import Testing

@testable import NucleicCore

/// `CodexGateOwnership`: the launch overrides that stop Codex's own review layer from shadowing
/// gates Nucleic already owns. Codex's guardian is stable and ON by default and assesses
/// `mcp_tool_call`, so a containerized run's `host_exec`/VM/`linux_container` calls came back as a
/// bare failed item — no result, no reason — which the model reported as not being "authorized".
@Suite struct CodexGateOwnershipTests {
    @Test func launchArgsDisableCodexReviewLayer() {
        #expect(CodexGateOwnership.launchArgs == ["-c", "features.guardian_approval=false"])
    }

    /// The `nucleic` server must be pre-approved and effectively unbounded: approval waits and
    /// host/VM/container calls may legitimately run beyond Codex's default MCP tool timeout.
    @Test func nucleicServerIsPreApprovedUnboundedAndPointedAtTheControlBridge() {
        let args = CodexGateOwnership.nucleicMCPArgs(port: 8765)
        #expect(args.contains("mcp_servers.nucleic.url=\"http://127.0.0.1:8765/mcp\""))
        #expect(args.contains("mcp_servers.nucleic.bearer_token_env_var=\"NUCLEIC_MCP_TOKEN\""))
        #expect(args.contains("mcp_servers.nucleic.default_tools_approval_mode=\"approve\""))
        #expect(CodexGateOwnership.toolTimeoutSeconds == 2_147_483_647)
        #expect(args.contains("mcp_servers.nucleic.tool_timeout_sec=2147483647"))
        // Every value is a `-c` override, so they must pair up.
        #expect(args.count == 8)
        #expect(args.filter { $0 == "-c" }.count == 4)
    }

    /// The token rides in an env var so it never lands in a config file on disk.
    @Test func tokenIsNamedForEnvHandoffNotInlinedInConfig() {
        #expect(CodexGateOwnership.tokenEnvVar == "NUCLEIC_MCP_TOKEN")
        #expect(!CodexGateOwnership.nucleicMCPArgs(port: 1).contains { $0.contains("bearer_token=") })
    }
}
