// Run explicitly through session-machine-card.test.tsx so Radix sees the DOM at import time.
import { afterAll, beforeAll, beforeEach, describe, expect, mock, test } from "bun:test";
import { GlobalRegistrator } from "@happy-dom/global-registrator";
import { act } from "react";

import type { AuthNeededItem } from "../../../timeline";

const STORE_URL =
  "https://chromewebstore.google.com/detail/opengeni-browser/phpmmcbeelfkcinjfbbggegjdcdmnnch";

type Machine = {
  sandboxId: string;
  enrollmentId: string | null;
  name: string;
  kind: string;
  state: string;
  active: boolean;
  isSessionGroup: boolean;
  os: string;
  hasDisplay: boolean;
  allowScreenControl: boolean;
  desktopUnavailableReason: string | null;
  runtime: Runtime | null;
  scope: "user" | "workspace" | "organization";
};
type Permissions = { screenRecording: boolean; accessibility: boolean; inputMonitoring: boolean };
type Runtime = {
  capabilities: { credentialRenew: boolean; screenControl: boolean | null };
  macPermissions: Permissions | null;
};
const runtime = (
  screenControl: boolean | null,
  macPermissions: Permissions | null = null,
  credentialRenew = true,
): Runtime => ({ capabilities: { credentialRenew, screenControl }, macPermissions });
const granted = (screenRecording: boolean, accessibility: boolean, inputMonitoring: boolean) => ({
  screenRecording,
  accessibility,
  inputMonitoring,
});
const machine = (sandboxId: string, name: string, overrides: Partial<Machine> = {}): Machine => ({
  sandboxId,
  enrollmentId: `enrollment-${sandboxId}`,
  name,
  kind: "selfhosted",
  state: "online",
  active: false,
  isSessionGroup: false,
  os: "macos",
  hasDisplay: true,
  allowScreenControl: false,
  desktopUnavailableReason: null,
  runtime: null,
  scope: "workspace",
  ...overrides,
});
const sessionBox = machine("home", "Cloud sandbox", {
  enrollmentId: null,
  isSessionGroup: true,
  kind: "modal",
  active: true,
});

const attach = mock(async (_sandboxId: string) => true);
const refresh = mock(async () => {});
const fleet = {
  machines: [sessionBox] as Machine[],
  canRead: true,
  canManage: true,
  canAttach: true,
  attaching: false,
  loading: false,
  error: null as unknown,
  mutationError: null as unknown,
  attach,
  refresh,
};
mock.module("../../lib/use-workspace-machines", () => ({ useWorkspaceMachines: () => fleet }));
mock.module("../../lib/app-api", () => ({
  useAppApi: () => ({ apiBaseUrl: "https://app.example.test" }),
}));
let desktop: ReturnType<typeof import("../desktop/this-computer").useDesktopThisComputer> = null;
mock.module("../desktop/this-computer", () => ({
  useDesktopThisComputer: () => desktop,
}));
const copyTextToClipboard = mock(async (_text: string) => true);
mock.module("../../../clipboard", () => ({ copyTextToClipboard }));

let mintCount = 0;
const mintEnrollToken = mock(
  async (
    _workspaceId: string,
    input: { scope?: string | undefined; allowScreenControl?: boolean | undefined },
  ) => {
    mintCount += 1;
    return {
      token: `oget_token${mintCount}.sig`,
      expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
      expiresInSeconds: 3600,
      scope: input.scope ?? "workspace",
      allowScreenControl: input.allowScreenControl ?? false,
    };
  },
);
let browsers: { devices: unknown[]; bridges: unknown[]; revision: number } = {
  devices: [],
  bridges: [],
  revision: 1,
};
const listAttachedBrowsers = mock(async () => browsers);
const sendMessage = mock(async (_workspaceId: string, _sessionId: string, _input: unknown) => ({
  id: "accepted",
  type: "user.message",
  payload: { routing: "accepted_for_execution" },
}));
let enableResult: Record<string, unknown> = { status: "active", reason: null, message: null };
let enableFailure: Error | null = null;
const enableMachineScreenControl = mock(async (_workspaceId: string, _enrollmentId: string) => {
  if (enableFailure) throw enableFailure;
  return enableResult;
});
const updateMachineAgent = mock(async (_workspaceId: string, _enrollmentId: string) => ({
  operationId: "operation",
  accepted: true,
  targetVersion: "9.9.9",
}));
const openMachinePrivacySettings = mock(
  async (_workspaceId: string, _enrollmentId: string, _input: { pane: string }) => ({
    opened: true,
    message: null,
  }),
);
const everyone = ["enrollments:read", "enrollments:manage", "sessions:control"];
const context = {
  client: {
    mintEnrollToken,
    listAttachedBrowsers,
    sendMessage,
    enableMachineScreenControl,
    openMachinePrivacySettings,
    updateMachineAgent,
  },
  accessContext: {
    subjectId: "member",
    workspaceGrants: [{ workspaceId: "workspace", permissions: everyone }],
  },
  workspaces: [{ id: "workspace", kind: "shared" }],
  workspaceCapabilityCatalog: [],
};
mock.module("../../app-context", () => ({ useAppContext: () => context }));
mock.module("sonner", () => ({ toast: { success: () => {}, error: () => {}, info: () => {} } }));
GlobalRegistrator.register();
const { createRoot } = await import("react-dom/client");
const { SessionCapabilityCard } = await import("./session-capability-card");

const notice = {
  id: "notice",
  kind: "auth-needed",
  serverId: "opengeni",
  providerDomain: "opengeni.ai",
  reason: "missing_connection",
  capability: {
    id: "api:connected-machine",
    name: "Connected Machine",
    kind: "api",
    action: "connect",
    rationale: "Connect your Mac so I can run the iOS build there.",
    requiredVariables: [],
  },
} as unknown as AuthNeededItem;

beforeAll(() => {
  (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean | undefined }).IS_REACT_ACT_ENVIRONMENT =
    true;
});
afterAll(() => {
  mock.restore();
  GlobalRegistrator.unregister();
});
beforeEach(() => {
  desktop = null;
  mintCount = 0;
  attach.mockClear();
  enableMachineScreenControl.mockClear();
  updateMachineAgent.mockClear();
  openMachinePrivacySettings.mockClear();
  enableResult = { status: "active", reason: null, message: null };
  enableFailure = null;
  sendMessage.mockClear();
  mintEnrollToken.mockClear();
  copyTextToClipboard.mockClear();
  listAttachedBrowsers.mockClear();
  browsers = { devices: [], bridges: [], revision: 1 };
  fleet.machines = [sessionBox];
  fleet.canRead = true;
  fleet.canManage = true;
  fleet.canAttach = true;
  fleet.error = null;
  fleet.mutationError = null;
  context.accessContext.workspaceGrants = [{ workspaceId: "workspace", permissions: everyone }];
});

type SendContext = {
  blocked: string | null;
  awaitingHuman: boolean;
  personalMachineIntent?: Record<string, unknown> | undefined;
  extras: Record<string, unknown>;
};
async function render(sendContext?: () => SendContext, item: AuthNeededItem = notice) {
  const container = document.createElement("div");
  document.body.append(container);
  const root = createRoot(container);
  const onConfigured = mock(async () => {});
  const draw = async () =>
    await act(async () => {
      root.render(
        <SessionCapabilityCard
          item={item}
          workspaceId="workspace"
          sessionId="session"
          sendContext={sendContext as never}
          onConfigured={onConfigured}
        />,
      );
      await new Promise((resolve) => setTimeout(resolve, 0));
    });
  await draw();
  const dialog = () => document.querySelector<HTMLElement>("[data-connect-machine-dialog]");
  const buttonIn = (scope: ParentNode | null, name: string) =>
    [...(scope?.querySelectorAll<HTMLButtonElement>("button") ?? [])].find(
      (button) => button.getAttribute("aria-label") === name || button.textContent?.trim() === name,
    ) ?? null;
  return {
    container,
    onConfigured,
    rerender: draw,
    text: () => container.textContent ?? "",
    button: (name: string) => buttonIn(container, name),
    /** The connect dialog renders in a portal outside the card. */
    dialog,
    dialogText: () => dialog()?.textContent ?? "",
    dialogButton: (name: string) => buttonIn(dialog(), name),
    command: () => dialog()?.querySelector("[data-connect-command]")?.textContent ?? "",
    close: async () => {
      await act(async () => root.unmount());
      container.remove();
    },
  };
}

async function click(element: HTMLElement | null) {
  if (!element) throw new Error("Missing element");
  await act(async () => {
    element.click();
    await new Promise((resolve) => setTimeout(resolve, 0));
  });
}

describe("Connected Machine conversation card", () => {
  test("desktop connects in one click and opens setup only for outstanding system permissions", async () => {
    const { defaultThisComputerLabels } = await import("../../../this-computer");
    const openSetup = mock(() => {});
    const connect = mock(async (_options: { screenControl: boolean }) => ({
      state: "connected" as const,
      busy: false,
      error: null,
      machineName: "This laptop",
    }));
    desktop = {
      workspaceId: "workspace",
      productName: "Opengeni",
      platform: "linux",
      labels: defaultThisComputerLabels(),
      openSetup,
      computer: {
        status: { state: "not_installed", busy: false, error: null, machineName: "This laptop" },
        acting: false,
        actionError: null,
        canDisconnect: true,
        connect,
        refresh: () => {},
        pause: async () => {},
        resume: async () => {},
        disconnect: async () => {},
        requestPermission: async () => {},
      },
    };
    const h = await render();
    try {
      await click(h.button("Use this computer"));
      expect(connect).toHaveBeenCalledTimes(1);
      expect(connect).toHaveBeenCalledWith({ screenControl: true });
      expect(openSetup).not.toHaveBeenCalled();
      expect(mintEnrollToken).not.toHaveBeenCalled();
      desktop.computer.status = {
        state: "connected",
        busy: false,
        error: null,
        machineName: "This laptop",
        permissions: [{ id: "screenRecording", granted: false }],
      };
      await h.rerender();
      await click(h.button("Use this computer"));
      expect(openSetup).toHaveBeenCalledTimes(1);
      expect(connect).toHaveBeenCalledTimes(1);
    } finally {
      await h.close();
    }
  });

  test("mints a command on demand, notices the new machine and moves the chat onto it", async () => {
    const consent = {
      mode: "session",
      expectedAuthorityEpoch: 1,
      workspaceSharedAcknowledged: false,
      sharedOutputWarningVersion: 1,
    };
    const h = await render(() => ({
      blocked: null,
      awaitingHuman: false,
      personalMachineIntent: consent,
      extras: {},
    }));
    try {
      expect(h.text()).toContain("Connect your Mac so I can run the iOS build there.");
      // Nothing is minted until the person asks for a command.
      expect(mintEnrollToken).not.toHaveBeenCalled();

      await click(h.button("Connect a computer"));
      expect(mintEnrollToken).not.toHaveBeenCalled();
      expect(h.command()).toBe("");
      expect(h.dialogText()).toContain("Open app and connect");
      await click(
        [...(h.dialog()?.querySelectorAll<HTMLButtonElement>("button") ?? [])].find((button) =>
          button.textContent?.startsWith("Connect a server instead"),
        ) ?? null,
      );
      expect(mintEnrollToken).toHaveBeenCalledTimes(1);
      // Only me is the default, and the command is minted for it.
      expect(mintEnrollToken.mock.calls[0]).toEqual([
        "workspace",
        { scope: "user", allowScreenControl: false },
      ]);
      expect(h.dialogText()).toContain("Use your computer");
      expect(h.dialogText()).toContain("Who can use it?");
      const command = h.command;
      expect(command()).toContain("https://app.example.test/install.sh");
      expect(command()).toContain("OPENGENI_ENROLL_TOKEN=oget_token1.sig");
      expect(h.dialogText()).toContain("Works for one machine until");
      expect(h.dialogText()).toContain("Keep it private.");
      await click(h.dialogButton("Copy command"));
      expect(copyTextToClipboard).toHaveBeenCalledTimes(1);
      expect(copyTextToClipboard.mock.calls[0]![0]).toBe(command());
      expect(h.dialogText()).toContain("Waiting for the machine to connect");

      // Windows gets the PowerShell form of the same single-use token.
      await click(h.dialogButton("Windows"));
      expect(command()).toContain("irm 'https://app.example.test/install.ps1' | iex");
      expect(command()).toContain("$env:OPENGENI_ENROLL_TOKEN='oget_token1.sig'");

      // Screen control is baked into a fresh token.
      const screen = h.dialog()?.querySelector<HTMLButtonElement>('button[role="switch"]');
      await click(screen as HTMLElement | null);
      expect(mintEnrollToken.mock.calls.at(-1)).toEqual([
        "workspace",
        { scope: "user", allowScreenControl: true },
      ]);
      expect(command()).toContain("oget_token2.sig");

      // The machine comes online: the same dialog says so, by name and access.
      fleet.machines = [sessionBox, machine("mac", "Studio Mac", { scope: "user" })];
      await h.rerender();
      expect(h.dialogText()).toContain("Machine connected");
      expect(h.dialogText()).toContain("Studio Mac");
      expect(h.dialogText()).toContain("Connected");
      expect(h.dialogText()).toContain("Only me");
      expect(h.dialog()?.querySelector("[data-connect-command]")).toBeNull();
      expect(h.dialogButton("Done")).not.toBeNull();
      expect(h.text()).toContain("Studio Mac connected. Choose it below to use it here.");
      expect(h.button("Use Studio Mac in this chat")?.textContent).toContain("Use in this chat");

      // Use in this chat goes through the card's existing attach path.
      await click(h.dialogButton("Use in this chat"));
      expect(h.dialog()).toBeNull();
      expect(attach).toHaveBeenCalledWith("mac");
      expect(sendMessage).toHaveBeenCalledTimes(1);
      const [workspaceId, sessionId, input] = sendMessage.mock.calls[0]!;
      expect([workspaceId, sessionId]).toEqual(["workspace", "session"]);
      expect((input as { text: string }).text).toBe("Use the machine “Studio Mac” for this chat.");
      expect((input as Record<string, unknown>).personalResourceAttachment).toEqual(consent);
      expect(h.onConfigured).toHaveBeenCalledTimes(1);

      // The chat now runs there; the card completes and offers Chrome.
      fleet.machines = [
        { ...sessionBox, active: false },
        machine("mac", "Studio Mac", { active: true }),
      ];
      await h.rerender();
      expect(h.text()).toContain("This chat now runs on Studio Mac.");
      expect(h.text()).toContain("In this chat");
      const store = h.container.querySelector<HTMLAnchorElement>(`a[href="${STORE_URL}"]`);
      expect(store?.textContent).toContain("Add to Chrome");
      expect(store?.target).toBe("_blank");
      expect(h.text()).toContain("Add Opengeni Browser on Studio Mac");
      // The outcome is announced through a live region that stays mounted.
      expect(h.container.querySelector('[role="status"][aria-live="polite"]')?.textContent).toBe(
        "This chat now runs on Studio Mac.",
      );
    } finally {
      await h.close();
    }
  });

  test("lists machines for a member who cannot connect one, and reports a linked Chrome", async () => {
    context.accessContext.workspaceGrants = [
      { workspaceId: "workspace", permissions: ["enrollments:read", "sessions:control"] },
    ];
    fleet.canManage = false;
    fleet.machines = [
      sessionBox,
      machine("linux", "build-box", { os: "linux", hasDisplay: false }),
      machine("mac", "Studio Mac"),
      machine("old", "Old laptop", { state: "offline" }),
    ];
    browsers = {
      revision: 2,
      bridges: [],
      devices: [
        // A teammate's Chrome on another machine is not this machine's Chrome.
        {
          id: "other",
          enrollmentId: "enrollment-elsewhere",
          name: "Chrome",
          profileLabel: "Teammate",
          browserName: "Chrome",
          state: "connected",
          capabilities: { debuggerAttachment: true },
        },
        {
          id: "device",
          enrollmentId: "enrollment-mac",
          name: "Chrome",
          profileLabel: "Work",
          browserName: "Chrome",
          state: "connected",
          capabilities: { debuggerAttachment: true },
        },
      ],
    };
    const h = await render();
    try {
      // A reachable machine makes "Use in this chat" the one primary action.
      expect(h.text()).toContain("Choose where this chat runs.");
      expect(h.button("Connect a computer")).toBeNull();
      expect(h.button("Connect another machine")).toBeNull();
      expect(h.button("Use build-box in this chat")?.textContent).toBe("Use");
      // An offline machine is listed but cannot take the chat.
      expect(h.button("Use Old laptop in this chat")).toBeNull();
      expect(h.text()).toContain("Offline");
      // Members who cannot remove machines are not told to.
      expect(h.text()).not.toContain("remove a connected machine");
      await h.rerender();
      expect(h.text()).toContain("Work on Studio Mac");
      expect(h.text()).not.toContain("Teammate");
    } finally {
      await h.close();
    }
  });

  test("a member who cannot connect machines is told who can", async () => {
    context.accessContext.workspaceGrants = [
      { workspaceId: "workspace", permissions: ["enrollments:read", "sessions:control"] },
    ];
    fleet.canManage = false;
    const h = await render();
    try {
      expect(h.text()).toContain("Ask a workspace admin to connect a machine.");
      expect(h.button("Connect a computer")).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("with a machine already available, connecting another is a secondary action", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    const h = await render();
    try {
      expect(h.button("Connect a computer")).toBeNull();
      await click(h.button("Connect another machine"));
      expect(mintEnrollToken).not.toHaveBeenCalled();
      expect(h.dialogText()).toContain("Use your computer");
      expect(h.command()).toBe("");
    } finally {
      await h.close();
    }
  });

  test("screen control turns on in place, then follows each Mac permission", async () => {
    const mac = (overrides: Partial<Machine>) => machine("mac", "Studio Mac", overrides);
    fleet.machines = [sessionBox, mac({ runtime: runtime(false, granted(false, false, false)) })];
    const h = await render();
    try {
      expect(h.text()).toContain("Let agents see and use this screen");
      await click(h.button("Turn on"));
      expect(enableMachineScreenControl.mock.calls[0]).toEqual(["workspace", "enrollment-mac"]);

      // Allowed, but the agent hasn't picked it up yet.
      fleet.machines = [
        sessionBox,
        mac({ allowScreenControl: true, runtime: runtime(false, granted(false, false, false)) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Turning on…");

      fleet.machines = [
        sessionBox,
        mac({ allowScreenControl: true, runtime: runtime(true, granted(false, false, false)) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Allow Screen Recording for Opengeni on this Mac.");
      await click(h.button("Open settings"));
      expect(openMachinePrivacySettings.mock.calls.at(-1)?.[2]).toEqual({
        pane: "screen_recording",
      });
      expect(h.text()).toContain(
        "On the Mac, switch on Opengeni under Screen Recording. Choose Quit & Reopen if macOS asks.",
      );
      await click(h.button("Open again"));
      expect(openMachinePrivacySettings).toHaveBeenCalledTimes(2);

      fleet.machines = [
        sessionBox,
        mac({ allowScreenControl: true, runtime: runtime(true, granted(true, false, false)) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Allow Accessibility for Opengeni on this Mac.");
      await click(h.button("Open settings"));
      expect(openMachinePrivacySettings.mock.calls.at(-1)?.[2]).toEqual({ pane: "accessibility" });

      fleet.machines = [
        sessionBox,
        mac({ allowScreenControl: true, runtime: runtime(true, granted(true, true, true)) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Agents can see and use this screen");
      expect(h.button("Open settings")).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("allowed screen control says when it will apply", async () => {
    fleet.machines = [
      sessionBox,
      machine("mac", "Studio Mac", {
        allowScreenControl: true,
        runtime: runtime(false, null, false),
      }),
    ];
    const h = await render();
    try {
      expect(h.text()).toContain("It turns on by itself once this machine's agent is updated.");
      expect(h.button("Turn on")).toBeNull();
      await click(h.button("Update agent"));
      expect(updateMachineAgent.mock.calls[0]).toEqual(["workspace", "enrollment-mac"]);
      // Reports from before the agent said whether it holds the consent.
      fleet.machines = [
        sessionBox,
        machine("pc", "Linux box", { os: "linux", allowScreenControl: true, runtime: null }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Agents can see and use this screen");
    } finally {
      await h.close();
    }
  });

  test("a renewal that didn't complete offers Try again", async () => {
    enableResult = {
      status: "pending",
      reason: "renewal_failed",
      message: "The machine couldn't refresh its credentials. Try again in a moment.",
    };
    fleet.machines = [sessionBox, machine("mac", "Studio Mac", { runtime: runtime(false) })];
    const h = await render();
    try {
      await click(h.button("Turn on"));
      fleet.machines = [
        sessionBox,
        machine("mac", "Studio Mac", { allowScreenControl: true, runtime: runtime(false) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("couldn't refresh its credentials");
      expect(h.text()).toContain("Not on yet");
      await click(h.button("Try again"));
      expect(enableMachineScreenControl).toHaveBeenCalledTimes(2);
    } finally {
      await h.close();
    }
  });

  test("a connection too old to change in place asks for the connect command again", async () => {
    enableResult = {
      status: "pending",
      reason: "reconnect_required",
      message: "Run the connect command on the machine again with screen control on.",
    };
    fleet.machines = [sessionBox, machine("mac", "Studio Mac", { runtime: runtime(false) })];
    const h = await render();
    try {
      await click(h.button("Turn on"));
      fleet.machines = [
        sessionBox,
        machine("mac", "Studio Mac", { allowScreenControl: true, runtime: runtime(false) }),
      ];
      await h.rerender();
      expect(h.text()).toContain("Needs a fresh connection");
      await click(h.button("Connect again"));
      // Reconnecting to turn screen control on starts with it chosen, and with
      // the machine's own access: a workspace machine stays a workspace machine.
      expect(h.command()).toContain("oget_token1.sig");
      expect(mintEnrollToken.mock.calls[0]).toEqual([
        "workspace",
        { scope: "workspace", allowScreenControl: true },
      ]);
      expect(h.dialog()?.querySelector('button[role="switch"]')?.getAttribute("aria-checked")).toBe(
        "true",
      );
      const thisWorkspace = [
        ...(h.dialog()?.querySelectorAll<HTMLElement>('[role="radio"]') ?? []),
      ].find((radio) => radio.textContent?.startsWith("This workspace"));
      expect(thisWorkspace?.getAttribute("aria-checked")).toBe("true");
      // A plain Connect another machine afterwards starts from the defaults.
      await click(h.dialogButton("Close"));
      await click(h.button("Connect another machine"));
      expect(h.command()).toBe("");
      await click(
        [...(h.dialog()?.querySelectorAll<HTMLButtonElement>("button") ?? [])].find((button) =>
          button.textContent?.startsWith("Connect a server instead"),
        ) ?? null,
      );
      expect(mintEnrollToken.mock.calls.at(-1)).toEqual([
        "workspace",
        { scope: "user", allowScreenControl: false },
      ]);
    } finally {
      await h.close();
    }
  });

  test("reconnecting a personal machine keeps it Only me", async () => {
    enableResult = {
      status: "pending",
      reason: "reconnect_required",
      message: "Run the connect command on the machine again with screen control on.",
    };
    fleet.machines = [
      sessionBox,
      machine("mac", "Studio Mac", { scope: "user", runtime: runtime(false) }),
    ];
    const h = await render();
    try {
      await click(h.button("Turn on"));
      fleet.machines = [
        sessionBox,
        machine("mac", "Studio Mac", {
          scope: "user",
          allowScreenControl: true,
          runtime: runtime(false),
        }),
      ];
      await h.rerender();
      await click(h.button("Connect again"));
      expect(mintEnrollToken.mock.calls[0]).toEqual([
        "workspace",
        { scope: "user", allowScreenControl: true },
      ]);
    } finally {
      await h.close();
    }
  });

  test("an older Mac agent still gets the Screen Recording step from its reason", async () => {
    fleet.machines = [
      sessionBox,
      machine("mac", "Studio Mac", {
        allowScreenControl: true,
        desktopUnavailableReason:
          "Screen Recording permission not granted — enable it for Opengeni in System Settings.",
      }),
    ];
    const h = await render();
    try {
      expect(h.text()).toContain("Allow Screen Recording for Opengeni on this Mac.");
      await click(h.button("Open settings"));
      expect(openMachinePrivacySettings.mock.calls.at(-1)?.[2]).toEqual({
        pane: "screen_recording",
      });
    } finally {
      await h.close();
    }
  });

  test("an organization machine needs an organization admin", async () => {
    const { OpenGeniApiError } = await import("@opengeni/sdk");
    enableFailure = new OpenGeniApiError(403, "missing permission: account:admin", {});
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    const h = await render();
    try {
      await click(h.button("Turn on"));
      expect(h.text()).toContain("Only an organization admin can turn this on.");
    } finally {
      await h.close();
    }
  });

  test("members who can't manage machines are told who can turn screen control on", async () => {
    context.accessContext.workspaceGrants = [
      { workspaceId: "workspace", permissions: ["enrollments:read", "sessions:control"] },
    ];
    fleet.canManage = false;
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    const h = await render();
    try {
      expect(h.text()).toContain("Ask a workspace admin to turn it on");
      expect(h.button("Turn on")).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("a chat waiting on a question keeps it: the move happens without a message", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    const h = await render(() => ({ blocked: null, awaitingHuman: true, extras: {} }));
    try {
      await click(h.button("Use Studio Mac in this chat"));
      expect(attach).toHaveBeenCalledWith("mac");
      expect(sendMessage).not.toHaveBeenCalled();
      expect(h.text()).toContain("Answer the question above to continue.");
    } finally {
      await h.close();
    }
  });

  test("a chat that cannot take input is not moved", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    const h = await render(() => ({
      blocked: "This chat has ended.",
      awaitingHuman: false,
      extras: {},
    }));
    try {
      await click(h.button("Use Studio Mac in this chat"));
      expect(attach).not.toHaveBeenCalled();
      expect(sendMessage).not.toHaveBeenCalled();
      expect(h.text()).toContain("Couldn't move this chat to Studio Mac. This chat has ended.");
    } finally {
      await h.close();
    }
  });

  test("moving onto my own machine carries my consent to use it in this chat", async () => {
    // Without the consent the chat points at the machine but every turn is
    // refused at admission: only a message that carries it grants the machine.
    const consent = {
      mode: "session",
      expectedAuthorityEpoch: 3,
      workspaceSharedAcknowledged: true,
      sharedOutputWarningVersion: 1,
    };
    fleet.machines = [sessionBox, machine("mac", "Studio Mac", { scope: "user" })];
    const h = await render(() => ({
      blocked: null,
      awaitingHuman: false,
      personalMachineIntent: consent,
      extras: { model: "model-a" },
    }));
    try {
      await click(h.button("Use Studio Mac in this chat"));
      expect(attach).toHaveBeenCalledWith("mac");
      expect(sendMessage).toHaveBeenCalledTimes(1);
      const input = sendMessage.mock.calls[0]![2] as Record<string, unknown>;
      expect(input.text).toBe("Use the machine “Studio Mac” for this chat.");
      expect(input.model).toBe("model-a");
      expect(input.personalResourceAttachment).toEqual(consent);
    } finally {
      await h.close();
    }
  });

  test("a refused machine leads with allowing the machine the agent asked for", async () => {
    const consent = {
      mode: "session",
      expectedAuthorityEpoch: 3,
      workspaceSharedAcknowledged: true,
      sharedOutputWarningVersion: 1,
    };
    fleet.machines = [
      sessionBox,
      machine("mac", "Studio Mac", { scope: "user" }),
      machine("pc", "Build box", { scope: "workspace" }),
    ];
    const h = await render(
      () => ({ blocked: null, awaitingHuman: false, personalMachineIntent: consent, extras: {} }),
      { ...notice, requestedSandboxId: "mac" } as AuthNeededItem,
    );
    try {
      expect(h.container.querySelector("h3")?.textContent).toBe("Studio Mac");
      expect(h.text()).toContain("The agent asked to use this machine.");
      // Other machines wait behind one quiet toggle.
      expect(h.text()).not.toContain("Build box");
      expect(h.button("Connect a computer")).toBeNull();
      const toggle = h.button("Use a different machine");
      expect(toggle?.getAttribute("aria-expanded")).toBe("false");
      await click(toggle);
      expect(h.text()).toContain("Build box");
      expect(h.button("Use Studio Mac in this chat")).toBeNull();

      await click(h.button("Allow"));
      expect(attach).toHaveBeenCalledWith("mac");
      expect(sendMessage).toHaveBeenCalledTimes(1);
      const input = sendMessage.mock.calls[0]![2] as Record<string, unknown>;
      expect(input.text).toBe("Use the machine “Studio Mac” for this chat.");
      expect(input.personalResourceAttachment).toEqual(consent);
    } finally {
      await h.close();
    }
  });

  test("a requested machine that is offline says to turn it on", async () => {
    fleet.machines = [
      sessionBox,
      machine("mac", "Studio Mac", { scope: "user", state: "offline" }),
    ];
    const h = await render(undefined, { ...notice, requestedSandboxId: "mac" } as AuthNeededItem);
    try {
      expect(h.text()).toContain("The agent asked to use Studio Mac.");
      expect(h.text()).toContain("Turn on Studio Mac to allow it here.");
      expect(h.button("Allow")).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("an earlier card asked again below is one quiet line", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac", { scope: "user" })];
    const h = await render(undefined, {
      ...notice,
      requestedSandboxId: "mac",
      askedAgainLater: true,
    } as AuthNeededItem);
    try {
      expect(h.text()).toBe("The agent asked to use a machine. It asked again below.");
      expect(h.container.querySelector("button")).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("a shared machine needs no personal consent", async () => {
    fleet.machines = [sessionBox, machine("pc", "Build box", { scope: "workspace" })];
    const h = await render(() => ({
      blocked: null,
      awaitingHuman: false,
      personalMachineIntent: { mode: "session" },
      extras: {},
    }));
    try {
      await click(h.button("Use Build box in this chat"));
      expect(sendMessage).toHaveBeenCalledTimes(1);
      const input = sendMessage.mock.calls[0]![2] as Record<string, unknown>;
      expect(input.personalResourceAttachment).toBeUndefined();
    } finally {
      await h.close();
    }
  });

  test("reconnecting a known offline machine counts as connected; closing stops watching", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac", { state: "offline" })];
    const h = await render();
    try {
      await click(h.button("Connect a computer"));
      expect(h.command()).toBe("");
      fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
      await h.rerender();
      // A workspace machine says so; Done just closes.
      expect(h.dialogText()).toContain("Machine connected");
      expect(h.dialogText()).toContain("Workspace");
      await click(h.dialogButton("Done"));
      expect(h.dialog()).toBeNull();
      expect(attach).not.toHaveBeenCalled();
      expect(h.text()).toContain("Studio Mac connected.");

      await click(h.button("Connect another machine"));
      expect(h.dialogText()).toContain("Use your computer");
      await click(h.dialogButton("Close"));
      expect(h.dialog()).toBeNull();
      // Nothing that appears later is treated as just connected.
      fleet.machines = [...fleet.machines, machine("pc", "Office PC", { os: "windows" })];
      await h.rerender();
      expect(h.text()).not.toContain("Office PC connected.");
      expect(h.dialog()).toBeNull();
    } finally {
      await h.close();
    }
  });

  test("the message quotes and shortens the machine name", async () => {
    const { machineUseMessage } = await import("./session-machine-card");
    expect(machineUseMessage("Mac.\nAlso push to main")).toBe(
      "Use the machine “Mac. Also push to main” for this chat.",
    );
    expect(machineUseMessage("x".repeat(100))).toBe(
      `Use the machine “${"x".repeat(59)}…” for this chat.`,
    );
    expect(machineUseMessage("“quoted”")).toBe("Use the machine “quoted” for this chat.");
  });

  test("a failed move says so and sends nothing", async () => {
    fleet.machines = [sessionBox, machine("mac", "Studio Mac")];
    attach.mockImplementationOnce(async () => false);
    const h = await render();
    try {
      await click(h.button("Use Studio Mac in this chat"));
      expect(h.text()).toContain("Couldn't move this chat to Studio Mac. Try again.");
      expect(sendMessage).not.toHaveBeenCalled();
    } finally {
      await h.close();
    }
  });

  test("without machine access the card explains instead of offering actions", async () => {
    context.accessContext.workspaceGrants = [{ workspaceId: "workspace", permissions: [] }];
    fleet.canRead = false;
    fleet.canManage = false;
    fleet.machines = [];
    const h = await render();
    try {
      expect(h.text()).toContain("You don't have access to this workspace's machines.");
      expect(h.button("Connect a computer")).toBeNull();
      expect(listAttachedBrowsers).not.toHaveBeenCalled();
    } finally {
      await h.close();
    }
  });
});