"""Issue #23 + #24 — the create_session start path.

Four regressions live here, in the order of the issues:

1. a herdr call aimed at another server must not carry the caller pane's own
   workspace/pane/tab ids (#23 comments: reproduced on Linux and macOS);
2. blocking start-up modals are agent-adapter knowledge and are answered while
   waiting for the TUI (#24);
3. onboarding delivery is judged by the agent's own `started` event (#23);
4. a rollback verifies the kill and leaves no `running` row or dangling job (#23).

What is mocked and what is real is stated per test. The dialog tests fix OUR
contract - which pane string gets which keys - not that the keys drive a real
agy/grok/codex/opencode TUI; no such TUI can be started here.
"""

import json
import os
import subprocess
import textwrap

import pytest


# --------------------------------------------------------------------------
# helpers
# --------------------------------------------------------------------------

def _run_lib(tmp_path, body, env=None):
    """Source the sandbox lib.sh and run `body`. Unlike the shim-contract
    helper this keeps HERDR_* exactly as `env` sets it: these tests are about
    what the caller's pane leaks in."""
    lib_path = tmp_path / ".agents" / "skills" / "lib.sh"
    script = 'source "%s"\n_init_herdr_isolation\n%s\n' % (lib_path, body)
    run_env = dict(os.environ)
    for var in ("HERDR_SESSION", "HERDR_SESSION_NAME", "HERDR_WORKSPACE_ID",
                "HERDR_PANE_ID", "HERDR_TAB_ID"):
        run_env.pop(var, None)
    run_env.update(env or {})
    return subprocess.run(["bash", "-c", script], capture_output=True,
                          text=True, cwd=str(tmp_path), env=run_env)


def _mock_state(mock_herdr):
    with open(mock_herdr) as f:
        return json.load(f)


def _write_mock_state(mock_herdr, state):
    with open(mock_herdr, "w") as f:
        json.dump(state, f, indent=2)


def _seed_agent(mock_herdr, tmp_path, name, workspace_id, pane_id):
    state = _mock_state(mock_herdr)
    state.setdefault("workspaces", [])
    if not any(w.get("workspace_id") == workspace_id for w in state["workspaces"]):
        state["workspaces"].append(
            {"workspace_id": workspace_id, "label": workspace_id, "cwd": str(tmp_path)})
    state.setdefault("agents", {})[name] = {
        "name": name, "agent": "agy", "status": "running", "cwd": str(tmp_path),
        "workspace_id": workspace_id, "pane_id": pane_id, "pid": 9999,
        "command": "agy", "buffer": "Ready",
    }
    state.setdefault("panes", []).append(
        {"pane_id": pane_id, "workspace_id": workspace_id, "label": name, "buffer": "Ready"})
    _write_mock_state(mock_herdr, state)


def _install_env_recorder(tmp_path, monkeypatch):
    """A herdr earlier in PATH than the mock that dumps the env it was called
    with, then execs the mock. The shim resolves the first non-shim herdr on
    PATH, so this observes exactly what reached the real binary."""
    rec_dir = tmp_path / "recorder"
    rec_dir.mkdir(parents=True, exist_ok=True)
    env_log = tmp_path / "herdr_env.ndjson"
    real = tmp_path / "bin" / "herdr"
    script = rec_dir / "herdr"
    script.write_text(textwrap.dedent('''\
        #!/usr/bin/env python3
        import json, os, sys
        with open(%r, "a") as f:
            f.write(json.dumps({
                "argv": sys.argv[1:],
                "HERDR_WORKSPACE_ID": os.environ.get("HERDR_WORKSPACE_ID"),
                "HERDR_PANE_ID": os.environ.get("HERDR_PANE_ID"),
                "HERDR_TAB_ID": os.environ.get("HERDR_TAB_ID"),
                "HERDR_SESSION": os.environ.get("HERDR_SESSION"),
                "HERDR_SESSION_NAME": os.environ.get("HERDR_SESSION_NAME"),
            }) + "\\n")
        os.execv(%r, [%r] + sys.argv[1:])
        ''') % (str(env_log), str(real), str(real)))
    script.chmod(0o755)
    monkeypatch.setenv("PATH", "%s:%s" % (rec_dir, os.environ["PATH"]))
    return env_log


def _recorded(env_log):
    if not os.path.exists(env_log):
        return []
    return [json.loads(l) for l in open(env_log) if l.strip()]


# --------------------------------------------------------------------------
# item 1 — caller pane scope must not leak across servers
# --------------------------------------------------------------------------

CROSS = {"HERDR_SESSION": "default", "HERDR_SESSION_NAME": "mam-isolated",
         "HERDR_WORKSPACE_ID": "w5", "HERDR_PANE_ID": "w5:p2",
         "HERDR_TAB_ID": "w5:t1"}


def test_s1_cross_server_call_drops_the_caller_panes_scope_ids(
        mam_sandbox, mock_herdr, mock_agents, monkeypatch):
    """S1 (mock herdr): the caller sits in another server's pane. has-session,
    kill-session and agent prompt must find the agent, and the three ids must
    not reach herdr."""
    tmp_path = mam_sandbox
    env_log = _install_env_recorder(tmp_path, monkeypatch)
    _seed_agent(mock_herdr, tmp_path, "creator-agy-01", "w1", "w1:p5")

    res = _run_lib(tmp_path, 'herdr has-session -t creator-agy-01', env=CROSS)
    assert res.returncode == 0, res.stdout + res.stderr

    res = _run_lib(tmp_path, 'herdr agent prompt creator-agy-01 "hello"', env=CROSS)
    assert res.returncode == 0, res.stdout + res.stderr

    res = _run_lib(tmp_path, 'herdr kill-session -t creator-agy-01', env=CROSS)
    assert res.returncode == 0, res.stdout + res.stderr

    calls = _recorded(env_log)
    assert calls, "the recorder saw no herdr call"
    for call in calls:
        assert call["HERDR_WORKSPACE_ID"] is None, call
        assert call["HERDR_PANE_ID"] is None, call
        assert call["HERDR_TAB_ID"] is None, call

    # the kill really happened, i.e. this is not a silent no-op
    assert "creator-agy-01" not in _mock_state(mock_herdr).get("agents", {})


def test_s1b_the_delegate_job_wrappers_bare_herdr_is_the_lib_sh_function(
        mam_sandbox, mock_herdr, mock_agents, monkeypatch):
    """S1b (mock herdr): the wrapper sources lib.sh and then calls a bare
    `herdr` (wrapper :918 preflight). A shell function beats PATH, so that call
    is mam_herdr and is fixed by item 1 too - this is why #23's preflight
    failure is cured by the same change."""
    tmp_path = mam_sandbox
    _install_env_recorder(tmp_path, monkeypatch)
    _seed_agent(mock_herdr, tmp_path, "creator-agy-01", "w1", "w1:p5")

    res = _run_lib(tmp_path, 'echo "kind=$(type -t herdr)"\nherdr has-session -t creator-agy-01',
                   env=CROSS)
    assert "kind=function" in res.stdout, res.stdout + res.stderr
    assert res.returncode == 0, res.stdout + res.stderr


def test_s2_same_server_keeps_the_explicit_workspace_scope(
        mam_sandbox, mock_herdr, mock_agents, monkeypatch):
    """S2 (mock herdr): on the target's own server the exported scope still
    scopes - a same-named agent in another workspace is not addressed (H-22)."""
    tmp_path = mam_sandbox
    _seed_agent(mock_herdr, tmp_path, "creator-agy-01", "w1", "w1:p5")
    same = {"HERDR_SESSION": "mam-isolated", "HERDR_SESSION_NAME": "mam-isolated",
            "HERDR_WORKSPACE_ID": "w2"}

    before = len(_mock_state(mock_herdr).get("calls", []))
    res = _run_lib(tmp_path, 'herdr agent prompt creator-agy-01 "hello from w2"', env=same)
    assert res.returncode != 0, res.stdout + res.stderr
    new = _mock_state(mock_herdr).get("calls", [])[before:]
    prompts = [c for c in new if len(c) >= 2 and c[0] == "agent" and c[1] == "prompt"]
    assert prompts == [], new


def test_s2b_a_caller_outside_any_pane_keeps_the_explicit_scope(
        mam_sandbox, mock_herdr, mock_agents):
    """S2b (mock herdr): no HERDR_SESSION means the caller is not in a pane at
    all, so an exported HERDR_WORKSPACE_ID is a deliberate scope, not a leak.
    This is the case H-18/H-21/H-23 fix."""
    tmp_path = mam_sandbox
    _seed_agent(mock_herdr, tmp_path, "creator-agy-01", "w1", "w1:p5")

    res = _run_lib(tmp_path, 'herdr has-session -t creator-agy-01',
                   env={"HERDR_SESSION_NAME": "mam-isolated", "HERDR_WORKSPACE_ID": "w2"})
    assert res.returncode == 1, "an explicit out-of-scope id must still hide the agent"

    res = _run_lib(tmp_path, 'herdr has-session -t creator-agy-01',
                   env={"HERDR_SESSION_NAME": "mam-isolated", "HERDR_WORKSPACE_ID": "w1"})
    assert res.returncode == 0, res.stdout + res.stderr


def test_s3_shim_contract_regressions_still_pass(mam_sandbox):
    """S3: H-18 / H-21 / H-23 are the tests that fix today's scoping meaning.
    Run them explicitly as this change's regression guard."""
    repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    res = subprocess.run(
        [os.path.join(repo, ".venv", "bin", "python"), "-m", "pytest", "-q",
         "-p", "no:cacheprovider",
         "tests/test_herdr_shim_contract.py", "-k",
         "h18 or h21 or h22 or h23"],
        capture_output=True, text=True, cwd=repo,
        env=dict(os.environ, PYTHONDONTWRITEBYTECODE="1"))
    assert res.returncode == 0, res.stdout[-4000:] + res.stderr[-2000:]


def test_s11_this_branch_does_not_change_the_generated_shim(mam_sandbox):
    """S11: the item-1 fix lives in mam_herdr, never in the heredoc that
    lib.sh materialises into $WORKSPACE_ROOT/.mam/shim/herdr. That file is
    shared by every checkout bound to one control plane, so keeping it
    byte-identical to base is what makes "the control plane is not modified"
    true at runtime."""
    repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    base = os.environ.get("MAM_BASE_SHA", "1e78dae")
    show = subprocess.run(["git", "show", "%s:.agents/skills/lib.sh" % base],
                          capture_output=True, text=True, cwd=repo)
    if show.returncode != 0:
        pytest.skip("base %s not available in this checkout" % base)
    with open(os.path.join(repo, ".agents", "skills", "lib.sh")) as f:
        head = f.read()
    assert _heredoc_body(head) == _heredoc_body(show.stdout), (
        "the shim heredoc changed: the generated .mam/shim/herdr of this branch "
        "would differ from the control root's, and the two would overwrite "
        "each other on every herdr call")


def _heredoc_body(text):
    lines = text.splitlines(True)
    start = None
    for i, line in enumerate(lines):
        if line.strip() == "cat <<'EOF' > \"$tmp_file\"":
            start = i + 1
            break
    assert start is not None, "shim heredoc not found in lib.sh"
    for j in range(start, len(lines)):
        if lines[j].rstrip("\n") == "EOF":
            return "".join(lines[start:j])
    raise AssertionError("unterminated shim heredoc")


@pytest.mark.parametrize("env,expected_rc", [(CROSS, 1), ({"HERDR_SESSION_NAME": "mam-isolated"}, 1)])
def test_s12_mam_herdr_never_aborts_its_caller_under_set_e(
        mam_sandbox, mock_herdr, mock_agents, env, expected_rc):
    """S12 (mock herdr): mam_herdr runs inside scripts using `set -euo
    pipefail`. Neither branch of the cross-server test may abort the shell,
    and the child's rc must be the function's rc."""
    tmp_path = mam_sandbox
    body = ('set -euo pipefail\n'
            'rc=0\n'
            'mam_herdr has-session -t nobody-here || rc=$?\n'
            'echo "missing_rc=$rc"\n'
            '_seen=0\n'
            'mam_herdr has-session -t creator-agy-01 || _seen=$?\n'
            'echo "present_rc=$_seen"\n'
            'echo REACHED_END\n')
    _seed_agent(mock_herdr, tmp_path, "creator-agy-01", "w1", "w1:p5")
    lib_path = tmp_path / ".agents" / "skills" / "lib.sh"
    script = 'source "%s"\n%s' % (lib_path, body)
    run_env = dict(os.environ)
    for var in ("HERDR_SESSION", "HERDR_SESSION_NAME", "HERDR_WORKSPACE_ID",
                "HERDR_PANE_ID", "HERDR_TAB_ID"):
        run_env.pop(var, None)
    run_env.update(env)
    res = subprocess.run(["bash", "-c", script], capture_output=True, text=True,
                         cwd=str(tmp_path), env=run_env)
    assert "REACHED_END" in res.stdout, res.stdout + res.stderr
    assert "missing_rc=%d" % expected_rc in res.stdout, res.stdout + res.stderr
    assert "present_rc=0" in res.stdout, res.stdout + res.stderr


def test_s13_the_loop_watcher_applies_the_same_rule(mam_sandbox):
    """S13 (pure unit): watcher.py builds its own herdr argv and never goes
    through mam_herdr, so it needs the same rule."""
    import sys
    repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    sys.path.insert(0, os.path.join(repo, ".agents", "skills"))
    from lib_py.loop import watcher

    caller_pane = {"HERDR_SESSION": "default", "HERDR_WORKSPACE_ID": "w5",
                   "HERDR_PANE_ID": "w5:p2", "HERDR_TAB_ID": "w5:t1", "PATH": "/usr/bin"}

    cross = watcher.scoped_env("mam-isolated", environ=caller_pane)
    assert "HERDR_WORKSPACE_ID" not in cross and "HERDR_PANE_ID" not in cross
    assert "HERDR_TAB_ID" not in cross and cross["PATH"] == "/usr/bin"

    same = watcher.scoped_env("default", environ=caller_pane)
    assert same["HERDR_WORKSPACE_ID"] == "w5"

    outside = watcher.scoped_env("mam-isolated", environ={"HERDR_WORKSPACE_ID": "w5"})
    assert outside["HERDR_WORKSPACE_ID"] == "w5"

    none_target = watcher.scoped_env(None, environ=caller_pane)
    assert none_target["HERDR_WORKSPACE_ID"] == "w5"

    seen = {}

    def _run(argv, **kw):
        seen["env"] = kw.get("env")

        class P:
            returncode, stdout, stderr = 0, "{}", ""
        return P()

    watcher.wait_once("agt", session="iso-x", run=_run)
    assert seen["env"] is not None and "HERDR_SESSION" not in ("",)


# --------------------------------------------------------------------------
# item 2 — start-up dialogs come from the adapter (#24)
#
# MOCKED, and this is the limit of it: the pane text is a fixture string and
# send-keys is a shell stub, so these fix OUR contract - which screen signature
# gets which keys, once. They do NOT show that the keys drive a real agy, grok,
# codex or opencode TUI; no such TUI can be started in this environment. That
# check is a live herdr run after the loop.
# --------------------------------------------------------------------------

def _run_dialogs(tmp_path, agent, pane_text, timeout=1, env=None, prelude=""):
    lib = tmp_path / ".agents" / "skills" / "lib.sh"
    pane_file = tmp_path / "pane.txt"
    pane_file.write_text(pane_text)
    keys_log = tmp_path / "sent_keys.txt"
    if keys_log.exists():
        keys_log.unlink()
    script = '''
source "%s"
_pane_tail() { cat "%s"; }
_sks_herdr() { printf '%%s\\n' "$*" >> "%s"; }
%s
handle_startup_dialogs test-sess %d %s
echo "rc=$?"
''' % (lib, pane_file, keys_log, prelude, timeout, agent)
    run_env = dict(os.environ)
    run_env.pop("MAM_AUTO_TRUST", None)
    run_env.update(env or {})
    res = subprocess.run(["bash", "-c", script], capture_output=True, text=True,
                         cwd=str(tmp_path), env=run_env)
    sent = keys_log.read_text().splitlines() if keys_log.exists() else []
    return res, sent


AGENT_DIALOGS = [
    ("agy", "Do you trust the contents of this project?\n > Yes, I trust this folder",
     ["send-keys -t test-sess Enter"]),
    ("grok", "Do you trust the contents of this directory?",
     ["send-keys -t test-sess y"]),
    ("codex", "Do you trust the contents of this directory?\n > 1. Yes, continue",
     ["send-keys -t test-sess Enter"]),
    ("codex", "Update available\n 1. Update now\n 2. Skip\n 3. Skip until next version",
     ["send-keys -t test-sess 2"]),
    ("claude", "Do you trust the files in this folder?\n Yes, I trust this folder",
     ["send-keys -t test-sess Enter"]),
    ("claude", "Try the new fullscreen renderer?\n Yes, try it",
     ["send-keys -t test-sess Escape"]),
]


@pytest.mark.parametrize("agent,pane,expected", AGENT_DIALOGS)
def test_s4_each_agents_dialog_signature_gets_its_own_keys(
        mam_sandbox, agent, pane, expected):
    """S4 (stubbed pane + stubbed send-keys): the adapter's signature is
    matched and exactly its keys are sent."""
    res, sent = _run_dialogs(mam_sandbox, agent, pane)
    assert sent == expected, (res.stdout, res.stderr, sent)


def test_s4b_every_adapter_publishes_the_fact(mam_sandbox):
    """S4b (real `lib_py.agents facts`): MAM_STARTUP_DIALOGS is part of the
    facts contract for every agent, so the shell never has to know an agent
    name. An agent with no known blocking modal publishes an empty list."""
    repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    skills = os.path.join(repo, ".agents", "skills")
    seen = {}
    for agent in ("claude", "agy", "grok", "codex", "opencode", "hermes"):
        out = subprocess.run(
            [os.path.join(repo, ".venv", "bin", "python"), "-m", "lib_py.agents",
             "facts", agent],
            capture_output=True, text=True, cwd=repo,
            env=dict(os.environ, PYTHONPATH=skills)).stdout
        line = [l for l in out.splitlines() if l.startswith("MAM_STARTUP_DIALOGS=")]
        assert line, "no MAM_STARTUP_DIALOGS for %s" % agent
        seen[agent] = json.loads(line[0].split("=", 1)[1].strip("'"))
    for agent in ("claude", "agy", "grok", "codex"):
        assert seen[agent], "%s must publish its start-up dialogs" % agent
        for pattern, keys, kind in seen[agent]:
            assert kind in ("trust", "notice"), (agent, kind)
            assert keys, (agent, pattern)
    assert seen["opencode"] == [] and seen["hermes"] == []


def test_s5_an_accepted_dialog_still_on_screen_is_not_resent(mam_sandbox):
    """S5 (stubbed pane + stubbed send-keys): #24's comment reports that
    `--source visible` keeps showing the dialog for a while after it was
    accepted, and _pane_capture hardcodes that source. The pane here never
    changes, so a frame-count rule would send the keys again every poll; the
    time cooldown must keep it at one."""
    res, sent = _run_dialogs(
        mam_sandbox, "grok", "Do you trust the contents of this directory?",
        timeout=3, env={"MAM_DIALOG_RESEND_S": "60"})
    assert sent == ["send-keys -t test-sess y"], (res.stdout, res.stderr, sent)


def test_s5b_the_cooldown_expiring_allows_one_more_try(mam_sandbox):
    """S5b: the cooldown is a rate limit, not a one-shot - a dialog that really
    did not take the keys is retried once the window passes."""
    res, sent = _run_dialogs(
        mam_sandbox, "grok", "Do you trust the contents of this directory?",
        timeout=4, env={"MAM_DIALOG_RESEND_S": "1"})
    assert len(sent) >= 2, (res.stdout, res.stderr, sent)
    assert set(sent) == {"send-keys -t test-sess y"}, sent


def test_s5c_readiness_is_judged_by_the_ready_tokens_not_by_the_dialog_leaving(
        mam_sandbox):
    """S5c: a ready screen returns 0 without sending anything."""
    res, sent = _run_dialogs(mam_sandbox, "grok", "Grok ready\n>>> ", timeout=3)
    assert sent == [], sent
    assert "rc=0" in res.stdout, res.stdout + res.stderr


def test_s6_no_auto_trust_leaves_trust_dialogs_alone_but_answers_notices(
        mam_sandbox):
    """S6 (stubbed): --no-auto-trust. codex trust is left to a human with a
    warning; the update notice still gets answered, since skipping it changes
    nothing and it blocks the session just as hard."""
    res, sent = _run_dialogs(
        mam_sandbox, "codex", "Do you trust the contents of this directory?\n > 1. Yes, continue",
        timeout=1, env={"MAM_AUTO_TRUST": "0"})
    assert sent == [], sent
    assert "no-auto-trust" in res.stderr, res.stderr

    res, sent = _run_dialogs(
        mam_sandbox, "codex", "Update available\n 1. Update now\n 3. Skip until next version",
        timeout=1, env={"MAM_AUTO_TRUST": "0"})
    assert sent == ["send-keys -t test-sess 2"], (res.stderr, sent)


def test_s6b_create_session_no_longer_gates_dialogs_on_claude(mam_sandbox):
    """S6b (source read): the #24 root cause was the `AGENT = claude` gate at
    the create_session call site, so the gate's absence is the regression."""
    repo = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
    src = open(os.path.join(repo, ".agents", "skills", "multi-agent-mux-create",
                            "scripts", "create_session.sh")).read()
    call = [l for l in src.splitlines() if "handle_startup_dialogs" in l]
    assert call, "create_session no longer answers start-up dialogs at all"
    assert all('"$AGENT"' in l for l in call), call
    assert 'if [ "$AGENT" = "claude" ] && [ -z "$LAST_VISIBLE_STATUS_OVERRIDE" ]' not in src