Test extensive coverage and improvement

.github/workflows/tests.yml

@@ -49,6 +49,12 @@ jobs:
           go vet ./cmd/...
           echo "✓ Vet passed"
 
+      - name: Run go test
+        run: |
+          echo "Running go test..."
+          go test ./cmd/...
+          echo "✓ Go tests passed"
+
   integration-tests:
     name: Integration Tests
     runs-on: macos-latest

bin/touchid.sh

@@ -12,7 +12,7 @@ LIB_DIR="$(cd "$SCRIPT_DIR/../lib" && pwd)"
 # shellcheck source=../lib/core/common.sh
 source "$LIB_DIR/core/common.sh"
 
-readonly PAM_SUDO_FILE="/etc/pam.d/sudo"
+readonly PAM_SUDO_FILE="${MOLE_PAM_SUDO_FILE:-/etc/pam.d/sudo}"
 readonly PAM_TID_LINE="auth       sufficient     pam_tid.so"
 
 # Check if Touch ID is already configured

cmd/analyze/analyze_test.go

@@ -0,0 +1,362 @@
+package main
+
+import (
+	"encoding/gob"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func resetOverviewSnapshotForTest() {
+	overviewSnapshotMu.Lock()
+	overviewSnapshotCache = nil
+	overviewSnapshotLoaded = false
+	overviewSnapshotMu.Unlock()
+}
+
+func TestScanPathConcurrentBasic(t *testing.T) {
+	root := t.TempDir()
+
+	rootFile := filepath.Join(root, "root.txt")
+	if err := os.WriteFile(rootFile, []byte("root-data"), 0o644); err != nil {
+		t.Fatalf("write root file: %v", err)
+	}
+
+	nested := filepath.Join(root, "nested")
+	if err := os.MkdirAll(nested, 0o755); err != nil {
+		t.Fatalf("create nested dir: %v", err)
+	}
+
+	fileOne := filepath.Join(nested, "a.bin")
+	if err := os.WriteFile(fileOne, []byte("alpha"), 0o644); err != nil {
+		t.Fatalf("write file one: %v", err)
+	}
+	fileTwo := filepath.Join(nested, "b.bin")
+	if err := os.WriteFile(fileTwo, []byte(strings.Repeat("b", 32)), 0o644); err != nil {
+		t.Fatalf("write file two: %v", err)
+	}
+
+	linkPath := filepath.Join(root, "link-to-a")
+	if err := os.Symlink(fileOne, linkPath); err != nil {
+		t.Fatalf("create symlink: %v", err)
+	}
+
+	var filesScanned, dirsScanned, bytesScanned int64
+	current := ""
+
+	result, err := scanPathConcurrent(root, &filesScanned, &dirsScanned, &bytesScanned, &current)
+	if err != nil {
+		t.Fatalf("scanPathConcurrent returned error: %v", err)
+	}
+
+	linkInfo, err := os.Lstat(linkPath)
+	if err != nil {
+		t.Fatalf("stat symlink: %v", err)
+	}
+
+	expectedDirSize := int64(len("alpha") + len(strings.Repeat("b", 32)))
+	expectedRootFileSize := int64(len("root-data"))
+	expectedLinkSize := getActualFileSize(linkPath, linkInfo)
+	expectedTotal := expectedDirSize + expectedRootFileSize + expectedLinkSize
+
+	if result.TotalSize != expectedTotal {
+		t.Fatalf("expected total size %d, got %d", expectedTotal, result.TotalSize)
+	}
+
+	if got := atomic.LoadInt64(&filesScanned); got != 3 {
+		t.Fatalf("expected 3 files scanned, got %d", got)
+	}
+	if dirs := atomic.LoadInt64(&dirsScanned); dirs == 0 {
+		t.Fatalf("expected directory scan count to increase")
+	}
+	if bytes := atomic.LoadInt64(&bytesScanned); bytes == 0 {
+		t.Fatalf("expected byte counter to increase")
+	}
+	if current == "" {
+		t.Fatalf("expected current path to be updated")
+	}
+
+	foundSymlink := false
+	for _, entry := range result.Entries {
+		if strings.HasSuffix(entry.Name, " →") {
+			foundSymlink = true
+			if entry.IsDir {
+				t.Fatalf("symlink entry should not be marked as directory")
+			}
+		}
+	}
+	if !foundSymlink {
+		t.Fatalf("expected symlink entry to be present in scan result")
+	}
+}
+
+func TestDeletePathWithProgress(t *testing.T) {
+	parent := t.TempDir()
+	target := filepath.Join(parent, "target")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatalf("create target: %v", err)
+	}
+
+	files := []string{
+		filepath.Join(target, "one.txt"),
+		filepath.Join(target, "two.txt"),
+	}
+	for _, f := range files {
+		if err := os.WriteFile(f, []byte("content"), 0o644); err != nil {
+			t.Fatalf("write %s: %v", f, err)
+		}
+	}
+
+	var counter int64
+	count, err := deletePathWithProgress(target, &counter)
+	if err != nil {
+		t.Fatalf("deletePathWithProgress returned error: %v", err)
+	}
+	if count != int64(len(files)) {
+		t.Fatalf("expected %d files removed, got %d", len(files), count)
+	}
+	if got := atomic.LoadInt64(&counter); got != count {
+		t.Fatalf("counter mismatch: want %d, got %d", count, got)
+	}
+	if _, err := os.Stat(target); !os.IsNotExist(err) {
+		t.Fatalf("expected target to be removed, stat err=%v", err)
+	}
+}
+
+func TestOverviewStoreAndLoad(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	resetOverviewSnapshotForTest()
+	t.Cleanup(resetOverviewSnapshotForTest)
+
+	path := filepath.Join(home, "project")
+	want := int64(123456)
+
+	if err := storeOverviewSize(path, want); err != nil {
+		t.Fatalf("storeOverviewSize: %v", err)
+	}
+
+	got, err := loadStoredOverviewSize(path)
+	if err != nil {
+		t.Fatalf("loadStoredOverviewSize: %v", err)
+	}
+	if got != want {
+		t.Fatalf("snapshot mismatch: want %d, got %d", want, got)
+	}
+
+	// Force reload from disk and ensure value persists.
+	resetOverviewSnapshotForTest()
+	got, err = loadStoredOverviewSize(path)
+	if err != nil {
+		t.Fatalf("loadStoredOverviewSize after reset: %v", err)
+	}
+	if got != want {
+		t.Fatalf("snapshot mismatch after reset: want %d, got %d", want, got)
+	}
+}
+
+func TestCacheSaveLoadRoundTrip(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+
+	target := filepath.Join(home, "cache-target")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatalf("create target dir: %v", err)
+	}
+
+	result := scanResult{
+		Entries: []dirEntry{
+			{Name: "alpha", Path: filepath.Join(target, "alpha"), Size: 10, IsDir: true},
+		},
+		LargeFiles: []fileEntry{
+			{Name: "big.bin", Path: filepath.Join(target, "big.bin"), Size: 2048},
+		},
+		TotalSize: 42,
+	}
+
+	if err := saveCacheToDisk(target, result); err != nil {
+		t.Fatalf("saveCacheToDisk: %v", err)
+	}
+
+	cache, err := loadCacheFromDisk(target)
+	if err != nil {
+		t.Fatalf("loadCacheFromDisk: %v", err)
+	}
+	if cache.TotalSize != result.TotalSize {
+		t.Fatalf("total size mismatch: want %d, got %d", result.TotalSize, cache.TotalSize)
+	}
+	if len(cache.Entries) != len(result.Entries) {
+		t.Fatalf("entry count mismatch: want %d, got %d", len(result.Entries), len(cache.Entries))
+	}
+	if len(cache.LargeFiles) != len(result.LargeFiles) {
+		t.Fatalf("large file count mismatch: want %d, got %d", len(result.LargeFiles), len(cache.LargeFiles))
+	}
+}
+
+func TestMeasureOverviewSize(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+	resetOverviewSnapshotForTest()
+	t.Cleanup(resetOverviewSnapshotForTest)
+
+	target := filepath.Join(home, "measure")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatalf("create target: %v", err)
+	}
+	content := []byte(strings.Repeat("x", 2048))
+	if err := os.WriteFile(filepath.Join(target, "data.bin"), content, 0o644); err != nil {
+		t.Fatalf("write file: %v", err)
+	}
+
+	size, err := measureOverviewSize(target)
+	if err != nil {
+		t.Fatalf("measureOverviewSize: %v", err)
+	}
+	if size <= 0 {
+		t.Fatalf("expected positive size, got %d", size)
+	}
+
+	// Ensure snapshot stored
+	cached, err := loadStoredOverviewSize(target)
+	if err != nil {
+		t.Fatalf("loadStoredOverviewSize: %v", err)
+	}
+	if cached != size {
+		t.Fatalf("snapshot mismatch: want %d, got %d", size, cached)
+	}
+}
+
+func TestIsCleanableDir(t *testing.T) {
+	if !isCleanableDir("/Users/test/project/node_modules") {
+		t.Fatalf("expected node_modules to be cleanable")
+	}
+	if isCleanableDir("/Users/test/Library/Caches/AppCache") {
+		t.Fatalf("Library caches should be handled by mo clean")
+	}
+	if isCleanableDir("") {
+		t.Fatalf("empty path should not be cleanable")
+	}
+}
+
+func TestHasUsefulVolumeMounts(t *testing.T) {
+	root := t.TempDir()
+	if hasUsefulVolumeMounts(root) {
+		t.Fatalf("empty directory should not report useful mounts")
+	}
+
+	hidden := filepath.Join(root, ".hidden")
+	if err := os.Mkdir(hidden, 0o755); err != nil {
+		t.Fatalf("create hidden dir: %v", err)
+	}
+	if hasUsefulVolumeMounts(root) {
+		t.Fatalf("hidden entries should not count as useful mounts")
+	}
+
+	mount := filepath.Join(root, "ExternalDrive")
+	if err := os.Mkdir(mount, 0o755); err != nil {
+		t.Fatalf("create mount dir: %v", err)
+	}
+	if !hasUsefulVolumeMounts(root) {
+		t.Fatalf("expected useful mount when real directory exists")
+	}
+}
+
+func TestLoadCacheExpiresWhenDirectoryChanges(t *testing.T) {
+	home := t.TempDir()
+	t.Setenv("HOME", home)
+
+	target := filepath.Join(home, "change-target")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatalf("create target: %v", err)
+	}
+
+	result := scanResult{TotalSize: 5}
+	if err := saveCacheToDisk(target, result); err != nil {
+		t.Fatalf("saveCacheToDisk: %v", err)
+	}
+
+	// Touch directory to advance mtime beyond grace period.
+	time.Sleep(time.Millisecond * 10)
+	if err := os.Chtimes(target, time.Now(), time.Now()); err != nil {
+		t.Fatalf("chtimes: %v", err)
+	}
+
+	// Force modtime difference beyond grace window by simulating an older cache entry.
+	cachePath, err := getCachePath(target)
+	if err != nil {
+		t.Fatalf("getCachePath: %v", err)
+	}
+	if _, err := os.Stat(cachePath); err != nil {
+		t.Fatalf("stat cache: %v", err)
+	}
+	oldTime := time.Now().Add(-cacheModTimeGrace - time.Minute)
+	if err := os.Chtimes(cachePath, oldTime, oldTime); err != nil {
+		t.Fatalf("chtimes cache: %v", err)
+	}
+
+	file, err := os.Open(cachePath)
+	if err != nil {
+		t.Fatalf("open cache: %v", err)
+	}
+	var entry cacheEntry
+	if err := gob.NewDecoder(file).Decode(&entry); err != nil {
+		t.Fatalf("decode cache: %v", err)
+	}
+	_ = file.Close()
+
+	entry.ScanTime = time.Now().Add(-8 * 24 * time.Hour)
+
+	tmp := cachePath + ".tmp"
+	f, err := os.Create(tmp)
+	if err != nil {
+		t.Fatalf("create tmp cache: %v", err)
+	}
+	if err := gob.NewEncoder(f).Encode(&entry); err != nil {
+		t.Fatalf("encode tmp cache: %v", err)
+	}
+	_ = f.Close()
+	if err := os.Rename(tmp, cachePath); err != nil {
+		t.Fatalf("rename tmp cache: %v", err)
+	}
+
+	if _, err := loadCacheFromDisk(target); err == nil {
+		t.Fatalf("expected cache load to fail after stale scan time")
+	}
+}
+
+func TestScanPathPermissionError(t *testing.T) {
+	root := t.TempDir()
+	lockedDir := filepath.Join(root, "locked")
+	if err := os.Mkdir(lockedDir, 0o755); err != nil {
+		t.Fatalf("create locked dir: %v", err)
+	}
+	
+	// Create a file inside before locking, just to be sure
+	if err := os.WriteFile(filepath.Join(lockedDir, "secret.txt"), []byte("shh"), 0o644); err != nil {
+		t.Fatalf("write secret: %v", err)
+	}
+
+	// Remove permissions
+	if err := os.Chmod(lockedDir, 0o000); err != nil {
+		t.Fatalf("chmod 000: %v", err)
+	}
+	defer func() {
+		// Restore permissions so cleanup can work
+		_ = os.Chmod(lockedDir, 0o755)
+	}()
+
+	var files, dirs, bytes int64
+	current := ""
+	
+	// Scanning the locked dir itself should fail
+	_, err := scanPathConcurrent(lockedDir, &files, &dirs, &bytes, &current)
+	if err == nil {
+		t.Fatalf("expected error scanning locked directory, got nil")
+	}
+	if !os.IsPermission(err) {
+		t.Logf("unexpected error type: %v", err)
+	}
+}

cmd/status/metrics_health_test.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestCalculateHealthScorePerfect(t *testing.T) {
+	score, msg := calculateHealthScore(
+		CPUStatus{Usage: 10},
+		MemoryStatus{UsedPercent: 20, Pressure: "normal"},
+		[]DiskStatus{{UsedPercent: 30}},
+		DiskIOStatus{ReadRate: 5, WriteRate: 5},
+		ThermalStatus{CPUTemp: 40},
+	)
+
+	if score != 100 {
+		t.Fatalf("expected perfect score 100, got %d", score)
+	}
+	if msg != "Excellent" {
+		t.Fatalf("unexpected message %q", msg)
+	}
+}
+
+func TestCalculateHealthScoreDetectsIssues(t *testing.T) {
+	score, msg := calculateHealthScore(
+		CPUStatus{Usage: 95},
+		MemoryStatus{UsedPercent: 90, Pressure: "critical"},
+		[]DiskStatus{{UsedPercent: 95}},
+		DiskIOStatus{ReadRate: 120, WriteRate: 80},
+		ThermalStatus{CPUTemp: 90},
+	)
+
+	if score >= 40 {
+		t.Fatalf("expected heavy penalties bringing score down, got %d", score)
+	}
+	if msg == "Excellent" {
+		t.Fatalf("expected message to include issues, got %q", msg)
+	}
+	if !strings.Contains(msg, "High CPU") {
+		t.Fatalf("message should mention CPU issue: %q", msg)
+	}
+	if !strings.Contains(msg, "Disk Almost Full") {
+		t.Fatalf("message should mention disk issue: %q", msg)
+	}
+}
+
+func TestFormatUptime(t *testing.T) {
+	if got := formatUptime(65); got != "1m" {
+		t.Fatalf("expected 1m, got %s", got)
+	}
+	if got := formatUptime(3600 + 120); got != "1h 2m" {
+		t.Fatalf("expected \"1h 2m\", got %s", got)
+	}
+	if got := formatUptime(86400*2 + 3600*3 + 60*5); got != "2d 3h 5m" {
+		t.Fatalf("expected \"2d 3h 5m\", got %s", got)
+	}
+}

scripts/run-tests.sh

@@ -66,7 +66,7 @@ echo ""
 # 4. Go Tests
 echo "4. Running Go tests..."
 if command -v go > /dev/null 2>&1; then
-    if go build ./... && go vet ./cmd/...; then
+    if go build ./... && go vet ./cmd/... && go test ./cmd/...; then
         echo -e "${GREEN}✓ Go tests passed${NC}"
     else
         echo -e "${RED}✗ Go tests failed${NC}"

tests/autofix.bats

@@ -0,0 +1,98 @@
+#!/usr/bin/env bats
+
+setup_file() {
+    PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
+    export PROJECT_ROOT
+}
+
+@test "show_suggestions lists auto and manual items and exports flag" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/base.sh"
+source "$PROJECT_ROOT/lib/manage/autofix.sh"
+
+export FIREWALL_DISABLED=true
+export FILEVAULT_DISABLED=true
+export TOUCHID_NOT_CONFIGURED=true
+export ROSETTA_NOT_INSTALLED=true
+export CACHE_SIZE_GB=9
+export BREW_HAS_WARNINGS=true
+export DISK_FREE_GB=25
+
+show_suggestions
+echo "AUTO_FLAG=${HAS_AUTO_FIX_SUGGESTIONS}"
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Enable Firewall for better security"* ]]
+    [[ "$output" == *"Enable FileVault"* ]]
+    [[ "$output" == *"Enable Touch ID for sudo"* ]]
+    [[ "$output" == *"Install Rosetta 2"* ]]
+    [[ "$output" == *"Low disk space (25GB free)"* ]]
+    [[ "$output" == *"AUTO_FLAG=true"* ]]
+}
+
+@test "ask_for_auto_fix accepts Enter" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/base.sh"
+source "$PROJECT_ROOT/lib/manage/autofix.sh"
+HAS_AUTO_FIX_SUGGESTIONS=true
+read_key() { echo "ENTER"; return 0; }
+ask_for_auto_fix
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"yes"* ]]
+}
+
+@test "ask_for_auto_fix rejects other keys" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/base.sh"
+source "$PROJECT_ROOT/lib/manage/autofix.sh"
+HAS_AUTO_FIX_SUGGESTIONS=true
+read_key() { echo "ESC"; return 0; }
+ask_for_auto_fix
+EOF
+
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"no"* ]]
+}
+
+@test "perform_auto_fix applies available actions and records summary" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/base.sh"
+source "$PROJECT_ROOT/lib/manage/autofix.sh"
+
+has_sudo_session() { return 0; }
+ensure_sudo_session() { return 0; }
+sudo() {
+    case "$1" in
+        defaults) return 0 ;;
+        bash) return 0 ;;
+        softwareupdate)
+            echo "Installing Rosetta 2 stub output"
+            return 0
+            ;;
+        *) return 0 ;;
+    esac
+}
+
+export FIREWALL_DISABLED=true
+export TOUCHID_NOT_CONFIGURED=true
+export ROSETTA_NOT_INSTALLED=true
+
+perform_auto_fix
+echo "SUMMARY=${AUTO_FIX_SUMMARY}"
+echo "DETAILS=${AUTO_FIX_DETAILS}"
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Firewall enabled"* ]]
+    [[ "$output" == *"Touch ID configured"* ]]
+    [[ "$output" == *"Rosetta 2 installed"* ]]
+    [[ "$output" == *"SUMMARY=Auto fixes applied: 3 issue(s)"* ]]
+    [[ "$output" == *"DETAILS"* ]]
+}

tests/optimization_tasks.bats

@@ -1,210 +0,0 @@
-#!/usr/bin/env bats
-
-setup_file() {
-    PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
-    export PROJECT_ROOT
-
-    ORIGINAL_HOME="${HOME:-}"
-    export ORIGINAL_HOME
-
-    HOME="$(mktemp -d "${BATS_TEST_DIRNAME}/tmp-opt-home.XXXXXX")"
-    export HOME
-
-    mkdir -p "$HOME"
-}
-
-teardown_file() {
-    rm -rf "$HOME"
-    if [[ -n "${ORIGINAL_HOME:-}" ]]; then
-        export HOME="$ORIGINAL_HOME"
-    fi
-}
-
-setup() {
-    export TERM="dumb"
-    rm -rf "${HOME:?}"/*
-    mkdir -p "$HOME/Library/Application Support/com.apple.sharedfilelist"
-    mkdir -p "$HOME/Library/Caches"
-    mkdir -p "$HOME/Library/Saved Application State"
-}
-
-@test "run_with_timeout succeeds without GNU timeout" {
-    run bash --noprofile --norc -c '
-        set -euo pipefail
-        PATH="/usr/bin:/bin"
-        unset MO_TIMEOUT_INITIALIZED MO_TIMEOUT_BIN
-        source "'"$PROJECT_ROOT"'/lib/core/common.sh"
-        run_with_timeout 1 sleep 0.1
-    '
-    [ "$status" -eq 0 ]
-}
-
-@test "run_with_timeout enforces timeout and returns 124" {
-    run bash --noprofile --norc -c '
-        set -euo pipefail
-        PATH="/usr/bin:/bin"
-        unset MO_TIMEOUT_INITIALIZED MO_TIMEOUT_BIN
-        source "'"$PROJECT_ROOT"'/lib/core/common.sh"
-        run_with_timeout 1 sleep 5
-    '
-    [ "$status" -eq 124 ]
-}
-
-@test "opt_recent_items removes shared file lists" {
-    local shared_dir="$HOME/Library/Application Support/com.apple.sharedfilelist"
-    mkdir -p "$shared_dir"
-    touch "$shared_dir/test.sfl2"
-    touch "$shared_dir/recent.sfl2"
-
-    run env HOME="$HOME" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-# Mock sudo and defaults to avoid system changes
-sudo() { return 0; }
-defaults() { return 0; }
-export -f sudo defaults
-opt_recent_items
-EOF
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"Recent items cleared"* ]]
-}
-
-@test "opt_recent_items handles missing shared directory" {
-    rm -rf "$HOME/Library/Application Support/com.apple.sharedfilelist"
-
-    run env HOME="$HOME" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-sudo() { return 0; }
-defaults() { return 0; }
-export -f sudo defaults
-opt_recent_items
-EOF
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"Recent items cleared"* ]]
-}
-
-@test "opt_saved_state_cleanup removes old saved states" {
-    local state_dir="$HOME/Library/Saved Application State"
-    mkdir -p "$state_dir/com.example.app.savedState"
-    touch "$state_dir/com.example.app.savedState/data.plist"
-
-    # Make the file old (8+ days) - MOLE_SAVED_STATE_AGE_DAYS defaults to 7
-    touch -t 202301010000 "$state_dir/com.example.app.savedState/data.plist"
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-opt_saved_state_cleanup
-EOF
-
-    [ "$status" -eq 0 ]
-}
-
-@test "opt_saved_state_cleanup handles missing state directory" {
-    rm -rf "$HOME/Library/Saved Application State"
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-opt_saved_state_cleanup
-EOF
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"No saved states directory"* ]]
-}
-
-@test "opt_cache_refresh cleans Quick Look cache" {
-    mkdir -p "$HOME/Library/Caches/com.apple.QuickLook.thumbnailcache"
-    touch "$HOME/Library/Caches/com.apple.QuickLook.thumbnailcache/test.db"
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-# Mock qlmanage and cleanup_path to avoid system calls
-qlmanage() { return 0; }
-cleanup_path() {
-    local path="$1"
-    local label="${2:-}"
-    [[ -e "$path" ]] && rm -rf "$path" 2>/dev/null || true
-}
-export -f qlmanage cleanup_path
-opt_cache_refresh
-EOF
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"Finder and Safari caches updated"* ]]
-}
-
-@test "opt_mail_downloads skips cleanup when size below threshold" {
-    mkdir -p "$HOME/Library/Mail Downloads"
-    # Create small file (below threshold of 5MB)
-    echo "test" > "$HOME/Library/Mail Downloads/small.txt"
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-# MOLE_MAIL_DOWNLOADS_MIN_KB is readonly, defaults to 5120 KB (~5MB)
-opt_mail_downloads
-EOF
-
-    [ "$status" -eq 0 ]
-    [[ "$output" == *"skipping cleanup"* ]]
-    [ -f "$HOME/Library/Mail Downloads/small.txt" ]
-}
-
-@test "opt_mail_downloads removes old attachments" {
-    mkdir -p "$HOME/Library/Mail Downloads"
-    touch "$HOME/Library/Mail Downloads/old.pdf"
-    # Make file old (31+ days) - MOLE_LOG_AGE_DAYS defaults to 30
-    touch -t 202301010000 "$HOME/Library/Mail Downloads/old.pdf"
-
-    # Create large enough size to trigger cleanup (>5MB threshold)
-    dd if=/dev/zero of="$HOME/Library/Mail Downloads/dummy.dat" bs=1024 count=6000 2>/dev/null
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-source "$PROJECT_ROOT/lib/optimize/tasks.sh"
-# MOLE_MAIL_DOWNLOADS_MIN_KB and MOLE_LOG_AGE_DAYS are readonly constants
-opt_mail_downloads
-EOF
-
-    [ "$status" -eq 0 ]
-}
-
-@test "get_path_size_kb returns zero for missing directory" {
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-size=$(get_path_size_kb "/nonexistent/path")
-echo "$size"
-EOF
-
-    [ "$status" -eq 0 ]
-    [ "$output" = "0" ]
-}
-
-@test "get_path_size_kb calculates directory size" {
-    mkdir -p "$HOME/test_size"
-    dd if=/dev/zero of="$HOME/test_size/file.dat" bs=1024 count=10 2>/dev/null
-
-    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
-set -euo pipefail
-source "$PROJECT_ROOT/lib/core/common.sh"
-size=$(get_path_size_kb "$HOME/test_size")
-echo "$size"
-EOF
-
-    [ "$status" -eq 0 ]
-    # Should be >= 10 KB
-    [ "$output" -ge 10 ]
-}

tests/system_maintenance.bats

@@ -0,0 +1,487 @@
+#!/usr/bin/env bats
+
+setup_file() {
+    PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
+    export PROJECT_ROOT
+
+    ORIGINAL_HOME="${HOME:-}"
+    export ORIGINAL_HOME
+
+    HOME="$(mktemp -d "${BATS_TEST_DIRNAME}/tmp-system-clean.XXXXXX")"
+    export HOME
+
+    mkdir -p "$HOME"
+}
+
+teardown_file() {
+    rm -rf "$HOME"
+    if [[ -n "${ORIGINAL_HOME:-}" ]]; then
+        export HOME="$ORIGINAL_HOME"
+    fi
+}
+
+@test "clean_deep_system issues safe sudo deletions" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+CALL_LOG="$HOME/system_calls.log"
+> "$CALL_LOG"
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/system.sh"
+
+safe_sudo_find_delete() {
+    echo "safe_sudo_find_delete:$1:$2" >> "$CALL_LOG"
+    return 0
+}
+safe_sudo_remove() {
+    echo "safe_sudo_remove:$1" >> "$CALL_LOG"
+    return 0
+}
+log_success() { :; }
+is_sip_enabled() { return 1; }
+get_file_mtime() { echo 0; }
+get_path_size_kb() { echo 0; }
+find() { return 0; }
+
+clean_deep_system
+cat "$CALL_LOG"
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"/Library/Caches"* ]]
+    [[ "$output" == *"/private/tmp"* ]]
+    [[ "$output" == *"/private/var/log"* ]]
+}
+
+@test "clean_deep_system skips /Library/Updates when SIP enabled" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+CALL_LOG="$HOME/system_calls_skip.log"
+> "$CALL_LOG"
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/system.sh"
+
+safe_sudo_find_delete() { return 0; }
+safe_sudo_remove() {
+    echo "REMOVE:$1" >> "$CALL_LOG"
+    return 0
+}
+log_success() { :; }
+is_sip_enabled() { return 0; } # SIP enabled -> skip removal
+find() { return 0; }
+
+clean_deep_system
+cat "$CALL_LOG"
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" != *"/Library/Updates"* ]]
+}
+
+@test "clean_time_machine_failed_backups exits when tmutil has no destinations" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/system.sh"
+
+tmutil() {
+    if [[ "$1" == "destinationinfo" ]]; then
+        echo "No destinations configured"
+        return 0
+    fi
+    return 0
+}
+pgrep() { return 1; }
+find() { return 0; }
+
+clean_time_machine_failed_backups
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"No failed Time Machine backups found"* ]]
+}
+
+@test "clean_orphaned_casks uses cached mapping when recent" {
+    cache_dir="$HOME/.cache/mole"
+    mkdir -p "$cache_dir"
+    cat > "$cache_dir/cask_apps.cache" <<'EOF'
+fake-app|Fake.app
+EOF
+
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/brew.sh"
+
+touch "$HOME/.cache/mole/cask_apps.cache"
+
+brew() { return 0; }
+start_inline_spinner(){ :; }
+stop_inline_spinner(){ :; }
+sudo() { return 0; }
+MOLE_SPINNER_PREFIX=""
+clean_orphaned_casks
+EOF
+
+    [ "$status" -eq 0 ]
+}
+
+@test "clean_homebrew skips when cleaned recently" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/brew.sh"
+
+mkdir -p "$HOME/.cache/mole"
+date +%s > "$HOME/.cache/mole/brew_last_cleanup"
+
+brew() { return 0; }
+
+clean_homebrew
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"cleaned"* ]]
+}
+
+@test "clean_homebrew runs cleanup with timeout stubs" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/clean/brew.sh"
+
+mkdir -p "$HOME/.cache/mole"
+rm -f "$HOME/.cache/mole/brew_last_cleanup"
+
+MO_BREW_TIMEOUT=2
+
+start_inline_spinner(){ :; }
+stop_inline_spinner(){ :; }
+
+brew() {
+    case "$1" in
+        cleanup)
+            echo "Removing: package"
+            return 0
+            ;;
+        autoremove)
+            echo "Uninstalling pkg"
+            return 0
+            ;;
+        *)
+            return 0
+            ;;
+    esac
+}
+
+clean_homebrew
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Homebrew cleanup"* ]]
+}
+
+@test "check_homebrew_updates reports counts and uses cache" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/check/all.sh"
+
+brew() {
+    if [[ "$1" == "outdated" && "$2" == "--quiet" ]]; then
+        echo "pkg1"
+        echo "pkg2"
+        return 0
+    fi
+    if [[ "$1" == "outdated" && "$2" == "--cask" ]]; then
+        echo "cask1"
+        return 0
+    fi
+    return 0
+}
+
+start_inline_spinner(){ :; }
+stop_inline_spinner(){ :; }
+
+check_homebrew_updates
+
+# second call should read cache (no spinner)
+check_homebrew_updates
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Homebrew"* ]]
+    [[ "$output" == *"2 formula"* ]]
+}
+
+@test "check_appstore_updates reports count from softwareupdate" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/check/all.sh"
+
+softwareupdate() {
+    echo "* Label: AppOne"
+    echo "* Label: AppTwo"
+    return 0
+}
+
+start_inline_spinner(){ :; }
+stop_inline_spinner(){ :; }
+
+check_appstore_updates
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"App Store"* ]]
+    [[ "$output" == *"2 apps"* ]]
+}
+
+@test "check_macos_update warns when update available" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/check/all.sh"
+
+softwareupdate() {
+    echo "* Label: macOS 99"
+    return 0
+}
+
+start_inline_spinner(){ :; }
+stop_inline_spinner(){ :; }
+
+check_macos_update
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"macOS"* ]]
+}
+
+@test "run_with_timeout succeeds without GNU timeout" {
+    run bash --noprofile --norc -c '
+        set -euo pipefail
+        PATH="/usr/bin:/bin"
+        unset MO_TIMEOUT_INITIALIZED MO_TIMEOUT_BIN
+        source "'"$PROJECT_ROOT"'/lib/core/common.sh"
+        run_with_timeout 1 sleep 0.1
+    '
+    [ "$status" -eq 0 ]
+}
+
+@test "run_with_timeout enforces timeout and returns 124" {
+    run bash --noprofile --norc -c '
+        set -euo pipefail
+        PATH="/usr/bin:/bin"
+        unset MO_TIMEOUT_INITIALIZED MO_TIMEOUT_BIN
+        source "'"$PROJECT_ROOT"'/lib/core/common.sh"
+        run_with_timeout 1 sleep 5
+    '
+    [ "$status" -eq 124 ]
+}
+
+@test "opt_recent_items removes shared file lists" {
+    local shared_dir="$HOME/Library/Application Support/com.apple.sharedfilelist"
+    mkdir -p "$shared_dir"
+    touch "$shared_dir/test.sfl2"
+    touch "$shared_dir/recent.sfl2"
+
+    run env HOME="$HOME" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+# Mock sudo and defaults to avoid system changes
+sudo() { return 0; }
+defaults() { return 0; }
+export -f sudo defaults
+opt_recent_items
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Recent items cleared"* ]]
+}
+
+@test "opt_recent_items handles missing shared directory" {
+    rm -rf "$HOME/Library/Application Support/com.apple.sharedfilelist"
+
+    run env HOME="$HOME" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+sudo() { return 0; }
+defaults() { return 0; }
+export -f sudo defaults
+opt_recent_items
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Recent items cleared"* ]]
+}
+
+@test "opt_saved_state_cleanup removes old saved states" {
+    local state_dir="$HOME/Library/Saved Application State"
+    mkdir -p "$state_dir/com.example.app.savedState"
+    touch "$state_dir/com.example.app.savedState/data.plist"
+
+    # Make the file old (8+ days) - MOLE_SAVED_STATE_AGE_DAYS defaults to 7
+    touch -t 202301010000 "$state_dir/com.example.app.savedState/data.plist"
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+opt_saved_state_cleanup
+EOF
+
+    [ "$status" -eq 0 ]
+}
+
+@test "opt_saved_state_cleanup handles missing state directory" {
+    rm -rf "$HOME/Library/Saved Application State"
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+opt_saved_state_cleanup
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"No saved states directory"* ]]
+}
+
+@test "opt_cache_refresh cleans Quick Look cache" {
+    mkdir -p "$HOME/Library/Caches/com.apple.QuickLook.thumbnailcache"
+    touch "$HOME/Library/Caches/com.apple.QuickLook.thumbnailcache/test.db"
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+# Mock qlmanage and cleanup_path to avoid system calls
+qlmanage() { return 0; }
+cleanup_path() {
+    local path="$1"
+    local label="${2:-}"
+    [[ -e "$path" ]] && rm -rf "$path" 2>/dev/null || true
+}
+export -f qlmanage cleanup_path
+opt_cache_refresh
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Finder and Safari caches updated"* ]]
+}
+
+@test "opt_mail_downloads skips cleanup when size below threshold" {
+    mkdir -p "$HOME/Library/Mail Downloads"
+    # Create small file (below threshold of 5MB)
+    echo "test" > "$HOME/Library/Mail Downloads/small.txt"
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+# MOLE_MAIL_DOWNLOADS_MIN_KB is readonly, defaults to 5120 KB (~5MB)
+opt_mail_downloads
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"skipping cleanup"* ]]
+    [ -f "$HOME/Library/Mail Downloads/small.txt" ]
+}
+
+@test "opt_mail_downloads removes old attachments" {
+    mkdir -p "$HOME/Library/Mail Downloads"
+    touch "$HOME/Library/Mail Downloads/old.pdf"
+    # Make file old (31+ days) - MOLE_LOG_AGE_DAYS defaults to 30
+    touch -t 202301010000 "$HOME/Library/Mail Downloads/old.pdf"
+
+    # Create large enough size to trigger cleanup (>5MB threshold)
+    dd if=/dev/zero of="$HOME/Library/Mail Downloads/dummy.dat" bs=1024 count=6000 2>/dev/null
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+# MOLE_MAIL_DOWNLOADS_MIN_KB and MOLE_LOG_AGE_DAYS are readonly constants
+opt_mail_downloads
+EOF
+
+    [ "$status" -eq 0 ]
+}
+
+@test "get_path_size_kb returns zero for missing directory" {
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+size=$(get_path_size_kb "/nonexistent/path")
+echo "$size"
+EOF
+
+    [ "$status" -eq 0 ]
+    [ "$output" = "0" ]
+}
+
+@test "get_path_size_kb calculates directory size" {
+    mkdir -p "$HOME/test_size"
+    dd if=/dev/zero of="$HOME/test_size/file.dat" bs=1024 count=10 2>/dev/null
+
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc << 'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+size=$(get_path_size_kb "$HOME/test_size")
+echo "$size"
+EOF
+
+    [ "$status" -eq 0 ]
+    # Should be >= 10 KB
+    [ "$output" -ge 10 ]
+}
+
+@test "opt_log_cleanup runs cleanup_path and safe_sudo_find_delete" {
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+
+CALLS_FILE="$HOME/log_cleanup_calls"
+: > "$CALLS_FILE"
+
+cleanup_path() {
+    echo "cleanup:$1" >> "$CALLS_FILE"
+}
+safe_sudo_find_delete() {
+    echo "safe:$1" >> "$CALLS_FILE"
+    return 0
+}
+
+opt_log_cleanup
+cat "$CALLS_FILE"
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"cleanup:$HOME/Library/Logs/DiagnosticReports"* ]]
+    [[ "$output" == *"safe:/Library/Logs/DiagnosticReports"* ]]
+}
+
+@test "opt_fix_broken_configs reports fixes" {
+    run env HOME="$HOME" PROJECT_ROOT="$PROJECT_ROOT" bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/optimize/maintenance.sh"
+source "$PROJECT_ROOT/lib/optimize/tasks.sh"
+
+fix_broken_preferences() {
+    echo 2
+}
+fix_broken_login_items() {
+    echo 1
+}
+
+opt_fix_broken_configs
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Fixed 2 broken preference files"* ]]
+    [[ "$output" == *"Removed 1 broken login items"* ]]
+}

tests/touchid.bats

@@ -0,0 +1,86 @@
+#!/usr/bin/env bats
+
+setup_file() {
+    PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
+    export PROJECT_ROOT
+
+    ORIGINAL_HOME="${HOME:-}"
+    export ORIGINAL_HOME
+
+    HOME="$(mktemp -d "${BATS_TEST_DIRNAME}/tmp-touchid.XXXXXX")"
+    export HOME
+
+    mkdir -p "$HOME"
+}
+
+teardown_file() {
+    rm -rf "$HOME"
+    if [[ -n "${ORIGINAL_HOME:-}" ]]; then
+        export HOME="$ORIGINAL_HOME"
+    fi
+}
+
+create_fake_sudo() {
+    local dir="$1"
+    mkdir -p "$dir"
+    cat > "$dir/sudo" <<'SCRIPT'
+#!/usr/bin/env bash
+if [[ "$1" == "-n" || "$1" == "-v" ]]; then
+    exit 0
+fi
+exec "$@"
+SCRIPT
+    chmod +x "$dir/sudo"
+}
+
+@test "touchid status reflects pam file contents" {
+    pam_file="$HOME/pam_test"
+    cat > "$pam_file" <<'EOF'
+# comment
+auth       sufficient     pam_opendirectory.so
+EOF
+
+    run env MOLE_PAM_SUDO_FILE="$pam_file" "$PROJECT_ROOT/bin/touchid.sh" status
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"not configured"* ]]
+
+    cat > "$pam_file" <<'EOF'
+auth       sufficient     pam_tid.so
+EOF
+
+    run env MOLE_PAM_SUDO_FILE="$pam_file" "$PROJECT_ROOT/bin/touchid.sh" status
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"enabled"* ]]
+}
+
+@test "enable_touchid inserts pam_tid line in pam file" {
+    pam_file="$HOME/pam_enable"
+    cat > "$pam_file" <<'EOF'
+# test pam
+auth       sufficient     pam_opendirectory.so
+EOF
+
+    fake_bin="$HOME/fake-bin"
+    create_fake_sudo "$fake_bin"
+
+    run env PATH="$fake_bin:$PATH" MOLE_PAM_SUDO_FILE="$pam_file" "$PROJECT_ROOT/bin/touchid.sh" enable
+    [ "$status" -eq 0 ]
+    grep -q "pam_tid.so" "$pam_file"
+    [[ -f "${pam_file}.mole-backup" ]]
+}
+
+@test "disable_touchid removes pam_tid line" {
+    pam_file="$HOME/pam_disable"
+    cat > "$pam_file" <<'EOF'
+auth       sufficient     pam_tid.so
+auth       sufficient     pam_opendirectory.so
+EOF
+
+    fake_bin="$HOME/fake-bin-disable"
+    create_fake_sudo "$fake_bin"
+
+    run env PATH="$fake_bin:$PATH" MOLE_PAM_SUDO_FILE="$pam_file" "$PROJECT_ROOT/bin/touchid.sh" disable
+    [ "$status" -eq 0 ]
+    run grep "pam_tid.so" "$pam_file"
+    [ "$status" -ne 0 ]
+}

tests/update_manager.bats

@@ -1,130 +1,227 @@
 #!/usr/bin/env bats
-# shellcheck disable=SC2030,SC2031
 
 setup_file() {
     PROJECT_ROOT="$(cd "${BATS_TEST_DIRNAME}/.." && pwd)"
     export PROJECT_ROOT
-
+    
-    ORIGINAL_HOME="${HOME:-}"
+    # Create a dummy cache directory for tests
-    export ORIGINAL_HOME
+    mkdir -p "${HOME}/.cache/mole"
-
-    HOME="$(mktemp -d "${BATS_TEST_DIRNAME}/tmp-update-manager.XXXXXX")"
-    export HOME
-
-    mkdir -p "$HOME"
-}
-
-teardown_file() {
-    rm -rf "$HOME"
-    if [[ -n "${ORIGINAL_HOME:-}" ]]; then
-        export HOME="$ORIGINAL_HOME"
-    fi
 }
 
 setup() {
-    source "$PROJECT_ROOT/lib/core/common.sh"
+    # Default values for tests
-    source "$PROJECT_ROOT/lib/manage/update.sh"
+    BREW_OUTDATED_COUNT=0
+    BREW_FORMULA_OUTDATED_COUNT=0
+    BREW_CASK_OUTDATED_COUNT=0
+    APPSTORE_UPDATE_COUNT=0
+    MACOS_UPDATE_AVAILABLE=false
+    MOLE_UPDATE_AVAILABLE=false
+    
+    # Create a temporary bin directory for mocks
+    export MOCK_BIN_DIR="$BATS_TMPDIR/mole-mocks-$$"
+    mkdir -p "$MOCK_BIN_DIR"
+    export PATH="$MOCK_BIN_DIR:$PATH"
 }
 
-# Test brew_has_outdated function
+teardown() {
-@test "brew_has_outdated returns 1 when brew not installed" {
+    rm -rf "$MOCK_BIN_DIR"
-    # shellcheck disable=SC2329
-    function brew() {
-        return 127  # Command not found
-    }
-    export -f brew
-
-    run bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; brew_has_outdated"
-    [ "$status" -eq 1 ]
 }
 
-@test "brew_has_outdated checks formula by default" {
+read_key() {
-    # Mock brew to simulate outdated formulas
+    # Default mock: press ESC to cancel
-    # shellcheck disable=SC2329
+    echo "ESC"
-    function brew() {
+    return 0
-        if [[ "$1" == "outdated" && "$2" != "--cask" ]]; then
-            echo "package1"
-            echo "package2"
-            return 0
-        fi
-        return 1
-    }
-    export -f brew
-
-    run bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; brew_has_outdated"
-    [ "$status" -eq 0 ]
 }
 
-@test "brew_has_outdated checks casks when specified" {
-    # Mock brew to simulate outdated casks
-    function brew() {
-        if [[ "$1" == "outdated" && "$2" == "--cask" ]]; then
-            echo "app1"
-            return 0
-        fi
-        return 1
-    }
-    export -f brew
-
-    run bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; brew_has_outdated cask"
-    [ "$status" -eq 0 ]
-}
-
-# Test format_brew_update_label function
-@test "format_brew_update_label returns empty when no updates" {
-    result=$(BREW_OUTDATED_COUNT=0 bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; format_brew_update_label")
-    [[ -z "$result" ]]
-}
-
-@test "format_brew_update_label formats with formula and cask counts" {
-    result=$(BREW_OUTDATED_COUNT=5 BREW_FORMULA_OUTDATED_COUNT=3 BREW_CASK_OUTDATED_COUNT=2 bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; format_brew_update_label")
-    [[ "$result" =~ "3 formula" ]]
-    [[ "$result" =~ "2 cask" ]]
-}
-
-@test "format_brew_update_label shows total when breakdown unavailable" {
-    result=$(BREW_OUTDATED_COUNT=5 bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; format_brew_update_label")
-    [[ "$result" =~ "5 updates" ]]
-}
-
-# Test ask_for_updates function
 @test "ask_for_updates returns 1 when no updates available" {
-    run bash -c "source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; ask_for_updates < /dev/null"
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+BREW_OUTDATED_COUNT=0
+APPSTORE_UPDATE_COUNT=0
+MACOS_UPDATE_AVAILABLE=false
+MOLE_UPDATE_AVAILABLE=false
+ask_for_updates
+EOF
+
     [ "$status" -eq 1 ]
 }
 
-@test "ask_for_updates detects Homebrew updates" {
+@test "ask_for_updates shows updates and waits for input" {
-    # Mock environment with Homebrew updates
+    run bash --noprofile --norc <<'EOF'
-    export BREW_OUTDATED_COUNT=5
+set -euo pipefail
-    export BREW_FORMULA_OUTDATED_COUNT=3
+source "$PROJECT_ROOT/lib/core/common.sh"
-    export BREW_CASK_OUTDATED_COUNT=2
+source "$PROJECT_ROOT/lib/manage/update.sh"
+BREW_OUTDATED_COUNT=5
+BREW_FORMULA_OUTDATED_COUNT=3
+BREW_CASK_OUTDATED_COUNT=2
+APPSTORE_UPDATE_COUNT=1
+MACOS_UPDATE_AVAILABLE=true
+MOLE_UPDATE_AVAILABLE=true
+
+read_key() { echo "ESC"; return 0; }
+
+ask_for_updates
+EOF
 
-    # Use input redirection to simulate ESC (cancel)
-    run bash -c "printf '\x1b' | source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; ask_for_updates"
-    # Should show updates and ask for confirmation
     [ "$status" -eq 1 ]  # ESC cancels
+    [[ "$output" == *"Homebrew (5 updates)"* ]]
+    [[ "$output" == *"App Store (1 apps)"* ]]
+    [[ "$output" == *"macOS system"* ]]
+    [[ "$output" == *"Mole"* ]]
 }
 
-@test "ask_for_updates detects App Store updates" {
+@test "ask_for_updates accepts Enter when updates exist" {
-    export APPSTORE_UPDATE_COUNT=3
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+BREW_OUTDATED_COUNT=2
+BREW_FORMULA_OUTDATED_COUNT=2
+read_key() { echo "ENTER"; return 0; }
+ask_for_updates
+EOF
 
-    run bash -c "printf '\x1b' | source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; ask_for_updates"
+    [ "$status" -eq 0 ]
-    [ "$status" -eq 1 ]  # ESC cancels
+    [[ "$output" == *"AVAILABLE UPDATES"* ]]
+    [[ "$output" == *"yes"* ]]
 }
 
-@test "ask_for_updates detects macOS updates" {
+@test "format_brew_update_label lists formula and cask counts" {
-    export MACOS_UPDATE_AVAILABLE=true
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+BREW_OUTDATED_COUNT=5
+BREW_FORMULA_OUTDATED_COUNT=3
+BREW_CASK_OUTDATED_COUNT=2
+format_brew_update_label
+EOF
 
-    run bash -c "printf '\x1b' | source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; ask_for_updates"
+    [ "$status" -eq 0 ]
-    [ "$status" -eq 1 ]  # ESC cancels
+    [[ "$output" == *"3 formula"* ]]
+    [[ "$output" == *"2 cask"* ]]
 }
 
-@test "ask_for_updates detects Mole updates" {
+@test "perform_updates handles Homebrew success and Mole update" {
-    export MOLE_UPDATE_AVAILABLE=true
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
 
-    run bash -c "printf '\x1b' | source '$PROJECT_ROOT/lib/core/common.sh'; source '$PROJECT_ROOT/lib/manage/update.sh'; ask_for_updates"
+BREW_FORMULA_OUTDATED_COUNT=1
-    [ "$status" -eq 1 ]  # ESC cancels
+BREW_CASK_OUTDATED_COUNT=0
+MOLE_UPDATE_AVAILABLE=true
+
+FAKE_DIR="$HOME/fake-script-dir"
+mkdir -p "$FAKE_DIR"
+cat > "$FAKE_DIR/mole" <<'SCRIPT'
+#!/usr/bin/env bash
+echo "Already on latest version"
+SCRIPT
+chmod +x "$FAKE_DIR/mole"
+SCRIPT_DIR="$FAKE_DIR"
+
+brew_has_outdated() { return 0; }
+start_inline_spinner() { :; }
+stop_inline_spinner() { :; }
+reset_brew_cache() { echo "BREW_CACHE_RESET"; }
+reset_mole_cache() { echo "MOLE_CACHE_RESET"; }
+has_sudo_session() { return 1; }
+ensure_sudo_session() { echo "ensure_sudo_session_called"; return 1; }
+
+brew() {
+    if [[ "$1" == "upgrade" ]]; then
+        echo "Upgrading formula"
+        return 0
+    fi
+    return 0
 }
 
+get_appstore_update_labels() { return 0; }
+get_macos_update_labels() { return 0; }
 
+perform_updates
+EOF
 
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Homebrew formulae updated"* ]]
+    [[ "$output" == *"Already on latest version"* ]]
+    [[ "$output" == *"MOLE_CACHE_RESET"* ]]
+}
+
+@test "perform_updates skips brew when no outdated packages" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+
+BREW_FORMULA_OUTDATED_COUNT=1
+BREW_CASK_OUTDATED_COUNT=1
+brew_has_outdated() { return 1; }
+start_inline_spinner() { :; }
+stop_inline_spinner() { :; }
+
+perform_updates
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"already up to date"* ]]
+}
+
+@test "perform_updates handles App Store fallback logic" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+
+APPSTORE_UPDATE_COUNT=2
+# Mock getting labels returning empty, triggering fallback
+get_appstore_update_labels() { return 0; }
+
+has_sudo_session() { return 0; }
+reset_softwareupdate_cache() { :; }
+
+# Mock sudo to check for -a flag (install all)
+sudo() {
+    if [[ "$1" == "softwareupdate" && "$2" == "-i" && "$3" == "-a" ]]; then
+        echo "Installing all updates..."
+        return 0
+    fi
+    echo "Wrong sudo command: $*"
+    return 1
+}
+
+perform_updates
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"Installing all available updates"* ]]
+    [[ "$output" == *"Software updates completed"* ]]
+}
+
+@test "perform_updates gracefully handles sudo failure for App Store" {
+    run bash --noprofile --norc <<'EOF'
+set -euo pipefail
+source "$PROJECT_ROOT/lib/core/common.sh"
+source "$PROJECT_ROOT/lib/manage/update.sh"
+
+APPSTORE_UPDATE_COUNT=1
+get_appstore_update_labels() { echo "Xcode"; }
+
+# Simulate user declining sudo or timeout
+has_sudo_session() { return 1; }
+ensure_sudo_session() { 
+    echo "User declined sudo"
+    return 1
+}
+
+perform_updates
+EOF
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"User declined sudo"* ]]
+    [[ "$output" == *"update via System Settings"* ]]
+    # Should not crash
+}