fix(auth): harden interactive diagnostic lifecycle

tools/tht/internal/compose/runner_test.go

@@ -116,6 +116,107 @@ func TestRunnerCleansUpNamedComposeContainerAfterCancellation(t *testing.T) {
 	assertContainerCleanup(t, logFile, marker, name)
 }
 
+func TestRunnerVerifiesAndRemovesNamedComposeContainerAfterNormalExit(t *testing.T) {
+	logFile := filepath.Join(t.TempDir(), "calls.log")
+	marker := filepath.Join(t.TempDir(), "container-present")
+	if err := os.WriteFile(marker, []byte("present"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("THT_RUNNER_TEST_LOG", logFile)
+	t.Setenv("THT_RUNNER_TEST_MARKER", marker)
+	t.Setenv("THT_RUNNER_TEST_MODE", "normal")
+	runner := NewRunner(writeExecutable(t, cleanupAwareDockerScript))
+	name := "thothii-cleanup-normal-sentinel"
+
+	result, err := RunBounded(runner, context.Background(), []string{
+		"compose", "run", "--rm", "--name", name, "core",
+	}, nil, CaptureLimits{StdoutBytes: 1024, StderrBytes: 1024})
+
+	if err != nil || result.ExitCode != 0 {
+		t.Fatalf("RunBounded() result=%#v error=%v, want clean exit", result, err)
+	}
+	assertContainerCleanup(t, logFile, marker, name)
+}
+
+func TestRunnerVerifiesAndRemovesNamedComposeContainerAfterExpectedExitOne(t *testing.T) {
+	logFile := filepath.Join(t.TempDir(), "calls.log")
+	marker := filepath.Join(t.TempDir(), "container-present")
+	if err := os.WriteFile(marker, []byte("present"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("THT_RUNNER_TEST_LOG", logFile)
+	t.Setenv("THT_RUNNER_TEST_MARKER", marker)
+	t.Setenv("THT_RUNNER_TEST_MODE", "exit-one")
+	runner := NewRunner(writeExecutable(t, cleanupAwareDockerScript))
+	name := "thothii-cleanup-exit-one-sentinel"
+
+	result, err := RunBounded(runner, context.Background(), []string{
+		"compose", "run", "--rm", "--name", name, "core",
+	}, nil, CaptureLimits{StdoutBytes: 1024, StderrBytes: 1024})
+
+	var exitError *exec.ExitError
+	if !errors.As(err, &exitError) || errors.Is(err, ErrContainerCleanup) || result.ExitCode != 1 {
+		t.Fatalf("RunBounded() result=%#v error=%v, want original exit 1", result, err)
+	}
+	assertContainerCleanup(t, logFile, marker, name)
+}
+
+func TestRunnerAcceptsANamedOneShotAlreadyRemovedByRm(t *testing.T) {
+	logFile := filepath.Join(t.TempDir(), "calls.log")
+	marker := filepath.Join(t.TempDir(), "container-absent")
+	t.Setenv("THT_RUNNER_TEST_LOG", logFile)
+	t.Setenv("THT_RUNNER_TEST_MARKER", marker)
+	t.Setenv("THT_RUNNER_TEST_MODE", "normal")
+	runner := NewRunner(writeExecutable(t, cleanupAwareDockerScript))
+	name := "thothii-cleanup-already-removed-sentinel"
+
+	result, err := RunBounded(runner, context.Background(), []string{
+		"compose", "run", "--rm", "--name", name, "core",
+	}, nil, CaptureLimits{StdoutBytes: 1024, StderrBytes: 1024})
+
+	if err != nil || result.ExitCode != 0 {
+		t.Fatalf("RunBounded() result=%#v error=%v, want clean exit", result, err)
+	}
+	calls, readErr := os.ReadFile(logFile)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	if !strings.Contains(string(calls), "container ls --all --quiet --filter name=^/"+name+"$") ||
+		strings.Contains(string(calls), "container rm -f "+name) {
+		t.Fatalf("Docker calls = %q, want absence verification without forced removal", calls)
+	}
+	if _, statErr := os.Stat(marker); !os.IsNotExist(statErr) {
+		t.Fatalf("named one-shot unexpectedly left residue: %v", statErr)
+	}
+}
+
+func TestRunnerJoinsCleanupFailureAfterNormalExit(t *testing.T) {
+	logFile := filepath.Join(t.TempDir(), "calls.log")
+	marker := filepath.Join(t.TempDir(), "container-present")
+	if err := os.WriteFile(marker, []byte("present"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("THT_RUNNER_TEST_LOG", logFile)
+	t.Setenv("THT_RUNNER_TEST_MARKER", marker)
+	t.Setenv("THT_RUNNER_TEST_MODE", "normal-cleanup-fails")
+	runner := NewRunner(writeExecutable(t, cleanupAwareDockerScript))
+	name := "thothii-cleanup-failure-sentinel"
+
+	result, err := RunBounded(runner, context.Background(), []string{
+		"compose", "run", "--rm", "--name", name, "core",
+	}, nil, CaptureLimits{StdoutBytes: 1024, StderrBytes: 1024})
+
+	if result.ExitCode != 0 || !errors.Is(err, ErrContainerCleanup) {
+		t.Fatalf("RunBounded() result=%#v error=%v, want cleanup failure joined to exit 0", result, err)
+	}
+	if strings.Contains(err.Error(), name) {
+		t.Fatalf("RunBounded() exposed the container name: %v", err)
+	}
+	if _, statErr := os.Stat(marker); statErr != nil {
+		t.Fatalf("cleanup failure test unexpectedly removed marker: %v", statErr)
+	}
+}
+
 func TestRunnerSurfacesCleanupFailureWithoutContainerName(t *testing.T) {
 	logFile := filepath.Join(t.TempDir(), "calls.log")
 	marker := filepath.Join(t.TempDir(), "container-present")
@@ -270,13 +371,19 @@ if [ "$1" = "container" ] && [ "$2" = "ls" ]; then
   exit 0
 fi
 if [ "$1" = "container" ] && [ "$2" = "rm" ]; then
-  if [ "$THT_RUNNER_TEST_MODE" = "cleanup-fails" ]; then exit 9; fi
+  case "$THT_RUNNER_TEST_MODE" in *cleanup-fails) exit 9 ;; esac
   rm -f "$THT_RUNNER_TEST_MARKER"
   exit 0
 fi
 if [ "$THT_RUNNER_TEST_MODE" = "flood" ]; then
   while :; do printf '0123456789abcdef'; printf 'fedcba9876543210' >&2; done
 fi
+if [ "$THT_RUNNER_TEST_MODE" = "normal" ] || [ "$THT_RUNNER_TEST_MODE" = "normal-cleanup-fails" ]; then
+  exit 0
+fi
+if [ "$THT_RUNNER_TEST_MODE" = "exit-one" ]; then
+  exit 1
+fi
 trap '' TERM INT
 while :; do sleep 1; done
 `