#[test]
fn quiet_update_keeps_prebuilt_enabled_by_default() {
    let install = include_str!("../install.sh");
    assert!(install.contains("use_prebuilt=\"${DOSH_USE_PREBUILT:-1}\""));
    assert!(
        !install.contains("use_prebuilt=0"),
        "quiet updates must not force source builds"
    );
}

#[test]
fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
    let upload = include_str!("../scripts/upload-gitea-release.sh");
    assert!(upload.contains("skipping $artifact: version"));
    assert!(upload.contains("expected_version"));

    let publish = include_str!("../scripts/publish-gitea-release.sh");
    assert!(publish.contains("skipping stale artifact"));
    assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
}

#[test]
fn systemd_service_does_not_sandbox_remote_shells() {
    let service = include_str!("../packaging/systemd/dosh-server.service");
    let install = include_str!("../install.sh");
    for raw in [service, install] {
        assert!(raw.contains("KillMode=process"));
        assert!(
            raw.contains("Restart=always"),
            "dosh-server should come back after accidental SIGTERM while preserving child shells"
        );
        for directive in [
            "NoNewPrivileges=",
            "PrivateTmp=",
            "ProtectSystem=",
            "ProtectHome=",
            "RestrictAddressFamilies=",
            "RestrictRealtime=",
            "LockPersonality=",
            "MemoryDenyWriteExecute=",
        ] {
            assert!(
                !raw.contains(directive),
                "dosh sessions are user shells; systemd sandbox directive {directive} changes terminal/app behavior"
            );
        }
        assert!(
            !raw.contains("ReadWritePaths="),
            "remote shells must not be restricted to dosh config/data paths"
        );
    }
}