markers should exist immediately
  # because synchronous commands block until done
  [ -f /tmp/orch-sync-pre-started ]
  [ -f /tmp/orch-sync-pre-completed ]
  [ -f /tmp/orch-sync-post-started ]
  [ -f /tmp/orch-sync-post-completed ]
}

@test "shebang sh executes correctly" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shebang-sh"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-sh web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-sh --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  [ -f /tmp/orch-shebang-sh-completed ]
}

@test "shebang bash executes correctly" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shebang-bash"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-bash web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-bash --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # marker is only created if BASH_VERSION is set, proving bash ran
  [ -f /tmp/orch-shebang-bash-completed ]
}

@test "shebang dash executes correctly" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shebang-dash"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-dash web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-dash --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  [ -f /tmp/orch-shebang-dash-completed ]
}

@test "shebang python3 executes correctly" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shebang-python3"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-python3 web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-python3 --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # marker is created via python3 pathlib, proving python3 ran
  [ -f /tmp/orch-shebang-python3-completed ]
}

@test "default shebang uses sh" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shebang-default"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-default web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shebang-default --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # no shebang in script, should default to #!/bin/sh
  [ -f /tmp/orch-shebang-default-completed ]
}

@test "SHELL directive /bin/bash -c is detected for container scripts" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/shell-directive"

  # build the custom image with SHELL ["/bin/bash", "-c"]
  docker compose -p bats-shell-directive build

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shell-directive web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-shell-directive --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # verify host command ran
  [ -f /tmp/orch-shell-directive-host-completed ]

  # check that the container script ran at all
  run docker run --rm -v bats-shell-directive_shell-test:/data nginx:latest cat /data/executed
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "script-ran" "$output"

  # check that bash was used (image SHELL directive detected)
  # the script uses [[ ]] which only works in bash, not dash/sh
  run docker run --rm -v bats-shell-directive_shell-test:/data nginx:latest cat /data/result
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "bash-ok" "$output"
}

@test "exited containers are cleaned up before deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/exited-container-cleanup"

  # Initial deploy: 3 running containers via docker-orchestrate
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-exited-cleanup web
  echo "output: $output"
  echo "status: $status"
  assert_success
  run docker ps --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=running" -q
  echo "initial running containers: $output"
  assert_equal "3" "$(echo "$output" | wc -l | tr -d ' ')"

  # Get container IDs for manipulation
  container_to_stop=$(docker ps --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=running" -q | sed -n '1p')
  container_to_kill=$(docker ps --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=running" -q | sed -n '2p')

  # Stop one container gracefully (exit code 0)
  docker stop "$container_to_stop"

  # Kill another container with SIGKILL (non-zero exit code)
  docker kill --signal=KILL "$container_to_kill"

  # Verify intermediate state: 1 running, 2 exited
  run docker ps --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=running" -q
  echo "running after stop/kill: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"

  run docker ps -a --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=exited" -q
  echo "exited after stop/kill: $output"
  assert_equal "2" "$(echo "$output" | wc -l | tr -d ' ')"

  # Verify exit codes: one should be 0, one should be non-zero
  exited_container_0=$(docker ps -a --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=exited" -q | sed -n '1p')
  exited_container_1=$(docker ps -a --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=exited" -q | sed -n '2p')
  exit_code_0=$(docker inspect --format '{{.State.ExitCode}}' "$exited_container_0")
  exit_code_1=$(docker inspect --format '{{.State.ExitCode}}' "$exited_container_1")
  echo "exit codes: $exit_code_0, $exit_code_1"

  # One should be 0 and one should be non-zero (137 for SIGKILL)
  if [[ "$exit_code_0" -eq 0 && "$exit_code_1" -ne 0 ]] || [[ "$exit_code_0" -ne 0 && "$exit_code_1" -eq 0 ]]; then
    echo "exit code verification passed: one is 0, one is non-zero"
  else
    flunk "expected one exit code 0 and one non-zero, got: $exit_code_0 and $exit_code_1"
  fi

  # Redeploy with --replicas 3: should clean up exited containers and reach 3 running
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-exited-cleanup --replicas 3 web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify final state: 3 running, 0 exited
  run docker ps --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=running" -q
  echo "final running: $output"
  assert_equal "3" "$(echo "$output" | wc -l | tr -d ' ')"

  run docker ps -a --filter "label=com.docker.compose.project=bats-exited-cleanup" --filter "status=exited" -q
  echo "final exited: $output"
  assert_equal "" "$output"
}

@test "compose spec pre_stop hooks execute inside container" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pre-stop-hooks"

  export BATS_HOST_TEST_VAR="interpolated-ok"
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-stop-hooks web
  echo "output: $output"
  echo "status: $status"
  assert_success

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-stop-hooks --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify host commands ran
  [ -f /tmp/orch-pre-stop-hooks-host-completed ]
  [ -f /tmp/orch-pre-stop-hooks-post-completed ]

  # Verify x-pre-stop-command ran inside container
  run docker run --rm -v bats-pre-stop-hooks_hook-test:/data nginx:latest cat /data/pre-stop-cmd
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "script-ran" "$output"

  # Verify first pre_stop hook ran
  run docker run --rm -v bats-pre-stop-hooks_hook-test:/data nginx:latest cat /data/hook1
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "hook1-ran" "$output"

  # Verify second pre_stop hook ran
  run docker run --rm -v bats-pre-stop-hooks_hook-test:/data nginx:latest cat /data/hook2
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "hook2-ran" "$output"

  # Verify third hook with direct environment value
  run docker run --rm -v bats-pre-stop-hooks_hook-test:/data nginx:latest cat /data/hook3
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "env-ok" "$output"

  # Verify fourth hook with compose-level ${VAR} interpolation from host env
  run docker run --rm -v bats-pre-stop-hooks_hook-test:/data nginx:latest cat /data/hook4
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "interpolated-ok" "$output"
}

@test "compose spec post_start hooks execute inside container during scale-up" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/post-start-hooks"

  export BATS_HOST_TEST_VAR="interpolated-ok"
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-post-start-hooks web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify first post_start hook ran
  run docker run --rm -v bats-post-start-hooks_hook-test:/data nginx:latest cat /data/hook1
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "hook1-ran" "$output"

  # Verify second post_start hook ran
  run docker run --rm -v bats-post-start-hooks_hook-test:/data nginx:latest cat /data/hook2
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "hook2-ran" "$output"

  # Verify third hook with direct environment value
  run docker run --rm -v bats-post-start-hooks_hook-test:/data nginx:latest cat /data/hook3
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "env-ok" "$output"

  # Verify fourth hook with compose-level ${VAR} interpolation from host env
  run docker run --rm -v bats-post-start-hooks_hook-test:/data nginx:latest cat /data/hook4
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "interpolated-ok" "$output"
}

@test "multiple compose files via repeated --file flag" {
  run "$DOCKER_ORCHESTRATE" deploy \
    --file "${BATS_TEST_DIRNAME}/tests/fixtures/multiple-files/docker-compose.yaml" \
    --file "${BATS_TEST_DIRNAME}/tests/fixtures/multiple-files/docker-compose.override.yaml" \
    --project-name bats-multi-file web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify the override was applied by checking the env var on the running container
  container_id=$(docker ps --filter "label=com.docker.compose.project=bats-multi-file" --filter "status=running" -q | head -1)
  run docker exec "$container_id" printenv OVERRIDE_APPLIED
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "true" "$output"
}

@test "env file via repeated --env-file flag" {
  run "$DOCKER_ORCHESTRATE" deploy \
    --file "${BATS_TEST_DIRNAME}/tests/fixtures/env-file/docker-compose.yaml" \
    --env-file "${BATS_TEST_DIRNAME}/tests/fixtures/env-file/custom.env" \
    --project-name bats-env-file web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify the env file was applied by checking the env var on the running container
  container_id=$(docker ps --filter "label=com.docker.compose.project=bats-env-file" --filter "status=running" -q | head -1)
  run docker exec "$container_id" printenv FROM_ENV_FILE
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_equal "env-file-works" "$output"
}

@test "pull policy from compose spec is respected" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  run docker ps --filter "label=com.docker.compose.project=bats-pull-policy" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "pull policy CLI flag overrides compose spec" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy --pull missing web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  run docker ps --filter "label=com.docker.compose.project=bats-pull-policy" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "invalid pull policy is rejected" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy --pull invalid web
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "invalid --pull value"
}

@test "pull policy if_not_present maps to missing" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy-if-not-present"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy-ifnp web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  run docker ps --filter "label=com.docker.compose.project=bats-pull-policy-ifnp" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "pull policy build from compose spec builds and deploys" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy-build"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy-build web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  run docker ps --filter "label=com.docker.compose.project=bats-pull-policy-build" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "build CLI flag builds and deploys" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pull-policy-build"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pull-policy-build --build --pull never web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  run docker ps --filter "label=com.docker.compose.project=bats-pull-policy-build" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "image prune removes leftover images from previous builds" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/image-prune"
  reset_image_prune

  export TAG=v1
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  export TAG=v2
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # The previous deploy left bats-image-prune-web:v1 behind, still project-labeled
  run docker images bats-image-prune-web:v1 -q
  echo "v1 before prune: $output"
  [[ -n "$output" ]] || flunk "expected the previous image to be present before prune"

  run "$DOCKER_ORCHESTRATE" image prune --project-name bats-image-prune
  echo "output: $output"
  echo "status: $status"
  assert_success

  # The leftover image is gone
  run docker images bats-image-prune-web:v1 -q
  echo "v1 after prune: $output"
  assert_equal "" "$output"

  # The current image is kept
  run docker images bats-image-prune-web:v2 -q
  echo "v2 after prune: $output"
  [[ -n "$output" ]] || flunk "expected the current image to be kept"

  reset_image_prune
}

@test "image prune --dry-run reports without removing" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/image-prune"
  reset_image_prune

  export TAG=v1
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force web
  assert_success

  export TAG=v2
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force web
  assert_success

  run "$DOCKER_ORCHESTRATE" image prune --project-name bats-image-prune --dry-run
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "Would remove image"

  # Dry-run did not remove the leftover
  run docker images bats-image-prune-web:v1 -q
  echo "v1 after dry-run: $output"
  [[ -n "$output" ]] || flunk "expected dry-run to leave the leftover image in place"

  reset_image_prune
}

@test "deploy --prune-images prunes old images after a rebuild" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/image-prune"
  reset_image_prune

  export TAG=v1
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force web
  assert_success

  export TAG=v2
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-image-prune --build --force --prune-images web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # The deploy pruned the previous image
  run docker images bats-image-prune-web:v1 -q
  echo "v1 after prune-images deploy: $output"
  assert_equal "" "$output"

  # The current image is kept
  run docker images bats-image-prune-web:v2 -q
  [[ -n "$output" ]] || flunk "expected the current image to be kept"

  reset_image_prune
}

@test "x-healthcheck-wait delays before treating container as healthy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/healthcheck-wait"

  # Record start time
  start_time=$(date +%s)

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-healthcheck-wait web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Record end time
  end_time=$(date +%s)
  elapsed=$((end_time - start_time))

  # The deploy should take at least 3 seconds due to x-healthcheck-wait
  # (we check >= 2 to allow for timing variance)
  if [[ "$elapsed" -lt 2 ]]; then
    flunk "expected deploy to take at least 2s due to x-healthcheck-wait, took ${elapsed}s"
  fi

  # Verify the container is running
  run docker ps --filter "label=com.docker.compose.project=bats-healthcheck-wait" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "x-wait-after-healthy delays after container becomes healthy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/wait-after-healthy"

  # Record start time
  start_time=$(date +%s)

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-wait-after-healthy web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Record end time
  end_time=$(date +%s)
  elapsed=$((end_time - start_time))

  # The deploy should take at least 3 seconds due to x-wait-after-healthy
  # (we check >= 2 to allow for timing variance)
  if [[ "$elapsed" -lt 2 ]]; then
    flunk "expected deploy to take at least 2s due to x-wait-after-healthy, took ${elapsed}s"
  fi

  # Verify the container is running
  run docker ps --filter "label=com.docker.compose.project=bats-wait-after-healthy" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "unhealthy containers are replaced first during rolling update" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/unhealthy-priority"

  # Initial deploy with 3 replicas
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-unhealthy-priority --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Wait for all containers to become healthy
  sleep 6

  # Verify all 3 containers are healthy
  healthy_count=0
  for id in $(docker ps -q --filter "label=com.docker.compose.project=bats-unhealthy-priority" --filter "status=running"); do
    health=$(docker inspect --format '{{.State.Health.Status}}' "$id")
    if [[ "$health" == "healthy" ]]; then
      healthy_count=$((healthy_count + 1))
    fi
  done
  assert_equal "3" "$healthy_count"

  # Pick one container and make it unhealthy
  unhealthy_id=$(docker ps -q --filter "label=com.docker.compose.project=bats-unhealthy-priority" --filter "status=running" | head -1)
  docker exec "$unhealthy_id" rm /tmp/healthy

  # Wait for Docker to mark it unhealthy
  sleep 6

  # Verify it's actually unhealthy
  health=$(docker inspect --format '{{.State.Health.Status}}' "$unhealthy_id")
  assert_equal "unhealthy" "$health"

  # Redeploy (rolling update)
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-unhealthy-priority --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify the output contains the prioritization message
  assert_output_contains "Prioritizing 1 unhealthy container(s) for replacement"

  # The unhealthy container should have been replaced (no longer running)
  run docker ps -q --filter "id=$unhealthy_id" --filter "status=running"
  assert_equal "" "$output"

  # Verify we still have 3 running containers
  count=$(docker ps -q --filter "label=com.docker.compose.project=bats-unhealthy-priority" --filter "status=running" | wc -l | tr -d ' ')
  assert_equal "3" "$count"
}

@test "one-shot service (restart: no) runs to completion" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-success"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-success migrate
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "One-shot service migrate completed successfully"
}

@test "one-shot service (restart: no) exit 1 aborts deployment" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-failure"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-failure migrate
  echo "output: $output"
  echo "status: $status"
  assert_failure
}

@test "one-shot service leaves no running containers" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-success"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-success migrate
  echo "output: $output"
  echo "status: $status"
  assert_success

  # No containers should be running (--rm removes them)
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-success" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "" "$output"
}

@test "one-shot pre-deploy runs migrate before web in project deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-pre-deploy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-pre-deploy
  echo "output: $output"
  echo "status: $status"
  assert_success

  # One-shot migrate should have completed
  assert_output_contains "One-shot service migrate completed successfully"

  # Web should be running
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-pre-deploy" --filter "label=com.docker.compose.service=web" --filter "status=running" -q
  echo "web running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"

  # Migrate should have no running containers (--rm removed it)
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-pre-deploy" --filter "label=com.docker.compose.service=migrate" --filter "status=running" -q
  echo "migrate running containers: $output"
  assert_equal "" "$output"
}

@test "one-shot post-deploy runs warm-cache after web in project deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-post-deploy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-post-deploy
  echo "output: $output"
  echo "status: $status"
  assert_success

  # warm-cache one-shot should have completed (check before other run commands overwrite $output)
  assert_output_contains "One-shot service warm-cache completed successfully"

  # Web should be running
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-post-deploy" --filter "label=com.docker.compose.service=web" --filter "status=running" -q
  echo "web running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"

  # warm-cache should have no running containers
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-post-deploy" --filter "label=com.docker.compose.service=warm-cache" --filter "status=running" -q
  echo "warm-cache running containers: $output"
  assert_equal "" "$output"
}

@test "one-shot failure aborts deployment of subsequent services" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-failure-aborts"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-failure-aborts
  echo "output: $output"
  echo "status: $status"
  assert_failure

  # Web should NOT be running (deployment aborted before reaching it)
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-failure-aborts" --filter "label=com.docker.compose.service=web" --filter "status=running" -q
  echo "web running containers: $output"
  assert_equal "" "$output"
}

@test "one-shot without depends_on runs before web without depends_on in project deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-priority"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-priority
  echo "output: $output"
  echo "status: $status"
  assert_success

  # One-shot migrate should have completed
  assert_output_contains "One-shot service migrate completed successfully"

  # Verify ordering: one-shot message should appear before web deployment message
  deploy_output="$output"
  migrate_line=$(echo "$deploy_output" | grep -n "Running one-shot service migrate" | head -1 | cut -d: -f1)
  web_line=$(echo "$deploy_output" | grep -n "Deploying service web" | head -1 | cut -d: -f1)
  if [[ "$migrate_line" -ge "$web_line" ]]; then
    flunk "expected one-shot migrate (line $migrate_line) to run before web deploy (line $web_line)"
  fi

  # Web should be running
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-priority" --filter "label=com.docker.compose.service=web" --filter "status=running" -q
  echo "web running containers: $output"
  assert_equal "1" "$(echo "$output" | wc -l | tr -d ' ')"
}

@test "one-shot service ignores --replicas flag" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-success"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-success --replicas 3 migrate
  echo "output: $output"
  echo "status: $status"
  assert_success

  # One-shot should complete successfully regardless of --replicas
  assert_output_contains "One-shot service migrate completed successfully"

  # No containers should be running (--rm removes them, one-shot ignores replicas)
  run docker ps --filter "label=com.docker.compose.project=bats-one-shot-success" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "" "$output"
}

# =====================================================
# Per-service deploy host command tests
# =====================================================

@test "per-service pre-deploy host command runs before deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pre-deploy-host-command"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-deploy-cmd web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # pre-deploy marker should exist
  [ -f /tmp/orch-pre-deploy-started ]
}

@test "per-service post-deploy host command runs after successful deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/post-deploy-host-command"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-post-deploy-cmd web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # post-deploy marker should exist
  [ -f /tmp/orch-post-deploy-completed ]
}

@test "both per-service pre and post deploy host commands run in correct order" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/deploy-host-command-both"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-deploy-both web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # both markers should exist
  [ -f /tmp/orch-deploy-both-pre-time ]
  [ -f /tmp/orch-deploy-both-post-time ]

  pre_time=$(cat /tmp/orch-deploy-both-pre-time)
  post_time=$(cat /tmp/orch-deploy-both-post-time)
  if [[ "$pre_time" -gt "$post_time" ]]; then
    flunk "expected pre-deploy (${pre_time}) to run before post-deploy (${post_time})"
  fi
}

# =====================================================
# Project-level deploy host command tests
# =====================================================

@test "project-level pre-deploy host command runs before deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/project-pre-deploy-host-command"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-project-pre-deploy
  echo "output: $output"
  echo "status: $status"
  assert_success

  # project pre-deploy marker should exist
  [ -f /tmp/orch-project-pre-deploy-started ]
}

@test "project-level post-deploy host command runs after successful deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/project-post-deploy-host-command"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-project-post-deploy
  echo "output: $output"
  echo "status: $status"
  assert_success

  # project post-deploy marker should exist
  [ -f /tmp/orch-project-post-deploy-completed ]
}

@test "both project-level pre and post deploy host commands run in correct order" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/project-deploy-host-command-both"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-project-deploy-both
  echo "output: $output"
  echo "status: $status"
  assert_success

  # both markers should exist
  [ -f /tmp/orch-project-deploy-both-pre-time ]
  [ -f /tmp/orch-project-deploy-both-post-time ]

  pre_time=$(cat /tmp/orch-project-deploy-both-pre-time)
  post_time=$(cat /tmp/orch-project-deploy-both-post-time)
  if [[ "$pre_time" -gt "$post_time" ]]; then
    flunk "expected project pre-deploy (${pre_time}) to run before project post-deploy (${post_time})"
  fi
}

# =====================================================
# Failure behavior tests
# =====================================================

@test "per-service post-deploy host command does NOT run on deploy failure" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/deploy-host-command-failure"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-deploy-failure web
  echo "output: $output"
  echo "status: $status"
  assert_failure

  # post-deploy marker should NOT exist (deploy failed)
  [ ! -f /tmp/orch-deploy-failure-post-deploy ]
}

@test "per-service pre-deploy host command failure aborts deployment" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/pre-deploy-host-command-fails"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-pre-deploy-fails web
  echo "output: $output"
  echo "status: $status"
  assert_failure

  # No containers should be running (deploy was aborted)
  run docker ps --filter "label=com.docker.compose.project=bats-pre-deploy-fails" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "" "$output"
}

@test "project-level post-deploy host command does NOT run on service failure" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/project-deploy-host-command-failure"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-project-deploy-failure
  echo "output: $output"
  echo "status: $status"
  assert_failure

  # project post-deploy marker should NOT exist (service deploy failed)
  [ ! -f /tmp/orch-project-deploy-failure-post-deploy ]
}

@test "project-level pre-deploy host command failure aborts all deployments" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/project-pre-deploy-host-command-fails"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-project-pre-deploy-fails
  echo "output: $output"
  echo "status: $status"
  assert_failure

  # No containers should be running (all deployments aborted)
  run docker ps --filter "label=com.docker.compose.project=bats-project-pre-deploy-fails" --filter "status=running" -q
  echo "running containers: $output"
  assert_equal "" "$output"
}

# =====================================================
# Detached execution tests
# =====================================================

@test "pre-deploy host command detached continues running after exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-pre-deploy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-detached-pre-deploy web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # started marker should exist (command was launched)
  [ -f /tmp/orch-detached-pre-deploy-started ]

  # completed marker should NOT exist yet (sleep 30 in script, deploy finishes faster)
  [ ! -f /tmp/orch-detached-pre-deploy-completed ]
}

@test "post-deploy host command detached does not block deployment" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-post-deploy"

  # Measure deploy time - detached mode should not wait for the sleep 30 in script
  start_time=$(date +%s)
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-detached-post-deploy web
  echo "output: $output"
  echo "status: $status"
  assert_success
  end_time=$(date +%s)

  elapsed=$((end_time - start_time))
  echo "elapsed: ${elapsed}s"

  # Deploy should complete in well under 30 seconds (the detached script has sleep 30)
  # Normal deploy takes ~6-10s for scale-up + healthcheck
  # If detached mode is NOT working (synchronous), it would take 30+ seconds
  if [[ "$elapsed" -ge 25 ]]; then
    flunk "expected deploy to complete in under 25 seconds (detached script has sleep 30), took ${elapsed}s"
  fi
}

@test "post-deploy host command detached process is forked before exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/detached-post-deploy"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-detached-post-deploy-fork web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # poll for the detached command to start (up to 10s)
  for i in $(seq 1 10); do
    [ -f /tmp/orch-detached-post-deploy-started ] && break
    sleep 1
  done

  # The "started" marker must exist — proves the process was forked before exit
  [ -f /tmp/orch-detached-post-deploy-started ]
}

# =====================================================
# Non-detached (synchronous) execution tests
# =====================================================

@test "non-detached deploy commands complete before exit" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/deploy-host-command-non-detached"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-deploy-non-detached web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # both pre-deploy started and completed markers should exist (synchronous)
  [ -f /tmp/orch-deploy-non-detached-pre-started ]
  [ -f /tmp/orch-deploy-non-detached-pre-completed ]

  # both post-deploy started and completed markers should exist (synchronous)
  [ -f /tmp/orch-deploy-non-detached-post-started ]
  [ -f /tmp/orch-deploy-non-detached-post-completed ]
}

# =====================================================
# Template variable tests
# =====================================================

@test "per-service deploy host command template variables expand correctly" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/deploy-host-command-template"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-deploy-template web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # verify service name was expanded
  [ -f /tmp/orch-deploy-template-service ]
  service_name=$(cat /tmp/orch-deploy-template-service | tr -d '[:space:]')
  assert_equal "web" "$service_name"

  # verify project name was expanded
  [ -f /tmp/orch-deploy-template-project ]
  project_name=$(cat /tmp/orch-deploy-template-project | tr -d '[:space:]')
  assert_equal "bats-deploy-template" "$project_name"
}

# =====================================================
# Combined project + per-service tests
# =====================================================

@test "project and per-service deploy hooks run in correct order" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/deploy-host-command-combined"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-deploy-combined
  echo "output: $output"
  echo "status: $status"
  assert_success

  # all four markers should exist
  [ -f /tmp/orch-deploy-combined-project-pre-time ]
  [ -f /tmp/orch-deploy-combined-service-pre-time ]
  [ -f /tmp/orch-deploy-combined-service-post-time ]
  [ -f /tmp/orch-deploy-combined-project-post-time ]

  project_pre=$(cat /tmp/orch-deploy-combined-project-pre-time)
  service_pre=$(cat /tmp/orch-deploy-combined-service-pre-time)
  service_post=$(cat /tmp/orch-deploy-combined-service-post-time)
  project_post=$(cat /tmp/orch-deploy-combined-project-post-time)

  # verify order: project-pre -> service-pre -> service-post -> project-post
  if [[ "$project_pre" -gt "$service_pre" ]]; then
    flunk "expected project-pre (${project_pre}) before service-pre (${service_pre})"
  fi
  if [[ "$service_pre" -gt "$service_post" ]]; then
    flunk "expected service-pre (${service_pre}) before service-post (${service_post})"
  fi
  if [[ "$service_post" -gt "$project_post" ]]; then
    flunk "expected service-post (${service_post}) before project-post (${project_post})"
  fi
}

# =====================================================
# One-shot service deploy hook tests
# =====================================================

@test "one-shot service runs per-service deploy hooks" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/one-shot-deploy-host-command"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-one-shot-deploy-cmd migrate
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Both pre and post deploy markers should exist
  [ -f /tmp/orch-one-shot-deploy-pre ]
  [ -f /tmp/orch-one-shot-deploy-post ]

  # One-shot should have completed
  assert_output_contains "One-shot service migrate completed successfully"
}

@test "unchanged service is skipped on second deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/config-hash-skip"

  # First deploy: should proceed normally
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify container is running
  count=$(docker ps -q --filter "label=com.docker.compose.project=bats-config-hash" --filter "label=com.docker.compose.service=web" | wc -l | tr -d ' ')
  assert_equal "1" "$count"

  # Second deploy: should skip because config is unchanged
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash web
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "Skipping unchanged service"
}

@test "force flag overrides config hash skip" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/config-hash-skip"

  # First deploy
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash-force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Second deploy with --force: should NOT skip
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash-force --force web
  echo "output: $output"
  echo "status: $status"
  assert_success
  [[ "$output" != *"Skipping unchanged service"* ]]
}

@test "project deploy skips unchanged services" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/config-hash-skip"

  # First deploy: should proceed normally
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash-project
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Second deploy: should skip unchanged services
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-config-hash-project
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "Skipping unchanged service"
}

@test "replica-only scale-up preserves existing containers" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/replica-only-change"

  # Initial deploy with 1 replica (default)
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-replica-only-up web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Capture the original container ID
  original_id=$(docker ps -q --no-trunc --filter "label=com.docker.compose.project=bats-replica-only-up" --filter "label=com.docker.compose.service=web")
  echo "original container: $original_id"

  # Scale up to 3 replicas
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-replica-only-up --replicas 3 web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify replica-only change was detected (no rolling update)
  assert_output_contains "Scaling replica-only change"
  [[ "$output" != *"Starting rolling update"* ]]

  # Verify 3 containers are running
  count=$(docker ps -q --filter "label=com.docker.compose.project=bats-replica-only-up" --filter "label=com.docker.compose.service=web" | wc -l | tr -d ' ')
  assert_equal "3" "$count"

  # Verify the original container is still running (not replaced)
  run docker ps -q --no-trunc --filter "id=$original_id" --filter "status=running"
  echo "original still running: $output"
  [[ -n "$output" ]]
}

@test "replica-only scale-down preserves remaining containers" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/replica-only-change"

  # Initial deploy with 3 replicas
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-replica-only-down --replicas 3 web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Capture all 3 container IDs
  original_ids=$(docker ps -q --no-trunc --filter "label=com.docker.compose.project=bats-replica-only-down" --filter "label=com.docker.compose.service=web" | sort)
  echo "original containers: $original_ids"
  original_count=$(echo "$original_ids" | wc -l | tr -d ' ')
  assert_equal "3" "$original_count"

  # Scale down to 1 replica
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-replica-only-down --replicas 1 web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Verify replica-only change was detected (no rolling update)
  assert_output_contains "Scaling replica-only change"
  [[ "$output" != *"Starting rolling update"* ]]

  # Verify 1 container is running
  count=$(docker ps -q --filter "label=com.docker.compose.project=bats-replica-only-down" --filter "label=com.docker.compose.service=web" | wc -l | tr -d ' ')
  assert_equal "1" "$count"

  # Verify the surviving container was one of the originals
  surviving_id=$(docker ps -q --no-trunc --filter "label=com.docker.compose.project=bats-replica-only-down" --filter "label=com.docker.compose.service=web")
  echo "surviving container: $surviving_id"
  echo "$original_ids" | grep -q "$surviving_id"
}

@test "anonymous volume warning shown during deploy" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/anonymous-volume-warning"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-anon-vol web
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "has anonymous volume at /var/lib/test-data"
}

@test "no anonymous volume warning with named volume" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/anonymous-volume-warning-named"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-anon-vol-named web
  echo "output: $output"
  echo "status: $status"
  assert_success
  [[ "$output" != *"has anonymous volume"* ]]
}

@test "anonymous volumes are cleaned up on container removal" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/anonymous-volume-warning"

  # Deploy to create a container with an anonymous volume
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-anon-vol-cleanup web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Get the container ID and its anonymous volume name
  container_id=$(docker ps --filter "label=com.docker.compose.project=bats-anon-vol-cleanup" -q | head -1)
  anon_volume=$(docker inspect --format '{{range .Mounts}}{{if eq .Type "volume"}}{{.Name}}{{end}}{{end}}' "$container_id")
  [ -n "$anon_volume" ]

  # Verify the volume exists
  run docker volume inspect "$anon_volume"
  assert_success

  # Redeploy with --force to trigger rolling update (ContainerTerminate removes old container)
  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-anon-vol-cleanup --force web
  echo "output: $output"
  echo "status: $status"
  assert_success

  # The old anonymous volume should have been removed
  run docker volume inspect "$anon_volume"
  echo "volume inspect output: $output"
  echo "volume inspect status: $status"
  [ "$status" -ne 0 ]
}

@test "models: deploy fails when docker-model plugin is not installed" {
  # Ensure no mock plugin is present
  rm -f "$HOME/.docker/cli-plugins/docker-model"

  cd "${BATS_TEST_DIRNAME}/tests/fixtures/models-plugin-missing"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-models-missing web
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "docker-model plugin is not available"
}

@test "models: deploy succeeds without models in compose file" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/models-no-models"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-no-models web
  echo "output: $output"
  echo "status: $status"
  assert_success
}

@test "models: deploy with mock plugin pulls and configures models" {
  # Build mock docker-model plugin for the current platform
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/models-plugin-installed"
  run go build -o docker-model .
  if [ "$status" -ne 0 ]; then
    skip "could not build mock docker-model plugin"
  fi

  # Install mock plugin
  mkdir -p "$HOME/.docker/cli-plugins"
  cp docker-model "$HOME/.docker/cli-plugins/docker-model"

  run "$DOCKER_ORCHESTRATE" deploy --project-name bats-models-mock web
  echo "output: $output"
  echo "status: $status"

  # Clean up mock plugin
  rm -f "$HOME/.docker/cli-plugins/docker-model"

  assert_success
  assert_output_contains "Pulling model"
  assert_output_contains "Configuring model"
}

@test "run execute runs one-shot service successfully" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-success"

  run "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-success migrate
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "One-shot service migrate completed successfully"
}

@test "run execute rejects non-one-shot service" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-not-one-shot"

  run "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-not-one-shot web
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "not a one-shot service"
}

@test "run execute rejects unknown service" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-success"

  run "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-unknown nonexistent
  echo "output: $output"
  echo "status: $status"
  assert_failure
  assert_output_contains "not found"
}

@test "run execute labels containers for history" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-success"

  run "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-labels migrate
  echo "output: $output"
  echo "status: $status"
  assert_success

  # Container should exist (not removed) with run labels
  run docker ps -a --filter "label=com.dokku.orchestrate/run=true" --filter "label=com.dokku.orchestrate/run-project=bats-run-exec-labels" --filter "label=com.dokku.orchestrate/run-service=migrate" -q
  echo "labeled containers: $output"
  [[ -n "$output" ]]

  # Clean up the container
  docker rm -f $output 2>/dev/null || true
}

@test "run execute runs deploy hooks" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-with-hooks"

  run "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-hooks migrate
  echo "output: $output"
  echo "status: $status"
  assert_success

  [ -f /tmp/orch-run-pre ]
  [ -f /tmp/orch-run-post ]

  # Clean up labeled container
  docker rm -f $(docker ps -a --filter "label=com.dokku.orchestrate/run-project=bats-run-exec-hooks" -q) 2>/dev/null || true
}

@test "run execute --detach returns immediately" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-success"

  run "$DOCKER_ORCHESTRATE" run execute --detach --project-name bats-run-exec-detach migrate
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "started in background"

  # Wait for container to finish
  sleep 2

  # Clean up labeled container
  docker rm -f $(docker ps -a --filter "label=com.dokku.orchestrate/run-project=bats-run-exec-detach" -q) 2>/dev/null || true
}

@test "run list shows one-shot services" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-list"

  run "$DOCKER_ORCHESTRATE" run list --project-name bats-run-list
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "./migrate up"
  assert_output_contains "./seed-data"
}

@test "run list excludes long-running services" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-list"

  run "$DOCKER_ORCHESTRATE" run list --project-name bats-run-list
  echo "output: $output"
  echo "status: $status"
  assert_success

  # web is not a one-shot service and should not appear
  if echo "$output" | grep -q "^web"; then
    flunk "web should not be listed as a one-shot service"
  fi
}

# =====================================================
# Docker CLI plugin tests
# =====================================================

@test "[plugin] docker-cli-plugin-metadata returns valid JSON" {
  run "$DOCKER_ORCHESTRATE" docker-cli-plugin-metadata
  echo "output: $output"
  echo "status: $status"
  assert_success

  run /bin/bash -c "'$DOCKER_ORCHESTRATE' docker-cli-plugin-metadata | jq -r .SchemaVersion"
  assert_success
  assert_output "0.1.0"

  run /bin/bash -c "'$DOCKER_ORCHESTRATE' docker-cli-plugin-metadata | jq -e '.Vendor != \"\"'"
  assert_success

  run /bin/bash -c "'$DOCKER_ORCHESTRATE' docker-cli-plugin-metadata | jq -e '.ShortDescription != \"\"'"
  assert_success
}

@test "[plugin] docker-cli-plugin-metadata is hidden from --help" {
  run /bin/bash -c "'$DOCKER_ORCHESTRATE' --help 2>&1"
  echo "output: $output"
  echo "status: $status"
  [[ "$output" != *"docker-cli-plugin-metadata"* ]] || flunk "expected --help not to list docker-cli-plugin-metadata"
}

@test "[plugin] docker orchestrate version" {
  mkdir -p "$HOME/.docker/cli-plugins"
  cp "$DOCKER_ORCHESTRATE" "$HOME/.docker/cli-plugins/docker-orchestrate"
  chmod +x "$HOME/.docker/cli-plugins/docker-orchestrate"

  run docker orchestrate version
  echo "output: $output"
  echo "status: $status"
  assert_success
  [[ -n "$output" ]] || flunk "expected non-empty version output"

  rm -f "$HOME/.docker/cli-plugins/docker-orchestrate"
}

@test "[plugin] docker orchestrate deploy via Docker CLI" {
  mkdir -p "$HOME/.docker/cli-plugins"
  cp "$DOCKER_ORCHESTRATE" "$HOME/.docker/cli-plugins/docker-orchestrate"
  chmod +x "$HOME/.docker/cli-plugins/docker-orchestrate"

  cd "${BATS_TEST_DIRNAME}/tests/fixtures/config-hash-skip"

  run docker orchestrate deploy --project-name bats-plugin-deploy web
  echo "output: $output"
  echo "status: $status"
  assert_success

  rm -f "$HOME/.docker/cli-plugins/docker-orchestrate"
}

@test "[plugin] direct invocation without prefix still works" {
  run "$DOCKER_ORCHESTRATE" version
  echo "output: $output"
  echo "status: $status"
  assert_success
}

@test "run list-executions shows executed containers" {
  cd "${BATS_TEST_DIRNAME}/tests/fixtures/run-execute-success"

  # First, execute a service to create history
  "$DOCKER_ORCHESTRATE" run execute --project-name bats-run-exec-history migrate

  # Now list executions
  run "$DOCKER_ORCHESTRATE" run list-executions --project-name bats-run-exec-history
  echo "output: $output"
  echo "status: $status"
  assert_success
  assert_output_contains "SERVICE"
  assert_output_contains "exited"

  # Clean up labeled container
  docker rm -f $(docker ps -a --filter "label=com.dokku.orchestrate/run-project=bats-run-exec-history" -q) 2>/dev/null || true
}