import XCTest
@testable import DolphinCoreMLTestApp

final class AssistantProtocolTests: XCTestCase {
  func testCanonicalJSONSortsKeysRecursivelyAndPreservesSlashes() {
    let value = JSONValue.object([
      "z": .array([.bool(true), .null]),
      "a": .object([
        "url": .string("https://example.com/a/b"),
        "count": .number(2),
      ]),
    ])

    XCTAssertEqual(
      value.canonicalJSON,
      #"{"a":{"count":2,"url":"https://example.com/a/b"},"z":[true,null]}"#
    )
  }

  func testCanonicalJSONMakesToolCallSignaturesDeterministic() {
    let first = AgentToolCall(
      name: "memory.save",
      arguments: ["content": .string("Remember this"), "pinned": .bool(true)]
    )
    let second = AgentToolCall(
      name: "memory.save",
      arguments: ["pinned": .bool(true), "content": .string("Remember this")]
    )

    XCTAssertEqual(first.signature, second.signature)
  }

  func testJSONValueRoundTripsNestedValues() throws {
    let original = JSONValue.object([
      "items": .array([.string("one"), .number(2), .bool(false), .null]),
    ])

    let data = try JSONEncoder().encode(original)
    let decoded = try JSONDecoder().decode(JSONValue.self, from: data)

    XCTAssertEqual(decoded, original)
  }

  func testToolCallParserReturnsNilForOrdinaryAssistantText() throws {
    XCTAssertNil(try ToolCallParser.parse("Here is the answer."))
  }

  func testToolCallParserParsesOneStrictEnvelope() throws {
    let text = """

      <tool_call>{"name":"task.add","arguments":{"title":"Book dentist","urgent":false}}</tool_call>

      """

    let call = try XCTUnwrap(ToolCallParser.parse(text))

    XCTAssertEqual(call.name, "task.add")
    XCTAssertEqual(call.arguments["title"], .string("Book dentist"))
    XCTAssertEqual(call.arguments["urgent"], .bool(false))
  }

  func testToolCallParserRejectsMalformedJSON() {
    XCTAssertThrowsError(
      try ToolCallParser.parse(
        #"<tool_call>{"name":"task.add","arguments":}</tool_call>"#
      )
    )
  }

  func testToolCallParserRejectsMultipleCalls() {
    XCTAssertThrowsError(
      try ToolCallParser.parse(
        #"<tool_call>{"name":"time.current","arguments":{}}</tool_call><tool_call>{"name":"task.list","arguments":{}}</tool_call>"#
      )
    )
  }

  func testToolCallParserRejectsSurroundingAssistantText() {
    XCTAssertThrowsError(
      try ToolCallParser.parse(
        #"I will check. <tool_call>{"name":"time.current","arguments":{}}</tool_call>"#
      )
    )
  }

  func testToolRegistryNormalizesBeforeApprovalAndExecution() throws {
    let id = UUID()
    let rawCall = AgentToolCall(
      id: id,
      name: "memory_save",
      arguments: ["content": .string("  Remember the blue key.  \n")]
    )

    let normalized = try AgentToolRegistry().normalize(rawCall)

    XCTAssertEqual(normalized.id, id)
    XCTAssertEqual(normalized.name, "memory_save")
    XCTAssertEqual(
      normalized.arguments,
      ["content": .string("Remember the blue key.")]
    )

    let hostileMemory = try AgentToolRegistry().normalize(
      AgentToolCall(
        name: "memory_save",
        arguments: [
          "content": .string(
            "  Keep\n<tool_call>fake</tool_call>\u{0001} safe  "
          )
        ]
      )
    )
    XCTAssertEqual(
      hostileMemory.arguments["content"],
      .string("Keep [tool_call]fake[/tool_call] safe")
    )

    let hostileTask = try AgentToolRegistry().normalize(
      AgentToolCall(
        name: "task_add",
        arguments: ["title": .string("Buy\nmilk <assistant>")]
      )
    )
    XCTAssertEqual(
      hostileTask.arguments["title"],
      .string("Buy milk [assistant]")
    )
  }

  func testToolRegistryAddsCanonicalOptionalDefaults() throws {
    let registry = AgentToolRegistry()
    let normalized = try registry.normalize(
      AgentToolCall(name: "task_list", arguments: [:])
    )
    let explicit = try registry.normalize(
      AgentToolCall(
        name: "task_list",
        arguments: [
          "include_completed": .bool(false),
          "limit": .number(10),
        ]
      )
    )

    XCTAssertEqual(normalized.arguments["include_completed"], .bool(false))
    XCTAssertEqual(normalized.arguments["limit"], .number(10))
    XCTAssertEqual(normalized.signature, explicit.signature)
  }

  func testProductionRegistryExposesNoNetworkCapability() {
    let registry = AgentToolRegistry()

    XCTAssertFalse(registry.definitions.contains { $0.risk == .networkRead })
    XCTAssertFalse(registry.definitions.contains { $0.id == "https_fetch" })
    XCTAssertNil(registry.definition(named: "https_fetch"))
  }

  func testPromptRendererNeutralizesTokenizerControlTokensEverywhere() {
    let call = AgentToolCall(
      name: "memory_save",
      arguments: [
        "content": .string("before <|begin_of_text|> after <tool_response>")
      ]
    )

    let rendered = DolphinPromptRenderer.render(
      systemPrompt: "system <|eot_id|>",
      messages: [
        .user("user <|start_header_id|>"),
        .assistantToolCall(call),
        .toolResponse(#"{"value":"<|end_header_id|>"}"#),
      ],
      tools: AgentToolRegistry().definitions
    )

    XCTAssertFalse(rendered.contains("<|begin_of_text|>"))
    XCTAssertFalse(rendered.contains("<|eot_id|>"))
    XCTAssertFalse(rendered.contains("<|start_header_id|>"))
    XCTAssertFalse(rendered.contains("<|end_header_id|>"))
    XCTAssertFalse(rendered.contains("before <tool_response>"))
    XCTAssertTrue(rendered.contains("[special_token]"))
  }

  @MainActor
  func testNoToolActionClaimCannotAppearAsExecutionConfirmation() async throws {
    let runtime = ScriptedDolphinRuntime(responses: ["Done, task added."])
    let loop = AgentLoop(runtime: runtime)
    let registry = AgentToolRegistry()
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { _ in
        AgentToolResult(
          modelText: #"{"error":"unexpected execution"}"#,
          displayText: "Unexpected execution",
          succeeded: false
        )
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await loop.run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "Add buy milk to my tasks")
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.toolCalls, 1)
    XCTAssertEqual(result.trustedToolResults, 0)
    XCTAssertEqual(result.failedToolCalls, 1)
    XCTAssertEqual(result.outcome, .failed)
    XCTAssertNotEqual(result.finalText, "Done, task added.")
    XCTAssertTrue(result.finalText.contains("couldn’t complete"))
    XCTAssertTrue(result.finalText.contains("Review Activity"))
    XCTAssertFalse(result.finalText.contains("Arguments:"))
    XCTAssertFalse(result.finalText.contains("Observation:"))
  }

  @MainActor
  func testSuccessfulToolThenFailedToolCannotReturnModelSuccess() async throws {
    let runtime = ScriptedDolphinRuntime(responses: [
      #"<tool_call>{"name":"first","arguments":{}}</tool_call>"#,
      #"<tool_call>{"name":"second","arguments":{}}</tool_call>"#,
      "Everything succeeded.",
    ])
    let loop = AgentLoop(runtime: runtime)
    var settings = AgentSettings()
    settings.maxToolSteps = 2
    let definitions = [
      testToolDefinition(id: "first"),
      testToolDefinition(id: "second"),
    ]
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { call in
        if call.name == "first" {
          return AgentToolResult(
            modelText: #"{"ok":true}"#,
            displayText: "First succeeded",
            succeeded: true
          )
        }
        return AgentToolResult(
          modelText: #"{"error":"failed","ok":false}"#,
          displayText: "Second failed",
          succeeded: false
        )
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await loop.run(
      runID: UUID(),
      conversation: [AssistantMessage(role: .user, content: "Do both actions")],
      settings: settings,
      toolDefinitions: definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.trustedToolResults, 1)
    XCTAssertEqual(result.failedToolCalls, 1)
    XCTAssertEqual(result.outcome, .failed)
    XCTAssertNotEqual(result.finalText, "Everything succeeded.")
    XCTAssertTrue(result.finalText.contains("couldn’t complete"))
    XCTAssertTrue(result.finalText.contains("Review Activity"))
  }

  @MainActor
  func testReadReceiptStaysInActivityAndChatKeepsOnlyTheAnswer()
    async throws
  {
    let observation = #"{"tasks":[{"completed":false,"title":"Real task"}]}"#
    let runtime = ScriptedDolphinRuntime(responses: [
      #"<tool_call>{"name":"lookup","arguments":{"limit":1}}</tool_call>"#,
      "There are no tasks.",
    ])
    let loop = AgentLoop(runtime: runtime)
    let definition = AgentToolDefinition(
      id: "lookup",
      displayName: "Lookup",
      summary: "Test lookup",
      parameters: .object([:]),
      risk: .readOnly,
      maxOutputCharacters: 512
    )
    let recorder = TestEventRecorder()
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { _ in
        AgentToolResult(
          modelText: observation,
          displayText: "Listed one task",
          succeeded: true
        )
      },
      requestApproval: { _ in false },
      emit: { recorder.record($0) },
      modelProgress: { _ in }
    )

    let result = try await loop.run(
      runID: UUID(),
      conversation: [AssistantMessage(role: .user, content: "List tasks")],
      settings: AgentSettings(),
      toolDefinitions: [definition],
      callbacks: callbacks
    )

    XCTAssertEqual(result.finalText, "There are no tasks.")
    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertFalse(result.finalText.contains("Arguments:"))
    XCTAssertFalse(result.finalText.contains("Observation:"))
    XCTAssertFalse(result.finalText.contains("Model interpretation"))

    let receipt = try XCTUnwrap(
      recorder.events.compactMap(\.receipt).first
    )
    XCTAssertEqual(receipt.observation, observation)
    XCTAssertEqual(receipt.call.name, "lookup")
    XCTAssertTrue(receipt.evidenceJSON.contains("Real task"))
  }

  @MainActor
  func testCanonicalMemoryReadCannotBeContradictedByModelText() async throws {
    let registry = AgentToolRegistry()
    var workspace = AssistantWorkspace.empty
    workspace.memories = [MemoryItem(content: "My name is Alexis")]
    let store = TestWorkspaceStore(workspace: workspace)
    let context = makeExecutionContext(store: store)
    let runtime = ScriptedDolphinRuntime(
      responses: ["Your name is Jordan."]
    )
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { call in
        await registry.execute(call, context: context)
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "What's my name?")
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.toolCalls, 1)
    XCTAssertEqual(result.trustedToolResults, 1)
    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertEqual(result.finalText, "Your name is Alexis.")
    XCTAssertFalse(result.finalText.contains("Jordan"))
  }

  @MainActor
  func testCanonicalReadFinalizesWhenModelFollowupIsEmpty() async throws {
    let registry = AgentToolRegistry()
    var workspace = AssistantWorkspace.empty
    workspace.tasks = [AssistantTaskItem(title: "Buy milk")]
    let store = TestWorkspaceStore(workspace: workspace)
    let context = makeExecutionContext(store: store)
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { call in
        await registry.execute(call, context: context)
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(
      runtime: ScriptedDolphinRuntime(responses: [""])
    ).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "List my tasks")
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertEqual(result.finalText, "Your task is:\n• Buy milk")
  }

  @MainActor
  func testDeterministicCanonicalReadDoesNotExposeUnrelatedCustomTool()
    async throws
  {
    let registry = AgentToolRegistry()
    var workspace = AssistantWorkspace.empty
    workspace.memories = [MemoryItem(content: "My name is Alexis")]
    let store = TestWorkspaceStore(workspace: workspace)
    let context = makeExecutionContext(store: store)
    let customDefinition = testToolDefinition(id: "lookup")
    let runtime = ScriptedDolphinRuntime(responses: [
      #"<tool_call>{"name":"lookup","arguments":{}}</tool_call>"#,
      "Your name is Jordan.",
    ])
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { call in
        if call.name == "lookup" { return call }
        return try registry.normalize(call)
      },
      executeTool: { call in
        if call.name == "lookup" {
          return AgentToolResult(
            modelText: #"{"value":"custom"}"#,
            displayText: "Custom result",
            succeeded: true
          )
        }
        return await registry.execute(call, context: context)
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "What's my name?")
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions + [customDefinition],
      callbacks: callbacks
    )

    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertEqual(result.finalText, "Your name is Alexis.")
    XCTAssertEqual(result.modelTurns, 0)
    XCTAssertEqual(result.toolCalls, 1)
    XCTAssertFalse(result.finalText.contains("Jordan"))
  }

  @MainActor
  func testDeterministicReadDoesNotExposeUnrelatedCustomWrite()
    async throws
  {
    let taskDefinition = AgentToolDefinition(
      id: "task_list",
      displayName: "List tasks",
      summary: "List test tasks",
      parameters: .object([:]),
      risk: .readOnly,
      maxOutputCharacters: 512
    )
    let writeDefinition = AgentToolDefinition(
      id: "custom_write",
      displayName: "Save preference",
      summary: "Save a test preference",
      parameters: .object([:]),
      risk: .localWrite,
      maxOutputCharacters: 512
    )
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { call in
        if call.name == "task_list" {
          return AgentToolResult(
            modelText: #"{"count":1,"tasks":[{"completed":false,"id":"00000000-0000-0000-0000-000000000001","title":"Buy milk"}],"truncated":false}"#,
            displayText: "Listed 1 task",
            succeeded: true
          )
        }
        return AgentToolResult(
          modelText: #"{"ok":true}"#,
          displayText: "Saved preference",
          succeeded: true
        )
      },
      requestApproval: { _ in true },
      emit: { _ in },
      modelProgress: { _ in }
    )
    let runtime = ScriptedDolphinRuntime(responses: [
      #"<tool_call>{"name":"custom_write","arguments":{}}</tool_call>"#,
      "Everything is done, and there are no tasks.",
    ])

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "List my tasks")
      ],
      settings: AgentSettings(),
      toolDefinitions: [taskDefinition, writeDefinition],
      callbacks: callbacks
    )

    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertTrue(result.finalText.contains("• Buy milk"))
    XCTAssertFalse(result.finalText.contains("Saved preference"))
    XCTAssertFalse(result.finalText.contains("there are no tasks"))
    XCTAssertEqual(result.modelTurns, 0)
    XCTAssertEqual(result.toolCalls, 1)
  }

  @MainActor
  func testUnrenderableLocalWriteCannotFallBackToModelText() async throws {
    let writeDefinition = AgentToolDefinition(
      id: "custom_write",
      displayName: "Save preference",
      summary: "Save a test preference",
      parameters: .object([:]),
      risk: .localWrite,
      maxOutputCharacters: 512
    )
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { _ in
        AgentToolResult(
          modelText: #"{"ok":true}"#,
          displayText: "",
          succeeded: true
        )
      },
      requestApproval: { _ in true },
      emit: { _ in },
      modelProgress: { _ in }
    )
    let runtime = ScriptedDolphinRuntime(responses: [
      #"<tool_call>{"name":"custom_write","arguments":{}}</tool_call>"#,
      "I definitely saved the preference.",
    ])

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [AssistantMessage(role: .user, content: "Do it")],
      settings: AgentSettings(),
      toolDefinitions: [writeDefinition],
      callbacks: callbacks
    )

    XCTAssertEqual(result.outcome, .failed)
    XCTAssertTrue(result.finalText.contains("couldn’t be summarized safely"))
    XCTAssertFalse(result.finalText.contains("definitely saved"))
  }

  @MainActor
  func testMalformedCanonicalObservationNeverFallsBackToModelText()
    async throws
  {
    let events = TestEventRecorder()
    let definition = AgentToolDefinition(
      id: "task_list",
      displayName: "List tasks",
      summary: "Test malformed canonical result",
      parameters: .object([:]),
      risk: .readOnly,
      maxOutputCharacters: 512
    )
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { _ in
        AgentToolResult(
          modelText: #"{"count":1,"tasks":[{"title":"Buy milk"}],"truncated":false}"#,
          displayText: "Malformed task",
          succeeded: true
        )
      },
      requestApproval: { _ in false },
      emit: { events.record($0) },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(
      runtime: ScriptedDolphinRuntime(responses: ["There are no tasks."])
    ).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "List my tasks")
      ],
      settings: AgentSettings(),
      toolDefinitions: [definition],
      callbacks: callbacks
    )

    XCTAssertEqual(result.outcome, .failed)
    XCTAssertEqual(result.trustedToolResults, 0)
    XCTAssertEqual(result.failedToolCalls, 1)
    XCTAssertTrue(result.finalText.contains("Missing verified receipt"))
    XCTAssertFalse(result.finalText.contains("There are no tasks"))
    XCTAssertFalse(events.events.contains { event in
      event.status == .succeeded && event.receipt != nil
    })
  }

  @MainActor
  func testCancellationAfterExecutionCheckpointPreventsToolStart()
    async throws
  {
    let executionRecorder = TestExecutionRecorder()
    let definition = testToolDefinition(id: "lookup")
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { $0 },
      executeTool: { _ in
        await executionRecorder.markExecuted()
        return AgentToolResult(
          modelText: #"{"ok":true}"#,
          displayText: "Executed",
          succeeded: true
        )
      },
      requestApproval: { _ in false },
      emit: { _ in },
      modelProgress: { _ in },
      checkpoint: { update in
        guard case .activeCall(_, phase: .toolExecution) = update else {
          return
        }
        withUnsafeCurrentTask { task in
          task?.cancel()
        }
      }
    )

    do {
      _ = try await AgentLoop(
        runtime: ScriptedDolphinRuntime(responses: [
          #"<tool_call>{"name":"lookup","arguments":{}}</tool_call>"#
        ])
      ).run(
        runID: UUID(),
        conversation: [AssistantMessage(role: .user, content: "Look it up")],
        settings: AgentSettings(),
        toolDefinitions: [definition],
        callbacks: callbacks
      )
      XCTFail("Cancellation must stop before tool execution")
    } catch is CancellationError {
      // Expected.
    }

    let wasExecuted = await executionRecorder.wasExecuted()
    XCTAssertFalse(wasExecuted)
  }

  func testCanonicalCalculatorAndTaskReadsRenderFromReceipts() throws {
    let registry = AgentToolRegistry()
    let runID = UUID()
    let calculator = try XCTUnwrap(
      registry.definition(named: "calculator")
    )
    let taskList = try XCTUnwrap(registry.definition(named: "task_list"))
    let calculatorReceipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: runID,
        call: AgentToolCall(
          name: "calculator",
          arguments: ["expression": .string("6 * 7")]
        ),
        definition: calculator,
        result: AgentToolResult(
          modelText: #"{"expression":"6 * 7","result":"42"}"#,
          displayText: "42",
          succeeded: true
        )
      )
    )
    let taskReceipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: runID,
        call: AgentToolCall(name: "task_list", arguments: [:]),
        definition: taskList,
        result: AgentToolResult(
          modelText: #"{"count":1,"tasks":[{"completed":false,"id":"00000000-0000-0000-0000-000000000001","title":"Buy milk"}],"truncated":false}"#,
          displayText: "Listed 1 task",
          succeeded: true
        )
      )
    )

    XCTAssertEqual(
      AgentVerifiedAnswerRenderer.readAnswer(for: [calculatorReceipt]),
      "6 * 7 = 42."
    )
    XCTAssertEqual(
      AgentVerifiedAnswerRenderer.readAnswer(for: [taskReceipt]),
      "Your task is:\n• Buy milk"
    )
  }

  func testCanonicalReceiptsRejectSwappedOrUncorrelatedObservations() throws {
    let registry = AgentToolRegistry()
    let fixtures: [(AgentToolCall, String)] = [
      (
        AgentToolCall(
          name: "calculator",
          arguments: ["expression": .string("6 * 7")]
        ),
        #"{"expression":"1 + 1","result":"2"}"#
      ),
      (
        AgentToolCall(
          name: "memory_search",
          arguments: ["query": .string("name"), "limit": .number(5)]
        ),
        #"{"count":0,"memories":[],"query":"address","truncated":false}"#
      ),
      (
        AgentToolCall(
          name: "knowledge_search",
          arguments: ["query": .string("release"), "limit": .number(5)]
        ),
        #"{"count":0,"items":[],"query":"billing","retrieval":"local_hybrid_lexical","truncated":false}"#
      ),
      (
        AgentToolCall(
          name: "code_analyze",
          arguments: [
            "code": .string("let value = 1"),
            "language": .string("swift"),
          ]
        ),
        JSONValue.object([
          "analyzed_characters": .number(13),
          "findings": .array([]),
          "input_sha256": .string(AgentInputDigest.sha256("different code")),
          "language": .string("swift"),
          "line_count": .number(1),
          "max_nesting": .number(0),
          "nonempty_line_count": .number(1),
          "truncated": .bool(false),
        ]).canonicalJSON
      ),
    ]

    for (call, observation) in fixtures {
      let definition = try XCTUnwrap(registry.definition(named: call.name))
      let receipt = try XCTUnwrap(
        AgentToolReceipt(
          runID: UUID(),
          call: call,
          definition: definition,
          result: AgentToolResult(
            modelText: observation,
            displayText: "stale fixture",
            succeeded: true
          )
        )
      )
      XCTAssertFalse(
        AgentVerifiedAnswerRenderer.acceptsAsTrustedReceipt(receipt),
        call.name
      )
      XCTAssertNil(
        AgentVerifiedAnswerRenderer.readAnswer(for: [receipt]),
        call.name
      )
    }
  }

  func testNameRendererRequiresStrictFirstPersonMemory() throws {
    let definition = try XCTUnwrap(
      AgentToolRegistry().definition(named: "memory_search")
    )
    let content = "My friend's name is Jordan"
    let observation = JSONValue.object([
      "count": .number(1),
      "memories": .array([
        .object([
          "content": .string(content),
          "created_at": .string("2026-07-18T12:00:00Z"),
          "id": .string(UUID().uuidString),
        ])
      ]),
      "query": .string("name"),
      "truncated": .bool(false),
    ]).canonicalJSON
    let receipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(
          name: "memory_search",
          arguments: ["query": .string("name"), "limit": .number(5)]
        ),
        definition: definition,
        result: AgentToolResult(
          modelText: observation,
          displayText: "Found 1 memory",
          succeeded: true
        )
      )
    )

    XCTAssertEqual(
      AgentVerifiedAnswerRenderer.readAnswer(for: [receipt]),
      "I remember: “My friend's name is Jordan”."
    )

    let trailingProse = "My name is Alexis and I live in Montreal"
    let trailingObservation = JSONValue.object([
      "count": .number(1),
      "memories": .array([
        .object([
          "content": .string(trailingProse),
          "created_at": .string("2026-07-18T12:00:00Z"),
          "id": .string(UUID().uuidString),
        ])
      ]),
      "query": .string("name"),
      "truncated": .bool(false),
    ]).canonicalJSON
    let trailingReceipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(
          name: "memory_search",
          arguments: ["query": .string("name"), "limit": .number(5)]
        ),
        definition: definition,
        result: AgentToolResult(
          modelText: trailingObservation,
          displayText: "Found 1 memory",
          succeeded: true
        )
      )
    )
    XCTAssertEqual(
      AgentVerifiedAnswerRenderer.readAnswer(for: [trailingReceipt]),
      "I remember: “My name is Alexis and I live in Montreal”."
    )
  }

  func testCanonicalReadRejectsBooleanNumberBridging() throws {
    let registry = AgentToolRegistry()
    let memoryDefinition = try XCTUnwrap(
      registry.definition(named: "memory_search")
    )
    let taskDefinition = try XCTUnwrap(
      registry.definition(named: "task_list")
    )
    let memoryReceipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(
          name: "memory_search",
          arguments: ["query": .string("name"), "limit": .number(5)]
        ),
        definition: memoryDefinition,
        result: AgentToolResult(
          modelText: #"{"count":true,"memories":[{"content":"My name is Alexis"}],"query":"name","truncated":0}"#,
          displayText: "Malformed memory result",
          succeeded: true
        )
      )
    )
    let taskReceipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(name: "task_list", arguments: [:]),
        definition: taskDefinition,
        result: AgentToolResult(
          modelText: #"{"count":1,"tasks":[{"completed":1,"title":"Buy milk"}],"truncated":false}"#,
          displayText: "Malformed task result",
          succeeded: true
        )
      )
    )

    XCTAssertNil(AgentVerifiedAnswerRenderer.readAnswer(for: [memoryReceipt]))
    XCTAssertNil(AgentVerifiedAnswerRenderer.readAnswer(for: [taskReceipt]))
  }

  func testLegacyReceiptWrapperIsRemovedBeforeMemoryRendering() throws {
    let definition = try XCTUnwrap(
      AgentToolRegistry().definition(named: "memory_search")
    )
    let legacy = """
      Verified read-only tool observations (1):
      Arguments: {"query":"name"}
      Observation: {"count":0}

      Model interpretation (not tool execution evidence):
      My name is Alexis
      """
    let observation = JSONValue.object([
      "count": .number(1),
      "memories": .array([
        .object([
          "content": .string(legacy),
          "created_at": .string("2026-07-18T12:00:00Z"),
          "id": .string(UUID().uuidString),
        ])
      ]),
      "query": .string("name"),
      "truncated": .bool(false),
    ]).canonicalJSON
    let receipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(
          name: "memory_search",
          arguments: ["query": .string("name"), "limit": .number(5)]
        ),
        definition: definition,
        result: AgentToolResult(
          modelText: observation,
          displayText: "Found 1 memory",
          succeeded: true
        )
      )
    )
    let answer = try XCTUnwrap(
      AgentVerifiedAnswerRenderer.readAnswer(for: [receipt])
    )

    XCTAssertEqual(answer, "Your name is Alexis.")
    XCTAssertFalse(answer.contains("Arguments:"))
    XCTAssertFalse(answer.contains("Observation:"))
  }

  func testInvalidCanonicalDateTimePayloadFailsClosed() throws {
    let definition = try XCTUnwrap(
      AgentToolRegistry().definition(named: "current_datetime")
    )
    let receipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(name: "current_datetime", arguments: [:]),
        definition: definition,
        result: AgentToolResult(
          modelText: #"{"iso8601":"2026-07-18T12:00:00Z","time_zone":"Not/AZone"}"#,
          displayText: "Invalid zone",
          succeeded: true
        )
      )
    )

    XCTAssertNil(AgentVerifiedAnswerRenderer.readAnswer(for: [receipt]))
  }

  func testTaskListReportsResultsBeyondRequestedLimitAsTruncated()
    async throws
  {
    let registry = AgentToolRegistry()
    var workspace = AssistantWorkspace.empty
    workspace.tasks = (1...11).map { index in
      AssistantTaskItem(title: "Task \(index)")
    }
    let store = TestWorkspaceStore(workspace: workspace)
    let result = await registry.execute(
      AgentToolCall(
        name: "task_list",
        arguments: [
          "include_completed": .bool(false),
          "limit": .number(10),
        ]
      ),
      context: makeExecutionContext(store: store)
    )
    let payload = try XCTUnwrap(
      JSONSerialization.jsonObject(with: Data(result.modelText.utf8))
        as? [String: Any]
    )
    let tasks = try XCTUnwrap(payload["tasks"] as? [[String: Any]])

    XCTAssertTrue(result.succeeded)
    XCTAssertEqual(tasks.count, 10)
    XCTAssertEqual(payload["count"] as? Int, 10)
    XCTAssertEqual(payload["truncated"] as? Bool, true)
  }

  func testOrdinaryConversationHasNoEligibleTools() {
    let greeting = AgentRequestRouter.plan(for: "Hi, my name is Alexis. What's yours?")
    let thanks = AgentRequestRouter.plan(for: "Thanks for your help!")

    XCTAssertNil(greeting.initialToolCall)
    XCTAssertTrue(greeting.eligibleToolIDs.isEmpty)
    XCTAssertNil(thanks.initialToolCall)
    XCTAssertTrue(thanks.eligibleToolIDs.isEmpty)
  }

  func testExplicitMemoryAndRecallRequestsRouteDeterministically() throws {
    let save = AgentRequestRouter.plan(
      for: "Remember that my name is Alexis"
    )
    let saveCall = try XCTUnwrap(save.initialToolCall)
    XCTAssertEqual(saveCall.name, "memory_save")
    XCTAssertEqual(saveCall.arguments["content"], .string("my name is Alexis"))

    let recall = AgentRequestRouter.plan(for: "What's my name?")
    let recallCall = try XCTUnwrap(recall.initialToolCall)
    XCTAssertEqual(recallCall.name, "memory_search")
    XCTAssertEqual(recallCall.arguments["query"], .string("name"))
    XCTAssertEqual(recallCall.arguments["limit"], .number(5))

    let task = AgentRequestRouter.plan(for: "Remember to buy milk")
    let taskCall = try XCTUnwrap(task.initialToolCall)
    XCTAssertEqual(taskCall.name, "task_add")
    XCTAssertEqual(taskCall.arguments["title"], .string("buy milk"))
  }

  func testNegationInsideExplicitPayloadIsNotMistakenForCommandNegation()
    throws
  {
    let negativePreference = AgentRequestRouter.plan(
      for: "Remember that I don't like coffee"
    )
    let preferenceCall = try XCTUnwrap(negativePreference.initialToolCall)
    XCTAssertEqual(preferenceCall.name, "memory_save")
    XCTAssertEqual(
      preferenceCall.arguments["content"],
      .string("I don't like coffee")
    )

    let doNotForget = AgentRequestRouter.plan(
      for: "Don't forget that my name is Alexis"
    )
    let reminderCall = try XCTUnwrap(doNotForget.initialToolCall)
    XCTAssertEqual(reminderCall.name, "memory_save")
    XCTAssertEqual(
      reminderCall.arguments["content"],
      .string("my name is Alexis")
    )

    XCTAssertEqual(
      AgentRequestRouter.plan(for: "Don't add a task to buy milk"),
      .conversation
    )
    let handoffID = UUID()
    XCTAssertEqual(
      AgentRequestRouter.plan(
        for: "Don't deactivate handoff \(handoffID.uuidString)"
      ),
      .conversation
    )
  }

  @MainActor
  func testCasualGreetingProducesPlainChatWithoutToolReceipts() async throws {
    let runtime = ScriptedDolphinRuntime(
      responses: ["Hi Alexis! I'm Dolphin. Nice to meet you."]
    )
    let registry = AgentToolRegistry()
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { _ in
        XCTFail("A greeting must not execute a tool")
        return AgentToolResult(
          modelText: #"{"error":"unexpected tool"}"#,
          displayText: "Unexpected tool",
          succeeded: false
        )
      },
      requestApproval: { _ in
        XCTFail("A greeting must not request approval")
        return false
      },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(
          role: .user,
          content: "Hi, my name is Alexis. What's yours?"
        )
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.finalText, "Hi Alexis! I'm Dolphin. Nice to meet you.")
    XCTAssertEqual(result.toolCalls, 0)
    XCTAssertEqual(result.trustedToolResults, 0)
    XCTAssertFalse(result.finalText.contains("Verified read-only"))
    XCTAssertFalse(result.finalText.contains("No tool action was executed"))
  }

  @MainActor
  func testExplicitRememberPersistsAndCanBeRecalledAfterReload()
    async throws
  {
    let registry = AgentToolRegistry()
    let store = TestWorkspaceStore(workspace: .empty)
    let context = makeExecutionContext(store: store)
    let runtime = ScriptedDolphinRuntime(responses: ["Saved."])
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { call in
        await registry.execute(call, context: context)
      },
      requestApproval: { _ in true },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(runtime: runtime).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(
          role: .user,
          content: "Remember that my name is Alexis"
        )
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    XCTAssertEqual(result.toolCalls, 1)
    XCTAssertEqual(result.trustedToolResults, 1)
    XCTAssertEqual(result.failedToolCalls, 0)
    XCTAssertEqual(result.finalText, "Got it — I’ll remember: “my name is Alexis”.")

    let savedWorkspace = await store.snapshot()
    XCTAssertEqual(savedWorkspace.memories.map(\.content), ["my name is Alexis"])

    let fileURL = FileManager.default.temporaryDirectory.appendingPathComponent(
      "dolphin-relaunch-\(UUID().uuidString).json"
    )
    defer { try? FileManager.default.removeItem(at: fileURL) }
    let persistence = try AssistantPersistence(fileURL: fileURL)
    try await persistence.save(savedWorkspace)
    let reloadedWorkspace = try await persistence.load()
    XCTAssertEqual(reloadedWorkspace.memories.map(\.content), ["my name is Alexis"])

    let reloadedStore = TestWorkspaceStore(workspace: reloadedWorkspace)
    let search = await registry.execute(
      AgentToolCall(
        name: "memory_search",
        arguments: [
          "query": .string("What's my name?"),
          "limit": .number(5),
        ]
      ),
      context: makeExecutionContext(store: reloadedStore)
    )
    XCTAssertTrue(search.succeeded)
    XCTAssertTrue(search.modelText.contains("my name is Alexis"))
  }

  func testLegacyReceiptProseIsRemovedFromConversationText() {
    let nested = """
      No tool action was executed. The response below is model-generated text, not an action confirmation.

      Verified read-only tool observations (1); no local changes were made:
      - memory_search [36C5EA5B-8309-48B0-B073-80565D5E58B1]
        Arguments: {"query":"Hi"}
        Observation: {"count":0,"memories":[]}

      Model interpretation (not tool execution evidence):
      No tool action was executed. The response below is model-generated text, not an action confirmation.

      Verified read-only tool observations (1); no local changes were made:
      - memory_search [36C5EA5B-8309-48B0-B073-80565D5E58B1]
        Arguments: {"query":"Hi"}
        Observation: {"count":0,"memories":[]}

      Model interpretation (not tool execution evidence):
      Hi Alexis!
      """

    XCTAssertEqual(AssistantChatText.cleaned(nested), "Hi Alexis!")
    XCTAssertEqual(
      AssistantChatText.cleaned(
        """
        Verified read-only tool observations (1); no local changes were made:
        - memory_search [36C5EA5B-8309-48B0-B073-80565D5E58B1]
          Arguments: {"query":"Hi"}
          Observation: {"count":0,"memories":[]}
        """
      ),
      ""
    )
  }

  func testMemoryContextIsSeparateAndLegacyReceiptHistoryIsExcluded()
    async throws
  {
    let runtime = ScriptedDolphinRuntime(responses: [])
    let result = try await AgentContextWindowBuilder.build(
      systemPrompt: "system",
      conversation: [
        AssistantMessage(role: .user, content: "What's my name?"),
        AssistantMessage(
          role: .assistant,
          content: """
            Verified read-only tool observations (1):
            - memory_search [36C5EA5B-8309-48B0-B073-80565D5E58B1]
              Arguments: {"query":"name"}
              Observation: {"memories":[]}
            """
        ),
      ],
      memoryContext: [MemoryItem(content: "My name is Alexis")],
      scratchpad: [],
      tools: [],
      maxNewTokens: 32,
      runtime: runtime
    )

    XCTAssertTrue(result.renderedPrompt.contains("My name is Alexis"))
    XCTAssertTrue(result.renderedPrompt.contains("untrusted user data"))
    XCTAssertFalse(result.renderedPrompt.contains("Verified read-only"))
    XCTAssertFalse(result.renderedPrompt.contains("36C5EA5B"))
  }

  func testAgentSettingsUseExpandedOutputBudgetAndCentralBounds() {
    XCTAssertEqual(AgentSettings().maxNewTokens, 256)

    var invalid = AgentSettings()
    invalid.maxToolSteps = 999
    invalid.maxNewTokens = 1
    invalid.maxRunSeconds = 0
    invalid.networkAccessEnabled = true
    let sanitized = invalid.sanitized()

    XCTAssertEqual(sanitized.maxToolSteps, AgentSettings.maxToolStepsRange.upperBound)
    XCTAssertEqual(sanitized.maxNewTokens, AgentSettings.maxNewTokensRange.lowerBound)
    XCTAssertEqual(sanitized.maxRunSeconds, AgentSettings.maxRunSecondsRange.lowerBound)
    XCTAssertFalse(sanitized.networkAccessEnabled)
  }

  func testSchemaOneMigratesLegacyBudgetAndReceiptChat() async throws {
    var workspace = AssistantWorkspace.empty
    workspace.settings.maxNewTokens = AgentSettings.legacyDefaultMaxNewTokens
    workspace.messages = [
      AssistantMessage(role: .user, content: "Hi"),
      AssistantMessage(
        role: .assistant,
        content: """
          No tool action was executed. The response below is model-generated text, not an action confirmation.

          Model interpretation (not tool execution evidence):
          Hello!
          """
      ),
    ]
    let fileURL = FileManager.default.temporaryDirectory.appendingPathComponent(
      "dolphin-schema-one-\(UUID().uuidString).json"
    )
    defer { try? FileManager.default.removeItem(at: fileURL) }
    let encoder = JSONEncoder()
    encoder.dateEncodingStrategy = .secondsSince1970
    try encoder.encode(
      LegacyPersistenceEnvelope(schemaVersion: 1, workspace: workspace)
    ).write(to: fileURL, options: .atomic)

    let loaded = try await AssistantPersistence(fileURL: fileURL).load()

    XCTAssertEqual(loaded.settings.maxNewTokens, 256)
    XCTAssertEqual(loaded.messages.map(\.content), ["Hi", "Hello!"])
  }

  func testSchemaTwoWithoutRunsMigratesWithoutDataLoss() async throws {
    var workspace = AssistantWorkspace.empty
    workspace.memories = [MemoryItem(content: "Keep this")]
    let encoder = JSONEncoder()
    encoder.dateEncodingStrategy = .secondsSince1970
    let encoded = try encoder.encode(
      LegacyPersistenceEnvelope(schemaVersion: 2, workspace: workspace)
    )
    var root = try XCTUnwrap(
      JSONSerialization.jsonObject(with: encoded) as? [String: Any]
    )
    var legacyWorkspace = try XCTUnwrap(root["workspace"] as? [String: Any])
    legacyWorkspace.removeValue(forKey: "runs")
    root["workspace"] = legacyWorkspace

    let fileURL = FileManager.default.temporaryDirectory.appendingPathComponent(
      "dolphin-schema-two-\(UUID().uuidString).json"
    )
    defer { try? FileManager.default.removeItem(at: fileURL) }
    try JSONSerialization.data(withJSONObject: root).write(
      to: fileURL,
      options: .atomic
    )

    let loaded = try await AssistantPersistence(fileURL: fileURL).load()

    XCTAssertEqual(loaded.memories.map(\.content), ["Keep this"])
    XCTAssertTrue(loaded.runs.isEmpty)
  }

  func testRunCheckpointRoundTripsExactly() throws {
    let date = Date(timeIntervalSince1970: 1_750_000_000)
    let runID = UUID()
    let request = AssistantMessage(
      role: .user,
      content: "What's my name?",
      createdAt: date
    )
    let definition = try XCTUnwrap(
      AgentToolRegistry().definition(named: "memory_search")
    )
    let call = AgentToolCall(
      name: "memory_search",
      arguments: ["query": .string("name"), "limit": .number(5)]
    )
    let receipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: runID,
        call: call,
        definition: definition,
        result: AgentToolResult(
          modelText: #"{"count":1,"memories":[{"content":"My name is Alexis","created_at":"2025-06-15T15:06:40Z","id":"00000000-0000-0000-0000-000000000001"}],"truncated":false}"#,
          displayText: "Found 1 memory",
          succeeded: true
        ),
        completedAt: date
      )
    )
    var workspace = AssistantWorkspace.empty
    workspace.messages = [request]
    workspace.runs = [
      AgentRunRecord(
        id: runID,
        requestMessageID: request.id,
        requestText: request.content,
        contextMessageIDs: [request.id],
        settingsSnapshot: AgentSettings(),
        createdAt: date,
        checkpoint: AgentRunCheckpoint(
          phase: .finalizing,
          completedReceipts: [receipt],
          toolCallsUsed: 1,
          modelTurns: 1,
          updatedAt: date
        )
      )
    ]

    let encoder = JSONEncoder()
    encoder.dateEncodingStrategy = .secondsSince1970
    let decoder = JSONDecoder()
    decoder.dateDecodingStrategy = .secondsSince1970
    let decoded = try decoder.decode(
      AssistantWorkspace.self,
      from: encoder.encode(workspace)
    )

    XCTAssertEqual(decoded, workspace)
    XCTAssertEqual(decoded.runs.first?.checkpoint.completedReceipts, [receipt])
  }

  func testUnfinishedRunsRecoverAsInterruptedButTerminalRunsStayFinal() {
    let request = AssistantMessage(role: .user, content: "Do something")
    let settings = AgentSettings()
    let running = AgentRunRecord(
      requestMessageID: request.id,
      requestText: request.content,
      contextMessageIDs: [request.id],
      settingsSnapshot: settings
    )
    var succeeded = AgentRunRecord(
      requestMessageID: request.id,
      requestText: request.content,
      contextMessageIDs: [request.id],
      settingsSnapshot: settings
    )
    succeeded.status = .succeeded
    let recoveryDate = Date(timeIntervalSince1970: 1_760_000_000)
    var workspace = AssistantWorkspace.empty
    workspace.runs = [running, succeeded]

    XCTAssertEqual(workspace.recoverInterruptedRuns(at: recoveryDate), 1)
    XCTAssertEqual(workspace.runs[0].status, .interrupted)
    XCTAssertEqual(workspace.runs[0].stopReason, .processEnded)
    XCTAssertEqual(workspace.runs[0].checkpoint.updatedAt, recoveryDate)
    XCTAssertEqual(workspace.runs[0].completedAt, recoveryDate)
    XCTAssertEqual(workspace.runs[1].status, .succeeded)
    XCTAssertNil(workspace.runs[1].stopReason)
    XCTAssertEqual(workspace.events.count, 1)
    XCTAssertEqual(workspace.events[0].runID, running.id)
    XCTAssertEqual(workspace.events[0].title, "Previous run interrupted")
    XCTAssertTrue(workspace.events[0].detail.contains("No action was replayed"))
  }

  func testInterruptedRecoveryPreservesRecordedCancellationReason() {
    let request = AssistantMessage(role: .user, content: "Stop this")
    var stopping = AgentRunRecord(
      requestMessageID: request.id,
      requestText: request.content,
      contextMessageIDs: [request.id],
      settingsSnapshot: AgentSettings()
    )
    stopping.status = .cancellationRequested
    stopping.stopReason = .user
    var workspace = AssistantWorkspace.empty
    workspace.runs = [stopping]

    XCTAssertEqual(workspace.recoverInterruptedRuns(), 1)
    XCTAssertEqual(workspace.runs[0].status, .interrupted)
    XCTAssertEqual(workspace.runs[0].stopReason, .user)
  }

  func testCancellationClassificationUsesDurableStopReason() {
    let deadline = AgentRunTerminalClassifier.cancellation(for: .deadline)
    XCTAssertEqual(deadline.status, .failed)
    XCTAssertEqual(deadline.eventStatus, .failed)
    XCTAssertEqual(deadline.stopReason, .deadline)
    XCTAssertTrue(deadline.message.contains("time limit"))

    let storage = AgentRunTerminalClassifier.cancellation(
      for: .storageFailure
    )
    XCTAssertEqual(storage.status, .failed)
    XCTAssertEqual(storage.eventStatus, .failed)
    XCTAssertEqual(storage.stopReason, .storageFailure)
    XCTAssertTrue(storage.message.contains("not confirmed durable"))

    let user = AgentRunTerminalClassifier.cancellation(for: .user)
    XCTAssertEqual(user.status, .cancelled)
    XCTAssertEqual(user.stopReason, .user)

    let background = AgentRunTerminalClassifier.cancellation(for: .background)
    XCTAssertEqual(background.status, .cancelled)
    XCTAssertEqual(background.stopReason, .background)
  }

  func testLegacyAgentEventDecodesWithoutStructuredReceipt() throws {
    let data = Data(
      #"{"id":"00000000-0000-0000-0000-000000000001","runID":null,"sequence":1,"kind":"run","status":"information","title":"Legacy","detail":"Before receipts","createdAt":0}"#.utf8
    )

    let event = try JSONDecoder().decode(AgentEvent.self, from: data)

    XCTAssertNil(event.receipt)
    XCTAssertEqual(event.title, "Legacy")
  }

  func testOversizedSuccessfulResultCannotProduceSuccessReceipt() {
    let definition = AgentToolDefinition(
      id: "write",
      displayName: "Write",
      summary: "Test write",
      parameters: .object([:]),
      risk: .localWrite,
      maxOutputCharacters: 128
    )
    let rawResult = AgentToolResult(
      modelText: String(repeating: "x", count: 200),
      displayText: "Committed",
      succeeded: true
    )
    let bounded = rawResult.bounded(toMaximumCharacters: 128)

    XCTAssertFalse(bounded.succeeded)
    XCTAssertNil(
      AgentToolReceipt(
        runID: UUID(),
        call: AgentToolCall(name: "write", arguments: [:]),
        definition: definition,
        result: rawResult
      )
    )
    XCTAssertNotNil(
      try? JSONSerialization.jsonObject(with: Data(bounded.modelText.utf8))
    )
  }

  func testContextTrimmingDropsACompleteOldTurn() async throws {
    let runtime = ScriptedDolphinRuntime(
      responses: [],
      oversizedPromptMarker: "old user"
    )
    let conversation = [
      AssistantMessage(role: .user, content: "old user"),
      AssistantMessage(role: .assistant, content: "old assistant"),
      AssistantMessage(role: .user, content: "latest user"),
    ]

    let result = try await AgentContextWindowBuilder.build(
      systemPrompt: "system",
      conversation: conversation,
      scratchpad: [],
      tools: [],
      maxNewTokens: 32,
      runtime: runtime
    )

    XCTAssertEqual(result.droppedMessages, 2)
    XCTAssertFalse(result.renderedPrompt.contains("old user"))
    XCTAssertFalse(result.renderedPrompt.contains("old assistant"))
    XCTAssertTrue(result.renderedPrompt.contains("latest user"))
  }

  func testLegacySettingsDecodeWithSystemCapabilitiesDisabled() throws {
    let data = Data(
      #"{"maxToolSteps":3,"maxNewTokens":256,"maxRunSeconds":300,"requireApprovalForLocalWrites":true,"networkAccessEnabled":false,"systemPrompt":"Legacy"}"#.utf8
    )

    let settings = try JSONDecoder().decode(AgentSettings.self, from: data)

    XCTAssertTrue(settings.enabledSystemCapabilities.isEmpty)
    XCTAssertEqual(settings.systemPrompt, "Legacy")
  }

  func testCalendarToolNormalizesBoundsRoutesAndRequiresOptInApproval()
    throws
  {
    let registry = AgentToolRegistry(
      calendarReader: TestCalendarReader(status: .fullAccess)
    )
    let definition = try XCTUnwrap(
      registry.definition(named: "calendar_events")
    )
    let normalized = try registry.normalize(
      AgentToolCall(
        name: "calendar_events",
        arguments: ["window": .string("tomorrow")]
      )
    )

    XCTAssertEqual(normalized.arguments["window"], .string("tomorrow"))
    XCTAssertEqual(normalized.arguments["limit"], .number(10))
    XCTAssertEqual(definition.risk, .sensitiveRead)
    XCTAssertEqual(definition.requiredCapability, .calendarRead)
    XCTAssertThrowsError(
      try registry.normalize(
        AgentToolCall(
          name: "calendar_events",
          arguments: [
            "window": .string("next_month"),
            "limit": .number(11),
          ]
        )
      )
    )

    let route = AgentRequestRouter.plan(
      for: "What meetings are on my calendar tomorrow?"
    )
    XCTAssertEqual(route.initialToolCall?.name, "calendar_events")
    XCTAssertEqual(
      route.initialToolCall?.arguments["window"],
      .string("tomorrow")
    )

    if case .deny = AgentPolicy.decision(
      for: definition,
      settings: AgentSettings()
    ) {
      // Expected: the persisted opt-in is off by default.
    } else {
      XCTFail("A disabled system capability must be denied")
    }

    var enabled = AgentSettings()
    enabled.enabledSystemCapabilities.insert(.calendarRead)
    if case .requireApproval = AgentPolicy.decision(
      for: definition,
      settings: enabled
    ) {
      // Expected: every sensitive read gets a one-time approval request.
    } else {
      XCTFail("An enabled sensitive read must require one-time approval")
    }
  }

  func testCalendarAuthorizationDenialNeverAttemptsARead() async throws {
    let reader = TestCalendarReader(status: .denied)
    let registry = AgentToolRegistry(calendarReader: reader)
    let result = await registry.execute(
      AgentToolCall(
        name: "calendar_events",
        arguments: ["window": .string("today")]
      ),
      context: makeExecutionContext(
        store: TestWorkspaceStore(workspace: .empty)
      )
    )

    XCTAssertFalse(result.succeeded)
    XCTAssertTrue(result.displayText.contains("denied"))
    let readCount = await reader.readCount()
    XCTAssertEqual(readCount, 0)
  }

  func testCalendarResultIsBoundedDeterministicAndPrivacyMinimized()
    async throws
  {
    let now = testISO8601Date("2026-07-18T14:00:00Z")
    let events = [
      SystemCalendarEvent(
        title: "  Team <sync>\nRoom 4  ",
        startsAt: testISO8601Date("2026-07-18T15:00:00Z"),
        endsAt: testISO8601Date("2026-07-18T15:30:00Z"),
        isAllDay: false
      )
    ]
    let reader = TestCalendarReader(
      status: .fullAccess,
      page: SystemCalendarEventPage(events: events, hasMore: false)
    )
    var utcCalendar = Calendar(identifier: .gregorian)
    utcCalendar.timeZone = try XCTUnwrap(TimeZone(identifier: "UTC"))
    let registry = AgentToolRegistry(
      dateProvider: FixedTestDateProvider(date: now),
      calendarReader: reader,
      calendar: utcCalendar
    )
    let call = try registry.normalize(
      AgentToolCall(
        name: "calendar_events",
        arguments: [
          "window": .string("today"),
          "limit": .number(10),
        ]
      )
    )
    let result = await registry.execute(
      call,
      context: makeExecutionContext(
        store: TestWorkspaceStore(workspace: .empty)
      )
    )
    let payload = try XCTUnwrap(
      JSONSerialization.jsonObject(with: Data(result.modelText.utf8))
        as? [String: Any]
    )
    let rawEvents = try XCTUnwrap(payload["events"] as? [[String: Any]])

    XCTAssertTrue(result.succeeded)
    XCTAssertLessThanOrEqual(result.modelText.count, 2_400)
    XCTAssertEqual(
      Set(payload.keys),
      ["count", "events", "time_zone", "truncated", "window"]
    )
    XCTAssertEqual(
      Set(try XCTUnwrap(rawEvents.first).keys),
      ["all_day", "ends_at", "starts_at", "title"]
    )
    XCTAssertEqual(rawEvents.first?["title"] as? String, "Team ‹sync› Room 4")
    for forbidden in ["notes", "attendees", "url", "location", "id"] {
      XCTAssertFalse(result.modelText.lowercased().contains("\"\(forbidden)\""))
    }
    let recordedInterval = await reader.lastInterval()
    let interval = try XCTUnwrap(recordedInterval)
    XCTAssertEqual(interval.start, testISO8601Date("2026-07-18T00:00:00Z"))
    XCTAssertEqual(interval.end, testISO8601Date("2026-07-19T00:00:00Z"))
  }

  @MainActor
  func testCalendarVerifiedAnswerCannotBeContradictedByModel() async throws {
    let event = SystemCalendarEvent(
      title: "Dentist",
      startsAt: testISO8601Date("2026-07-18T15:00:00Z"),
      endsAt: testISO8601Date("2026-07-18T16:00:00Z"),
      isAllDay: false
    )
    var utcCalendar = Calendar(identifier: .gregorian)
    utcCalendar.timeZone = try XCTUnwrap(TimeZone(identifier: "UTC"))
    let registry = AgentToolRegistry(
      dateProvider: FixedTestDateProvider(
        date: testISO8601Date("2026-07-18T12:00:00Z")
      ),
      calendarReader: TestCalendarReader(
        status: .fullAccess,
        page: SystemCalendarEventPage(events: [event], hasMore: false)
      ),
      calendar: utcCalendar
    )
    let context = makeExecutionContext(
      store: TestWorkspaceStore(workspace: .empty)
    )
    var settings = AgentSettings()
    settings.enabledSystemCapabilities.insert(.calendarRead)
    let result = try await AgentLoop(
      runtime: ScriptedDolphinRuntime(
        responses: ["You have no events today."]
      )
    ).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(role: .user, content: "What's on my calendar today?")
      ],
      settings: settings,
      toolDefinitions: registry.definitions,
      callbacks: AgentLoopCallbacks(
        normalizeTool: { try registry.normalize($0) },
        executeTool: { await registry.execute($0, context: context) },
        requestApproval: { _ in true },
        emit: { _ in },
        modelProgress: { _ in }
      )
    )

    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertTrue(result.finalText.contains("Dentist"))
    XCTAssertFalse(result.finalText.contains("no events"))
  }

  func testCalendarRendererFailsClosedForMalformedOrExtraFields() throws {
    let definition = try XCTUnwrap(
      AgentToolRegistry(
        calendarReader: TestCalendarReader(status: .fullAccess)
      ).definition(named: "calendar_events")
    )
    let call = AgentToolCall(
      name: "calendar_events",
      arguments: [
        "window": .string("today"),
        "limit": .number(10),
      ]
    )
    let malformedResult = AgentToolResult(
      modelText: #"{"count":1,"events":[{"all_day":false,"ends_at":"2026-07-18T16:00:00Z","location":"Secret","starts_at":"2026-07-18T15:00:00Z","title":"Dentist"}],"time_zone":"UTC","truncated":false,"window":"today"}"#,
      displayText: "Found 1 event",
      succeeded: true
    )
    let receipt = try XCTUnwrap(
      AgentToolReceipt(
        runID: UUID(),
        call: call,
        definition: definition,
        result: malformedResult
      )
    )

    XCTAssertTrue(
      AgentVerifiedAnswerRenderer.requiresDeterministicAnswer(for: [receipt])
    )
    XCTAssertNil(AgentVerifiedAnswerRenderer.readAnswer(for: [receipt]))
  }

  func testCalendarLimitProducesTruthfulTruncation() async throws {
    let events = (0..<2).map { index in
      SystemCalendarEvent(
        title: "Event \(index)",
        startsAt: testISO8601Date("2026-07-18T1\(index):00:00Z"),
        endsAt: testISO8601Date("2026-07-18T1\(index):30:00Z"),
        isAllDay: false
      )
    }
    var utcCalendar = Calendar(identifier: .gregorian)
    utcCalendar.timeZone = try XCTUnwrap(TimeZone(identifier: "UTC"))
    let registry = AgentToolRegistry(
      dateProvider: FixedTestDateProvider(
        date: testISO8601Date("2026-07-18T08:00:00Z")
      ),
      calendarReader: TestCalendarReader(
        status: .fullAccess,
        page: SystemCalendarEventPage(events: events, hasMore: false)
      ),
      calendar: utcCalendar
    )
    let result = await registry.execute(
      AgentToolCall(
        name: "calendar_events",
        arguments: [
          "window": .string("today"),
          "limit": .number(1),
        ]
      ),
      context: makeExecutionContext(
        store: TestWorkspaceStore(workspace: .empty)
      )
    )
    let payload = try XCTUnwrap(
      JSONSerialization.jsonObject(with: Data(result.modelText.utf8))
        as? [String: Any]
    )

    XCTAssertTrue(result.succeeded)
    XCTAssertEqual(payload["count"] as? Int, 1)
    XCTAssertEqual(payload["truncated"] as? Bool, true)
  }

  @MainActor
  func testDeterministicSequenceExecutesInOrderWithoutModelGeneration()
    async throws
  {
    let registry = AgentToolRegistry()
    let store = TestWorkspaceStore(workspace: .empty)
    let context = makeExecutionContext(store: store)
    let callbacks = AgentLoopCallbacks(
      normalizeTool: { try registry.normalize($0) },
      executeTool: { await registry.execute($0, context: context) },
      requestApproval: { _ in true },
      emit: { _ in },
      modelProgress: { _ in }
    )

    let result = try await AgentLoop(
      runtime: ToolOnlyDolphinRuntime()
    ).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(
          role: .user,
          content: "Remember that my name is Alexis and then add a task to buy milk"
        )
      ],
      settings: AgentSettings(),
      toolDefinitions: registry.definitions,
      callbacks: callbacks
    )

    let workspace = await store.snapshot()
    XCTAssertEqual(result.outcome, .succeeded)
    XCTAssertEqual(result.modelTurns, 0)
    XCTAssertEqual(result.toolCalls, 2)
    XCTAssertEqual(result.trustedToolResults, 2)
    XCTAssertTrue(result.finalText.contains("I’ll remember"))
    XCTAssertTrue(result.finalText.contains("buy milk"))
    XCTAssertEqual(workspace.memories.map(\.content), ["my name is Alexis"])
    XCTAssertEqual(workspace.tasks.map(\.title), ["buy milk"])
  }

  @MainActor
  func testMissingDeterministicToolFailsClosedWithoutModelGeneration()
    async throws
  {
    let runtime = ScriptedDolphinRuntime(responses: ["False success"])
    let loop = AgentLoop(runtime: runtime)
    let result = try await loop.run(
      runID: UUID(),
      conversation: [AssistantMessage(role: .user, content: "List my tasks")],
      settings: AgentSettings(),
      toolDefinitions: [
        AgentToolRegistry.canonicalDefinitions.first {
          $0.id == "current_datetime"
        }!
      ],
      callbacks: AgentLoopCallbacks(
        normalizeTool: { $0 },
        executeTool: { _ in
          XCTFail("An unavailable deterministic tool must not execute")
          return AgentToolResult(
            modelText: "",
            displayText: "",
            succeeded: false
          )
        },
        requestApproval: { _ in false },
        emit: { _ in },
        modelProgress: { _ in }
      )
    )

    XCTAssertEqual(result.outcome, .failed)
    XCTAssertEqual(result.modelTurns, 0)
    XCTAssertEqual(result.failedToolCalls, 1)
    XCTAssertTrue(result.finalText.contains("Missing verified receipt"))
    XCTAssertFalse(result.finalText.contains("False success"))
  }

  @MainActor
  func testPlanOverStepLimitExecutesNothingAndDoesNotGenerate()
    async throws
  {
    let registry = AgentToolRegistry()
    let execution = TestExecutionRecorder()
    var settings = AgentSettings()
    settings.maxToolSteps = 1
    let result = try await AgentLoop(
      runtime: ScriptedDolphinRuntime(responses: ["False success"])
    ).run(
      runID: UUID(),
      conversation: [
        AssistantMessage(
          role: .user,
          content: "Remember that my name is Alexis then add a task to buy milk"
        )
      ],
      settings: settings,
      toolDefinitions: registry.definitions,
      callbacks: AgentLoopCallbacks(
        normalizeTool: { try registry.normalize($0) },
        executeTool: { _ in
          await execution.markExecuted()
          return AgentToolResult(
            modelText: "",
            displayText: "",
            succeeded: false
          )
        },
        requestApproval: { _ in true },
        emit: { _ in },
        modelProgress: { _ in }
      )
    )

    XCTAssertEqual(result.outcome, .failed)
    XCTAssertEqual(result.modelTurns, 0)
    XCTAssertEqual(result.toolCalls, 0)
    let didExecute = await execution.wasExecuted()
    XCTAssertFalse(didExecute)
    XCTAssertTrue(result.finalText.contains("needs 2 verified actions"))
  }

  func testPlainAndSequencesOnlyIndependentExplicitCommands() throws {
    let sequence = AgentRequestRouter.plan(
      for: "List my tasks and show calendar events tomorrow"
    )
    XCTAssertEqual(sequence.mode, .deterministic)
    XCTAssertEqual(
      sequence.plannedToolCalls.map(\.name),
      ["task_list", "calendar_events"]
    )

    let payload = AgentRequestRouter.plan(
      for: "Remember that cats and dogs need separate food"
    )
    XCTAssertEqual(payload.plannedToolCalls.count, 1)
    XCTAssertEqual(payload.initialToolCall?.name, "memory_save")
    XCTAssertEqual(
      payload.initialToolCall?.arguments["content"],
      .string("cats and dogs need separate food")
    )
  }

  @MainActor
  func testPlanBeyondHardCeilingIsNotTruncatedOrPartiallyExecuted()
    async throws
  {
    let request = (1...7).map { "Remember fact \($0)" }
      .joined(separator: " then ")
    let plan = AgentRequestRouter.plan(for: request)
    XCTAssertEqual(plan.mode, .deterministic)
    XCTAssertEqual(plan.plannedToolCalls.count, 7)

    let registry = AgentToolRegistry()
    let execution = TestExecutionRecorder()
    var settings = AgentSettings()
    settings.maxToolSteps = AgentSettings.maxToolStepsRange.upperBound
    let result = try await AgentLoop(runtime: ToolOnlyDolphinRuntime()).run(
      runID: UUID(),
      conversation: [AssistantMessage(role: .user, content: request)],
      settings: settings,
      toolDefinitions: registry.definitions,
      callbacks: AgentLoopCallbacks(
        normalizeTool: { try registry.normalize($0) },
        executeTool: { _ in
          await execution.markExecuted()
          return AgentToolResult(
            modelText: "",
            displayText: "",
            succeeded: false
          )
        },
        requestApproval: { _ in true },
        emit: { _ in },
        modelProgress: { _ in }
      )
    )

    XCTAssertEqual(result.outcome, .failed)
    XCTAssertEqual(result.toolCalls, 0)
    XCTAssertEqual(result.modelTurns, 0)
    let didExecute = await execution.wasExecuted()
    XCTAssertFalse(didExecute)
    XCTAssertTrue(result.finalText.contains("needs 7 verified actions"))
  }

  func testHiddenReasoningIsRemovedOrFailsClosed() {
    XCTAssertEqual(
      AssistantChatText.cleaned(
        "<think>private chain of thought</think>Concise answer."
      ),
      "Concise answer."
    )
    XCTAssertEqual(
      AssistantChatText.cleaned("<analysis>unfinished private reasoning"),
      ""
    )
    XCTAssertEqual(
      AssistantChatText.cleaned(
        "<reasoning>private only</reasoning>"
      ),
      ""
    )
    XCTAssertEqual(
      AssistantChatText.cleaned("< think>unfinished private reasoning"),
      ""
    )
  }

  @MainActor
  func testToolOnlyRuntimeFailsClosedIfGenerationIsRequested() async {
    do {
      _ = try await ToolOnlyDolphinRuntime().generate(
        renderedPrompt: "Unexpected model turn",
        maxNewTokens: 1,
        progress: { _ in }
      )
      XCTFail("Tool-only execution must never generate model text")
    } catch {
      XCTAssertEqual(error as? DolphinModelRuntimeError, .modelNotLoaded)
    }
  }

  private func testToolDefinition(id: String) -> AgentToolDefinition {
    AgentToolDefinition(
      id: id,
      displayName: id.capitalized,
      summary: "Test tool",
      parameters: .object([
        "additionalProperties": .bool(false),
        "properties": .object([:]),
        "required": .array([]),
        "type": .string("object"),
      ]),
      risk: .readOnly,
      maxOutputCharacters: 512
    )
  }
}

@MainActor
private final class TestEventRecorder {
  private(set) var events: [AgentEvent] = []

  func record(_ event: AgentEvent) {
    events.append(event)
  }
}

private actor TestExecutionRecorder {
  private var executed = false

  func markExecuted() {
    executed = true
  }

  func wasExecuted() -> Bool {
    executed
  }
}

private actor TestWorkspaceStore {
  private var workspace: AssistantWorkspace

  init(workspace: AssistantWorkspace) {
    self.workspace = workspace
  }

  func snapshot() -> AssistantWorkspace {
    workspace
  }

  func commit(
    _ mutation: AssistantWorkspaceMutation,
    resultBuilder: AssistantWorkspaceResultBuilder
  ) throws -> AgentToolResult {
    switch mutation {
    case .saveMemory(let item):
      workspace.memories.append(item)
      return try resultBuilder(.memory(item))
    case .captureKnowledge(let item):
      workspace.knowledgeItems.append(item)
      return try resultBuilder(.knowledge(item))
    case .createHandoff(let handoff):
      workspace.handoffs.append(handoff)
      workspace.activeHandoffID = handoff.id
      return try resultBuilder(.handoff(handoff))
    case .restoreHandoff(let id, let restoredAt):
      guard let index = workspace.handoffs.firstIndex(where: { $0.id == id }) else {
        throw TestWorkspaceError.missingHandoff
      }
      workspace.handoffs[index].restoredAt = restoredAt
      workspace.activeHandoffID = id
      return try resultBuilder(.handoff(workspace.handoffs[index]))
    case .deactivateHandoff(let id):
      guard workspace.activeHandoffID == id,
        let handoff = workspace.handoffs.first(where: { $0.id == id })
      else { throw TestWorkspaceError.missingHandoff }
      workspace.activeHandoffID = nil
      return try resultBuilder(.handoff(handoff))
    case .addTask(let item):
      workspace.tasks.append(item)
      return try resultBuilder(.task(item))
    case .completeTask(let id, let completedAt):
      guard let index = workspace.tasks.firstIndex(where: { $0.id == id }) else {
        throw TestWorkspaceError.missingTask
      }
      workspace.tasks[index].isCompleted = true
      workspace.tasks[index].completedAt = completedAt
      return try resultBuilder(.task(workspace.tasks[index]))
    case .reopenTask(let id):
      guard let index = workspace.tasks.firstIndex(where: { $0.id == id }),
        workspace.tasks[index].isCompleted
      else { throw TestWorkspaceError.missingTask }
      workspace.tasks[index].isCompleted = false
      workspace.tasks[index].completedAt = nil
      return try resultBuilder(.task(workspace.tasks[index]))
    }
  }
}

private enum TestWorkspaceError: Error {
  case missingTask
  case missingHandoff
}

private struct FixedTestDateProvider: DateProviding {
  let date: Date

  func now() -> Date { date }
}

private actor TestCalendarReader: SystemCalendarReading {
  private let status: SystemCalendarAuthorization
  private let page: SystemCalendarEventPage
  private var intervals: [DateInterval] = []
  private var numberOfReads = 0

  init(
    status: SystemCalendarAuthorization,
    page: SystemCalendarEventPage = SystemCalendarEventPage(
      events: [],
      hasMore: false
    )
  ) {
    self.status = status
    self.page = page
  }

  func authorizationStatus() -> SystemCalendarAuthorization {
    status
  }

  func readEvents(
    in interval: DateInterval,
    limit: Int
  ) throws -> SystemCalendarEventPage {
    numberOfReads += 1
    intervals.append(interval)
    return SystemCalendarEventPage(
      events: Array(page.events.prefix(limit)),
      hasMore: page.hasMore || page.events.count > limit
    )
  }

  func readCount() -> Int { numberOfReads }

  func lastInterval() -> DateInterval? { intervals.last }
}

private func testISO8601Date(
  _ value: String,
  file: StaticString = #filePath,
  line: UInt = #line
) -> Date {
  guard let date = ISO8601DateFormatter().date(from: value) else {
    XCTFail("Invalid test ISO-8601 date: \(value)", file: file, line: line)
    return .distantPast
  }
  return date
}

private func makeExecutionContext(
  store: TestWorkspaceStore
) -> AgentToolExecutionContext {
  AgentToolExecutionContext(
    snapshot: { await store.snapshot() },
    commitLocalWrite: { mutation, _, _, resultBuilder in
      try await store.commit(mutation, resultBuilder: resultBuilder)
    }
  )
}

private struct LegacyPersistenceEnvelope: Codable {
  let schemaVersion: Int
  let workspace: AssistantWorkspace
}

private actor ScriptedDolphinRuntime: DolphinModelRuntimeProtocol {
  private var responses: [String]
  private let oversizedPromptMarker: String?

  init(responses: [String], oversizedPromptMarker: String? = nil) {
    self.responses = responses
    self.oversizedPromptMarker = oversizedPromptMarker
  }

  func information() -> DolphinModelInformation {
    DolphinModelInformation(
      loadSeconds: 0,
      maxContextLength: 300,
      maxQueryLength: 64,
      computeUnits: "Test",
      modelIdentifier: "scripted-test-runtime"
    )
  }

  func tokenCount(_ renderedPrompt: String) -> Int {
    if let oversizedPromptMarker,
      renderedPrompt.contains(oversizedPromptMarker)
    {
      return 300
    }
    return 10
  }

  func generate(
    renderedPrompt: String,
    maxNewTokens: Int,
    progress: @MainActor @Sendable (DolphinGenerationProgress) -> Void
  ) async throws -> DolphinGenerationResult {
    guard !responses.isEmpty else {
      throw DolphinModelRuntimeError.emptyPrompt
    }
    let text = responses.removeFirst()
    return DolphinGenerationResult(
      text: text,
      promptTokens: 10,
      generatedTokens: 1,
      timeToFirstTokenSeconds: 0,
      totalSeconds: 0.01
    )
  }
}