import { describe, expect, it } from 'vitest'
import { evaluatePolicy } from './policy-engine'
import { getAgentProfileById, getResourceManifestById } from './resource-pool'

function mustGetAgent(agentId: string) {
  const agent = getAgentProfileById(agentId)
  if (!agent) {
    throw new Error(`Missing agent profile: ${agentId}`)
  }
  return agent
}

function mustGetResource(resourceId: string) {
  const resource = getResourceManifestById(resourceId)
  if (!resource) {
    throw new Error(`Missing resource manifest: ${resourceId}`)
  }
  return resource
}

describe('agent-os policy engine', () => {
  it('denies git push command by command rule', () => {
    const agent = mustGetAgent('agent.orchestrator.core')
    const resource = mustGetResource('tool.shell.exec')

    const result = evaluatePolicy(agent, resource, { command: 'git push origin main' })

    expect(result.effect).toBe('deny')
    expect(result.reasons.some((reason) => reason.includes('command_rule'))).toBe(true)
  })

  it('denies .env reads by path rule', () => {
    const agent = mustGetAgent('agent.orchestrator.core')
    const resource = mustGetResource('tool.fs.read')

    const result = evaluatePolicy(agent, resource, { paths: ['/tmp/.env.local'] })

    expect(result.effect).toBe('deny')
    expect(result.reasons.some((reason) => reason.includes('path_rule'))).toBe(true)
  })

  it('degrades repeated calls via doom loop guard', () => {
    const agent = mustGetAgent('agent.discovery.scout')
    const resource = mustGetResource('tool.web.read')

    const result = evaluatePolicy(agent, resource, { repeatedCallCount: 5 })

    expect(result.effect).toBe('deny')
    expect(result.reasons.some((reason) => reason.includes('doom_loop'))).toBe(true)
  })
})