from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[1]


def test_teleo_agent_template_supports_optional_per_agent_env_file():
    unit = (REPO_ROOT / "systemd" / "teleo-agent@.service").read_text()

    assert "Environment=PYTHONUNBUFFERED=1" in unit
    assert "EnvironmentFile=-/opt/teleo-eval/secrets/teleo-agent-%i.env" in unit


def test_teleo_agent_template_allows_transcript_dumps_under_strict_fs():
    unit = (REPO_ROOT / "systemd" / "teleo-agent@.service").read_text()

    assert "ProtectSystem=strict" in unit
    assert "ReadWritePaths=/opt/teleo-eval/transcripts" in unit


def test_deploy_scripts_restart_wallet_test_agent_when_present():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert "add_restart_if_unit_exists teleo-agent@leo-wallet-test" in auto_deploy
    assert 'systemctl list-units --all --full "$1.service"' in auto_deploy
    assert "teleo-agent@leo-wallet-test" in manual_deploy


def test_deploy_scripts_do_not_start_inactive_legacy_leo_agent():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert "add_restart_if_unit_active teleo-agent@leo" in auto_deploy
    assert "add_restart teleo-agent@leo" not in auto_deploy
    assert "systemctl is-active --quiet teleo-agent@leo.service" in manual_deploy
    assert "teleo-pipeline teleo-diagnostics teleo-agent@leo" not in manual_deploy


def test_auto_deploy_prefers_github_remote_when_present():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()

    assert 'DEPLOY_REMOTE="${TELEO_DEPLOY_REMOTE:-}"' in auto_deploy
    assert 'remote get-url github' in auto_deploy
    assert 'git fetch "$DEPLOY_REMOTE" main' in auto_deploy
    assert 'git rev-parse "$DEPLOY_REMOTE/main"' in auto_deploy
    assert 'git merge --ff-only "$DEPLOY_REMOTE/main"' in auto_deploy


def test_auto_deploy_executable_safety_net_stays_inside_synced_dirs():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()

    assert "for dir in \"$PIPELINE_DIR\" \"$TELEGRAM_DIR\" \"$DIAGNOSTICS_DIR\" \"$AGENT_STATE_DIR\"" in auto_deploy
    assert "find /opt/teleo-eval -maxdepth 3 -name '*.sh'" not in auto_deploy
    assert "backups" in auto_deploy


def test_agent_healthcheck_timer_runs_both_live_telegram_agents():
    service = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.service").read_text()
    timer = (REPO_ROOT / "systemd" / "teleo-agent-healthcheck.timer").read_text()

    assert "/opt/teleo-eval/telegram/agent_healthcheck.py" in service
    assert "--agents leo leo-wallet-test" in service
    assert "--since \"20 min ago\"" in service
    assert "OnUnitActiveSec=5min" in timer
    assert "WantedBy=timers.target" in timer


def test_deploy_scripts_install_systemd_units_and_enable_agent_healthcheck():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert 'SYSTEMD_DIR="/etc/systemd/system"' in auto_deploy
    assert 'sudo install -m 0644 "$unit" "$SYSTEMD_DIR/$(basename "$unit")"' in auto_deploy
    assert "sudo systemctl daemon-reload" in auto_deploy
    assert "sudo systemctl enable --now teleo-agent-healthcheck.timer" in auto_deploy
    assert "git diff --name-only \"$OLD_SHA\" \"$NEW_SHA\" -- systemd/teleo-agent@.service" in auto_deploy

    assert 'VPS_SYSTEMD="/etc/systemd/system"' in manual_deploy
    assert "teleo-agent-healthcheck.timer" in manual_deploy


def test_deploy_scripts_sync_leoclean_skills_and_restart_gateway_when_active():
    auto_deploy = (REPO_ROOT / "deploy" / "auto-deploy.sh").read_text()
    manual_deploy = (REPO_ROOT / "deploy" / "deploy.sh").read_text()

    assert 'LEOCLEAN_SKILLS_DIR="/home/teleo/.hermes/profiles/leoclean/skills"' in auto_deploy
    assert 'hermes-agent/leoclean-skills/vps/' in auto_deploy
    assert 'add_restart_if_unit_active leoclean-gateway' in auto_deploy
    assert 'VPS_LEOCLEAN_SKILLS="/home/teleo/.hermes/profiles/leoclean/skills"' in manual_deploy
    assert 'hermes-agent/leoclean-skills/vps/' in manual_deploy
    assert 'systemctl is-active --quiet leoclean-gateway.service' in manual_deploy


def test_gcp_leoclean_skill_sync_targets_parallel_runtime_without_secrets():
    script_path = REPO_ROOT / "deploy" / "sync-gcp-leoclean-skills.sh"
    script = script_path.read_text()

    assert 'PROJECT="${PROJECT:-teleo-501523}"' in script
    assert 'ZONE="${ZONE:-europe-west6-a}"' in script
    assert 'INSTANCE="${INSTANCE:-teleo-prod-1}"' in script
    assert 'SERVICE="${SERVICE:-leoclean-gcp-prod-parallel.service}"' in script
    assert "hermes-agent/leoclean-skills/gcp" in script
    assert "--tunnel-through-iap" in script
    assert "/home/teleo/.hermes/profiles/leoclean/skills" in script
    assert "/kb/claims/<claim_id>|wrap claim IDs, proposal IDs" in script
    assert 'COPYFILE_DISABLE=1 tar --format=ustar -C "$SOURCE_DIR" -cf - .' in script
    assert 'sudo tar -C "\\$remote_skills" -xf -' in script
    assert "sudo systemctl restart" in script
    assert "sudo rsync" not in script
    assert "TELEGRAM_BOT_TOKEN" not in script
    assert "CLOUDSQL_PASSWORD" not in script