package pi

import (
	"context"
	"strings"
	"testing"
)

func TestDoctorRequiresExternalEndpointAuthPiStateAndHealth(t *testing.T) {
	fake := newFakeRunner()
	if err := Doctor(context.Background(), fake); err != nil {
		t.Fatalf("Doctor() error = %v", err)
	}
	for _, command := range []string{"pi --version", "test -w /home/thoth/.pi", "test -r /home/thoth/.pi/agent/auth.json", "/health"} {
		assertCalled(t, fake.calls, command)
	}
}

func TestTestUsesOnlySanitizedPiAndCoreProbes(t *testing.T) {
	fake := newFakeRunner()
	if err := Test(context.Background(), fake); err != nil {
		t.Fatalf("Test() error = %v", err)
	}
	for _, command := range []string{"pi --version", "/health", "/models", "/settings"} {
		assertCalled(t, fake.calls, command)
	}
	if got := strings.Join(fake.calls, "\n"); strings.Contains(got, "secret") {
		t.Fatalf("probe commands expose secret: %s", got)
	}
}