#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)"
CHECK="${SCRIPT_DIR}/check-no-isolated-execution.sh"
FIXTURE="$(mktemp -d)"
trap 'rm -rf "${FIXTURE}"' EXIT

git -C "${FIXTURE}" init -q
mkdir -p "${FIXTURE}/guardrails/desktop"
cp "${CHECK}" "${FIXTURE}/guardrails/desktop/check-no-isolated-execution.sh"
chmod +x "${FIXTURE}/guardrails/desktop/check-no-isolated-execution.sh"
git -C "${FIXTURE}" add guardrails/desktop/check-no-isolated-execution.sh

run_check() {
  AGENTTEAM_NO_ISOLATED_EXECUTION_ROOT="${FIXTURE}" "${CHECK}"
}

run_check >/dev/null

iso="isolated"
exec_word="execution"
worker_word="worker"

mkdir -p \
  "${FIXTURE}/allowed" \
  "${FIXTURE}/internal/tidb/migrations" \
  "${FIXTURE}/src"

cat >"${FIXTURE}/allowed/ordinary.txt" <<'EOF'
Task execution
Workflow execution
generic Exec CLI token
PowerShell -ExecutionPolicy Bypass
CSS isolation: isolate
compilerOptions.isolatedModules
ordinary runtime recovery and trajectory
KIMI_SHARE_DIR DisableNativeTools private share recovery
EOF
printf 'ALTER TABLE agents DROP COLUMN %s_%s_mode;\n' \
  "${iso}" "${exec_word}" \
  >"${FIXTURE}/internal/tidb/migrations/00175_execution_policy_contract.sql"
printf 'ALTER TABLE agents ADD COLUMN mcp_tools_enabled BOOL;\n' \
  >"${FIXTURE}/internal/tidb/migrations/00204_agent_tool_switches.sql"
git -C "${FIXTURE}" add allowed/ordinary.txt \
  internal/tidb/migrations/00175_execution_policy_contract.sql \
  internal/tidb/migrations/00204_agent_tool_switches.sql
run_check >/dev/null

# Untracked files are deliberately outside the source contract.
printf '%s %s\n' "${iso}" "${exec_word}" >"${FIXTURE}/src/untracked.go"
run_check >/dev/null
rm "${FIXTURE}/src/untracked.go"

# A tracked file intentionally deleted from the worktree is no longer part of
# the source contract and must not make the scanner fail before the deletion is
# committed.
printf '%s %s\n' "${iso}" "${exec_word}" >"${FIXTURE}/src/deleted.go"
git -C "${FIXTURE}" add src/deleted.go
rm "${FIXTURE}/src/deleted.go"
run_check >/dev/null
git -C "${FIXTURE}" rm -q --cached src/deleted.go

expect_rejected() {
  local relative="$1"
  local expected_rule="$2"
  if output="$(run_check 2>&1)"; then
    echo "expected guardrail rejection for ${relative}" >&2
    exit 1
  fi
  grep -F "${expected_rule}: ${relative}" <<<"${output}" >/dev/null || {
    echo "missing ${expected_rule} diagnostic for ${relative}: ${output}" >&2
    exit 1
  }
}

printf '%s %s is retired\n' "${iso}" "${exec_word}" >"${FIXTURE}/src/feature.md"
git -C "${FIXTURE}" add src/feature.md
expect_rejected "src/feature.md" "retired-phrase"
git -C "${FIXTURE}" rm -q -f src/feature.md

mkdir -p "${FIXTURE}/src"
printf '%s_%s\n' "${exec_word}" "${worker_word}" >"${FIXTURE}/src/scope.go"
git -C "${FIXTURE}" add src/scope.go
expect_rejected "src/scope.go" "retired-worker-scope"
git -C "${FIXTURE}" rm -q -f src/scope.go

mkdir -p "${FIXTURE}/src"
printf 'Supports%s%s\n' "Isolated" "Execution" >"${FIXTURE}/src/capability.go"
git -C "${FIXTURE}" add src/capability.go
expect_rejected "src/capability.go" "retired-runtime-capability"
git -C "${FIXTURE}" rm -q -f src/capability.go

mkdir -p "${FIXTURE}/src"
printf '"%s_start"\n' "${exec_word}" >"${FIXTURE}/src/tool.go"
git -C "${FIXTURE}" add src/tool.go
expect_rejected "src/tool.go" "retired-lifecycle-tool"
git -C "${FIXTURE}" rm -q -f src/tool.go

mkdir -p "${FIXTURE}/src"
printf 'type ToolAccessSettings struct{}\n' >"${FIXTURE}/src/tool_switch.go"
git -C "${FIXTURE}" add src/tool_switch.go
expect_rejected "src/tool_switch.go" "retired-tool-switch"
git -C "${FIXTURE}" rm -q -f src/tool_switch.go

mkdir -p "${FIXTURE}/src"
printf 'filepath.Join(root, "executions")\n' >"${FIXTURE}/src/workdir.go"
git -C "${FIXTURE}" add src/workdir.go
expect_rejected "src/workdir.go" "retired-execution-workdir"
git -C "${FIXTURE}" rm -q -f src/workdir.go

# An exact path allowance grants only its necessary rule, not every retired
# token and not a future migration filename.
printf '%s_%s_mode\n"%s_start"\n' "${iso}" "${exec_word}" "${exec_word}" \
  >"${FIXTURE}/internal/tidb/migrations/00175_execution_policy_contract.sql"
expect_rejected \
  "internal/tidb/migrations/00175_execution_policy_contract.sql" \
  "retired-lifecycle-tool"
printf 'ALTER TABLE agents DROP COLUMN %s_%s_mode;\n' \
  "${iso}" "${exec_word}" \
  >"${FIXTURE}/internal/tidb/migrations/00175_execution_policy_contract.sql"

printf 'DROP COLUMN %s_%s_mode;\n' "${iso}" "${exec_word}" \
  >"${FIXTURE}/internal/tidb/migrations/00313_future.sql"
git -C "${FIXTURE}" add internal/tidb/migrations/00313_future.sql
expect_rejected \
  "internal/tidb/migrations/00313_future.sql" \
  "retired-identifier"

echo "Retired execution and tool-switch surface guardrail tests passed."