laplaque
diff --git a/‎cmd/proxy/main.go‎
Lines changed: 6 additions & 42 deletions b/‎cmd/proxy/main.go‎
Lines changed: 6 additions & 42 deletions
diff --git a/‎cmd/proxy/main_test.go‎
Lines changed: 194 additions & 14 deletions b/‎cmd/proxy/main_test.go‎
Lines changed: 194 additions & 14 deletions
diff --git a/‎cmd/proxy/shutdown.go‎
Lines changed: 21 additions & 0 deletions b/‎cmd/proxy/shutdown.go‎
Lines changed: 21 additions & 0 deletions
@@ -23,10 +23,8 @@
 package main
 
 import (
-	"context"
 	"fmt"
 	"log"
-	"net/http"
 	"os"
 	"os/signal"
 	"syscall"
@@ -41,62 +39,28 @@ import (
 func main() {
 	cfg := config.Load()
 
-	// Startup guard: zero enabled packs is a fatal misconfiguration.
 	if len(cfg.EnabledPacks) == 0 {
 		log.Fatalf("[PROXY] Fatal: no PII detection packs enabled. Configure enabledPacks in proxy-config.json or set ENABLED_PACKS env var.")
 	}
 
 	printBanner(cfg)
 
-	// Build the management domain registry so both servers share the same state.
-	// Runtime domain changes are persisted to ai-domains.json and restored on restart.
 	registry := management.NewDomainRegistry(cfg, "ai-domains.json")
-
-	// Shared metrics collector — passed to both servers so counters are unified.
 	m := metrics.New()
 
-	// Start management API in background.
-	// Fatal is intentional: the proxy should not run without its control plane.
-	mgmt := management.New(cfg, registry, m)
-	go func() {
-		if err := mgmt.ListenAndServe(); err != nil {
-			log.Fatalf("[MANAGEMENT] Fatal: %v", err)
-		}
-	}()
+	_ = startManagementAPI(cfg, registry, m)
 
-	// Start proxy server
 	proxyServer := proxy.New(cfg, registry, m)
-	defer func() {
-		if err := proxyServer.Close(); err != nil {
-			log.Printf("[PROXY] Cache close error: %v", err)
-		}
-	}()
-
-	addr := fmt.Sprintf("%s:%d", cfg.BindAddress, cfg.ProxyPort)
-	log.Printf("[PROXY] Listening on %s", addr)
+	defer closeProxyServer(proxyServer)
 
-	srv := &http.Server{
-		Addr:              addr,
-		Handler:           proxyServer,
-		ReadHeaderTimeout: 10 * time.Second,
-	}
+	srv := proxyHTTPServer(cfg, proxyServer)
+	log.Printf("[PROXY] Listening on %s", srv.Addr)
 
-	// Graceful shutdown on SIGINT / SIGTERM
 	quit := make(chan os.Signal, 1)
 	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
-	go func() {
-		<-quit
-		log.Printf("[PROXY] Shutting down…")
-		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-		defer cancel()
-		if err := srv.Shutdown(ctx); err != nil {
-			log.Printf("[PROXY] Shutdown error: %v", err)
-		}
-	}()
+	go installShutdownHandler(quit, srv, 15*time.Second)
 
-	if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
-		log.Fatalf("[PROXY] Fatal: %v", err)
-	}
+	runHTTPServer(srv)
 }
 
 func printBanner(cfg *config.Config) {
 
@@ -1,15 +1,33 @@
 package main
 
 import (
+	"bytes"
 	"fmt"
 	"io"
+	"net"
 	"os"
+	"os/exec"
+	"path/filepath"
 	"strings"
+	"sync"
+	"syscall"
 	"testing"
+	"time"
 
 	"ai-anonymizing-proxy/internal/config"
 )
 
+// TestMain dispatches to main() when GO_WANT_HELPER_PROCESS=1, allowing
+// helper-process tests to re-exec this test binary as the production binary.
+// Pattern copied from stdlib os/exec internal tests.
+func TestMain(m *testing.M) {
+	if os.Getenv("GO_WANT_HELPER_PROCESS") == "1" {
+		main()
+		os.Exit(0)
+	}
+	os.Exit(m.Run())
+}
+
 // captureStdout redirects os.Stdout to a pipe for the duration of fn,
 // then returns everything written to it.
 func captureStdout(t *testing.T, fn func()) string {
@@ -76,21 +94,183 @@ func TestPrintBanner_NoProxy_ShowsDirect(t *testing.T) {
 	}
 }
 
-// TestMain_Smoke verifies the package compiles and the binary entry point exists.
-// The actual main() starts network listeners so it cannot be called in tests.
-func TestMain_Smoke(t *testing.T) {
-	// Verify printBanner doesn't panic with zero-value config
-	func() {
-		defer func() {
-			if r := recover(); r != nil {
-				t.Errorf("printBanner panicked: %v", r)
-			}
-		}()
-		captureStdout(t, func() { printBanner(&config.Config{}) })
+// TestPrintBanner_ZeroValueConfig_DoesNotPanic asserts that printBanner
+// survives a zero-value *config.Config — a regression like a nil-map deref
+// or missing-field panic on uninitialised input would be caught here.
+// Inherited from the original TestMain_Smoke, kept as its own test so the
+// guarantee survives the helper-process TestMain rewrite.
+func TestPrintBanner_ZeroValueConfig_DoesNotPanic(t *testing.T) {
+	defer func() {
+		if r := recover(); r != nil {
+			t.Errorf("printBanner panicked on zero-value config: %v", r)
+		}
 	}()
+	_ = captureStdout(t, func() { printBanner(&config.Config{}) })
+}
+
+// TestMain_HelperProcess_Lifecycle re-execs this test binary as the proxy
+// daemon, waits for it to bind its listener, sends SIGTERM, and verifies a
+// clean exit. Exercises main()'s full startup-and-shutdown lifecycle.
+func TestMain_HelperProcess_Lifecycle(t *testing.T) {
+	proxyPort := freePort(t)
+	mgmtPort := freePort(t)
+
+	cmd := exec.CommandContext(t.Context(), os.Args[0]) //nolint:gosec // G204: helper-process pattern: os.Args[0] is the test binary itself, not external input
+	cmd.Env = append(os.Environ(),
+		"GO_WANT_HELPER_PROCESS=1",
+		"BIND_ADDRESS=127.0.0.1",
+		fmt.Sprintf("PROXY_PORT=%d", proxyPort),
+		fmt.Sprintf("MANAGEMENT_PORT=%d", mgmtPort),
+		"ENABLED_PACKS=SECRETS,GLOBAL",
+		"USE_AI_DETECTION=false",
+	)
+	cmd.Dir = t.TempDir()
+	stderr := &syncBuffer{}
+	cmd.Stderr = stderr
+	cmd.Stdout = io.Discard
+
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("start: %v", err)
+	}
+	t.Cleanup(func() {
+		if cmd.ProcessState == nil {
+			_ = cmd.Process.Kill()
+			_ = cmd.Wait()
+		}
+	})
+
+	waitForLog(t, stderr, "[PROXY] Listening on", 10*time.Second)
 
-	// Self-referential sanity: package name is main
-	if fmt.Sprintf("%T", main) != "func()" {
-		t.Error("expected main to be func()")
+	if err := cmd.Process.Signal(syscall.SIGTERM); err != nil {
+		t.Fatalf("signal: %v", err)
+	}
+
+	done := make(chan error, 1)
+	go func() { done <- cmd.Wait() }()
+	select {
+	case err := <-done:
+		if err != nil {
+			t.Errorf("process exited with error: %v\n%s", err, stderr.String())
+		}
+	case <-time.After(10 * time.Second):
+		_ = cmd.Process.Kill()
+		t.Fatalf("process did not exit within 10s of SIGTERM\n%s", stderr.String())
+	}
+}
+
+// TestMain_HelperProcess_ProxyPortConflict_Fatal pre-binds the proxy port so
+// the subprocess's srv.ListenAndServe() fails, exercising runHTTPServer's
+// log.Fatalf branch.
+func TestMain_HelperProcess_ProxyPortConflict_Fatal(t *testing.T) {
+	ln := listenLocal(t)
+	defer func() { _ = ln.Close() }()
+	addr, ok := ln.Addr().(*net.TCPAddr)
+	if !ok {
+		t.Fatalf("listener address %T is not *net.TCPAddr", ln.Addr())
+	}
+	proxyPort := addr.Port
+	mgmtPort := freePort(t)
+
+	cmd := exec.CommandContext(t.Context(), os.Args[0]) //nolint:gosec // G204: helper-process pattern: os.Args[0] is the test binary itself, not external input
+	cmd.Env = append(os.Environ(),
+		"GO_WANT_HELPER_PROCESS=1",
+		"BIND_ADDRESS=127.0.0.1",
+		fmt.Sprintf("PROXY_PORT=%d", proxyPort),
+		fmt.Sprintf("MANAGEMENT_PORT=%d", mgmtPort),
+		"ENABLED_PACKS=SECRETS,GLOBAL",
+		"USE_AI_DETECTION=false",
+	)
+	cmd.Dir = t.TempDir()
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatalf("expected non-zero exit on proxy port conflict, got success\n%s", out)
+	}
+	if !strings.Contains(string(out), "[PROXY] Fatal") {
+		t.Errorf("expected '[PROXY] Fatal' in output, got:\n%s", out)
+	}
+}
+
+// TestMain_HelperProcess_MgmtPortConflict_Fatal pre-binds the management port
+// so the subprocess's mgmt.ListenAndServe() fails, exercising runManagementAPI's
+// log.Fatalf branch.
+func TestMain_HelperProcess_MgmtPortConflict_Fatal(t *testing.T) {
+	ln := listenLocal(t)
+	defer func() { _ = ln.Close() }()
+	addr, ok := ln.Addr().(*net.TCPAddr)
+	if !ok {
+		t.Fatalf("listener address %T is not *net.TCPAddr", ln.Addr())
+	}
+	mgmtPort := addr.Port
+	proxyPort := freePort(t)
+
+	cmd := exec.CommandContext(t.Context(), os.Args[0]) //nolint:gosec // G204: helper-process pattern: os.Args[0] is the test binary itself, not external input
+	cmd.Env = append(os.Environ(),
+		"GO_WANT_HELPER_PROCESS=1",
+		"BIND_ADDRESS=127.0.0.1",
+		fmt.Sprintf("PROXY_PORT=%d", proxyPort),
+		fmt.Sprintf("MANAGEMENT_PORT=%d", mgmtPort),
+		"ENABLED_PACKS=SECRETS,GLOBAL",
+		"USE_AI_DETECTION=false",
+	)
+	cmd.Dir = t.TempDir()
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatalf("expected non-zero exit on mgmt port conflict, got success\n%s", out)
+	}
+	if !strings.Contains(string(out), "[MANAGEMENT] Fatal") {
+		t.Errorf("expected '[MANAGEMENT] Fatal' in output, got:\n%s", out)
+	}
+}
+
+// TestMain_HelperProcess_ZeroPacks_Fatal verifies that a config with no packs
+// enabled triggers the startup guard's log.Fatalf (non-zero exit). Covers that
+// branch of main() which is otherwise unreachable from the lifecycle test.
+func TestMain_HelperProcess_ZeroPacks_Fatal(t *testing.T) {
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "proxy-config.json")
+	if err := os.WriteFile(cfgPath, []byte(`{"enabledPacks":[]}`), 0o600); err != nil {
+		t.Fatalf("write config: %v", err)
+	}
+
+	cmd := exec.CommandContext(t.Context(), os.Args[0]) //nolint:gosec // G204: helper-process pattern: os.Args[0] is the test binary itself, not external input
+	cmd.Env = append(os.Environ(), "GO_WANT_HELPER_PROCESS=1")
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatalf("expected non-zero exit on zero-packs guard, got success\n%s", out)
+	}
+	if !strings.Contains(string(out), "no PII detection packs enabled") {
+		t.Errorf("expected guard message in output, got:\n%s", out)
+	}
+}
+
+// syncBuffer is a goroutine-safe wrapper around bytes.Buffer for use as
+// cmd.Stderr while a poller in the parent reads it concurrently.
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *syncBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.Write(p)
+}
+
+func (b *syncBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buf.String()
+}
+
+func waitForLog(t *testing.T, buf *syncBuffer, substr string, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if strings.Contains(buf.String(), substr) {
+			return
+		}
+		time.Sleep(50 * time.Millisecond)
 	}
+	t.Fatalf("did not see %q in log within %v\n%s", substr, timeout, buf.String())
 }
@@ -0,0 +1,21 @@
+package main
+
+import (
+	"context"
+	"log"
+	"net/http"
+	"os"
+	"time"
+)
+
+// installShutdownHandler blocks on quit, then calls srv.Shutdown with the given
+// timeout. Intended to run in a goroutine spawned by main().
+func installShutdownHandler(quit <-chan os.Signal, srv *http.Server, timeout time.Duration) {
+	<-quit
+	log.Printf("[PROXY] Shutting down…")
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	if err := srv.Shutdown(ctx); err != nil {
+		log.Printf("[PROXY] Shutdown error: %v", err)
+	}
+}