#!/bin/bash
set -euo pipefail

node - <<'NODE'
const fs = require('node:fs');
const raw = process.env.EVAL_FINAL_MESSAGE || '';
let result;
try {
  result = JSON.parse(raw);
} catch (error) {
  console.error(`mode:agent 输出不是单个裸 JSON：${error.message}`);
  process.exit(1);
}

const failures = [];

if (result.mutation_policy !== 'report-only') {
  failures.push('mode:agent 未强制 mutation_policy=report-only');
}
if ('applied_fixes' in result) {
  failures.push('mode:agent 不应返回 applied_fixes');
}
if (!Array.isArray(result.findings) || result.findings.length === 0) {
  failures.push('mode:agent 未返回结构化 finding');
}
const findingText = JSON.stringify(result.findings);
if (!findingText.includes('src/orders.js') || !/(tenant|租户|越权|授权|ownership)/i.test(findingText)) {
  failures.push('结构化 finding 未定位跨租户授权绕过');
}
if (result.scope?.files_changed !== 1) {
  failures.push(`scope.files_changed 应为 1，实际为 ${String(result.scope?.files_changed)}`);
}
if (result.status !== 'degraded') {
  failures.push('缺少 dispatch 授权时应返回 degraded');
}
if (result.coverage?.dispatch_reason_code !== 'dispatch_authorization_missing') {
  failures.push('未返回 dispatch_authorization_missing');
}
if (!result.coverage?.verification_evidence) {
  failures.push('缺少 verification_evidence');
}
if (!fs.readFileSync('src/orders.js', 'utf8').includes('return orders.find((candidate) => candidate.id === orderId) || null;')) {
  failures.push('mode:agent 修改了被审查文件');
}

if (failures.length > 0) {
  for (const failure of failures) {
    console.error(failure);
  }
  process.exit(1);
}
NODE