/// Lifted out of the dispatch so `--export` is written here too. It used to be

/// read only by the full-screen session, which meant a headless run that asked

/// for a transcript got none and was told nothing.

///

/// A missing prompt is a missing input, not a licence to invent one. This

/// substituted the literal `Analyze workspace and run tests`, opened a thread,

/// and spent the grant on an instruction nobody gave — one screen above

/// [`run_offline_coder`], which refuses the identical omission by name. The

/// same input is now handled the same way on both paths.

async fn run_headless_coder(

    coder: CoderArgs,

    api_base: &str,

    repository: Option<String>,

    resumed: Option<crate::resume::Resumption>,

) -> Result<(), Box<dyn std::error::Error>> {

    let prompt = coder

    let Some(prompt) = coder

        .prompt

        .clone()

        .unwrap_or_else(|| "Analyze workspace and run tests".to_string());

        .as_deref()

        .map(str::trim)

        .filter(|p| !p.is_empty())

        .map(str::to_string)

    else {

        fail(

            "--headless runs one prompt and exits. Give it one: \

             `oa coder --headless \"<prompt>\"`",

        );

    };

    println!("Executing coder prompt headlessly: {}", prompt);

    let lane_name = coder.lane_name().unwrap_or_else(|reason| fail(&reason));

    // A headless session may start children. They run on the same lane and the

            "`name` (lowercase identifier, it becomes the tool name)",

        ));

    }

    // The manifest name *is* the tool name, and the session's own tools are

    // dispatched before any plugin. A plugin under one of those names would be

    // declared to the model and then permanently unreachable, which is worse

    // than one that failed to install: the model is told a capability exists

    // and every call to it lands on the builtin. Refused here, so it reaches

    // neither the catalog nor a load.

    if crate::tools::BUILTIN_TOOL_NAMES.contains(&name) {

        return Err(refuse(

            "name_reserved",

            format!(

                "the manifest is named `{name}`, which is a built-in tool of this session. \

                 The builtin answers first, so the plugin could never run. Rename it; \

                 the reserved names are {}",

                crate::tools::BUILTIN_TOOL_NAMES.join(", ")

            ),

        ));

    }

    let version = record.get("version").and_then(|v| v.as_str()).unwrap_or("");

    if version.is_empty() {

        return Err(bad("`version`"));

        );

    }

    /// Every name the session dispatches itself is refused, and the refusal

    /// says which one it collided with.

    ///

    /// The manifest is otherwise valid, so a host without this check installs

    /// it, declares its tool, and routes every call to the builtin instead.

    #[test]

    fn a_plugin_named_after_a_builtin_tool_is_refused_by_name() {

        for reserved in crate::tools::BUILTIN_TOOL_NAMES {

            let mut value = manifest_json(serde_json::json!([]), serde_json::json!([]));

            value["name"] = serde_json::json!(reserved);

            let refusal = validate_manifest(&value).unwrap_err();

            assert_eq!(refusal.code, "name_reserved", "`{reserved}`: {refusal}");

            assert!(

                refusal.reason.contains(reserved),

                "the refusal did not name the collision: {}",

                refusal.reason

            );

        }

        // A name that collides with nothing still loads, so the check is a

        // reservation and not a ban on plugins.

        assert_eq!(

            validate_manifest(&manifest_json(serde_json::json!([]), serde_json::json!([])))

                .unwrap()

                .name,

            "probe_plugin"

        );

    }

    /// A colliding manifest never reaches the catalog either, so nothing can

    /// ask for it by name and no tool is declared for it.

    #[test]

    fn a_colliding_manifest_is_left_out_of_the_catalog() {

        let root = tempfile::tempdir().unwrap();

        let plugins = root.path().join("plugins");

        for name in ["shell", "word_count"] {

            let dir = plugins.join(name);

            std::fs::create_dir_all(&dir).unwrap();

            let mut value = manifest_json(serde_json::json!([]), serde_json::json!([]));

            value["name"] = serde_json::json!(name);

            std::fs::write(

                dir.join("manifest.json"),

                serde_json::to_vec_pretty(&value).unwrap(),

            )

            .unwrap();

        }

        let names: Vec<String> = discover_catalog(root.path())

            .into_iter()

            .map(|entry| entry.name)

            .collect();

        assert_eq!(

            names,

            vec!["word_count"],

            "a plugin named after a builtin reached the catalog"

        );

    }

    #[test]

    fn an_unknown_abi_is_refused_by_name() {

        let mut value = manifest_json(serde_json::json!([]), serde_json::json!([]));

pub const OUTPUT_LIMIT: usize = 30_000;

/// The names [`HarnessToolRegistry::execute_tool`] answers itself.

///

/// A loaded plugin is dispatched from the fallthrough arm, *below* all five of

/// these, so a plugin carrying one of these names would be declared to the

/// model and never reached: the builtin answers first, every time. That is why

/// [`crate::plugins::validate_manifest`] refuses such a manifest by name

/// rather than installing a capability nothing can call.

///

/// `delegate` is on the list even though it is declared only where a

/// delegation gate exists, because its match arm is unconditional — a gateless

/// session answers it with a refusal, which shadows a plugin just as

/// completely. `every_declared_tool_has_an_arm_that_answers_it` keeps this

/// list and the arms in step.

pub const BUILTIN_TOOL_NAMES: [&str; 5] =

    ["shell", "skill", "openagents", "capability", "delegate"];

/// The largest index at or below `max` that is a character boundary in `text`.

///

/// Slicing a `String` by a byte index panics when the index lands inside a

            names,

            vec!["shell", "skill", "openagents", "capability", "delegate"]

        );

        // The same five names `plugins::validate_manifest` refuses a plugin

        // for taking. An arm added here and not there would leave a name a

        // plugin can claim and never be called under.

        assert_eq!(

            names,

            BUILTIN_TOOL_NAMES.to_vec(),

            "the reserved list and the arms disagree"

        );

        let runtime = tokio::runtime::Runtime::new().unwrap();

        for name in &names {

    );

}

// -------------------------------------------- `--headless` with no prompt

/// A headless run with no prompt refuses, and opens no thread.

///

/// It used to substitute the literal `Analyze workspace and run tests`, open a

/// thread, and spend the grant on an instruction nobody gave — one screen

/// below where `--offline` refuses the identical omission by name. The exit

/// code alone does not catch that: an invented turn can fail afterwards and

/// exit non-zero too. What catches it is the server, which is never asked to

/// open anything.

#[test]

fn headless_without_a_prompt_refuses_and_opens_no_thread() {

    let server = RouteServer::start(coder_routes);

    let origin = server.origin();

    let base = origin.as_str();

    for bare in [

        vec!["--api-url", base, "coder", "--headless"],

        // Whitespace is not a prompt either; it is the same omission with a

        // space in it.

        vec!["--api-url", base, "coder", "--headless", "   "],

    ] {

        let run = oa_env(&bare, &[("OPENAGENTS_TOKEN", "t")]);

        // Asserted first, because it is the assertion that carries the test:

        // an invented prompt that opens a thread and then fails would satisfy

        // an exit code and nothing else.

        let paths: Vec<String> = server.hits().into_iter().map(|hit| hit.path).collect();

        assert!(

            !paths.iter().any(|p| p == "/api/v1/threads"),

            "{bare:?} still opened a thread: {paths:?}"

        );

        assert!(

            !run.stdout.contains("Analyze workspace"),

            "a prompt nobody gave was run anyway: {}",

            run.stdout

        );

        assert_eq!(run.status, Some(2), "{bare:?} stdout: {}", run.stdout);

        assert!(

            run.stderr.contains("--headless") && run.stderr.contains("<prompt>"),

            "the refusal did not say what is missing or how to give it: {}",

            run.stderr

        );

    }

    // The control, on the same fixture: with a prompt it does open one. Without

    // this the assertion above would also pass against a binary that could not

    // reach the server at all.

    let given = oa_env(

        &["--api-url", &origin, "coder", "--headless", "hello"],

        &[("OPENAGENTS_TOKEN", "t")],

    );

    assert_eq!(given.status, Some(0), "stderr: {}", given.stderr);

    let paths: Vec<String> = server.hits().into_iter().map(|hit| hit.path).collect();

    assert!(

        paths.iter().any(|p| p == "/api/v1/threads"),

        "the fixture never opens a thread, so the test proves nothing: {paths:?}"

    );

}

/// The same omission, refused the same way on both coder paths.

///

/// This is the defect stated as a property: `--offline` and `--headless` were

/// two arms of one function handling one missing input two opposite ways, and

/// the reader who forgot the prompt got a refusal or an invented instruction

/// depending on which arm they were in.

#[test]

fn a_missing_prompt_is_refused_the_same_way_offline_and_headless() {

    let dead = "http://127.0.0.1:1";

    let offline = oa_env(

        &["--api-url", dead, "coder", "--offline"],

        &[("OPENAGENTS_TOKEN", "t")],

    );

    let headless = oa_env(

        &["--api-url", dead, "coder", "--headless"],

        &[("OPENAGENTS_TOKEN", "t")],

    );

    assert_eq!(offline.status, Some(2), "stdout: {}", offline.stdout);

    assert_eq!(

        headless.status,

        Some(2),

        "the headless path accepted a missing prompt: {} {}",

        headless.stdout,

        headless.stderr

    );

    for run in [&offline, &headless] {

        assert!(

            run.stderr.contains("<prompt>"),

            "the refusal did not show the form that works: {}",

            run.stderr

        );

    }

}

// ----------------------------------------------------------------- `--model`

/// `--model` decides the id sent at thread open; without it the default lane's

use openagents_cli::plugins::{

    invoke, load_plugin, Approval, CatalogEntry, Mount, MOUNT_FILE_LIMIT,

};

use openagents_cli::tools::{HarnessToolRegistry, ToolCall};

use sha2::{Digest, Sha256};

/// Bump-allocating `packet-v0` scaffolding every fixture shares.

    .is_ok());

}

// ──────────────────────────────────────── a name the session already answers

/// A valid, digest-pinned, pure-compute guest that loads and does nothing.

///

/// The collision test needs a plugin that would otherwise install cleanly, so

/// the only thing between it and the model's tool list is the reserved-name

/// check.

fn inert_guest() -> Vec<u8> {

    wasm(&format!(

        r#"(module (memory (export "memory") 1) {PREAMBLE}

             (func (export "handle_packet") (param i32 i32) (result i64) (i64.const 0)))"#

    ))

}

fn call(name: &str, arguments: serde_json::Value) -> ToolCall {

    ToolCall {

        id: "1".to_string(),

        name: name.to_string(),

        arguments,

    }

}

/// A plugin named after a builtin is refused at install, so the declared tool

/// list never carries a name the session would answer for itself.

///

/// The two plugins below are the same fixture under two names. `word_count`

/// is the control: it installs, it is declared, and it dispatches to the

/// plugin. `shell` is the collision — a builtin match arm wins before the

/// plugin lookup, so a host that installed it would declare a tool the model

/// could never reach. The list assertion is exact, which is what catches the

/// duplicate: a host without the check declares `shell` twice.

#[tokio::test]

async fn a_plugin_named_after_a_builtin_is_never_declared_and_every_declared_tool_answers() {

    let dir = tempfile::tempdir().unwrap();

    let artifact = inert_guest();

    for name in ["shell", "word_count"] {

        let home = dir.path().join("plugins").join(name);

        std::fs::create_dir_all(&home).unwrap();

        plant(&home, name, &artifact, serde_json::json!([]), 2000, 16);

    }

    let registry = HarnessToolRegistry::new(Some(dir.path().to_path_buf()));

    let installed: Vec<&str> = registry

        .catalog

        .iter()

        .map(|entry| entry.name.as_str())

        .collect();

    assert_eq!(

        installed,

        vec!["word_count"],

        "a plugin named after a builtin reached the catalog"

    );

    // Asked for by exact name: the free name loads, the taken one is not

    // there to load, and the model is told so rather than left with a tool

    // that answers from somewhere else.

    let taken = registry

        .execute_tool(&call("capability", serde_json::json!({"name": "shell"})))

        .await;

    assert!(

        taken.is_error,

        "`shell` was loaded as a plugin: {}",

        taken.output

    );

    let free = registry

        .execute_tool(&call(

            "capability",

            serde_json::json!({"name": "word_count"}),

        ))

        .await;

    assert!(

        !free.is_error,

        "the control plugin did not load: {}",

        free.output

    );

    // This registry has no delegation gate, so `delegate` is not declared.

    let names: Vec<String> = registry.list_tools().into_iter().map(|t| t.name).collect();

    assert_eq!(

        names,

        vec!["shell", "skill", "openagents", "capability", "word_count"],

        "the declared list is not the set of tools that can be called"

    );

    // And every name on it reaches an implementation. `word_count` is the one

    // that matters here: it is the plugin, dispatched from the arm below all

    // the builtins, which is the arm a collision would have hidden it behind.

    for name in &names {

        if name == "openagents" {

            // Shelling out to another CLI is not this test's business.

            continue;

        }

        let out = registry

            .execute_tool(&call(name, serde_json::json!({})))

            .await;

        assert!(

            !out.output.starts_with("Unknown tool:"),

            "`{name}` is declared and unanswered: {}",

            out.output

        );

    }

}

// ─────────────────────────────────────────────────── what actually ships

#[test]