#!/usr/bin/env bash
set -uo pipefail
DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
HOOK="$DIR/../preference-consult-gate.sh"
PASS=0; FAIL=0; FAILED=()
run() { printf '%s' "$1" | bash "$HOOK" >/dev/null 2>&1; echo $?; }
assert_exit() { local got; got=$(run "$2"); if [ "$got" = "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: want exit $1 got $got"); fi; }

TMP="$(mktemp -d)"
# Transcript WITH a profile-read this turn. The profile-read's RESULT is recorded
# as a user entry whose content is only tool_result blocks (the real Claude Code
# shape); that entry must NOT be treated as the human turn boundary, or the gate
# false-blocks every compliant send.
CONSULTED="$TMP/consulted.jsonl"
{
  printf '%s\n' '{"type":"user","message":{"role":"user","content":"make the quote"}}'
  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"saving the pdf now"}]}}'
} > "$CONSULTED"
# Genuine human turn recorded as a content LIST (image + text), not a string, must
# still count as the boundary.
CONSULTED_LIST="$TMP/consulted_list.jsonl"
{
  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"text","text":"make the quote"}]}}'
  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
  printf '%s\n' '{"type":"user","message":{"role":"user","content":[{"type":"tool_result","content":"prefs..."}]}}'
} > "$CONSULTED_LIST"
# Transcript with NO profile-read this turn (one appears BEFORE the last user msg only).
UNCONSULTED="$TMP/unconsulted.jsonl"
{
  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"tool_use","name":"mcp__plugin_memory_memory__profile-read","input":{}}]}}'
  printf '%s\n' '{"type":"user","message":{"role":"user","content":"send it"}}'
  printf '%s\n' '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"ok"}]}}'
} > "$UNCONSULTED"

pdf_env() { printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"memory/users/+447700900000/documents/quote.pdf"},"transcript_path":"%s"}' "$1"; }
email_att_env() { printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{"attachments":["memory/users/+44/documents/x.pdf"]},"transcript_path":"%s"}' "$1"; }

# Gated tool + consulted (with a tool_result user entry after profile-read) -> allow.
assert_exit 0 "$(pdf_env "$CONSULTED")" "pdf consulted allows despite tool_result user entry"
# Genuine user turn as a content list -> boundary still detected, consulted -> allow.
assert_exit 0 "$(pdf_env "$CONSULTED_LIST")" "pdf consulted (list user turn) allows"
# Gated tool + not consulted -> block.
assert_exit 2 "$(pdf_env "$UNCONSULTED")" "pdf unconsulted blocks"
# Email with attachment + not consulted -> block.
assert_exit 2 "$(email_att_env "$UNCONSULTED")" "email+attach unconsulted blocks"
# Email with NO attachment -> not a document deliverable -> allow.
assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_email_email__email-send","tool_input":{},"transcript_path":"%s"}' "$UNCONSULTED")" "email no-attach allows"
# browser-pdf-save OUTSIDE customer documents scope -> allow.
assert_exit 0 "$(printf '{"tool_name":"mcp__plugin_browser_browser__browser-pdf-save","tool_input":{"path":"output/report.pdf"},"transcript_path":"%s"}' "$UNCONSULTED")" "pdf outside scope allows"
# Non-send tool -> allow.
assert_exit 0 "$(printf '{"tool_name":"Read","tool_input":{"file_path":"x"},"transcript_path":"%s"}' "$UNCONSULTED")" "read allows"
# Empty stdin -> fail open (allow).
assert_exit 0 "" "empty stdin fails open"

echo "----- $PASS passed, $FAIL failed -----"
for f in "${FAILED[@]:-}"; do [ -n "$f" ] && echo "  $f"; done
[ "$FAIL" -eq 0 ]