package agent

import (
	"context"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"os/exec"
	"path/filepath"
	"runtime"
	"strings"
	"sync"
	"testing"
	"time"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/desktop/internal/agent/drivercontract"
	"github.com/tidbcloud/AgentTeam/desktop/internal/agent/runtimeconfig"
	"github.com/tidbcloud/AgentTeam/desktop/internal/consts"
	"github.com/tidbcloud/AgentTeam/desktop/internal/provider"
)

func TestPreparePiLaunchMaterializesInlineProviderAtomically(t *testing.T) {
	t.Setenv("AGENTTEAM_PI_TEST_KEY", "env-secret")
	cfg := drivercontract.LaunchConfig{
		AgentID: "pi-catalog-test", RuntimeType: runtimeconfig.TypePi,
		WorkDir: t.TempDir(), PermissionMode: "full_access", Model: "agentteam-model",
		Provider: &drivercontract.ProviderConfig{
			ID: "agentteam-inline", Name: "AgentTeam Inline", BaseURL: "https://gateway.example.test/v1",
			EnvKey: "AGENTTEAM_PI_TEST_KEY", Headers: map[string]string{"X-AgentTeam": "preserved"},
			WireAPIs: []string{provider.WireAPIResponses},
		},
	}
	prepared, err := preparePiLaunch(cfg, "session-id")
	require.NoError(t, err)
	t.Cleanup(prepared.Cleanup)

	require.NotEmpty(t, prepared.AgentDir)
	require.Equal(t, prepared.AgentDir, envValue(prepared.Env, piAgentDirEnv))
	info, err := os.Stat(prepared.AgentDir)
	require.NoError(t, err)
	require.Equal(t, os.FileMode(0o700), info.Mode().Perm())
	info, err = os.Lstat(prepared.ModelsFile)
	require.NoError(t, err)
	require.True(t, info.Mode().IsRegular())
	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())

	raw, err := os.ReadFile(prepared.ModelsFile)
	require.NoError(t, err)
	var catalog struct {
		Providers map[string]struct {
			Name    string            `json:"name"`
			BaseURL string            `json:"baseUrl"`
			API     string            `json:"api"`
			APIKey  string            `json:"apiKey"`
			Headers map[string]string `json:"headers"`
			Compat  map[string]bool   `json:"compat"`
			Models  []struct {
				ID  string `json:"id"`
				API string `json:"api"`
			} `json:"models"`
		} `json:"providers"`
	}
	require.NoError(t, json.Unmarshal(raw, &catalog))
	inline := catalog.Providers["agentteam-inline"]
	require.Equal(t, "AgentTeam Inline", inline.Name)
	require.Equal(t, "https://gateway.example.test/v1", inline.BaseURL)
	require.Equal(t, "openai-responses", inline.API)
	require.Empty(t, inline.Compat)
	require.Equal(t, "$AGENTTEAM_PI_TEST_KEY", inline.APIKey)
	require.Equal(t, map[string]string{"X-AgentTeam": "preserved"}, inline.Headers)
	require.Equal(t, "agentteam-model", inline.Models[0].ID)
	require.Equal(t, "openai-responses", inline.Models[0].API)
	require.Equal(t, "env-secret", envValue(prepared.Env, "AGENTTEAM_PI_TEST_KEY"))
}

func TestPiModelsProviderConfigAPIKeyContract(t *testing.T) {
	tests := []struct {
		name       string
		provider   *drivercontract.ProviderConfig
		wantAPIKey string
		wantErr    string
	}{
		{
			name: "env reference",
			provider: &drivercontract.ProviderConfig{
				BaseURL: "https://gateway.example.test/v1",
				EnvKey:  "AGENTTEAM_PI_TEST_KEY",
			},
			wantAPIKey: "$AGENTTEAM_PI_TEST_KEY",
		},
		{
			name: "explicit literal",
			provider: &drivercontract.ProviderConfig{
				BaseURL: "https://gateway.example.test/v1",
				APIKey:  "literal-api-key",
			},
			wantAPIKey: "literal-api-key",
		},
		{
			name: "invalid env key",
			provider: &drivercontract.ProviderConfig{
				BaseURL: "https://gateway.example.test/v1",
				EnvKey:  "AGENTTEAM-PI-TEST-KEY",
			},
			wantErr: "invalid",
		},
	}

	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			got, err := piModelsProviderConfig(test.provider, "model")
			if test.wantErr != "" {
				require.Error(t, err)
				require.Contains(t, err.Error(), test.wantErr)
				return
			}
			require.NoError(t, err)
			require.Equal(t, test.wantAPIKey, got["apiKey"])
		})
	}
}

func TestPreparePiLaunchInlineKeepsAgentLocalModelsStore(t *testing.T) {
	nativeHome := t.TempDir()
	t.Setenv("HOME", nativeHome)
	native := filepath.Join(nativeHome, ".pi", "agent")
	require.NoError(t, os.MkdirAll(native, 0o700))
	require.NoError(t, os.WriteFile(filepath.Join(native, "auth.json"), []byte(`{"native":"must-not-copy"}`), 0o600))

	stateDir := t.TempDir()
	agentHome := filepath.Join(stateDir, piAgentHomeName)
	require.NoError(t, os.MkdirAll(agentHome, 0o700))
	store := []byte(`{"cached":{"models":[{"id":"cached-model"}]}}`)
	require.NoError(t, os.WriteFile(filepath.Join(agentHome, "models-store.json"), store, 0o600))

	prepared, err := preparePiLaunch(drivercontract.LaunchConfig{
		RuntimeType: runtimeconfig.TypePi, WorkDir: t.TempDir(), RuntimeStateDir: stateDir,
		PermissionMode: "full_access", Model: "inline-model",
		Provider: &drivercontract.ProviderConfig{
			ID: "inline", BaseURL: "https://gateway.example.test", WireAPIs: []string{provider.WireAIOpenAI},
		},
	}, "session-id")
	require.NoError(t, err)
	t.Cleanup(prepared.Cleanup)
	_, err = os.Stat(filepath.Join(agentHome, "auth.json"))
	require.ErrorIs(t, err, os.ErrNotExist)
	got, err := os.ReadFile(filepath.Join(agentHome, "models-store.json"))
	require.NoError(t, err)
	require.Equal(t, store, got)
}

func TestPreparePiLaunchUsesPersistentPerAgentHomeAndInheritsRuntimeDefault(t *testing.T) {
	t.Setenv(piAgentDirEnv, "")
	home := t.TempDir()
	t.Setenv("HOME", home)
	native := filepath.Join(home, ".pi", "agent")
	require.NoError(t, os.MkdirAll(native, 0o700))
	require.NoError(t, os.WriteFile(filepath.Join(native, "settings.json"), []byte(`{"defaultProvider":"native","defaultModel":"native-model"}`), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(native, "auth.json"), []byte(`{"native":{"type":"api_key","key":"secret"}}`), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(native, "models.json"), []byte(`{"providers":{"native":{"baseUrl":"https://native.example","api":"openai-completions","models":[{"id":"native-model"}]}}}`), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(native, "models-store.json"), []byte(`{"native":{"models":[]}}`), 0o600))

	stateDir := t.TempDir()
	cfg := drivercontract.LaunchConfig{
		AgentID: "pi-persistent-home", RuntimeType: runtimeconfig.TypePi,
		WorkDir: t.TempDir(), RuntimeStateDir: stateDir, PermissionMode: "full_access",
	}
	prepared, err := preparePiLaunch(cfg, "session-id")
	require.NoError(t, err)
	t.Cleanup(prepared.Cleanup)

	wantHome := filepath.Join(stateDir, piAgentHomeName)
	require.Equal(t, wantHome, prepared.AgentDir)
	require.Equal(t, wantHome, envValue(prepared.Env, piAgentDirEnv))
	for _, name := range piRuntimeDefaultFiles {
		got, readErr := os.ReadFile(filepath.Join(wantHome, name))
		require.NoError(t, readErr, name)
		want, readErr := os.ReadFile(filepath.Join(native, name))
		require.NoError(t, readErr, name)
		require.Equal(t, want, got, name)
		info, statErr := os.Stat(filepath.Join(wantHome, name))
		require.NoError(t, statErr, name)
		require.Equal(t, os.FileMode(0o600), info.Mode().Perm(), name)
	}

	// A later launch must retain agent-local changes rather than silently
	// re-importing the user's native runtime settings.
	require.NoError(t, os.WriteFile(filepath.Join(wantHome, "settings.json"), []byte(`{"defaultProvider":"agent-local"}`), 0o600))
	preparedAgain, err := preparePiLaunch(cfg, "session-id-2")
	require.NoError(t, err)
	t.Cleanup(preparedAgain.Cleanup)
	got, err := os.ReadFile(filepath.Join(wantHome, "settings.json"))
	require.NoError(t, err)
	require.Equal(t, `{"defaultProvider":"agent-local"}`, string(got))
}

func TestPreparePiLaunchSeparatesLaunchAuxiliaryFilesFromAgentHome(t *testing.T) {
	stateDir := t.TempDir()
	prepared, err := preparePiLaunch(testLaunchConfig(drivercontract.LaunchConfig{RuntimeType: runtimeconfig.TypePi, WorkDir: t.TempDir(), RuntimeStateDir: stateDir, PermissionMode: "full_access"}, testLaunchSurfaces{BaseInstructions: "launch-only prompt"}), "session-id")
	require.NoError(t, err)
	require.NotEmpty(t, prepared.LaunchDir)
	require.NotEqual(t, prepared.AgentDir, prepared.LaunchDir)
	require.Equal(t, prepared.LaunchDir, filepath.Dir(prepared.BridgeFile))
	require.Equal(t, prepared.LaunchDir, filepath.Dir(prepared.SystemPromptFile))
	for _, path := range []string{prepared.BridgeFile, prepared.SystemPromptFile} {
		info, statErr := os.Lstat(path)
		require.NoError(t, statErr, path)
		require.True(t, info.Mode().IsRegular(), path)
		require.Equal(t, os.FileMode(0o600), info.Mode().Perm(), path)
	}
	launchDir := prepared.LaunchDir
	prepared.Cleanup()
	_, err = os.Stat(launchDir)
	require.ErrorIs(t, err, os.ErrNotExist)
	_, err = os.Stat(prepared.AgentDir)
	require.NoError(t, err)
}

func TestPreparePiLaunchWireAPIAndNativeCompatibility(t *testing.T) {
	tests := []struct{ wire, want string }{
		{provider.WireAPIResponses, "openai-responses"},
		{provider.WireAIOpenAI, "openai-completions"},
		{provider.WireAPIAnthropic, "anthropic-messages"},
	}
	for _, test := range tests {
		t.Run(test.want, func(t *testing.T) {
			prepared, err := preparePiLaunch(drivercontract.LaunchConfig{
				RuntimeType: runtimeconfig.TypePi, WorkDir: t.TempDir(), PermissionMode: "full_access", Model: "model",
				Provider: &drivercontract.ProviderConfig{ID: "inline", BaseURL: "https://gateway.example.test", WireAPIs: []string{test.wire}},
			}, "session-id")
			require.NoError(t, err)
			t.Cleanup(prepared.Cleanup)
			raw, err := os.ReadFile(prepared.ModelsFile)
			require.NoError(t, err)
			require.Contains(t, string(raw), `"`+test.want+`"`)
			if test.wire == provider.WireAIOpenAI {
				require.Contains(t, string(raw), `"supportsStore": false`)
			} else {
				require.NotContains(t, string(raw), `"supportsStore"`)
			}
		})
	}
	prepared, err := preparePiLaunch(drivercontract.LaunchConfig{
		RuntimeType: runtimeconfig.TypePi, WorkDir: t.TempDir(), PermissionMode: "full_access", Model: "native-model",
		Provider: &drivercontract.ProviderConfig{ID: "openai"},
	}, "session-id")
	require.NoError(t, err)
	t.Cleanup(prepared.Cleanup)
	require.NotEmpty(t, prepared.AgentDir)
	require.Equal(t, prepared.AgentDir, envValue(prepared.Env, piAgentDirEnv))
	require.Empty(t, prepared.ModelsFile)
}

func TestPreparePiLaunchUsesAnthropicForAgentTeamHostedMaaS(t *testing.T) {
	cfg := drivercontract.LaunchConfig{
		AgentID: "pi-hosted-test", RuntimeType: runtimeconfig.TypePi,
		WorkDir: t.TempDir(), PermissionMode: "full_access", Model: "agentteam/deepseek-v4-flash",
		Provider: &drivercontract.ProviderConfig{
			ID: "hosted-agent-id", BaseURL: "http://127.0.0.1:12345/maas/v1",
			CredentialKind: LLMCredentialKindMaaSCapability,
			WireAPIs:       []string{provider.WireAIOpenAI},
		},
	}
	prepared, err := preparePiLaunch(cfg, "session-id")
	require.NoError(t, err)
	t.Cleanup(prepared.Cleanup)

	raw, err := os.ReadFile(prepared.ModelsFile)
	require.NoError(t, err)
	var catalog struct {
		Providers map[string]struct {
			BaseURL string         `json:"baseUrl"`
			API     string         `json:"api"`
			Compat  map[string]any `json:"compat"`
			Models  []struct {
				ID        string         `json:"id"`
				API       string         `json:"api"`
				Reasoning bool           `json:"reasoning"`
				Compat    map[string]any `json:"compat"`
			} `json:"models"`
		} `json:"providers"`
	}
	require.NoError(t, json.Unmarshal(raw, &catalog))
	hosted, ok := catalog.Providers["hosted-agent-id"]
	require.True(t, ok)
	require.Equal(t, "http://127.0.0.1:12345/maas", hosted.BaseURL)
	require.Equal(t, "anthropic-messages", hosted.API)
	require.Empty(t, hosted.Compat)
	require.Len(t, hosted.Models, 1)
	require.Equal(t, "agentteam/deepseek-v4-flash", hosted.Models[0].ID)
	require.Equal(t, "anthropic-messages", hosted.Models[0].API)
	require.True(t, hosted.Models[0].Reasoning)
	require.Empty(t, hosted.Models[0].Compat)
	require.Contains(t, prepared.Args, "hosted-agent-id")
	require.NotContains(t, prepared.Args, "deepseek")
}

func TestPreparePiLaunchRejectsUnknownOrConflictingWireAPI(t *testing.T) {
	for name, wireAPIs := range map[string][]string{
		"unknown":     {"not-a-pi-api"},
		"conflicting": {provider.WireAIOpenAI, provider.WireAPIAnthropic},
	} {
		t.Run(name, func(t *testing.T) {
			_, err := preparePiLaunch(drivercontract.LaunchConfig{
				RuntimeType: runtimeconfig.TypePi, WorkDir: t.TempDir(),
				RuntimeStateDir: t.TempDir(), PermissionMode: "full_access", Model: "model",
				Provider: &drivercontract.ProviderConfig{
					ID: "inline", BaseURL: "https://gateway.example.test", WireAPIs: wireAPIs,
				},
			}, "session-id")
			require.Error(t, err)
			require.Contains(t, err.Error(), "wire API")
		})
	}
}

func TestPreparePiLaunchRejectsSymlinkedPersistentHome(t *testing.T) {
	workDir := t.TempDir()
	stateDir := t.TempDir()
	target := filepath.Join(t.TempDir(), "redirect")
	require.NoError(t, os.Mkdir(target, 0o700))
	require.NoError(t, os.Symlink(target, filepath.Join(stateDir, piAgentHomeName)))
	_, err := preparePiLaunch(drivercontract.LaunchConfig{
		RuntimeType: runtimeconfig.TypePi, WorkDir: workDir, RuntimeStateDir: stateDir, PermissionMode: "full_access", Model: "model",
		Provider: &drivercontract.ProviderConfig{ID: "inline", BaseURL: "https://gateway.example.test"},
	}, "session-id")
	require.Error(t, err)
	require.Contains(t, strings.ToLower(err.Error()), "safe directory")
}

func TestPreparePiLaunchPreservesWorkDirPermissions(t *testing.T) {
	for _, mode := range []os.FileMode{0o700, 0o750} {
		t.Run(mode.String(), func(t *testing.T) {
			workDir := filepath.Join(t.TempDir(), "work")
			require.NoError(t, os.Mkdir(workDir, mode))
			before, err := os.Stat(workDir)
			require.NoError(t, err)
			prepared, err := preparePiLaunch(drivercontract.LaunchConfig{
				RuntimeType: runtimeconfig.TypePi, WorkDir: workDir, PermissionMode: "full_access",
			}, "session-id")
			require.NoError(t, err)
			prepared.Cleanup()
			after, err := os.Stat(workDir)
			require.NoError(t, err)
			require.Equal(t, before.Mode().Perm(), after.Mode().Perm())
		})
	}
}

func TestPreparePiLaunchAllowsSymlinkedWorkDirAncestor(t *testing.T) {
	realRoot := t.TempDir()
	linkRoot := filepath.Join(t.TempDir(), "link")
	require.NoError(t, os.Symlink(realRoot, linkRoot))
	workDir := filepath.Join(linkRoot, "work")
	prepared, err := preparePiLaunch(drivercontract.LaunchConfig{
		RuntimeType: runtimeconfig.TypePi, WorkDir: workDir, PermissionMode: "full_access",
	}, "session-id")
	require.NoError(t, err)
	prepared.Cleanup()
	_, err = os.Stat(filepath.Join(realRoot, "work"))
	require.NoError(t, err)
}

func TestWritePiModelsAtomicRejectsSymlinkAndNonRegularTarget(t *testing.T) {
	dir := t.TempDir()
	target := filepath.Join(dir, "target.json")
	require.NoError(t, os.WriteFile(target, []byte(`{"old":true}`), 0o600))
	symlink := filepath.Join(dir, "models-symlink.json")
	require.NoError(t, os.Symlink(target, symlink))
	require.Error(t, writePiModelsAtomic(symlink, []byte(`{"new":true}`)))

	nonRegular := filepath.Join(dir, "models-dir")
	require.NoError(t, os.Mkdir(nonRegular, 0o700))
	require.Error(t, writePiModelsAtomic(nonRegular, []byte(`{"new":true}`)))
}

func TestPiInitialPromptUsesCompilerOwnedModeSelectionAndFallback(t *testing.T) {
	cases := []struct {
		name     string
		surfaces testLaunchSurfaces
		resumed  bool
		want     string
	}{
		{name: "fresh", surfaces: testLaunchSurfaces{Prompt: "canonical", FreshPrompt: "fresh", ResumePrompt: "resume"}, want: "fresh"},
		{name: "resume", surfaces: testLaunchSurfaces{Prompt: "canonical", FreshPrompt: "fresh", ResumePrompt: "resume"}, resumed: true, want: "resume"},
		{name: "fresh prompt fallback", surfaces: testLaunchSurfaces{Prompt: "canonical", ResumePrompt: "resume"}, want: "canonical"},
		{name: "resume prompt fallback", surfaces: testLaunchSurfaces{Prompt: "canonical", FreshPrompt: "fresh"}, resumed: true, want: "canonical"},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			cfg := testLaunchConfig(drivercontract.LaunchConfig{RuntimeType: runtimeconfig.TypePi}, tc.surfaces)
			require.Equal(t, tc.want, piInitialPrompt(cfg, tc.resumed))
		})
	}
}

func TestPiInstalledRPCUsesInlineProviderAndPersistsSession(t *testing.T) {
	binary, err := exec.LookPath("pi")
	if err != nil {
		t.Skip("pi is not installed")
	}
	var (
		requestMu sync.Mutex
		requests  []struct {
			Authorization   string
			AgentTeamHeader string
			Body            []byte
		}
	)
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, readErr := io.ReadAll(r.Body)
		require.NoError(t, readErr)
		requestMu.Lock()
		requests = append(requests, struct {
			Authorization   string
			AgentTeamHeader string
			Body            []byte
		}{
			Authorization:   r.Header.Get("Authorization"),
			AgentTeamHeader: r.Header.Get("X-AgentTeam"),
			Body:            body,
		})
		requestMu.Unlock()
		w.Header().Set("Content-Type", "text/event-stream")
		w.Header().Set("Cache-Control", "no-cache")
		_, _ = io.WriteString(w, "data: {\"id\":\"local-1\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{\"role\":\"assistant\",\"content\":\"local-ok\"},\"finish_reason\":null}]}\n\n")
		_, _ = io.WriteString(w, "data: {\"id\":\"local-1\",\"object\":\"chat.completion.chunk\",\"choices\":[{\"index\":0,\"delta\":{},\"finish_reason\":\"stop\"}]}\n\n")
		_, _ = io.WriteString(w, "data: [DONE]\n\n")
		if flusher, ok := w.(http.Flusher); ok {
			flusher.Flush()
		}
	}))
	defer server.Close()

	cfg := testLaunchConfig(drivercontract.LaunchConfig{AgentID: "pi-real-local", RuntimeType: runtimeconfig.TypePi, Binary: binary, WorkDir: t.TempDir(), RuntimeStateDir: t.TempDir(), PermissionMode: "full_access", Model: "local-model", DisableNativeTools: true, Provider: &drivercontract.ProviderConfig{
		ID: "agentteam-local-http", BaseURL: server.URL, APIKey: "local-secret",
		Headers:  map[string]string{"X-AgentTeam": "fixture"},
		WireAPIs: []string{provider.WireAIOpenAI},
	}}, testLaunchSurfaces{FreshPrompt: "local prompt"})
	driver := &PiRPCDriver{}
	result, err := driver.Spawn(context.Background(), cfg)
	if err != nil {
		t.Skipf("installed pi RPC fixture unavailable: %v", err)
	}
	defer result.Cleanup()
	events := collectPiEvents(t, result, consts.ParsedEventKindRuntimeIdle)
	var text string
	for _, event := range events {
		text += event.text
	}
	require.Contains(t, text, "local-ok")

	require.Eventually(t, func() bool {
		requestMu.Lock()
		defer requestMu.Unlock()
		return len(requests) == 1
	}, 5*time.Second, 10*time.Millisecond)
	requestMu.Lock()
	request := requests[0]
	requestMu.Unlock()
	require.Equal(t, "Bearer local-secret", request.Authorization)
	require.Equal(t, "fixture", request.AgentTeamHeader)
	require.Contains(t, string(request.Body), `"model":"local-model"`)
	require.NotContains(t, string(request.Body), `"store"`)
	require.Contains(t, string(request.Body), "local prompt")

	require.Eventually(t, func() bool {
		matches, globErr := filepath.Glob(filepath.Join(cfg.RuntimeStateDir, ".pi-sessions", "*_"+result.SessionID+".jsonl"))
		return globErr == nil && len(matches) == 1
	}, 5*time.Second, 10*time.Millisecond)
	matches, err := filepath.Glob(filepath.Join(cfg.RuntimeStateDir, ".pi-sessions", "*_"+result.SessionID+".jsonl"))
	require.NoError(t, err)
	require.Len(t, matches, 1)
	session, err := os.ReadFile(matches[0])
	require.NoError(t, err)
	require.Contains(t, string(session), "local prompt")
	require.Contains(t, string(session), "local-ok")
}

func writeFakePiPreRPCFailureBinary(t *testing.T, stderr string) string {
	t.Helper()
	dir := t.TempDir()
	bin := filepath.Join(dir, "pi")
	if runtime.GOOS == "windows" {
		bin += ".cmd"
		script := fmt.Sprintf("@echo off\r\necho %s 1>&2\r\nexit /b 1\r\n", stderr)
		require.NoError(t, os.WriteFile(bin, []byte(script), 0o755))
		return bin
	}
	script := fmt.Sprintf("#!/bin/sh\nprintf '%%s\\n' %s >&2\nexit 1\n", testShellQuote(stderr))
	require.NoError(t, os.WriteFile(bin, []byte(script), 0o755))
	return bin
}

func TestPiRPCSpawnInitialPromptFailurePreservesStderrCatalogRootCause(t *testing.T) {
	binary := writeFakePiPreRPCFailureBinary(t, `Error: Unknown provider "inline"`)
	cfg := piTestConfig(t, binary)
	setTestLaunchSurface(&cfg, "FreshPrompt", "start")

	result, err := (&PiRPCDriver{}).Spawn(t.Context(), cfg)
	require.Error(t, err)
	require.Nil(t, result.Cmd)
	require.Contains(t, err.Error(), "initial RPC prompt")
	require.Contains(t, err.Error(), "pi RPC transport closed")
	require.Contains(t, err.Error(), `Unknown provider "inline"`)
	require.True(t, IsDeterministicRuntimeStartupError(err))
}

func TestPiRPCSpawnInitialPromptFailureKeepsTransientStderrNonDeterministic(t *testing.T) {
	binary := writeFakePiPreRPCFailureBinary(t, "temporary network setup failure")
	cfg := piTestConfig(t, binary)
	setTestLaunchSurface(&cfg, "FreshPrompt", "start")

	result, err := (&PiRPCDriver{}).Spawn(t.Context(), cfg)
	require.Error(t, err)
	require.Nil(t, result.Cmd)
	require.Contains(t, err.Error(), "initial RPC prompt")
	require.Contains(t, err.Error(), "temporary network setup failure")
	require.False(t, IsDeterministicRuntimeStartupError(err))
}

func envValue(env []string, key string) string {
	prefix := key + "="
	for _, entry := range env {
		if strings.HasPrefix(entry, prefix) {
			return strings.TrimPrefix(entry, prefix)
		}
	}
	return ""
}