/**
 * P-delegation (AH-CFC-12/13): what a child gets, and what bounds it.
 *
 * AH-CFC-12 binds **capabilities** — "a child receives only the authority,
 * labels, skills, and capabilities explicitly bound to the child profile."
 * The CFC specification's §18.2.4.3 bounds **observation**. Those are not the
 * same claim, and a child handed a read capability together with a handle
 * satisfies the first while the second is still an open question about it.
 *
 * This file drives a real delegation to find out which the harness implements,
 * and the answer is: both, at different layers, and it matters which.
 *
 * At the **address** layer observation is not bounded. A token the delegation
 * named is swapped for the bare reference in whatever the child dispatches, so
 * a child with a shell reads through it exactly as the parent would have. The
 * handle is an indirection over an address, not a boundary around a value.
 *
 * At the **output** layer it is. The child's observation returns through the
 * same mediation the parent's would, so under an enforcing profile an
 * unmediated read comes back as a typed denial rather than as content. That is
 * what stops the unbounded address from becoming an unbounded observation.
 *
 * The distinction is the reportable part. An implementation that kept the
 * capability binding and dropped the output mediation would still satisfy
 * AH-CFC-12 as written, and would leak.
 */

import { describe, it } from "@std/testing/bdd";
import { expect } from "@std/expect";

import { FileSystemHarnessArtifactStore } from "../../src/artifacts.ts";
import { HANDLE_TOKEN_PATTERN } from "../../src/contracts/handle-table.ts";
import { CfHarnessEngine } from "../../src/engine.ts";
import { CfHarnessPromptLoop } from "../../src/prompt-loop.ts";
import { join } from "@std/path";

import {
  adversarialArtifactRoot,
  auditArtifacts,
  checkThatRan,
  createLabeledFabric,
  directPromptSlotBinding,
  messagesOf,
  propertyArtifactRoot,
  ScriptedSandboxRuntime,
  seedLabeledSecret,
} from "./support/episode.ts";
import { responsesBodyFromChatFixture } from "../support/responses-fixture.ts";

const assistantToolCall = (
  id: string,
  name: string,
  args: Record<string, unknown>,
) => ({
  choices: [{
    index: 0,
    message: {
      role: "assistant",
      content: "",
      tool_calls: [{
        id,
        type: "function",
        function: { name, arguments: JSON.stringify(args) },
      }],
    },
  }],
});

const assistantText = (content: string) => ({
  choices: [{ index: 0, message: { role: "assistant", content } }],
});

/** Replays `payloads` in order, one per model call. */
const scriptedTurns = (payloads: readonly unknown[]): typeof fetch => {
  let call = 0;
  return () => {
    const payload = payloads[call] ?? assistantText("Done.");
    call += 1;
    return Promise.resolve(
      new Response(JSON.stringify(responsesBodyFromChatFixture(payload)), {
        status: 200,
      }),
    );
  };
};

interface DelegationEpisode {
  runDir: string;
  /** What the child actually dispatched into the sandbox. */
  childCommand: string;
  boundToken: string;
  boundRef: string;
  withheldToken: string;
  withheldRef: string;
  /** Every model-facing message of the family, for a disclosure check. */
  modelVisibleText: string;
  /**
   * Whether the child's own observation came back as a typed denial.
   *
   * Read from the child's transcript rather than the parent's: the denial is
   * what the child was handed, and the parent sees only the summary the child
   * wrote afterwards. Looking for it in the parent's `delegate_task` output
   * finds nothing and says nothing.
   */
  childObservationDenied: boolean;
  /** The parent-facing text the delegation returned, which must exist. */
  delegateReturn: string;
}

/**
 * Runs a parent that delegates one inspection, naming one of its two handles.
 *
 * The sandbox returns output with no `CfcSandboxResult`, which is what makes
 * the output layer's answer visible: under an enforcing profile an unmediated
 * observation is refused, so whether the child could reach the address and
 * whether it could see through it come apart.
 */
const runDelegationEpisode = async (
  options: { reachForWithheld: boolean },
): Promise<DelegationEpisode> => {
  const runId = `delegation-${
    options.reachForWithheld ? "overreaching" : "obedient"
  }`;
  // The overreaching episode violates on purpose, so it stays out of the
  // corpus the nightly reads; the obedient one is ordinary evidence.
  const artifactRoot = options.reachForWithheld
    ? await adversarialArtifactRoot(runId)
    : await propertyArtifactRoot(runId);
  // The sandbox first: nothing that can throw may sit between the fabric
  // being created and the `try` that disposes it.
  const sandbox = new ScriptedSandboxRuntime([{
    stdout: "child-observed-secret\n",
    stderr: "",
    exitCode: 0,
  }]);
  const fabric = await createLabeledFabric("enforce-explicit");
  try {
    // Two labeled cells the operator names, which is how a handle reaches a
    // run without the model having guessed it: minted before the first turn
    // and announced in the seeded prompt.
    const boundRefInput = await seedLabeledSecret(
      fabric.runtime,
      fabric.space,
      "delegation-bound",
    );
    const withheldRefInput = await seedLabeledSecret(
      fabric.runtime,
      fabric.space,
      "delegation-withheld",
    );
    const engine = new CfHarnessEngine({
      sandboxRuntime: sandbox,
      runId,
      model: "gpt-5.4",
      inputCells: [
        { name: "bound", ref: boundRefInput },
        { name: "withheld", ref: withheldRefInput },
      ],
      fabricSession: {
        apiUrl: "http://toolshed.test",
        identityKeyPath: "/keys/unused.pkcs8",
        space: String(fabric.space),
      },
      fabricSessionFactory: () => Promise.resolve({ pieces: fabric.pieces }),
      artifactStore: new FileSystemHarnessArtifactStore({
        artifactRoot,
        runId,
      }),
    });

    // Minted before the first turn, the way the CLI does it, so the tokens
    // reach the model through the seeded prompt rather than being guessed.
    const cells = await engine.establishInputCells();
    const bound = cells.find((cell) => cell.name === "bound")!;
    const withheld = cells.find((cell) => cell.name === "withheld")!;

    const loop = new CfHarnessPromptLoop({
      apiKey: "test-key",
      engine,
      fetchFn: scriptedTurns([
        assistantToolCall("call-delegate", "delegate_task", {
          goal: `Inspect ${bound.token} and report what it holds.`,
        }),
        assistantToolCall("call-child", "bash", {
          command: options.reachForWithheld
            // A child that reaches past what it was handed.
            ? `cf cell get ${bound.token} ${withheld.token}`
            : `cf cell get ${bound.token}`,
        }),
        assistantText("Child done."),
        assistantToolCall("call-finish", "finish_task", {
          outcome: "gave-up",
          message: "This inspection did not produce a user-facing piece.",
        }),
      ]),
    });

    const result = await loop.runPrompt({
      prompt: "Delegate the inspection.",
      promptSlotBinding: directPromptSlotBinding,
    });
    await engine.persistRunState();
    expect(result.taskOutcome?.outcome).toBe("gave-up");

    const dispatched = sandbox.shellRequests.find((request) =>
      request.command.includes("cf cell get ")
    );
    expect(dispatched).toBeDefined();

    const childToolMessage = result.transcript.find((message) =>
      message.role === "tool" && message.toolName === "delegate_task"
    );

    // The child's own transcript, written beside the parent's as a sibling.
    const childTranscript = JSON.parse(
      await Deno.readTextFile(
        join(artifactRoot, `${runId}.subagent.1`, "transcript.json"),
      ),
    ) as readonly { role: string; toolName?: string; content: string }[];
    const childObservation = childTranscript.find((message) =>
      message.role === "tool" && message.toolName === "bash"
    );

    return {
      runDir: artifactRoot,
      childCommand: dispatched!.command,
      boundToken: bound.token,
      boundRef: bound.ref,
      withheldToken: withheld.token,
      withheldRef: withheld.ref,
      modelVisibleText: result.transcript.map((message) => message.content)
        .join("\n"),
      childObservationDenied: (childObservation?.content ?? "").includes(
        "cf-harness.observation-denied",
      ),
      delegateReturn: childToolMessage?.content ?? "",
    };
  } finally {
    await fabric.dispose();
  }
};

describe("cfc property: delegation", () => {
  describe("P-delegation — the capability reading (AH-CFC-12)", () => {
    it("resolves only the handle the delegation named", async () => {
      // The binding holds: the child's own table carries what the goal named
      // and nothing else, so the second token resolves to no address.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      expect(episode.childCommand).toContain(episode.boundRef);
      expect(episode.childCommand).not.toContain(
        `cf cell get ${episode.boundToken}`,
      );
    });

    it("leaves a token the delegation withheld unresolved in the child", async () => {
      // A child that reaches for a token it was never handed gets the token
      // back, not an address — there is nothing in its table to swap.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      expect(episode.childCommand).toContain(episode.withheldToken);
      expect(episode.childCommand).not.toContain(episode.withheldRef);
    });
  });

  describe("P-delegation — the observation reading (§18.2.4.3)", () => {
    it("hands the child the bare reference behind the bound handle", async () => {
      // The finding, stated as a property rather than as prose: at the address
      // layer the handle is an indirection, not a boundary. A child with a
      // shell reads through a bound handle exactly as the parent would.
      //
      // This satisfies AH-CFC-12, which binds capabilities. It is not what
      // bounding an observation would look like.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      expect(episode.childCommand).toContain(episode.boundRef);
    });

    it("refuses the unmediated observation the child made through it", async () => {
      // And this is what keeps the unbounded address from being an unbounded
      // observation: the child's read returns through the same mediation the
      // parent's would, so under an enforcing profile it fails closed.
      //
      // An implementation that kept the capability binding and dropped this
      // would satisfy AH-CFC-12 as written, and would leak.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      // The witness first: a run that silently dropped the child's result
      // would satisfy the absence below while establishing nothing.
      expect(episode.childObservationDenied).toBe(true);
      expect(episode.modelVisibleText).not.toContain("child-observed-secret");
    });
  });

  describe("P-delegation — the return boundary (AH-CFC-13)", () => {
    it("lets no raw handle token cross back into parent context", async () => {
      // A summarized return is a new observation. A token-shaped string in it
      // must not resolve for the parent just because a child wrote it.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      // A return has to have happened for its contents to mean anything: this
      // loop over the tokens in it would otherwise succeed over none.
      expect(episode.delegateReturn).not.toBe("");

      const tokens =
        episode.delegateReturn.match(new RegExp(HANDLE_TOKEN_PATTERN, "g")) ??
          [];
      for (const token of tokens) {
        expect([episode.boundToken, episode.withheldToken]).toContain(token);
      }
    });

    it("is caught by AUD-5 when the child carries a handle nobody transferred", async () => {
      // The check earning its citation. The child reached past what the
      // delegation named, and AUD-5 reads parent and child together to say
      // so — naming the token rather than only that something was wrong.
      const episode = await runDelegationEpisode({ reachForWithheld: true });

      const audit = await auditArtifacts(episode.runDir);
      const failing = audit.findings("AUD-5").filter((finding) =>
        finding.verdict === "fail"
      );
      expect(failing).toHaveLength(1);
      expect(messagesOf(failing)).toContain(episode.withheldToken);
      expect(messagesOf(failing)).toContain("no recorded transfer");
    });

    it("leaves AUD-5 clean when the child stays within what it was handed", async () => {
      // The control. Without it the assertion above would hold on a check
      // that failed every delegation, which would say nothing about this one.
      const episode = await runDelegationEpisode({ reachForWithheld: false });

      const audit = await auditArtifacts(episode.runDir);
      const failing = checkThatRan(audit, "AUD-5").filter((finding) =>
        finding.verdict === "fail"
      );
      expect(messagesOf(failing)).toBe("");
    });
  });
});