import { test, expect } from "vitest";
import { spawn as nodeSpawn } from "node:child_process";
import path from "node:path";
import os from "node:os";
import { chmodSync, unlinkSync, writeFileSync } from "node:fs";
import { buildApp } from "../src/app.js";
import { loadConfig } from "../src/config.js";
import { SseHub } from "../src/sse/sse-hub.js";

const FAKE = path.resolve("../harness/tests/fake_pi/fake_pi_rpc.mjs");
const SCRIPT = path.resolve("../harness/tests/fake_pi/scripts/f1_disambiguation.json");

function mutApp(thtRunner: any) {
  return buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: { ollamaEnsure: async () => ({ ok: true }), ...thtRunner },
    getSettings: () => ({ workspace: "w" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
}

function deferred<T = void>() {
  let resolve!: (value: T | PromiseLike<T>) => void;
  let reject!: (reason?: unknown) => void;
  const promise = new Promise<T>((onResolve, onReject) => {
    resolve = onResolve;
    reject = onReject;
  });
  return { promise, resolve, reject };
}

const aliceHeaders = {
  "x-thoth-principal-issuer": "portal",
  "x-thoth-principal-subject": "alice",
  "x-thoth-principal-display-name": "Alice",
  "x-thoth-is-admin": "0",
};

test("upstream requests without a principal fail before a Pi runtime can be created", async () => {
  let created = false;
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    mgr: { createFor: () => { created = true; throw new Error("must not spawn"); } } as any,
    thtRunner: {} as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });

  expect(response.statusCode).toBe(401);
  expect(created).toBe(false);
});

test("session routes conceal foreign or missing sessions and deny SSE before it subscribes", async () => {
  let subscribed = false;
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      withPrincipal: () => ({ sessionShow: async () => null }),
    } as any,
    hub: { subscribe: () => { subscribed = true; return () => {}; } } as any,
  });

  const document = await app.inject({ method: "GET", url: "/sessions/foreign/documents", headers: aliceHeaders });
  const events = await app.inject({ method: "GET", url: "/sessions/foreign/events", headers: aliceHeaders });

  expect(document.statusCode).toBe(404);
  expect(events.statusCode).toBe(404);
  expect(subscribed).toBe(false);
});

test("session listing permits all scope only to admins", async () => {
  const seen: boolean[] = [];
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      withPrincipal: (principal: any) => ({
        sessionList: async () => { seen.push(principal.isAdmin); return [{ id: "s1" }]; },
      }),
    } as any,
  });
  const regularAll = await app.inject({ method: "GET", url: "/sessions?scope=all", headers: aliceHeaders });
  const mine = await app.inject({ method: "GET", url: "/sessions?scope=mine", headers: aliceHeaders });
  const adminAll = await app.inject({
    method: "GET", url: "/sessions?scope=all",
    headers: { ...aliceHeaders, "x-thoth-is-admin": "1" },
  });

  expect(regularAll.statusCode).toBe(403);
  expect(mine.statusCode).toBe(200);
  expect(adminAll.statusCode).toBe(200);
  expect(seen).toEqual([false, true]);
});

test("A, B, and admin requests preserve owner isolation through session route mutations", async () => {
  const owners = new Map([["a", "alice"], ["b", "bob"]]);
  const closed: Array<{ id: string; subject: string }> = [];
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      withPrincipal: (principal: any) => ({
        sessionList: async () => [...owners]
          .filter(([, owner]) => principal.isAdmin || owner === principal.subject)
          .map(([id, owner]) => ({ id, author: owner })),
        sessionShow: async (id: string) =>
          (principal.isAdmin || owners.get(id) === principal.subject) ? { id, status: "open" } : null,
        closeSession: async (id: string) => { closed.push({ id, subject: principal.subject }); },
      }),
    } as any,
    mgr: { get: () => undefined } as any,
    hub: { clear: () => {} } as any,
    getSettings: () => ({ workspace: "w" }) as any,
  });
  const bobHeaders = { ...aliceHeaders, "x-thoth-principal-subject": "bob" };
  const adminHeaders = { ...aliceHeaders, "x-thoth-principal-subject": "admin", "x-thoth-is-admin": "1" };

  expect((await app.inject({ method: "GET", url: "/sessions", headers: aliceHeaders })).json())
    .toEqual([{ id: "a", author: "alice", active: false }]);
  expect((await app.inject({ method: "GET", url: "/sessions", headers: bobHeaders })).json())
    .toEqual([{ id: "b", author: "bob", active: false }]);
  expect((await app.inject({ method: "GET", url: "/sessions?scope=all", headers: adminHeaders })).json())
    .toEqual([{ id: "a", author: "alice", active: false }, { id: "b", author: "bob", active: false }]);

  expect((await app.inject({ method: "POST", url: "/sessions/a/close", headers: bobHeaders })).statusCode)
    .toBe(404);
  expect((await app.inject({ method: "POST", url: "/sessions/a/close", headers: adminHeaders })).statusCode)
    .toBe(200);
  expect(closed).toEqual([{ id: "a", subject: "admin" }]);
});

test("new sessions are created through the authenticated principal, not a client owner field", async () => {
  let principal: any;
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      withPrincipal: (p: any) => {
        principal = p;
        return { sessionNew: async () => ({ id: "owned" }), searchPack: async () => {} };
      },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    mgr: {
      createFor: () => ({ bridge: { onClientEvent: () => {} } }),
      configure: async () => {}, start: () => {}, get: () => undefined,
    } as any,
    getSettings: () => ({ workspace: "w" }) as any,
  });

  const response = await app.inject({
    method: "POST", url: "/sessions", headers: aliceHeaders,
    payload: { question: "q", owner: "mallory" },
  });

  expect(response.statusCode).toBe(200);
  expect(principal).toMatchObject({ issuer: "portal", subject: "alice" });
});

test("POST /sessions usa i settings (workspace/provider/model/thinking) e crea+avvia", async () => {
  const modelKey = path.join(os.tmpdir(), `thoth-model-key-${process.pid}`);
  writeFileSync(modelKey, "test-model-key", { mode: 0o600 });
  chmodSync(modelKey, 0o600);
  let sessionNewArg: any;
  let spawnArg: any;
  const app = buildApp(loadConfig({
    THT_HARNESS_DIR: "../harness", THT_MODEL_API_KEY_FILE: modelKey,
  }), {
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      searchPack: async () => {},
      sessionNew: async (o: any) => { sessionNewArg = o; return { id: "s1" }; },
      sessionList: async () => [{ id: "s1" }],
    } as any,
    getSettings: () => ({ workspace: "w", provider: "zai", model: "glm-5.2", thinking: "high" }),
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const created = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(created.json()).toEqual({ id: "s1" });
  expect(sessionNewArg.workspace).toBe("w");
  expect(sessionNewArg.provider).toBe("zai");
  expect(sessionNewArg.model).toBe("glm-5.2");
  expect(sessionNewArg.thinking).toBe("high");
  expect(sessionNewArg.question).toBe("q");
  const list = await app.inject({ method: "GET", url: "/sessions" });
  expect(list.json()).toEqual([{ id: "s1", active: expect.any(Boolean) }]);
  unlinkSync(modelKey);
});

test("POST /sessions refuses to create a session when the local DWH precheck fails", async () => {
  let sessionNewCalls = 0;
  let pinged = 0;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness", THT_DWH_PRECHECK: "1" }), {
    thtRunner: {
      dbPing: async () => { pinged += 1; return { ok: false, detail: "DWH non accessibile" }; },
      sessionNew: async () => { sessionNewCalls += 1; return { id: "s1" }; },
      searchPack: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "w" }) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.statusCode).toBe(503);
  expect(res.json()).toMatchObject({ code: "dwh_unreachable" });
  expect(pinged).toBe(1);
  expect(sessionNewCalls).toBe(0); // session must not be created
});

test("POST /sessions proceeds past a passing DWH precheck", async () => {
  let pinged = 0;
  let created = 0;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness", THT_DWH_PRECHECK: "1" }), {
    thtRunner: {
      dbPing: async () => { pinged += 1; return { ok: true, detail: "OK" }; },
      sessionNew: async () => { created += 1; return { id: "s1" }; },
      searchPack: async () => {},
      sessionList: async () => [{ id: "s1" }],
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "w" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.statusCode).toBe(200);
  expect(pinged).toBe(1);
  expect(created).toBe(1);
});

test("POST /sessions skips the DWH precheck when the flag is off (default)", async () => {
  let pinged = 0;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      dbPing: async () => { pinged += 1; return { ok: false, detail: "should never run" }; },
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      sessionList: async () => [{ id: "s1" }],
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "w" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.statusCode).toBe(200);
  expect(pinged).toBe(0); // probe never runs without the flag
});

test("POST /sessions configura Pi con il thinking globale selezionato", async () => {
  let configured: any;
  const bridge = { onClientEvent: () => {}, emitClientEvent: () => {} };
  const runtime = { bridge } as any;
  let current: any;
  const mgr = {
    get: () => current,
    createFor: () => { current = runtime; return runtime; },
    configure: async (_rt: any, options: any) => { configured = options; },
    start: () => {},
    teardownIfCurrent: (_id: string, expected: any) => {
      if (current !== expected) return false;
      current = undefined;
      return true;
    },
  } as any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr,
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      searchPack: async () => {},
      sessionNew: async () => ({ id: "s-thinking" }),
    } as any,
    getSettings: () => ({ workspace: "psd", provider: "zai", model: "glm-5.2", thinking: "high" }) as any,
  });

  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  await new Promise((resolve) => setImmediate(resolve));

  expect(configured.thinking).toBe("high");
});

test("POST /sessions/:id/resume configura Pi con il thinking persistito", async () => {
  let configured: any;
  const bridge = { onClientEvent: () => {}, emitClientEvent: () => {} };
  const runtime = { bridge } as any;
  let current: any;
  const mgr = {
    get: () => current,
    createFor: () => { current = runtime; return runtime; },
    configure: async (_rt: any, options: any) => { configured = options; },
    start: () => {},
    teardownIfCurrent: (_id: string, expected: any) => {
      if (current !== expected) return false;
      current = undefined;
      return true;
    },
  } as any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr,
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      sessionShow: async () => ({
        status: "open",
        archived: false,
        provider: "zai",
        model: "glm-5.2",
        thinking: "medium",
      }),
      reopenSession: async () => {},
    } as any,
    getSettings: () => ({ workspace: "psd", thinking: "low" }) as any,
  });

  await app.inject({ method: "POST", url: "/sessions/s-thinking/resume" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(configured.thinking).toBe("medium");
});

test("POST /sessions/:id/resume usa il thinking globale se manca nel manifest", async () => {
  let configured: any;
  const bridge = { onClientEvent: () => {}, emitClientEvent: () => {} };
  const runtime = { bridge } as any;
  let current: any;
  const mgr = {
    get: () => current,
    createFor: () => { current = runtime; return runtime; },
    configure: async (_rt: any, options: any) => { configured = options; },
    start: () => {},
    teardownIfCurrent: (_id: string, expected: any) => {
      if (current !== expected) return false;
      current = undefined;
      return true;
    },
  } as any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr,
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
    } as any,
    getSettings: () => ({ workspace: "psd", thinking: "low" }) as any,
  });

  await app.inject({ method: "POST", url: "/sessions/s-thinking/resume" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(configured.thinking).toBe("low");
});

test.each(["running", "waiting"])(
  "POST resume preserves a %s runtime",
  async (state) => {
    let tornDown = false;
    let cleared = false;
    const existing = { bridge: { turnState: () => state } } as any;
    const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
      mgr: {
        get: () => existing,
        teardown: () => { tornDown = true; },
      } as any,
      hub: { clear: () => { cleared = true; } } as any,
      thtRunner: {} as any,
      getSettings: () => ({ workspace: "psd" }) as any,
    });
    const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
    expect(response.json()).toEqual({ id: "s1", alreadyActive: true });
    expect(tornDown).toBe(false);
    expect(cleared).toBe(false);
  },
);

test.each(["idle", "failed"])(
  "POST resume replaces a %s runtime and starts the persisted session",
  async (state) => {
    const order: string[] = [];
    const oldRuntime = { bridge: { turnState: () => state } } as any;
    const newRuntime = { bridge: { onClientEvent: () => {}, emitClientEvent: () => {} } } as any;
    let current: any = oldRuntime;
    const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
      mgr: {
        get: () => current,
        teardownIfCurrent: (id: string, expected: any) => {
          if (current !== expected) return false;
          order.push(`teardown:${id}`);
          current = undefined;
          return true;
        },
        createFor: () => { order.push("create"); current = newRuntime; return newRuntime; },
        configure: async () => {},
        start: () => order.push("start"),
      } as any,
      hub: {
        clear: (id: string) => order.push(`clear:${id}`),
        publish: () => {},
      } as any,
      thtRunner: {
        sessionShow: async () => ({
          status: "open", archived: false,
          provider: "local-qwen", model: "qwen3.6-35b-a3b", thinking: "low",
        }),
        reopenSession: async () => order.push("reopen"),
      } as any,
      readiness: { ensure: async () => ({ ok: true }) } as any,
      getSettings: () => ({ workspace: "local", thinking: "medium" }) as any,
    });
    const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
    await new Promise((resolve) => setImmediate(resolve));
    expect(response.json()).toEqual({ id: "s1", alreadyActive: false });
    expect(order).toEqual(["reopen", "teardown:s1", "create", "clear:s1", "start"]);
  },
);

test("POST resume without a runtime clears stale SSE state before cold start", async () => {
  const order: string[] = [];
  let createOptions: any;
  const newRuntime = { bridge: { onClientEvent: () => {}, emitClientEvent: () => {} } } as any;
  let current: any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: (_id: string, options: any) => {
        createOptions = options;
        order.push("create");
        current = newRuntime;
        return newRuntime;
      },
      configure: async () => {},
      start: () => order.push("start"),
    } as any,
    hub: {
      clear: (id: string) => order.push(`clear:${id}`),
      publish: () => {},
    } as any,
    thtRunner: {
      sessionShow: async () => ({
        status: "open", archived: false,
        provider: "local-qwen", model: "qwen3.6-35b-a3b", thinking: "low",
      }),
      reopenSession: async () => order.push("reopen"),
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local", thinking: "medium" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/crashed/resume" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(response.json()).toEqual({ id: "crashed", alreadyActive: false });
  expect(order).toEqual(["reopen", "create", "clear:crashed", "start"]);
  expect(createOptions).toMatchObject({
    provider: "local-qwen", model: "qwen3.6-35b-a3b", thinking: "low", mode: "resume",
  });
});

test("POST resume keeps an idle runtime stream attached when the manifest is read-only", async () => {
  let tornDown = false;
  let cleared = false;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => ({ bridge: { turnState: () => "idle" } }),
      teardown: () => { tornDown = true; },
    } as any,
    hub: { clear: () => { cleared = true; } } as any,
    thtRunner: {
      sessionShow: async () => ({ status: "finalized", archived: false }),
    } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });

  expect(response.statusCode).toBe(409);
  expect(tornDown).toBe(false);
  expect(cleared).toBe(false);
});

test("POST resume keeps a failed runtime stream attached when readiness fails", async () => {
  let tornDown = false;
  let cleared = false;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => ({ bridge: { turnState: () => "failed" } }),
      teardown: () => { tornDown = true; },
    } as any,
    hub: { clear: () => { cleared = true; } } as any,
    thtRunner: {
      sessionShow: async () => ({ status: "open", archived: false }),
    } as any,
    readiness: { ensure: async () => ({ ok: false, error: "not ready" }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });

  expect(response.statusCode).toBe(503);
  expect(tornDown).toBe(false);
  expect(cleared).toBe(false);
});

test("POST resume sanitizes reopen failure and preserves the old hub attachment", async () => {
  const delivered: string[] = [];
  const actualHub = new SseHub();
  let clearCalls = 0;
  let tornDown = false;
  const hub = {
    subscribe: actualHub.subscribe.bind(actualHub),
    publish: actualHub.publish.bind(actualHub),
    clear: (id: string) => { clearCalls += 1; actualHub.clear(id); },
  } as any;
  hub.subscribe("s1", (_event: string, data: any) => delivered.push(data.text));
  hub.publish("s1", "info", { text: "before" });
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => ({ bridge: { turnState: () => "idle" } }),
      teardown: () => { tornDown = true; },
    } as any,
    hub,
    thtRunner: {
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => { throw new Error("REOPEN_SENTINEL"); },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  hub.publish("s1", "info", { text: "post-failure probe" });

  expect(response.statusCode).toBe(503);
  expect(response.json()).toEqual({
    error: "Session could not be resumed. Check configuration and connectivity, then try again.",
  });
  expect(response.body).not.toContain("REOPEN_SENTINEL");
  expect(clearCalls).toBe(0);
  expect(tornDown).toBe(false);
  expect(delivered).toEqual(["before", "post-failure probe"]);
});

test("POST resume sanitizes runtime creation failure and preserves the old hub attachment", async () => {
  const delivered: string[] = [];
  const actualHub = new SseHub();
  let clearCalls = 0;
  let createCalls = 0;
  const hub = {
    subscribe: actualHub.subscribe.bind(actualHub),
    publish: actualHub.publish.bind(actualHub),
    clear: (id: string) => { clearCalls += 1; actualHub.clear(id); },
  } as any;
  hub.subscribe("s1", (_event: string, data: any) => delivered.push(data.text));
  hub.publish("s1", "info", { text: "before" });
  let current: any = { bridge: { turnState: () => "failed" } };
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
      createFor: () => { createCalls += 1; throw new Error("CREATE_SENTINEL"); },
    } as any,
    hub,
    thtRunner: {
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  hub.publish("s1", "info", { text: "post-failure probe" });

  expect(response.statusCode).toBe(503);
  expect(response.json()).toEqual({
    error: "Session could not be resumed. Check configuration and connectivity, then try again.",
  });
  expect(response.body).not.toContain("CREATE_SENTINEL");
  expect(createCalls).toBe(1);
  expect(clearCalls).toBe(0);
  expect(delivered).toEqual(["before", "post-failure probe"]);
});

test("concurrent cold Resume requests serialize and create one runtime", async () => {
  let runtime: any;
  let showCalls = 0;
  let readinessCalls = 0;
  let reopenCalls = 0;
  let createCalls = 0;
  let clearCalls = 0;
  let releaseReopen!: () => void;
  let markReopenStarted!: () => void;
  const reopenStarted = new Promise<void>((resolve) => { markReopenStarted = resolve; });
  const reopenReleased = new Promise<void>((resolve) => { releaseReopen = resolve; });
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => runtime,
      createFor: () => {
        createCalls += 1;
        runtime = {
          bridge: {
            turnState: () => "running",
            onClientEvent: () => {},
            emitClientEvent: () => {},
          },
        };
        return runtime;
      },
      configure: async () => {},
      start: () => {},
      teardown: () => {},
    } as any,
    hub: {
      clear: () => { clearCalls += 1; },
      publish: () => {},
    } as any,
    thtRunner: {
      sessionShow: async () => {
        showCalls += 1;
        return { status: "open", archived: false };
      },
      reopenSession: async () => {
        reopenCalls += 1;
        markReopenStarted();
        await reopenReleased;
      },
    } as any,
    readiness: {
      ensure: async () => { readinessCalls += 1; return { ok: true }; },
    } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const first = app.inject({ method: "POST", url: "/sessions/s1/resume" });
  await reopenStarted;
  const second = app.inject({ method: "POST", url: "/sessions/s1/resume" });
  await new Promise((resolve) => setImmediate(resolve));
  releaseReopen();
  const [firstResponse, secondResponse] = await Promise.all([first, second]);
  await new Promise((resolve) => setImmediate(resolve));

  expect(firstResponse.json()).toEqual({ id: "s1", alreadyActive: false });
  expect(secondResponse.json()).toEqual({ id: "s1", alreadyActive: true });
  expect({ showCalls, readinessCalls, reopenCalls, createCalls, clearCalls }).toEqual({
    // Each caller is authorized against repository ownership, including the request which
    // finds the runtime already active after waiting on the lifecycle lock.
    showCalls: 2,
    readinessCalls: 1,
    reopenCalls: 1,
    createCalls: 1,
    clearCalls: 1,
  });
});

test.each([
  ["close", "resolve"],
  ["close", "reject"],
  ["delete", "resolve"],
  ["delete", "reject"],
] as const)(
  "a bootstrap that %s left behind cannot %s against a replacement runtime",
  async (lifecycle, outcome) => {
    const oldConfigure = deferred<void>();
    const published: any[] = [];
    const starts: string[] = [];
    let failed = 0;
    let configureCalls = 0;
    let current: any;
    const runtime = (name: string) => {
      let listener: ((event: any) => void) | undefined;
      return {
        name,
        bridge: {
          turnState: () => "running",
          onClientEvent: (next: (event: any) => void) => { listener = next; },
          emitClientEvent: (event: any) => listener?.(event),
        },
      };
    };
    const oldRuntime = runtime("old");
    const replacement = runtime("replacement");
    const runtimes = [oldRuntime, replacement];
    const mgr = {
      get: () => current,
      createFor: () => {
        current = runtimes.shift();
        return current;
      },
      configure: async () => {
        configureCalls += 1;
        if (configureCalls === 1) await oldConfigure.promise;
      },
      start: (_id: string, expected: any) => {
        if (current !== expected) throw new Error("stale start");
        starts.push(expected.name);
      },
      teardown: () => { current = undefined; },
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    };
    const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
      mgr: mgr as any,
      hub: {
        publish: (_id: string, event: string, data: object) => {
          published.push({ event, data });
          return published.length;
        },
        clear: () => {},
        forget: () => {},
      } as any,
      thtRunner: {
        sessionNew: async () => ({ id: "s1" }),
        searchPack: async () => {},
        sessionShow: async () => ({ status: "open", archived: false }),
        reopenSession: async () => {},
        closeSession: async () => {},
        deleteSession: async () => {},
        failSession: async () => { failed += 1; },
      } as any,
      readiness: { ensure: async () => ({ ok: true }) } as any,
      getSettings: () => ({ workspace: "local" }) as any,
    });

    await app.inject({ method: "POST", url: "/sessions", payload: { question: "old" } });
    if (lifecycle === "close") {
      await app.inject({ method: "POST", url: "/sessions/s1/close" });
      await app.inject({ method: "POST", url: "/sessions/s1/resume" });
    } else {
      await app.inject({ method: "DELETE", url: "/sessions/s1" });
      await app.inject({ method: "POST", url: "/sessions", payload: { question: "replacement" } });
    }
    await new Promise((resolve) => setImmediate(resolve));
    expect(current).toBe(replacement);
    published.length = 0;
    starts.length = 0;
    failed = 0;

    if (outcome === "resolve") oldConfigure.resolve();
    else oldConfigure.reject(new Error("old bootstrap failed"));
    await new Promise((resolve) => setImmediate(resolve));

    expect(current).toBe(replacement);
    expect(starts).toEqual([]);
    expect(failed).toBe(0);
    expect(published).toEqual([]);
  },
);

test.each(["resolve", "reject"] as const)(
  "a deleted session stays forgotten when its stale bootstrap later %s",
  async (outcome) => {
    const oldConfigure = deferred<void>();
    const published: any[] = [];
    let failed = 0;
    let current: any;
    let forgotten = false;
    let listener: ((event: any) => void) | undefined;
    const runtime = {
      bridge: {
        onClientEvent: (next: (event: any) => void) => { listener = next; },
        emitClientEvent: (event: any) => listener?.(event),
      },
    };
    const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
      mgr: {
        get: () => current,
        createFor: () => { current = runtime; return runtime; },
        configure: async () => oldConfigure.promise,
        start: () => { throw new Error("deleted runtime must not start"); },
        teardown: () => { current = undefined; },
        teardownIfCurrent: (_id: string, expected: any) => {
          if (current !== expected) return false;
          current = undefined;
          return true;
        },
      } as any,
      hub: {
        publish: (_id: string, event: string, data: object) => {
          published.push({ event, data });
          return published.length;
        },
        forget: () => { forgotten = true; },
      } as any,
      thtRunner: {
        sessionNew: async () => ({ id: "s1" }),
        searchPack: async () => {},
        deleteSession: async () => {},
        failSession: async () => { failed += 1; },
      } as any,
      readiness: { ensure: async () => ({ ok: true }) } as any,
      getSettings: () => ({ workspace: "local" }) as any,
    });

    await app.inject({ method: "POST", url: "/sessions", payload: { question: "old" } });
    await app.inject({ method: "DELETE", url: "/sessions/s1" });
    published.length = 0;

    if (outcome === "resolve") oldConfigure.resolve();
    else oldConfigure.reject(new Error("old bootstrap failed"));
    await new Promise((resolve) => setImmediate(resolve));

    expect(current).toBeUndefined();
    expect(forgotten).toBe(true);
    expect(failed).toBe(0);
    expect(published).toEqual([]);
  },
);

test.each(["close", "delete"] as const)(
  "Resume followed by %s leaves no runtime or post-removal bootstrap events",
  async (lifecycle) => {
    const reopen = deferred<void>();
    const configure = deferred<void>();
    let markReopenStarted!: () => void;
    const reopenStarted = new Promise<void>((resolve) => { markReopenStarted = resolve; });
    let current: any;
    let removalSettled = false;
    const published: any[] = [];
    const removalEvents: string[] = [];
    const replacement = {
      bridge: {
        turnState: () => "running",
        onClientEvent: () => {},
        emitClientEvent: () => {},
      },
    };
    const teardown = (expected?: any) => {
      if (expected && current !== expected) return false;
      current = undefined;
      return true;
    };
    const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
      mgr: {
        get: () => current,
        createFor: () => { current = replacement; return replacement; },
        configure: async () => configure.promise,
        start: () => { throw new Error("removed runtime must not start"); },
        teardown: () => { teardown(); },
        teardownIfCurrent: (_id: string, expected: any) => teardown(expected),
      } as any,
      hub: {
        publish: (_id: string, event: string, data: object) => {
          published.push({ event, data });
          return published.length;
        },
        clear: () => { removalEvents.push("clear"); },
        forget: () => { removalEvents.push("forget"); },
      } as any,
      thtRunner: {
        sessionShow: async () => ({ status: "open", archived: false }),
        reopenSession: async () => {
          markReopenStarted();
          await reopen.promise;
        },
        closeSession: async () => { removalEvents.push("close"); },
        deleteSession: async () => { removalEvents.push("delete"); },
        failSession: async () => {},
      } as any,
      readiness: { ensure: async () => ({ ok: true }) } as any,
      getSettings: () => ({ workspace: "local" }) as any,
    });

    const resumeResponse = app.inject({ method: "POST", url: "/sessions/s1/resume" });
    await reopenStarted;
    const removalResponse = app.inject({
      method: lifecycle === "close" ? "POST" : "DELETE",
      url: `/sessions/s1/${lifecycle === "close" ? "close" : ""}`.replace(/\/$/, ""),
    }).then((response) => {
      removalSettled = true;
      return response;
    });
    await new Promise((resolve) => setImmediate(resolve));
    expect(removalSettled).toBe(false);

    reopen.resolve();
    expect((await resumeResponse).json()).toEqual({ id: "s1", alreadyActive: false });
    await removalResponse;
    published.length = 0;
    configure.resolve();
    await new Promise((resolve) => setImmediate(resolve));

    expect(current).toBeUndefined();
    expect(published).toEqual([]);
    expect(removalEvents.at(-1)).toBe(lifecycle === "close" ? "clear" : "forget");
  },
);

test("Close followed by Resume installs a fresh runtime only after Close finishes", async () => {
  const close = deferred<void>();
  let markCloseStarted!: () => void;
  const closeStarted = new Promise<void>((resolve) => { markCloseStarted = resolve; });
  const oldRuntime = { bridge: { turnState: () => "running" } };
  const replacement = {
    bridge: {
      turnState: () => "running",
      onClientEvent: () => {},
      emitClientEvent: () => {},
    },
  };
  let current: any = oldRuntime;
  let resumeSettled = false;
  const teardown = (expected?: any) => {
    if (expected && current !== expected) return false;
    current = undefined;
    return true;
  };
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = replacement; return replacement; },
      configure: async () => {},
      start: () => {},
      teardown: () => { teardown(); },
      teardownIfCurrent: (_id: string, expected: any) => teardown(expected),
    } as any,
    hub: { publish: () => 1, clear: () => {} } as any,
    thtRunner: {
      closeSession: async () => { markCloseStarted(); await close.promise; },
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const closeResponse = app.inject({ method: "POST", url: "/sessions/s1/close" });
  await closeStarted;
  const resumeResponse = app.inject({ method: "POST", url: "/sessions/s1/resume" })
    .then((response) => { resumeSettled = true; return response; });
  await new Promise((resolve) => setImmediate(resolve));
  expect(resumeSettled).toBe(false);

  close.resolve();
  await closeResponse;
  const resumed = await resumeResponse;
  await new Promise((resolve) => setImmediate(resolve));

  expect(resumed.json()).toEqual({ id: "s1", alreadyActive: false });
  expect(current).toBe(replacement);
});

test("Close suppresses a bootstrap that settles while close persistence is pending", async () => {
  const configure = deferred<void>();
  const close = deferred<void>();
  let markCloseStarted!: () => void;
  const closeStarted = new Promise<void>((resolve) => { markCloseStarted = resolve; });
  const published: any[] = [];
  const starts: any[] = [];
  let current: any;
  let listener: ((event: any) => void) | undefined;
  const runtime = {
    bridge: {
      onClientEvent: (next: (event: any) => void) => { listener = next; },
      emitClientEvent: (event: any) => listener?.(event),
    },
  };
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtime; return runtime; },
      configure: async () => configure.promise,
      start: (_id: string, expected: any) => { starts.push(expected); },
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    } as any,
    hub: {
      publish: (_id: string, event: string, data: object) => {
        published.push({ event, data });
        return published.length;
      },
      clear: () => {},
    } as any,
    thtRunner: {
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      closeSession: async () => { markCloseStarted(); await close.promise; },
      failSession: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  const closeResponse = app.inject({ method: "POST", url: "/sessions/s1/close" });
  await closeStarted;
  published.length = 0;
  configure.resolve();
  await new Promise((resolve) => setImmediate(resolve));

  expect(starts).toEqual([]);
  expect(published).toEqual([]);

  close.resolve();
  await closeResponse;
  expect(current).toBeUndefined();
});

test("bootstrap failure persists once and keeps Resume serialized behind that persistence", async () => {
  const oldConfigure = deferred<void>();
  const failurePersistence = deferred<void>();
  let markFailureStarted!: () => void;
  const failureStarted = new Promise<void>((resolve) => { markFailureStarted = resolve; });
  const oldRuntime = {
    bridge: {
      onClientEvent: undefined as ((next: (event: any) => void) => void) | undefined,
      emitClientEvent: undefined as ((event: any) => void) | undefined,
    },
  } as any;
  const replacement = {
    bridge: {
      turnState: () => "running",
      onClientEvent: () => {},
      emitClientEvent: () => {},
    },
  };
  let oldListener: ((event: any) => void) | undefined;
  oldRuntime.bridge.onClientEvent = (next: (event: any) => void) => { oldListener = next; };
  oldRuntime.bridge.emitClientEvent = (event: any) => oldListener?.(event);
  const runtimes = [oldRuntime, replacement];
  let current: any;
  let configureCalls = 0;
  let failCalls = 0;
  let resumeSettled = false;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtimes.shift(); return current; },
      configure: async () => {
        configureCalls += 1;
        if (configureCalls === 1) await oldConfigure.promise;
      },
      start: () => {},
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    } as any,
    hub: { publish: () => 1, clear: () => {} } as any,
    thtRunner: {
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
      failSession: async () => {
        failCalls += 1;
        if (failCalls === 1) {
          markFailureStarted();
          await failurePersistence.promise;
        }
      },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  oldConfigure.reject(new Error("configure failed"));
  await failureStarted;
  const resumeResponse = app.inject({ method: "POST", url: "/sessions/s1/resume" })
    .then((response) => { resumeSettled = true; return response; });
  await new Promise((resolve) => setImmediate(resolve));
  expect(resumeSettled).toBe(false);

  failurePersistence.resolve();
  expect((await resumeResponse).json()).toEqual({ id: "s1", alreadyActive: false });
  await new Promise((resolve) => setImmediate(resolve));

  expect(failCalls).toBe(1);
  expect(current).toBe(replacement);
});

test("Delete followed by Resume cannot resurrect the deleted session", async () => {
  const deletion = deferred<void>();
  let markDeleteStarted!: () => void;
  const deleteStarted = new Promise<void>((resolve) => { markDeleteStarted = resolve; });
  const oldRuntime = { bridge: { turnState: () => "running" } };
  let current: any = oldRuntime;
  let deleted = false;
  let resumeSettled = false;
  let createCalls = 0;
  const teardown = (expected?: any) => {
    if (expected && current !== expected) return false;
    current = undefined;
    return true;
  };
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => {
        createCalls += 1;
        current = { bridge: { onClientEvent: () => {}, emitClientEvent: () => {} } };
        return current;
      },
      configure: async () => {},
      start: () => {},
      teardown: () => { teardown(); },
      teardownIfCurrent: (_id: string, expected: any) => teardown(expected),
    } as any,
    hub: { publish: () => 1, clear: () => {}, forget: () => {} } as any,
    thtRunner: {
      deleteSession: async () => {
        markDeleteStarted();
        await deletion.promise;
        deleted = true;
      },
      sessionShow: async () => {
        if (deleted) throw new Error("session deleted");
        return { status: "open", archived: false };
      },
      reopenSession: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const deleteResponse = app.inject({ method: "DELETE", url: "/sessions/s1" });
  await deleteStarted;
  const resumeResponse = app.inject({ method: "POST", url: "/sessions/s1/resume" })
    .then((response) => { resumeSettled = true; return response; });
  await new Promise((resolve) => setImmediate(resolve));
  expect(resumeSettled).toBe(false);

  deletion.resolve();
  await deleteResponse;
  const resumed = await resumeResponse;

  expect(resumed.statusCode).toBe(503);
  expect(current).toBeUndefined();
  expect(createCalls).toBe(0);
});

test("a replaced runtime cannot publish or fail the newly resumed session", async () => {
  const controlledBridge = (initialState: string) => {
    let state = initialState;
    let listener: ((event: any) => void) | undefined;
    return {
      turnState: () => state,
      setState: (next: string) => { state = next; },
      onClientEvent: (next: (event: any) => void) => { listener = next; },
      emitClientEvent: (event: any) => listener?.(event),
      pendingWidget: () => null,
    };
  };
  const oldBridge = controlledBridge("running");
  const newBridge = controlledBridge("running");
  const runtimes = [{ bridge: oldBridge }, { bridge: newBridge }];
  let current: any;
  let failed = 0;
  const published: any[] = [];
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtimes.shift(); return current; },
      configure: async () => {},
      start: () => {},
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    } as any,
    hub: {
      clear: () => {},
      publish: (_id: string, event: string, data: object) => {
        published.push({ event, data });
        return published.length;
      },
    } as any,
    thtRunner: {
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
      failSession: async () => { failed += 1; },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });
  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  await new Promise((resolve) => setImmediate(resolve));
  oldBridge.setState("idle");

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  published.length = 0;
  // The manager removes an unexpectedly exited active runtime before its bridge publishes the
  // public failure sequence. Binding identity, rather than mgr.get(), must still admit it.
  current = undefined;
  oldBridge.emitClientEvent({ type: "system_event", event: "session_failed" });
  newBridge.emitClientEvent({ type: "info", text: "new runtime" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(response.json()).toEqual({ id: "s1", alreadyActive: false });
  expect(failed).toBe(0);
  expect(published).toEqual([{
    event: "info",
    data: { type: "info", text: "new runtime" },
  }]);
});

test("a deleted runtime cannot repopulate or fail the forgotten session", async () => {
  let listener: ((event: any) => void) | undefined;
  const bridge = {
    turnState: () => "running",
    onClientEvent: (next: (event: any) => void) => { listener = next; },
    emitClientEvent: (event: any) => listener?.(event),
  };
  const runtime = { bridge };
  let current: any;
  let failed = 0;
  const published: any[] = [];
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtime; return runtime; },
      configure: async () => {},
      start: () => {},
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    } as any,
    hub: {
      publish: (_id: string, event: string, data: object) => {
        published.push({ event, data });
        return published.length;
      },
      forget: () => {},
    } as any,
    thtRunner: {
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      deleteSession: async () => {},
      failSession: async () => { failed += 1; },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });
  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  await new Promise((resolve) => setImmediate(resolve));

  const response = await app.inject({ method: "DELETE", url: "/sessions/s1" });
  published.length = 0;
  bridge.emitClientEvent({ type: "system_event", event: "session_failed" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(response.statusCode).toBe(204);
  expect(failed).toBe(0);
  expect(published).toEqual([]);
});

test("an unexpectedly exited runtime publishes its terminal sequence then releases its binding", async () => {
  let listener: ((event: any) => void) | undefined;
  const bridge = {
    onClientEvent: (next: (event: any) => void) => { listener = next; },
    emitClientEvent: (event: any) => listener?.(event),
  };
  const runtime = { bridge };
  let current: any;
  let failed = 0;
  const published: any[] = [];
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtime; return runtime; },
      configure: async () => {},
      start: () => {},
      teardown: () => { current = undefined; },
    } as any,
    hub: {
      publish: (_id: string, event: string, data: object) => {
        published.push({ event, data });
        return published.length;
      },
    } as any,
    thtRunner: {
      sessionNew: async () => ({ id: "s1" }),
      searchPack: async () => {},
      failSession: async () => { failed += 1; },
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });
  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  await new Promise((resolve) => setImmediate(resolve));
  published.length = 0;

  // PiProcessManager deletes an unexpectedly exited runtime before emitting this sequence.
  current = undefined;
  bridge.emitClientEvent({ type: "info", level: "error", text: "public failure" });
  bridge.emitClientEvent({ type: "system_event", event: "session_failed" });
  bridge.emitClientEvent({ type: "system_event", event: "agent_end" });
  bridge.emitClientEvent({ type: "text_delta", text: "too late" });
  await new Promise((resolve) => setImmediate(resolve));

  expect(failed).toBe(1);
  expect(published).toEqual([
    { event: "info", data: { type: "info", level: "error", text: "public failure" } },
    { event: "system_event", data: { type: "system_event", event: "session_failed" } },
    { event: "system_event", data: { type: "system_event", event: "agent_end" } },
  ]);
});

test("POST resume tears down a created runtime when bridge binding fails", async () => {
  const delivered: string[] = [];
  const actualHub = new SseHub();
  let clearCalls = 0;
  let teardownCalls = 0;
  let current: any = { bridge: { turnState: () => "failed" } };
  const hub = {
    subscribe: actualHub.subscribe.bind(actualHub),
    publish: actualHub.publish.bind(actualHub),
    clear: (id: string) => { clearCalls += 1; actualHub.clear(id); },
  } as any;
  hub.subscribe("s1", (_event: string, data: any) => delivered.push(data.text));
  hub.publish("s1", "info", { text: "before" });
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        teardownCalls += 1;
        current = undefined;
        return true;
      },
      createFor: () => {
        current = {
          bridge: {
            onClientEvent: () => { throw new Error("BIND_SENTINEL"); },
          },
        };
        return current;
      },
    } as any,
    hub,
    thtRunner: {
      sessionShow: async () => ({ status: "open", archived: false }),
      reopenSession: async () => {},
    } as any,
    readiness: { ensure: async () => ({ ok: true }) } as any,
    getSettings: () => ({ workspace: "local" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  hub.publish("s1", "info", { text: "post-failure probe" });

  expect(response.statusCode).toBe(503);
  expect(response.body).not.toContain("BIND_SENTINEL");
  expect(teardownCalls).toBe(2);
  expect(current).toBeUndefined();
  expect(clearCalls).toBe(0);
  expect(delivered).toEqual(["before", "post-failure probe"]);
});

test("POST /sessions/:id/response senza gate pendente risponde 409 (risposta stantia)", async () => {
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      searchPack: async () => {},
      sessionNew: async () => ({ id: "s1" }),
      sessionList: async () => [],
    } as any,
    getSettings: () => ({ workspace: "w" }),
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  // The fake Pi never emitted a ui_request: the bridge has no pending descriptor, so a
  // response (stale UI, double submit) must be rejected instead of forwarded to Pi.
  const res = await app.inject({ method: "POST", url: "/sessions/s1/response",
    payload: { ui_response: { id: "u1", choices: ["a"] } } });
  expect(res.statusCode).toBe(409);
});

test("POST /sessions/:id/rename calls setName", async () => {
  let arg: any;
  const app = mutApp({ setName: async (id: string, name: string) => { arg = { id, name }; } });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/rename", payload: { name: "N" } });
  expect(res.statusCode).toBe(204);
  expect(arg).toEqual({ id: "s1", name: "N" });
});

test("rename authorizes and mutates through the same selected workspace", async () => {
  const workspaces: string[] = [];
  const app = buildApp(loadConfig({ AUTH_MODE: "upstream", THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      withPrincipal: () => ({
        sessionShow: async (_id: string, workspace: string) => { workspaces.push(`show:${workspace}`); return { id: "s1" }; },
        setName: async (_id: string, _name: string, workspace: string) => { workspaces.push(`set:${workspace}`); },
      }),
    } as any,
    getSettings: () => ({ workspace: "tenant-a" }) as any,
  });
  const res = await app.inject({
    method: "POST", url: "/sessions/s1/rename", payload: { name: "N" },
    headers: {
      "x-thoth-principal-issuer": "portal", "x-thoth-principal-subject": "42", "x-thoth-is-admin": "false",
    },
  });
  expect(res.statusCode).toBe(204);
  expect(workspaces).toEqual(["show:tenant-a", "set:tenant-a"]);
});

test("POST /sessions/:id/group calls setGroup", async () => {
  let arg: any;
  const app = mutApp({ setGroup: async (id: string, group: string) => { arg = { id, group }; } });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/group", payload: { group: "G" } });
  expect(res.statusCode).toBe(204);
  expect(arg).toEqual({ id: "s1", group: "G" });
});

test("POST archive / unarchive call the runner", async () => {
  const seen: string[] = [];
  const app = mutApp({
    archive: async (id: string) => { seen.push(`a:${id}`); },
    unarchive: async (id: string) => { seen.push(`u:${id}`); },
  });
  expect((await app.inject({ method: "POST", url: "/sessions/s1/archive" })).statusCode).toBe(204);
  expect((await app.inject({ method: "POST", url: "/sessions/s1/unarchive" })).statusCode).toBe(204);
  expect(seen).toEqual(["a:s1", "u:s1"]);
});

test("DELETE /sessions/:id calls deleteSession", async () => {
  let deleted: string | null = null;
  const app = mutApp({ deleteSession: async (id: string) => { deleted = id; } });
  const res = await app.inject({ method: "DELETE", url: "/sessions/s1" });
  expect(res.statusCode).toBe(204);
  expect(deleted).toBe("s1");
});

test("DELETE /sessions/:id tears down the runtime before deleting on disk", async () => {
  const order: string[] = [];
  const runtime = {} as any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: { deleteSession: async (id: string) => { order.push(`del:${id}`); } } as any,
    mgr: {
      get: () => runtime,
      teardownIfCurrent: (id: string, expected: any) => {
        expect(expected).toBe(runtime);
        order.push(`teardown:${id}`);
        return true;
      },
    } as any,
    hub: { forget: (id: string) => { order.push(`forget:${id}`); } } as any,
    getSettings: () => ({ workspace: "w" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "DELETE", url: "/sessions/s1" });
  expect(res.statusCode).toBe(204);
  expect(order).toEqual(["teardown:s1", "del:s1", "forget:s1"]);
});

test("POST /sessions/:id/close clears transient hub state without forgetting its id", async () => {
  const calls: string[] = [];
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: { closeSession: async () => {} } as any,
    mgr: { get: () => undefined } as any,
    hub: {
      clear: (id: string) => { calls.push(`clear:${id}`); },
      forget: (id: string) => { calls.push(`forget:${id}`); },
    } as any,
    getSettings: () => ({ workspace: "w" }) as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions/s1/close" });

  expect(response.statusCode).toBe(200);
  expect(calls).toEqual(["clear:s1"]);
});

test("GET /sessions/:id/documents returns the runner output", async () => {
  const app = mutApp({ documents: async () => [{ phase: "—", key: "question", title: "t", format: "text", content: "q" }] });
  const res = await app.inject({ method: "GET", url: "/sessions/s1/documents" });
  expect(res.statusCode).toBe(200);
  expect(res.json()[0].key).toBe("question");
});

test("POST resume on a finalized session is refused with 409", async () => {
  const app = mutApp({ sessionShow: async () => ({ status: "finalized", archived: false }) });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  expect(res.statusCode).toBe(409);
});

test("POST resume on an archived session is refused with 409", async () => {
  const app = mutApp({ sessionShow: async () => ({ status: "open", archived: true }) });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  expect(res.statusCode).toBe(409);
});

test("POST /sessions readiness failure returns one fixed public message without raw diagnostics", async () => {
  let createdCalled = false;
  const rawFailure =
    "connect https://secret.invalid/ready?token=DO_NOT_LEAK using /srv/private/model-key";
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      ollamaEnsure: async () => ({ ok: false, stage: "model", error: rawFailure }),
      searchPack: async () => {},
      sessionNew: async () => { createdCalled = true; return { id: "s1" }; },
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.statusCode).toBe(503);
  expect(res.json()).toEqual({
    error: "Session services are not ready. Check configuration and connectivity, then try again.",
  });
  expect(res.body).not.toMatch(/secret\.invalid|DO_NOT_LEAK|\/srv\/private\/model-key/);
  expect(createdCalled).toBe(false);
});

test("POST /sessions returns storage 503 before creating a Pi runtime when session persistence fails", async () => {
  let piCreated = false;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      sessionNew: async () => { throw new Error("database unavailable"); },
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
    mgr: { createFor: () => { piCreated = true; throw new Error("must not spawn"); } } as any,
  });

  const response = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });

  expect(response.statusCode).toBe(503);
  expect(response.json()).toEqual({ error: "session storage is unavailable" });
  expect(piCreated).toBe(false);
});

test("POST /sessions proceeds when ollamaEnsure succeeds", async () => {
  let ensureWs: string | undefined;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      ollamaEnsure: async (ws: string) => { ensureWs = ws; return { ok: true }; },
      searchPack: async () => {},
      sessionNew: async () => ({ id: "s1" }),
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.json()).toEqual({ id: "s1" });
  expect(ensureWs).toBe("psd");
});

test("POST /sessions/:id/resume returns 409 for a read-only session without calling ollamaEnsure", async () => {
  let ensureCalled = false;
  const app = mutApp({
    sessionShow: async () => ({ status: "finalized", archived: false }),
    ollamaEnsure: async () => { ensureCalled = true; return { ok: false, error: "down" }; },
  });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  expect(res.statusCode).toBe(409);
  expect(ensureCalled).toBe(false);
});

test("POST /sessions/:id/resume readiness failure returns the same fixed public message", async () => {
  const rawFailure =
    "stderr https://secret.invalid/resume?api_key=DO_NOT_LEAK /srv/private/resume-key";
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {
      ollamaEnsure: async () => ({ ok: false, error: rawFailure }),
      sessionShow: async () => ({ status: "open", archived: false }),
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
    spawnFn: () => nodeSpawn("node", [FAKE, SCRIPT]) as any,
  });
  const res = await app.inject({ method: "POST", url: "/sessions/s1/resume" });
  expect(res.statusCode).toBe(503);
  expect(res.json()).toEqual({
    error: "Session services are not ready. Check configuration and connectivity, then try again.",
  });
  expect(res.body).not.toMatch(/secret\.invalid|DO_NOT_LEAK|\/srv\/private\/resume-key/);
});

test("POST /runtime/prewarm returns 202 without awaiting readiness", async () => {
  let workspace: string | undefined;
  let finish!: (value: any) => void;
  const pending = new Promise((resolve) => { finish = resolve; });
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    thtRunner: {} as any,
    readiness: {
      ensure: (ws: string) => { workspace = ws; return pending; },
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
  });
  const res = await app.inject({ method: "POST", url: "/runtime/prewarm" });
  expect(res.statusCode).toBe(202);
  expect(res.json()).toEqual({ status: "warming" });
  expect(workspace).toBe("psd");
  finish({ ok: true });
});

test("POST /sessions returns after bridge attachment but starts only after retrieval", async () => {
  let finishPack!: () => void;
  const pack = new Promise<void>((resolve) => { finishPack = resolve; });
  let bridgeAttached = false;
  let started = false;
  const bridge = {
    onClientEvent: () => { bridgeAttached = true; },
    emitClientEvent: () => {},
  };
  const runtime = { bridge } as any;
  let current: any;
  const mgr = {
    get: () => current,
    createFor: () => { current = runtime; return runtime; },
    configure: async () => {},
    start: () => {
      expect(bridgeAttached).toBe(true);
      started = true;
    },
    teardownIfCurrent: (_id: string, expected: any) => {
      if (current !== expected) return false;
      current = undefined;
      return true;
    },
  } as any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr,
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      sessionNew: async () => ({ id: "s-early" }),
      searchPack: async () => pack,
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
  });

  const res = await app.inject({ method: "POST", url: "/sessions", payload: { question: "q" } });
  expect(res.json()).toEqual({ id: "s-early" });
  expect(bridgeAttached).toBe(true);
  expect(started).toBe(false);
  finishPack();
  await new Promise((resolve) => setImmediate(resolve));
  expect(started).toBe(true);
});

test("POST /sessions bootstrap failure emits only a fixed recovery message", async () => {
  const published: Array<{ event: string; data: any }> = [];
  let listener: ((event: any) => void) | undefined;
  const bridge = {
    onClientEvent: (callback: (event: any) => void) => { listener = callback; },
    emitClientEvent: (event: any) => listener?.(event),
  };
  const runtime = { bridge } as any;
  const rawFailure =
    "connect https://secret.invalid/bootstrap?token=DO_NOT_LEAK using /srv/private/model-key";
  let current: any;
  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
    mgr: {
      get: () => current,
      createFor: () => { current = runtime; return runtime; },
      configure: async () => { throw new Error(rawFailure); },
      start: () => {},
      teardownIfCurrent: (_id: string, expected: any) => {
        if (current !== expected) return false;
        current = undefined;
        return true;
      },
    } as any,
    hub: {
      publish: (_id: string, event: string, data: any) => published.push({ event, data }),
    } as any,
    thtRunner: {
      ollamaEnsure: async () => ({ ok: true }),
      sessionNew: async () => ({ id: "s-bootstrap" }),
      searchPack: async () => {},
      failSession: async () => {},
    } as any,
    getSettings: () => ({ workspace: "psd" }) as any,
  });

  const response = await app.inject({
    method: "POST",
    url: "/sessions",
    payload: { question: "q" },
  });
  await new Promise((resolve) => setImmediate(resolve));

  expect(response.json()).toEqual({ id: "s-bootstrap" });
  expect(published.map(({ data }) => data)).toContainEqual({
    type: "info",
    level: "error",
    text: "Session startup failed. Check configuration and connectivity, then Resume the session.",
  });
  const clientOutput = JSON.stringify(published);
  expect(clientOutput).not.toContain("secret.invalid");
  expect(clientOutput).not.toContain("DO_NOT_LEAK");
  expect(clientOutput).not.toContain("/srv/private/model-key");
});