import subprocess
from pathlib import Path

REPO_ROOT = Path(__file__).resolve().parents[1]


def test_teleo_agent_template_supports_optional_per_agent_env_file():
    unit = (REPO_ROOT / "systemd" / "teleo-agent@.service").read_text()

    assert "Environment=PYTHONUNBUFFERED=1" in unit
    assert "EnvironmentFile=-/opt/teleo-eval/secrets/teleo-agent-%i.env" in unit


def test_teleo_agent_template_allows_transcript_dumps_under_strict_fs():
    unit = (REPO_ROOT / "systemd" / "teleo-agent@.service").read_text()

    assert "ProtectSystem=strict" in unit
    assert "ReadWritePaths=/opt/teleo-eval/transcripts" in unit


def test_deploy_scripts_restart_wallet_test_agent_when_present():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert "add_restart_if_unit_exists teleo-agent@leo-wallet-test" in auto_deploy
    assert 'systemctl list-units --all --full "$1.service"' in auto_deploy
    assert "teleo-agent@leo-wallet-test" in manual_deploy


def test_deploy_scripts_do_not_start_inactive_legacy_leo_agent():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert "add_restart_if_unit_active teleo-agent@leo" in auto_deploy
    assert "add_restart teleo-agent@leo" not in auto_deploy
    assert "systemctl is-active --quiet teleo-agent@leo.service" in manual_deploy
    assert "teleo-pipeline teleo-diagnostics teleo-agent@leo" not in manual_deploy


def test_auto_deploy_prefers_github_remote_when_present():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()

    assert 'DEPLOY_REMOTE="${TELEO_DEPLOY_REMOTE:-}"' in auto_deploy
    assert 'remote get-url github' in auto_deploy
    assert 'git fetch "$DEPLOY_REMOTE" main' in auto_deploy
    assert 'git rev-parse "$DEPLOY_REMOTE/main"' in auto_deploy
    assert 'git merge --ff-only "$DEPLOY_REMOTE/main"' in auto_deploy


def test_auto_deploy_executable_safety_net_stays_inside_synced_dirs():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()

    assert "for dir in \"$PIPELINE_DIR\" \"$TELEGRAM_DIR\" \"$DIAGNOSTICS_DIR\" \"$AGENT_STATE_DIR\"" in auto_deploy
    assert "find /opt/teleo-eval -maxdepth 3 -name '*.sh'" not in auto_deploy
    assert "backups" in auto_deploy


def test_agent_healthcheck_timer_runs_both_live_telegram_agents():
    service = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.service").read_text()
    timer = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.timer").read_text()

    assert "/opt/teleo-eval/telegram/agent_healthcheck.py" in service
    assert "--agents leo leo-wallet-test" in service
    assert "--since \"20 min ago\"" in service
    assert "OnUnitActiveSec=5min" in timer
    assert "WantedBy=timers.target" in timer


def test_deploy_scripts_install_systemd_units_and_enable_agent_healthcheck():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert 'SYSTEMD_DIR="/etc/systemd/system"' in auto_deploy
    assert 'sudo install -m 0644 "$unit" "$SYSTEMD_DIR/$(basename "$unit")"' in auto_deploy
    assert "sudo systemctl daemon-reload" in auto_deploy
    assert "sudo systemctl enable --now teleo-agent-healthcheck.timer" in auto_deploy
    assert "git diff --name-only \"$OLD_SHA\" \"$NEW_SHA\" -- systemd/teleo-agent@.service" in auto_deploy

    assert 'VPS_SYSTEMD="/etc/systemd/system"' in manual_deploy
    assert "teleo-agent-healthcheck.timer" in manual_deploy


def _leoclean_gateway_restart_required(*changed_paths: str) -> bool:
    result = subprocess.run(
        ["bash", str(REPO_ROOT / "deploy" / "leoclean-gateway-restart-required.sh")],
        input="\n".join(changed_paths),
        capture_output=True,
        check=False,
        text=True,
    )
    assert result.returncode in {0, 1}, result.stderr
    return result.returncode == 0


def test_deploy_scripts_sync_leoclean_skills_and_restart_gateway_for_runtime_changes():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()
    sudoers = (REPO_ROOT / "deploy" / "sudoers" / "teleo-auto-deploy").read_text()

    assert 'LEOCLEAN_BIN_DIR="/home/teleo/.hermes/profiles/leoclean/bin"' in auto_deploy
    assert 'LEOCLEAN_SKILLS_DIR="/home/teleo/.hermes/profiles/leoclean/skills"' in auto_deploy
    assert 'LEOCLEAN_PLUGINS_DIR="/home/teleo/.hermes/profiles/leoclean/plugins"' in auto_deploy
    assert 'hermes-agent/leoclean-bin/' in auto_deploy
    assert 'hermes-agent/leoclean-skills/vps/' in auto_deploy
    assert 'hermes-agent/leoclean-plugins/vps/' in auto_deploy
    assert 'HERMES_PATCH_DIR="/home/teleo/.hermes/teleo-runtime-patches"' in auto_deploy
    assert '"status": "installed_now"' in auto_deploy
    assert 'Hermes response-transform drift repaired' in auto_deploy
    assert 'deploy/leoclean-gateway-restart-required.sh' in auto_deploy
    assert 'TELEO_AUTO_DEPLOY_REEXECED' in auto_deploy
    assert 'exec bash "$DEPLOY_CHECKOUT/deploy/auto-deploy.sh"' in auto_deploy
    assert 'add_restart_if_unit_active leoclean-gateway' in auto_deploy
    assert 'sudo systemctl restart "$svc"' in auto_deploy
    assert "sudo systemctl restart $RESTART" not in auto_deploy
    assert "NOPASSWD: /usr/bin/systemctl restart leoclean-gateway" in sudoers
    assert "NOPASSWD: /bin/systemctl restart leoclean-gateway" in sudoers
    assert 'VPS_LEOCLEAN_BIN="/home/teleo/.hermes/profiles/leoclean/bin"' in manual_deploy
    assert 'VPS_LEOCLEAN_SKILLS="/home/teleo/.hermes/profiles/leoclean/skills"' in manual_deploy
    assert 'VPS_LEOCLEAN_PLUGINS="/home/teleo/.hermes/profiles/leoclean/plugins"' in manual_deploy
    assert 'hermes-agent/leoclean-bin/' in manual_deploy
    assert 'hermes-agent/leoclean-skills/vps/' in manual_deploy
    assert 'hermes-agent/leoclean-plugins/vps/' in manual_deploy
    assert 'VPS_HERMES_PATCHES="/home/teleo/.hermes/teleo-runtime-patches"' in manual_deploy
    assert 'systemctl is-active --quiet leoclean-gateway.service' in manual_deploy


def test_deploy_scripts_syntax_check_leoclean_database_runtime_before_restart():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert "hermes-agent/leoclean-bin/*.py" in auto_deploy
    assert "scripts/leo_behavior_manifest.py" in auto_deploy
    assert '"$REPO_ROOT/hermes-agent/leoclean-bin/"*.py' in manual_deploy
    assert '"$REPO_ROOT/scripts/leo_behavior_manifest.py"' in manual_deploy


def test_auto_deploy_hot_syncs_leoclean_markdown_without_gateway_restart():
    assert not _leoclean_gateway_restart_required(
        "hermes-agent/leoclean-skills/vps/teleo-kb-bridge/SKILL.md"
    )
    assert not _leoclean_gateway_restart_required(
        "hermes-agent/leoclean-skills/vps/live-leo-telegram/SKILL.md"
    )


def test_auto_deploy_restarts_gateway_for_leoclean_runtime_changes():
    assert _leoclean_gateway_restart_required("hermes-agent/leoclean-bin/kb_tool.py")
    assert _leoclean_gateway_restart_required(
        "hermes-agent/leoclean-skills/vps/teleo-kb-bridge/runtime_helper.py"
    )
    assert _leoclean_gateway_restart_required(
        "hermes-agent/leoclean-plugins/vps/leo-db-context/__init__.py"
    )
    assert _leoclean_gateway_restart_required(
        "hermes-agent/patches/apply_response_transform_hook.py"
    )


def test_auto_deploy_sudoers_installer_is_root_only_and_visudo_checked():
    installer = (REPO_ROOT / "deploy" / "install-auto-deploy-sudoers.sh").read_text()

    assert 'TARGET="/etc/sudoers.d/teleo-auto-deploy"' in installer
    assert 'id -u' in installer
    assert 'install -m 0440 "$SOURCE" "$TARGET"' in installer
    assert 'visudo -cf "$TARGET"' in installer


def test_gcp_leoclean_skill_sync_targets_parallel_runtime_without_secrets():
    script_path = REPO_ROOT / "deploy" / "sync-gcp-leoclean-skills.sh"
    script = script_path.read_text()

    assert 'PROJECT="${PROJECT:-teleo-501523}"' in script
    assert 'ZONE="${ZONE:-europe-west6-a}"' in script
    assert 'INSTANCE="${INSTANCE:-teleo-prod-1}"' in script
    assert 'SERVICE="${SERVICE:-leoclean-gcp-prod-parallel.service}"' in script
    assert "hermes-agent/leoclean-skills/gcp" in script
    assert "--tunnel-through-iap" in script
    assert "/home/teleo/.hermes/profiles/leoclean/skills" in script
    assert "/kb/claims/<claim_id>|wrap claim IDs, proposal IDs" in script
    assert 'COPYFILE_DISABLE=1 tar --format=ustar -C "$SOURCE_DIR" -cf - .' in script
    assert 'sudo tar -C "\\$remote_skills" -xf -' in script
    assert "sudo systemctl restart" in script
    assert "sudo rsync" not in script
    assert "TELEGRAM_BOT_TOKEN" not in script
    assert "CLOUDSQL_PASSWORD" not in script
