#!/usr/bin/env bash
# Task 1996 — an upgrade must not re-deliver an agent the operator switched off.
#
# provision_account_dir wipes every core specialist and re-copies it from the
# bundled templates on every run. Without this, disabling an agent lapses on the
# next publish: the file reappears in the dispatchable directory, nothing logs,
# and the card still reads "disabled". That is the no-event failure the task
# names, so it is pinned here.
set -uo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PLAT_SCRIPTS="$SCRIPT_DIR/.."
PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
TEMPLATES_DIR="$PROJECT_DIR/templates"
PASS=0; FAIL=0; FAILED=()
assert_absent() { if [ ! -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected absent [$1]"); fi; }
assert_present() { if [ -e "$1" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$2: expected present [$1]"); fi; }
assert_eq() { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }

. "$PLAT_SCRIPTS/lib/provision-account-dir.sh"
export TEMPLATES_DIR PROJECT_DIR
export SCRIPT_DIR="$PLAT_SCRIPTS"
export USERS_FILE="/nonexistent/users.json"

# A real shipped specialist, so the test exercises the same wipe-and-recopy loop
# a publish runs rather than a synthetic filename.
DISABLED_AGENT="coding-assistant.md"

T1=$(mktemp -d); A1="$T1/acct"
provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" >/dev/null 2>&1
assert_present "$A1/specialists/agents/$DISABLED_AGENT" "baseline-agent-delivered"

# The operator disables it: the file moves to quarantine and the store names it.
mkdir -p "$A1/specialists/agents-disabled"
mv "$A1/specialists/agents/$DISABLED_AGENT" "$A1/specialists/agents-disabled/$DISABLED_AGENT"
printf '{"disabled":["%s"]}\n' "$DISABLED_AGENT" > "$A1/agents-disabled.json"

# The upgrade runs again.
OUT="$(provision_account_dir "$A1" "dddddddd-dddd-dddd-dddd-dddddddddddd" "house" 2>&1)"

assert_absent "$A1/specialists/agents/$DISABLED_AGENT" "disabled-agent-not-redelivered"
assert_present "$A1/specialists/agents-disabled/$DISABLED_AGENT" "quarantined-copy-survives-upgrade"
# Every other core specialist is still delivered: the guard removes what the
# operator named, not the whole set.
assert_present "$A1/specialists/agents/librarian.md" "other-agents-still-delivered"
# The removal is reported, so an operator reading the publish output can see
# which agents provisioning deliberately withheld.
assert_eq "$(printf '%s' "$OUT" | grep -c "agents-withheld=1")" "1" "withheld-count-logged"
rm -rf "$T1"

# No store, no behaviour change: every core specialist is delivered.
T2=$(mktemp -d); A2="$T2/acct"
provision_account_dir "$A2" "eeeeeeee-eeee-eeee-eeee-eeeeeeeeeeee" "house" >/dev/null 2>&1
assert_present "$A2/specialists/agents/$DISABLED_AGENT" "no-store-delivers-everything"
rm -rf "$T2"

# A malformed store withholds nothing rather than withholding everything: an
# unreadable file is not evidence that the operator disabled an agent.
T3=$(mktemp -d); A3="$T3/acct"
provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" >/dev/null 2>&1
printf '{ not json\n' > "$A3/agents-disabled.json"
OUT3="$(provision_account_dir "$A3" "ffffffff-ffff-ffff-ffff-ffffffffffff" "house" 2>&1)"
assert_present "$A3/specialists/agents/$DISABLED_AGENT" "malformed-store-withholds-nothing"
assert_eq "$(printf '%s' "$OUT3" | grep -c 'agents-disabled-store-unreadable')" "1" "malformed-store-reported"
rm -rf "$T3"

# Review finding: the withhold used `rm -f` unconditionally. In the drift state
# the reconcile check exists to catch — store names it, file is live, quarantine
# empty — that deletes the only copy of a premium `--` agent or an operator-edited
# override, because the replace loop skips `*--*` and the copy loop only restores
# templates. Withholding must move, never destroy.
T4=$(mktemp -d); A4="$T4/acct"
provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1
mkdir -p "$A4/specialists/agents"
printf -- '---\nname: quoter\n---\n\nOperator edited this premium agent.\n' > "$A4/specialists/agents/sitedesk--quoter.md"
printf '{"disabled":["sitedesk--quoter.md"]}\n' > "$A4/agents-disabled.json"
provision_account_dir "$A4" "aaaa1111-aaaa-1111-aaaa-111111111111" "house" >/dev/null 2>&1

assert_absent "$A4/specialists/agents/sitedesk--quoter.md" "premium-withheld-from-dispatch"
assert_present "$A4/specialists/agents-disabled/sitedesk--quoter.md" "premium-preserved-not-destroyed"
assert_eq "$(grep -c 'Operator edited this premium agent' "$A4/specialists/agents-disabled/sitedesk--quoter.md" 2>/dev/null || echo 0)" "1" "premium-content-intact"
rm -rf "$T4"

echo "PASS=$PASS FAIL=$FAIL"
if [ "$FAIL" -gt 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi