}

    fn build(cwd: Option<PathBuf>, delegation: Option<DelegationGate>) -> Self {

        let root = cwd.unwrap_or_else(|| std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")));

        let root =

            cwd.unwrap_or_else(|| std::env::current_dir().unwrap_or_else(|_| PathBuf::from(".")));

        let catalog = plugins::discover_catalog(&root);

        let mut registry = Self {

            cwd: root,

            dirs.push(PathBuf::from(home).join(".agents").join("skills"));

        }

        // The skills this CLI ships, read from the package they live in.

        dirs.push(self.cwd.join("packages").join("openagents-cli").join("skills"));

        dirs.push(

            self.cwd

                .join("packages")

                .join("openagents-cli")

                .join("skills"),

        );

        dirs

    }

    /// The plugins loaded into this session so far.

    pub fn loaded_plugins(&self) -> Vec<Arc<LoadedPlugin>> {

        self.loaded.lock().map(|held| held.clone()).unwrap_or_default()

        self.loaded

            .lock()

            .map(|held| held.clone())

            .unwrap_or_default()

    }

    pub fn list_tools(&self) -> Vec<ToolDefinition> {

    pub async fn execute_tool(&self, call: &ToolCall) -> ToolOutput {

        match call.name.as_str() {

            "shell" => {

                let cmd = call.arguments.get("command").and_then(|v| v.as_str()).unwrap_or("");

                let timeout_secs = call.arguments.get("timeout_seconds")

                let cmd = call

                    .arguments

                    .get("command")

                    .and_then(|v| v.as_str())

                    .unwrap_or("");

                let timeout_secs = call

                    .arguments

                    .get("timeout_seconds")

                    .and_then(|v| v.as_u64())

                    .unwrap_or(DEFAULT_TIMEOUT_SECS)

                    .min(MAXIMUM_TIMEOUT_SECS);

                }

            }

            "skill" => {

                let name = call.arguments.get("name").and_then(|v| v.as_str()).unwrap_or("");

                let name = call

                    .arguments

                    .get("name")

                    .and_then(|v| v.as_str())

                    .unwrap_or("");

                if let Some(skill_info) = self.skills.get(name) {

                    ToolOutput {

                        call_id: call.id.clone(),

                }

            }

            "openagents" => {

                let args_array = call.arguments.get("args")

                let args_array = call

                    .arguments

                    .get("args")

                    .and_then(|v| v.as_array())

                    .map(|arr| arr.iter().filter_map(|v| v.as_str()).map(String::from).collect::<Vec<_>>())

                    .map(|arr| {

                        arr.iter()

                            .filter_map(|v| v.as_str())

                            .map(String::from)

                            .collect::<Vec<_>>()

                    })

                    .unwrap_or_default();

                let (output_str, failed) = run_openagents_cli(&args_array).await;

                // turn dies of; the only `is_error` here is the absence of a

                // plugin where one was named.

                let is_error = loaded.is_none()

                    && call.arguments.get("name").and_then(|v| v.as_str()).is_some();

                    && call

                        .arguments

                        .get("name")

                        .and_then(|v| v.as_str())

                        .is_some();

                if let Some(plugin) = loaded {

                    if let Ok(mut held) = self.loaded.lock() {

                        held.retain(|existing| existing.manifest.name != plugin.manifest.name);

    } else {

        skill.body.clone()

    };

    format!("Skill `{}` ({}):\n\n{}", skill.name, skill.path.display(), body)

    format!(

        "Skill `{}` ({}):\n\n{}",

        skill.name,

        skill.path.display(),

        body

    )

}

/// What the two OpenAgents repositories are, when the session is in one.

    // whole workspace root, which holds every read-only reference clone, and

    // it spent the tool's whole budget before being stopped.

    if let Some(sibling) = sibling_checkout(cwd) {

        let parent = sibling.parent().map(|p| p.display().to_string()).unwrap_or_default();

        let parent = sibling

            .parent()

            .map(|p| p.display().to_string())

            .unwrap_or_default();

        lines.push(String::new());

        lines.push(format!(

            "The other one is checked out at `{}`. To search or read it, change directory first — \

        .kill_on_drop(true);

    #[cfg(unix)]

    command.process_group(0);

    let child = match command.spawn()

    {

    let child = match command.spawn() {

        Ok(c) => c,

        Err(e) => return (format!("Failed to spawn shell command: {}", e), true),

    };

            if output.status.success() {

                if bounded.trim().is_empty() {

                    ("The command succeeded and printed nothing.".to_string(), false)

                    (

                        "The command succeeded and printed nothing.".to_string(),

                        false,

                    )

                } else {

                    (bounded.trim().to_string(), false)

                }

            } else {

                let code = output.status.code().unwrap_or(1);

                (

                    format!("The command exited with code {}.\n\n{}", code, bounded.trim()),

                    format!(

                        "The command exited with code {}.\n\n{}",

                        code,

                        bounded.trim()

                    ),

                    true,

                )

            }

        }

        Ok(Err(e)) => (format!("Shell execution error: {}", e), true),

        Err(_) => (

            format!("The command timed out after {} seconds and was stopped.", timeout_secs),

            format!(

                "The command timed out after {} seconds and was stopped.",

                timeout_secs

            ),

            true,

        ),

    }

/// As [`run_real_shell`]: the text, and whether it worked. A CLI that could

/// not even be spawned was previously reported to the model as a success.

/// Where the program behind the `openagents` tool came from.

#[derive(Debug, Clone, Copy, PartialEq, Eq)]

pub enum OpenAgentsCliSource {

    /// A program named `openagents` found on `PATH`.

    Path,

    /// Nothing on `PATH`, so this binary answers for it.

    ThisBinary,

}

/// The program the `openagents` tool runs, and where it was found.

///

/// `PATH` first, deliberately: the CLI installed under that name is the

/// TypeScript one, and it covers more subcommands than this binary does, so

/// where both exist the model should reach the fuller of the two.

///

/// This binary is the fallback rather than the first choice because it is

/// installed as `oa`. On a machine carrying only the Rust CLI there is nothing

/// named `openagents` anywhere on `PATH`, and this used to be

/// `Command::new("openagents")` — so every call the model made failed with

/// `No such file or directory` while the very binary that could have answered

/// was the one running the tool.

pub fn resolve_openagents_cli() -> Result<(PathBuf, OpenAgentsCliSource), String> {

    let name = format!("openagents{}", std::env::consts::EXE_SUFFIX);

    let on_path = std::env::var_os("PATH")

        .map(|path| std::env::split_paths(&path).collect::<Vec<_>>())

        .unwrap_or_default()

        .into_iter()

        .map(|dir| dir.join(&name))

        .find(|candidate| is_executable_file(candidate));

    if let Some(found) = on_path {

        return Ok((found, OpenAgentsCliSource::Path));

    }

    match std::env::current_exe() {

        Ok(exe) => Ok((exe, OpenAgentsCliSource::ThisBinary)),

        // Neither resolves. This is an error rather than an empty success: a

        // tool result that says nothing reads to a model as a command that ran

        // and printed nothing.

        Err(error) => Err(format!(

            "No `openagents` CLI is available: nothing named `openagents` is on PATH, \

             and this binary's own path could not be read: {error}"

        )),

    }

}

fn is_executable_file(path: &Path) -> bool {

    let Ok(meta) = std::fs::metadata(path) else {

        return false;

    };

    if !meta.is_file() {

        return false;

    }

    #[cfg(unix)]

    {

        use std::os::unix::fs::PermissionsExt;

        meta.permissions().mode() & 0o111 != 0

    }

    #[cfg(not(unix))]

    {

        true

    }

}

async fn run_openagents_cli(args: &[String]) -> (String, bool) {

    let mut cmd = Command::new("openagents");

    let (program, source) = match resolve_openagents_cli() {

        Ok(resolved) => resolved,

        Err(error) => return (error, true),

    };

    // Which program answered is part of the result. The two differ in what

    // they support, so a model reading `unknown command` needs to know which

    // CLI said it rather than guessing.

    let note = match source {

        OpenAgentsCliSource::Path => {

            format!("[ran the `openagents` CLI on PATH: {}]", program.display())

        }

        OpenAgentsCliSource::ThisBinary => format!(

            "[no `openagents` on PATH; ran this binary instead: {}]",

            program.display()

        ),

    };

    let mut cmd = Command::new(&program);

    cmd.args(args);

    cmd.stdout(Stdio::piped());

    cmd.stderr(Stdio::piped());

            let mut combined = String::new();

            combined.push_str(&String::from_utf8_lossy(&output.stdout));

            combined.push_str(&String::from_utf8_lossy(&output.stderr));

            (combined.trim().to_string(), !output.status.success())

            (

                format!("{note}\n\n{}", combined.trim()),

                !output.status.success(),

            )

        }

        Err(e) => (format!("Failed to run openagents CLI: {}", e), true),

        Err(e) => (

            format!("{note}\n\nFailed to run the openagents CLI: {e}"),

            true,

        ),

    }

}

    #[test]

    fn a_refusal_says_what_the_command_would_have_done() {

        let refusal = check_shell_refusal("rm -rf ~/").expect("refused");

        assert!(refusal.contains("erase a root or a home directory"), "{refusal}");

        assert!(

            refusal.contains("erase a root or a home directory"),

            "{refusal}"

        );

        assert!(refusal.contains("name the directory"), "{refusal}");

    }

    #[test]

    fn a_folded_block_description_is_one_paragraph() {

        let source = "---\nname: folded\ndescription: >-\n  First line\n  second line.\n---\nBody.\n";

        let source =

            "---\nname: folded\ndescription: >-\n  First line\n  second line.\n---\nBody.\n";

        let (_, description, _) = parse_skill_front_matter(source).expect("parsed");

        assert_eq!(description, "First line second line.");

    }

    #[test]

    fn the_nearest_skills_directory_keeps_a_contested_name() {

        let root = tempfile::tempdir().unwrap();

        write_skill(root.path(), "shared", "---\nname: shared\ndescription: The repository's.\n---\nRepo body.\n");

        let shipped = root.path().join("packages").join("openagents-cli").join("skills").join("shared");

        write_skill(

            root.path(),

            "shared",

            "---\nname: shared\ndescription: The repository's.\n---\nRepo body.\n",

        );

        let shipped = root

            .path()

            .join("packages")

            .join("openagents-cli")

            .join("skills")

            .join("shared");

        std::fs::create_dir_all(&shipped).unwrap();

        std::fs::write(

            shipped.join("SKILL.md"),

        let tools = registry.list_tools();

        let skill_tool = tools.iter().find(|t| t.name == "skill").expect("declared");

        assert!(skill_tool.description.contains("`brewing`: How to make tea."));

        assert!(skill_tool

            .description

            .contains("`brewing`: How to make tea."));

        // The catalog is what a session pays for on every turn; a body in it

        // is 46 KB of instructions the model may never use.

        assert!(

            })

            .await;

        assert!(!out.is_error);

        assert!(out.output.contains("STEEP_FOR_FOUR_MINUTES"), "{}", out.output);

        assert!(

            out.output.contains("STEEP_FOR_FOUR_MINUTES"),

            "{}",

            out.output

        );

        assert!(out.output.contains("SKILL.md"), "{}", out.output);

        let missing = registry

        );

        let registry = HarnessToolRegistry::new(Some(root.path().to_path_buf()));

        let context = registry.standing_context().expect("an auto skill is injected");

        let context = registry

            .standing_context()

            .expect("an auto skill is injected");

        assert!(context.contains("WORK_THIS_WAY"), "{context}");

        assert!(

            !context.contains("ONLY_ON_REQUEST"),

    #[test]

    fn a_workspace_with_no_auto_skill_injects_nothing() {

        let root = tempfile::tempdir().unwrap();

        write_skill(root.path(), "plain", "---\nname: plain\ndescription: Read on request.\n---\nBody.\n");

        write_skill(

            root.path(),

            "plain",

            "---\nname: plain\ndescription: Read on request.\n---\nBody.\n",

        );

        // A temporary directory is not named for either OpenAgents repository,

        // so the workspace note does not apply either.

        assert!(HarnessToolRegistry::new(Some(root.path().to_path_buf()))

        // context this session starts with.

        let context = registry.standing_context().expect("something is injected");

        assert!(

            registry.skills.get("superdelegate").is_some_and(|skill| skill.auto),

            registry

                .skills

                .get("superdelegate")

                .is_some_and(|skill| skill.auto),

            "superdelegate is the repository's auto skill"

        );

        let body = &registry.skills["superdelegate"].body;

        assert!(context.contains(&body[..80.min(body.len())]), "the auto body was not injected");

        assert!(

            context.contains(&body[..80.min(body.len())]),

            "the auto body was not injected"

        );

    }

    // ───────────────────────────────────────────── the capability tool wiring

        let root = tempfile::tempdir().unwrap();

        let registry = HarnessToolRegistry::with_delegation(

            Some(root.path().to_path_buf()),

            DelegationGate { lane: "test".to_string(), user_token: None, max_count: 2 },

            DelegationGate {

                lane: "test".to_string(),

                user_token: None,

                max_count: 2,

            },

        );

        let names: Vec<String> = registry.list_tools().into_iter().map(|t| t.name).collect();

        assert_eq!(names, vec!["shell", "skill", "openagents", "capability", "delegate"]);

        assert_eq!(

            names,

            vec!["shell", "skill", "openagents", "capability", "delegate"]

        );

        let runtime = tokio::runtime::Runtime::new().unwrap();

        for name in &names {

    #[tokio::test]

    async fn a_capability_search_names_a_plugin_and_loading_it_declares_its_tool() {

        let repo = Path::new(env!("CARGO_MANIFEST_DIR")).join("..").join("..");

        if !repo.join("plugins").join("word-stats").join("manifest.json").is_file() {

        if !repo

            .join("plugins")

            .join("word-stats")

            .join("manifest.json")

            .is_file()

        {

            return;

        }

        let registry = HarnessToolRegistry::new(Some(repo));

        assert!(!registry.catalog.is_empty(), "the checked-in catalog was not discovered");

        assert!(

            !registry.catalog.is_empty(),

            "the checked-in catalog was not discovered"

        );

        let search = registry

            .execute_tool(&ToolCall {

            .into_iter()

            .find(|t| t.name == "word_stats")

            .expect("the loaded plugin declares its tool");

        assert_eq!(word_stats.parameters["properties"]["text"]["type"], "string");

        assert_eq!(

            word_stats.parameters["properties"]["text"]["type"],

            "string"

        );

        // And the tool the plugin declared runs the plugin.

        let ran = registry

    #[tokio::test]

    async fn a_mounted_capability_refuses_to_load_without_an_operator() {

        let repo = Path::new(env!("CARGO_MANIFEST_DIR")).join("..").join("..");

        if !repo.join("plugins").join("file-stats").join("manifest.json").is_file() {

        if !repo

            .join("plugins")

            .join("file-stats")

            .join("manifest.json")

            .is_file()

        {

            return;

        }

        let unattended = HarnessToolRegistry::new(Some(repo.clone()));

                arguments: serde_json::json!({"name": "file_stats"}),

            })

            .await;

        assert!(refused.output.contains("approval_unavailable"), "{}", refused.output);

        assert!(unattended.list_tools().iter().all(|t| t.name != "file_stats"));

        assert!(

            refused.output.contains("approval_unavailable"),

            "{}",

            refused.output

        );

        assert!(unattended

            .list_tools()

            .iter()

            .all(|t| t.name != "file_stats"));

        let attended = HarnessToolRegistry::new(Some(repo)).allowing_plugin_mounts();

        let loaded = attended

                arguments: serde_json::json!({"name": "file_stats"}),

            })

            .await;

        assert!(loaded.output.contains("digest verified"), "{}", loaded.output);

        assert!(

            loaded.output.contains("digest verified"),

            "{}",

            loaded.output

        );

        assert!(attended.list_tools().iter().any(|t| t.name == "file_stats"));

    }

        // 29,999 ASCII bytes, then a 3-byte character straddling byte 30,000.

        let mut text = "a".repeat(OUTPUT_LIMIT - 1);

        text.push_str("€€€");

        assert!(!text.is_char_boundary(OUTPUT_LIMIT), "the probe must straddle");

        assert!(

            !text.is_char_boundary(OUTPUT_LIMIT),

            "the probe must straddle"

        );

        let cut = floor_char_boundary(&text, OUTPUT_LIMIT);

        // The old code did `&text[..OUTPUT_LIMIT]`, which panics here.

//! The end-to-end half of the live-execution audit for

//! OpenAgentsInc/openagents#89.

//!

//! Six defects were found by driving the compiled binary against the live

//! deployment rather than by reading the source. Five are fixed in

//! `c48fa5b138` and the sixth in the commit this file arrives on; each test

//! below now asserts the **fixed** behaviour, and each keeps the account of

//! what the defect was, because the reason a test exists outlives the

//! assertion.

//!

//! These run one layer out from the unit tests that accompany the fixes:

//! `tools::defect_tests` calls `run_real_shell` and `floor_char_boundary`

//! directly, while these go through `HarnessToolRegistry::execute_tool` with

//! real subprocesses, and through `CoderRuntimeSession` against a real socket.

//! Where a defect is covered at both layers the outer one is kept here and the

//! duplicate dropped — the hosted-lane transcript test lives in

//! `runtime_test.rs` as `the_second_turn_carries_what_the_first_turn_answered`,

//! so what remains here is the local lane, which that fix also changed and

//! nothing else covers.

//!

//! What the live run confirmed working, and what is therefore not re-asserted

//! here: a headless turn reaches a real model and prints its answer, a turn

//! calls `shell` and answers from the result, a two-child fan-out returns two

//! real outputs from separate git worktrees, every lane opens on the model it

//! names, and reported token counts match what `GET /api/v1/threads` records.

use openagents_cli::runtime::{CoderRuntimeSession, Lane};

use openagents_cli::tools::{

    resolve_openagents_cli, HarnessToolRegistry, OpenAgentsCliSource, ToolCall,

};

use std::sync::{Arc, Mutex};

use tokio::io::{AsyncReadExt, AsyncWriteExt};

// ───────────────────────────────────────────────────────────────── the stub

/// What a request should be answered with.

enum Reply {

    Json(String),

    /// Server-sent events, the shape the inference proxy streams.

    Sse(Vec<String>),

    /// Newline-delimited JSON, the shape Ollama streams.

    Ndjson(Vec<String>),

}

/// A stand-in for whichever server the session is talking to, recording what

/// it was asked.

///

/// It answers on a real socket, so everything between the session and the wire

/// is the production path and what these tests assert on is the bytes that

/// were actually sent.

struct Stub {

    base: String,

    origin: String,

    requests: Arc<Mutex<Vec<String>>>,

}

impl Stub {

    /// Every request this stub has taken, headers and body, oldest first.

    fn requests(&self) -> Vec<String> {

        self.requests.lock().unwrap().clone()

    }

    /// Just the bodies of the calls that asked a model to say something.

    fn completions(&self) -> Vec<String> {

        self.requests()

            .into_iter()

            .filter(|r| r.starts_with("POST /proxy") || r.starts_with("POST /api/chat"))

            .collect()

    }

}

/// Start a stub whose reply is chosen by the request and by how many

/// completions it has already served.

fn start<H>(handler: H) -> Stub

where

    H: Fn(&str, usize, &str) -> Reply + Send + Sync + 'static,

{

    let requests = Arc::new(Mutex::new(Vec::new()));

    let recorder = Arc::clone(&requests);

    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();

    listener.set_nonblocking(true).unwrap();

    let port = listener.local_addr().unwrap().port();

    let origin = format!("http://127.0.0.1:{port}");

    let base = format!("{origin}/api/v1");

    let handler_origin = origin.clone();

    tokio::spawn(async move {

        let listener = tokio::net::TcpListener::from_std(listener).unwrap();

        let mut served = 0usize;

        loop {

            let Ok((mut socket, _)) = listener.accept().await else {

                return;

            };

            let Some(request) = read_request(&mut socket).await else {

                continue;

            };

            recorder.lock().unwrap().push(request.clone());

            let reply = handler(&request, served, &handler_origin);

            match reply {

                Reply::Json(body) => {

                    let response = format!(

                        "HTTP/1.1 200 OK\r\ncontent-type: application/json\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}",

                        body.len()

                    );

                    let _ = socket.write_all(response.as_bytes()).await;

                }

                Reply::Sse(frames) => {

                    served += 1;

                    let _ = socket

                        .write_all(b"HTTP/1.1 200 OK\r\ncontent-type: text/event-stream\r\nconnection: close\r\n\r\n")

                        .await;

                    for frame in frames {

                        let _ = socket

                            .write_all(format!("data: {frame}\n\n").as_bytes())

                            .await;

                    }

                    let _ = socket.write_all(b"data: [DONE]\n\n").await;

                }

                Reply::Ndjson(lines) => {

                    served += 1;

                    let _ = socket

                        .write_all(b"HTTP/1.1 200 OK\r\ncontent-type: application/x-ndjson\r\nconnection: close\r\n\r\n")

                        .await;

                    for line in lines {

                        let _ = socket.write_all(format!("{line}\n").as_bytes()).await;

                    }

                }

            }

            let _ = socket.flush().await;

        }

    });

    Stub {

        base,

        origin,

        requests,

    }

}

/// Read one request, headers and declared body, and return it as text.

async fn read_request(socket: &mut tokio::net::TcpStream) -> Option<String> {

    let mut request = Vec::new();

    let mut buffer = [0u8; 4096];

    loop {

        let read = socket.read(&mut buffer).await.ok()?;

        if read == 0 {

            break;

        }

        request.extend_from_slice(&buffer[..read]);

        let text = String::from_utf8_lossy(&request);

        if let Some(headers_end) = text.find("\r\n\r\n") {

            let length = text

                .lines()

                .find_map(|line| {

                    line.strip_prefix("content-length: ")

                        .or_else(|| line.strip_prefix("Content-Length: "))

                })

                .and_then(|value| value.trim().parse::<usize>().ok())

                .unwrap_or(0);

            if request.len() >= headers_end + 4 + length {

                break;

            }

        }

    }

    Some(String::from_utf8_lossy(&request).to_string())

}

fn grant(origin: &str) -> String {

    format!(

        r#"{{"thread":{{"id":"th_test"}},"grant":{{"token":"tok_test","url":"{origin}/proxy","model":"ox-alpha"}}}}"#

    )

}

/// One frame asking for a tool, whole rather than fragmented.

fn call_tool(id: &str, name: &str) -> String {

    serde_json::json!({

        "choices": [{ "delta": { "tool_calls": [{

            "index": 0, "id": id,

            "function": { "name": name, "arguments": "{}" }

        }]}}]

    })

    .to_string()

}

fn registry() -> (tempfile::TempDir, HarnessToolRegistry) {

    let dir = tempfile::tempdir().unwrap();

    let registry = HarnessToolRegistry::new(Some(dir.path().to_path_buf()));

    (dir, registry)

}

// ──────────────────────────────────────────────────────────────── defect 1

/// **Output cut through a multi-byte character no longer kills the agent.**

///

/// `run_real_shell` bounded output with `&combined[..OUTPUT_LIMIT]` — a *byte*

/// index into a `String`, which panics when the index is not a character

/// boundary. Any command whose combined output crossed 30,000 bytes

/// mid-character took the whole process down in the middle of a turn: a `git

/// log`, a test run with UTF-8 output, any file with an accent or an emoji

/// past 30 kB. It aborted before the thread could be revoked, so the grant's

/// remaining budget was stranded too.

///

/// Reproduced live against the built binary before the fix:

///

/// ```text

/// $ oa coder --headless "Use the shell tool to run exactly: sh repro.sh"

/// thread 'main' panicked at crates/openagents-cli/src/tools.rs:424:98:

/// byte index 30000 is not a char boundary; it is inside '€' (bytes 29999..30002)

/// EXIT=101

/// ```

///

/// `tools::defect_tests` covers `floor_char_boundary` on its own. This runs

/// the real `/bin/sh` through the tool dispatch and asserts the whole path

/// survives: the panic showed up through a command, so a command is what

/// proves it gone.

#[tokio::test]

async fn shell_output_cut_through_a_multibyte_character_is_truncated_not_fatal() {

    let (_dir, registry) = registry();

    // 29,999 single-byte characters, then three-byte ones. Byte 30,000 lands

    // inside the first `€`, which occupies bytes 29,999-30,001.

    let command = "head -c 29999 /dev/zero | tr '\\0' 'a' && printf '€€€€€€€€€€'";

    let call = ToolCall {

        id: "call_trunc".to_string(),

        name: "shell".to_string(),

        arguments: serde_json::json!({ "command": command }),

    };

    // On its own task, so a panic is reported rather than unwinding the test.

    let output = tokio::spawn(async move { registry.execute_tool(&call).await })

        .await

        .expect("the shell tool panicked on a multi-byte truncation boundary");

    assert!(

        output

            .output

            .contains("[Output truncated: printed 30029 characters, limit is 30000]"),

        "the output should say it was cut, and by how much: {}",

        &output.output[output.output.len().saturating_sub(200)..]

    );

    assert!(

        output.output.starts_with("aaa"),

        "the kept head should be the start of the command's output"

    );

    assert!(

        !output.output.contains('\u{FFFD}'),

        "the cut left a broken character behind"

    );

    assert!(!output.is_error, "the command itself succeeded");

}

// ──────────────────────────────────────────────────────────────── defect 2

/// **The local lane records what it answered, so the next turn can see it.**

///

/// `run_tools` records an assistant turn only when that turn called a tool, so

/// a turn that simply answered never joined `self.messages`. The session is

/// reused across turns, so the model was never shown a word it had said

/// itself. Live, in the interactive session, it did not admit the gap — it

/// confabulated:

///

/// ```text

/// turn 1: "Invent a random six-letter nonsense codeword." -> QORVEN

/// turn 2: "What was the codeword you just invented?"      -> ZORBEX

/// ```

///

/// A test that asks the model to recall something from the **user's** prompt

/// passes against the defect, because user messages were always recorded. The

/// word has to be one only the assistant ever said.

///

/// The hosted lane is covered by `the_second_turn_carries_what_the_first_turn_answered`

/// in `runtime_test.rs`. The fix changed `run_local_turn` the same way, and

/// this is that half: the local lane keeps its own message list, in Ollama's

/// shape, through a separate code path.

#[tokio::test]

async fn the_local_lane_records_what_it_answered() {

    let stub = start(|request, served, _origin| {

        if request.starts_with("GET /api/tags") {

            return Reply::Json(

                r#"{"models":[{"name":"qwen3:0.6b","modified_at":"2026-08-26T00:00:00Z"}]}"#

                    .to_string(),

            );

        }

        let word = if served == 0 { "QORVEN" } else { "ZORBEX" };

        Reply::Ndjson(vec![

            serde_json::json!({

                "model": "qwen3:0.6b",

                "message": { "role": "assistant", "content": word },

                "done": false

            })

            .to_string(),

            serde_json::json!({

                "model": "qwen3:0.6b",

                "message": { "role": "assistant", "content": "" },

                "done": true, "done_reason": "stop",

                "prompt_eval_count": 10, "eval_count": 3

            })

            .to_string(),

        ])

    });

    let (_dir, tools) = registry();

    let mut session = CoderRuntimeSession::new(

        Lane::Local(String::new()),

        Some(stub.base.clone()),

        None,

        tools,

    );

    session.ollama_host = stub.origin.clone();

    let first = session

        .execute_turn("invent a six-letter codeword", |_| {})

        .await

        .unwrap();

    assert_eq!(first, "QORVEN");

    session

        .execute_turn("what was the codeword?", |_| {})

        .await

        .unwrap();

    let chats = stub.completions();

    assert_eq!(chats.len(), 2, "expected one chat call per turn");

    assert!(

        chats[1].contains("QORVEN"),

        "the second turn did not carry the first turn's answer, so the local \

         model cannot see what it said: {}",

        chats[1]

    );

    assert!(

        session

            .messages

            .iter()

            .any(|m| m.role == "assistant" && m.content.as_deref() == Some("QORVEN")),

        "the answer is missing from the session's own transcript"

    );

}

// ──────────────────────────────────────────────────────────────── defect 3

/// **A turn that runs out of tool steps refuses instead of reporting success.**

///

/// `run_thread_turn` loops `for _ in 0..MAX_TOOL_STEPS` and assigned

/// `final_answer` only on the step that came back without tool calls. A model

/// that asked for a tool on all thirty steps fell out of the bottom and the

/// function returned `Ok(String::new())` — the same `Ok` a finished turn

/// returns, carrying nothing. `run_headless_coder` printed `Turn result:`

/// followed by a blank line and exited 0, and the interactive session settled

/// `TurnEvent::Done("")` as an answered turn.

///

/// That is the shape the issue was reopened over, one level down: the turn did

/// not finish and no caller could tell.

#[tokio::test]

async fn a_turn_that_exhausts_its_tool_steps_refuses() {

    // Every step asks for a tool and never stops asking. The name is one no

    // registry has, so the loop spends no time running anything.

    let stub = start(|request, served, origin| {

        if request.starts_with("POST /api/v1/threads") {

            return Reply::Json(grant(origin));

        }

        Reply::Sse(vec![call_tool(

            &format!("call_{served}"),

            "a_tool_that_does_not_exist",

        )])

    });

    let (_dir, tools) = registry();

    let mut session = CoderRuntimeSession::new(

        Lane::OxAlpha,

        Some(stub.base.clone()),

        Some("tok_user".to_string()),

        tools,

    );

    let error = session

        .execute_turn("loop forever", |_| {})

        .await

        .expect_err("a turn that never answered was reported as a finished turn");

    let error = error.to_string();

    assert!(

        error.contains("30") && error.contains("tool steps"),

        "the refusal should say the step budget ran out: {error}"

    );

    assert_eq!(

        stub.completions().len(),

        30,

        "MAX_TOOL_STEPS is 30, so the turn should spend the whole budget before refusing"

    );

}

// ──────────────────────────────────────────────────────────────── defect 4

/// **The `openagents` tool prefers `PATH` and falls back to this binary.**

///

/// The tool is declared as "Run the OpenAgents CLI commands (issue, project,

/// repo, auth, etc.)" and was implemented as `Command::new("openagents")` — a

/// bare name resolved through `PATH`, with nothing behind it. On the machine

/// this was verified on that reached `openagents v0.4.0`, the TypeScript CLI,

/// while the agent running the tool was `oa 0.1.0`; on a machine carrying only

/// the Rust CLI there is no `openagents` on `PATH` at all and every call

/// failed with `No such file or directory`.

///

/// The contract now: prefer `PATH`, because the CLI installed under that name

/// covers more subcommands than this binary does; fall back to

/// `current_exe()`, so the tool still works where only the Rust binary exists;

/// name which one ran in the result, so a model reading `unknown command`

/// knows which CLI said it; and if neither resolves, return an error rather

/// than a success carrying nothing.

#[tokio::test]

async fn the_openagents_tool_prefers_path_and_falls_back_to_this_binary() {

    let dir = tempfile::tempdir().unwrap();

    let shim = dir.path().join("openagents");

    std::fs::write(&shim, "#!/bin/sh\necho SHIM-ON-PATH\n").unwrap();

    #[cfg(unix)]

    {

        use std::os::unix::fs::PermissionsExt;

        std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755)).unwrap();

    }

    // The only test in this file that touches the environment.

    let original = std::env::var("PATH").unwrap_or_default();

    // With something named `openagents` on PATH, that is what runs.

    std::env::set_var("PATH", format!("{}:{original}", dir.path().display()));

    let registry = HarnessToolRegistry::new(Some(dir.path().to_path_buf()));

    let output = registry

        .execute_tool(&ToolCall {

            id: "call_oa".to_string(),

            name: "openagents".to_string(),

            arguments: serde_json::json!({ "args": ["--version"] }),

        })

        .await;

    let on_path = resolve_openagents_cli();

    // With nothing named `openagents` anywhere, this binary answers for it.

    std::env::set_var("PATH", "");

    let fallback = resolve_openagents_cli();

    std::env::set_var("PATH", original);

    assert!(

        output.output.contains("SHIM-ON-PATH"),

        "the CLI on PATH should have run: {}",

        output.output

    );

    assert!(

        output.output.contains("[ran the `openagents` CLI on PATH:")

            && output.output.contains(&shim.display().to_string()),

        "the result should name the program that answered: {}",

        output.output

    );

    assert!(!output.is_error, "the shim exited zero");

    let (found, source) = on_path.expect("a shim on PATH must resolve");

    assert_eq!(source, OpenAgentsCliSource::Path);

    assert_eq!(found, shim);

    let (found, source) = fallback.expect("an empty PATH must still resolve to this binary");

    assert_eq!(

        source,

        OpenAgentsCliSource::ThisBinary,

        "with nothing on PATH the tool should fall back rather than fail"

    );

    assert_eq!(found, std::env::current_exe().unwrap());

}

// ──────────────────────────────────────────────────────────────── defect 5

/// **Cancelling a turn stops the command the `shell` tool started.**

///

/// `run_real_shell` spawned with neither `process_group(0)` nor

/// `kill_on_drop(true)`, while `delegate.rs`, `computer.rs` and `acp.rs` all

/// already put their children in a group. Dropping the future — which is what

/// `run_proxy_child`'s `tokio::select!` does when a fan-out is cancelled —

/// left the operating-system process running, reparented to init. On the

/// default `ox-alpha` lane a child is an in-process task with no pid at all,

/// so `signals::stop_tree` is never called for it and nothing else stopped

/// what it had started.

///

/// Observed live before the fix: `oa coder --delegate --count 2` told to run

/// `sleep 300`, interrupted with `SIGINT`, printed "Stopping the fan-out;

/// children are being signalled", reported both children "stopped before

/// finishing", exited — and left two `sleep 300` processes at `PPID 1`.

///

/// Asserted without pgrep: the abandoned command must not go on to finish its

/// work, so the file it was told to create must never appear.

#[tokio::test]

async fn cancelling_a_shell_tool_call_stops_the_command_it_started() {

    let dir = tempfile::tempdir().unwrap();

    let witness = dir.path().join("the-orphan-kept-going.txt");

    let registry = HarnessToolRegistry::new(Some(dir.path().to_path_buf()));

    let call = ToolCall {

        id: "call_orphan".to_string(),

        name: "shell".to_string(),

        arguments: serde_json::json!({

            "command": format!("sleep 2 && touch '{}'", witness.display())

        }),

    };