hermes_test.go

package hermes

import (
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"reflect"
	"strings"
	"testing"

	"github.com/ObolNetwork/obol-stack/internal/agentruntime"
	"github.com/ObolNetwork/obol-stack/internal/config"
	"github.com/ObolNetwork/obol-stack/internal/ui"
	"gopkg.in/yaml.v3"
)

func testConfig(t *testing.T) *config.Config {
	t.Helper()

	dir := t.TempDir()
	if err := os.WriteFile(filepath.Join(dir, ".stack-id"), []byte("test-cluster"), 0o644); err != nil {
		t.Fatalf("write .stack-id: %v", err)
	}

	return &config.Config{ConfigDir: dir, DataDir: dir, BinDir: dir}
}

func TestSyncDefaultModels_BootstrapsMissingDefaultInstance(t *testing.T) {
	cfg := testConfig(t)
	wantErr := errors.New("setup called")

	origSetup := setupDefaultForModelSync
	origSync := syncDefaultForModelSync
	t.Cleanup(func() {
		setupDefaultForModelSync = origSetup
		syncDefaultForModelSync = origSync
	})

	setupDefaultForModelSync = func(got *config.Config, _ *ui.UI) error {
		if got != cfg {
			t.Fatalf("setup cfg = %p, want %p", got, cfg)
		}
		return wantErr
	}
	syncDefaultForModelSync = func(_ *config.Config, _ string, _ *ui.UI) error {
		t.Fatal("sync should not run when the default deployment is missing")
		return nil
	}

	if err := SyncDefaultModels(cfg, newTestUI()); !errors.Is(err, wantErr) {
		t.Fatalf("SyncDefaultModels() err = %v, want %v", err, wantErr)
	}
}

func TestSyncDefaultModels_SyncsExistingDefaultInstance(t *testing.T) {
	cfg := testConfig(t)
	if err := os.MkdirAll(DeploymentPath(cfg, agentruntime.DefaultInstanceID), 0o755); err != nil {
		t.Fatalf("create default deployment dir: %v", err)
	}
	wantErr := errors.New("sync called")

	origSetup := setupDefaultForModelSync
	origSync := syncDefaultForModelSync
	t.Cleanup(func() {
		setupDefaultForModelSync = origSetup
		syncDefaultForModelSync = origSync
	})

	setupDefaultForModelSync = func(_ *config.Config, _ *ui.UI) error {
		t.Fatal("setup should not run when the default deployment exists")
		return nil
	}
	syncDefaultForModelSync = func(got *config.Config, id string, _ *ui.UI) error {
		if got != cfg {
			t.Fatalf("sync cfg = %p, want %p", got, cfg)
		}
		if id != agentruntime.DefaultInstanceID {
			t.Fatalf("sync id = %q, want %q", id, agentruntime.DefaultInstanceID)
		}
		return wantErr
	}

	if err := SyncDefaultModels(cfg, newTestUI()); !errors.Is(err, wantErr) {
		t.Fatalf("SyncDefaultModels() err = %v, want %v", err, wantErr)
	}
}

func TestOnboardDefaultAlreadyInstalledIsIdempotent(t *testing.T) {
	cfg := testConfig(t)
	if err := os.MkdirAll(DeploymentPath(cfg, agentruntime.DefaultInstanceID), 0o755); err != nil {
		t.Fatalf("create default deployment dir: %v", err)
	}

	origInstalled := hermesDeploymentInstalledForOnboard
	t.Cleanup(func() {
		hermesDeploymentInstalledForOnboard = origInstalled
	})

	hermesDeploymentInstalledForOnboard = func(got *config.Config, id string) (bool, error) {
		if got != cfg {
			t.Fatalf("installed cfg = %p, want %p", got, cfg)
		}
		if id != agentruntime.DefaultInstanceID {
			t.Fatalf("installed id = %q, want %q", id, agentruntime.DefaultInstanceID)
		}
		return true, nil
	}

	if err := Onboard(cfg, OnboardOptions{
		ID:        agentruntime.DefaultInstanceID,
		Sync:      true,
		IsDefault: true,
		AgentMode: true,
	}, newTestUI()); err != nil {
		t.Fatalf("Onboard(existing installed default) err = %v", err)
	}
}

// TestGenerateConfig_PrimaryIsRoundTrippable guards the LiteLLM model_name
// contract end-to-end: whatever string the agent's `model.default` is set to
// MUST match a `model_name` entry in the LiteLLM ConfigMap byte-for-byte,
// because Hermes will pass it back as the `model` field on every
// chat-completion call. Stripping anywhere on this path causes the agent to
// call LiteLLM with a key that no longer matches a registered route — the
// flow-14 / ca820c9 regression.
func TestGenerateConfig_PrimaryIsRoundTrippable(t *testing.T) {
	cases := []struct {
		name    string
		primary string
	}{
		{"bare ollama tag", "llama3.1:8b"},
		{"bare claude id", "claude-opus-4-7"},
		{"bare openai id", "gpt-5.4"},
		// Wildcard-expanded entries can carry the provider prefix; the
		// agent must still send back the exact string LiteLLM published.
		{"provider-prefixed", "anthropic/claude-3-5-sonnet-latest"},
		// Custom endpoints write `model_name: <bare>` after the contract
		// fix; this case guards that the agent picks up that bare name
		// without re-namespacing.
		{"custom endpoint bare", "qwen36-fast"},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			raw, err := generateConfig(testConfig(t), tc.primary)
			if err != nil {
				t.Fatalf("generateConfig: %v", err)
			}
			var cfg map[string]any
			if err := yaml.Unmarshal(raw, &cfg); err != nil {
				t.Fatalf("yaml.Unmarshal: %v", err)
			}
			modelCfg, ok := cfg["model"].(map[string]any)
			if !ok {
				t.Fatalf("model config missing")
			}
			if got := modelCfg["default"]; got != tc.primary {
				t.Fatalf("model.default = %q, want %q (round-trip mismatch)", got, tc.primary)
			}
		})
	}
}

func TestGenerateConfig_UsesLiteLLMCustomProvider(t *testing.T) {
	raw, err := generateConfig(testConfig(t), "gpt-5.2")
	if err != nil {
		t.Fatalf("generateConfig() error = %v", err)
	}

	var cfg map[string]any
	if err := yaml.Unmarshal(raw, &cfg); err != nil {
		t.Fatalf("yaml.Unmarshal() error = %v", err)
	}

	modelCfg, ok := cfg["model"].(map[string]any)
	if !ok {
		t.Fatalf("model config missing or wrong type: %#v", cfg["model"])
	}

	if got := modelCfg["default"]; got != "gpt-5.2" {
		t.Fatalf("model.default = %#v, want %q", got, "gpt-5.2")
	}

	if got := modelCfg["provider"]; got != "custom" {
		t.Fatalf("model.provider = %#v, want %q", got, "custom")
	}

	if got := modelCfg["base_url"]; got != "http://litellm.llm.svc.cluster.local:4000/v1" {
		t.Fatalf("model.base_url = %#v", got)
	}

	if got := modelCfg["api_key"]; got != "sk-obol-test-cluster" {
		t.Fatalf("model.api_key = %#v, want stack-derived LiteLLM key", got)
	}

	terminalCfg, ok := cfg["terminal"].(map[string]any)
	if !ok {
		t.Fatalf("terminal config missing or wrong type: %#v", cfg["terminal"])
	}

	if got := terminalCfg["cwd"]; got != "/data/.hermes/workspace" {
		t.Fatalf("terminal.cwd = %#v, want %q", got, "/data/.hermes/workspace")
	}

	skillsCfg, ok := cfg["skills"].(map[string]any)
	if !ok {
		t.Fatalf("skills config missing or wrong type: %#v", cfg["skills"])
	}
	if got := fmt.Sprint(skillsCfg["external_dirs"]); !strings.Contains(got, "/data/.hermes/obol-skills") {
		t.Fatalf("skills.external_dirs = %#v, want Obol external skills dir", skillsCfg["external_dirs"])
	}
}

func TestGenerateValues_UsesHermesNativeNames(t *testing.T) {
	values := generateValues(
		"hermes-obol-agent",
		"hermes-obol-agent.obol.stack",
		"obol-agent.obol.stack",
		"https://agent.example.com",
		"secret-token",
		"gpt-5.2",
		[]byte("model:\n  default: gpt-5.2\n"),
	)

	for _, needle := range []string{
		"name: hermes",
		"name: hermes-config",
		"name: hermes-data",
		`API_SERVER_KEY: "secret-token"`,
		`value: "https://agent.example.com"`,
		"AGENT_NAMESPACE",
		`value: "hermes-obol-agent"`,
		"OBOL_SKILLS_DIR",
		"/data/.hermes/obol-skills",
		"/data/.hermes/logs",
		"containerPort: 8642",
		"containerPort: 9119",
		"runAsNonRoot: true",
		"runAsUser: 1000",
		"runAsGroup: 1000",
		"fsGroup: 1000",
		"fsGroupChangePolicy: Always",
		"checksum/hermes-config:",
		"init-hermes-data",
		"type: Recreate",
		`Hermes binary missing from image: /opt/hermes/.venv/bin/hermes`,
		`Hermes image is missing required extras: web,messaging,mcp,pty,cli,acp,google`,
		`import fastapi, uvicorn, telegram, mcp, ptyprocess, simple_term_menu, googleapiclient`,
		`PRAGMA quick_check`,
		`state-db-corrupt-$ts`,
		`- "/opt/hermes/.venv/bin/hermes"`,
		`- "hermes-obol-agent.obol.stack"`,
		`- "obol-agent.obol.stack"`,
		"name: hermes-dashboard",
		"name: GATEWAY_HEALTH_URL",
		"HERMES_DASHBOARD_BASIC_AUTH_USERNAME",
		"HERMES_DASHBOARD_BASIC_AUTH_PASSWORD",
		// Must track HERMES_HOME: v2026.7.x images bake
		// HERMES_WRITE_SAFE_ROOT=/opt/data and deny all file-tool
		// writes outside the safe root.
		"name: HERMES_WRITE_SAFE_ROOT",
		"value: /data/.hermes:/tmp",
	} {
		if !strings.Contains(values, needle) {
			t.Fatalf("generateValues() missing %q:\n%s", needle, values)
		}
	}

	for _, banned := range []string{
		"bootstrap-hermes-install",
		"git clone",
		"uv pip install",
		"/data/.hermes/hermes-agent",
		"init-hermes-perms",
		"chown -R 1000:1000 /data",
		"runAsUser: 0",
		"checksum/hermes-skills",
		"name: hermes-skills",
		"skills.tar.gz",
		"mountPath: /etc/hermes/skills",
	} {
		if strings.Contains(values, banned) {
			t.Fatalf("generateValues() contains banned fragment %q:\n%s", banned, values)
		}
	}

	var parsed any
	if err := yaml.Unmarshal([]byte(values), &parsed); err != nil {
		t.Fatalf("generateValues() produced invalid YAML: %v\n%s", err, values)
	}
}

func TestGenerateValues_ConfigChecksumChangesWithConfig(t *testing.T) {
	first := generateValues(
		"hermes-obol-agent",
		"hermes-obol-agent.obol.stack",
		"obol-agent.obol.stack",
		"https://agent.example.com",
		"secret-token",
		"gpt-5.2",
		[]byte("model:\n  default: gpt-5.2\n"),
	)
	second := generateValues(
		"hermes-obol-agent",
		"hermes-obol-agent.obol.stack",
		"obol-agent.obol.stack",
		"https://agent.example.com",
		"secret-token",
		"gpt-5.2",
		[]byte("model:\n  default: gpt-5.3\n"),
	)

	a := extractChecksumAnnotation(t, first, "checksum/hermes-config")
	b := extractChecksumAnnotation(t, second, "checksum/hermes-config")
	if a == "" || b == "" {
		t.Fatalf("missing checksum annotation(s): first=%q second=%q", a, b)
	}
	if a == b {
		t.Fatalf("checksum/hermes-config did not change when config changed: %s", a)
	}
}

func TestDashboardHostname_UsesDefaultAgentHostAndHermesUIHostForNamedInstances(t *testing.T) {
	tests := []struct {
		id   string
		want string
	}{
		{
			id:   "obol-agent",
			want: "obol-agent.obol.stack",
		},
		{
			id:   "research-agent",
			want: "hermes-research-agent-ui.obol.stack",
		},
	}

	for _, tt := range tests {
		t.Run(tt.id, func(t *testing.T) {
			if got := dashboardHostname(tt.id); got != tt.want {
				t.Fatalf("dashboardHostname(%q) = %q, want %q", tt.id, got, tt.want)
			}
		})
	}
}

func extractChecksumAnnotation(t *testing.T, values, key string) string {
	t.Helper()
	var doc struct {
		Resources []map[string]any `yaml:"resources"`
	}
	if err := yaml.Unmarshal([]byte(values), &doc); err != nil {
		t.Fatalf("generateValues produced invalid YAML: %v\n%s", err, values)
	}
	for _, res := range doc.Resources {
		if res["kind"] != "Deployment" {
			continue
		}
		spec, _ := res["spec"].(map[string]any)
		template, _ := spec["template"].(map[string]any)
		metadata, _ := template["metadata"].(map[string]any)
		annotations, _ := metadata["annotations"].(map[string]any)
		if got, _ := annotations[key].(string); got != "" {
			return got
		}
	}
	return ""
}

func TestHermesExecArgs_UsesNativeHermesBinary(t *testing.T) {
	got := hermesExecArgs("hermes-obol-agent", []string{"skills", "audit"}, false)
	want := []string{
		"exec", "-i",
		"-c", "hermes",
		"-n", "hermes-obol-agent",
		"deploy/hermes",
		"--",
		"/opt/hermes/.venv/bin/hermes",
		"skills",
		"audit",
	}

	if !reflect.DeepEqual(got, want) {
		t.Fatalf("hermesExecArgs() = %#v, want %#v", got, want)
	}
}

func TestResolveCLIInvocation_DefaultsToObolAgent(t *testing.T) {
	cfg := testConfig(t)
	mkdirInstance(t, cfg, agentruntime.DefaultInstanceID)
	mkdirInstance(t, cfg, "research")

	id, args, err := ResolveCLIInvocation(cfg, []string{"skills", "list"})
	if err != nil {
		t.Fatalf("ResolveCLIInvocation() error = %v", err)
	}
	if id != agentruntime.DefaultInstanceID {
		t.Fatalf("id = %q, want %q", id, agentruntime.DefaultInstanceID)
	}
	if !reflect.DeepEqual(args, []string{"skills", "list"}) {
		t.Fatalf("args = %#v", args)
	}
}

func TestResolveCLIInvocation_UsesExplicitAgent(t *testing.T) {
	cfg := testConfig(t)
	mkdirInstance(t, cfg, agentruntime.DefaultInstanceID)
	mkdirInstance(t, cfg, "research")

	id, args, err := ResolveCLIInvocation(cfg, []string{"--agent", "research", "config", "show"})
	if err != nil {
		t.Fatalf("ResolveCLIInvocation() error = %v", err)
	}
	if id != "research" {
		t.Fatalf("id = %q, want research", id)
	}
	if !reflect.DeepEqual(args, []string{"config", "show"}) {
		t.Fatalf("args = %#v", args)
	}
}

func TestResolveCLIInvocation(t *testing.T) {
	tests := []struct {
		name      string
		instances []string
		input     []string
		wantID    string
		wantArgs  []string
		wantErr   string
	}{
		{
			name:    "no instances",
			input:   []string{"version"},
			wantErr: "no Hermes instances found",
		},
		{
			name:      "single instance fallback",
			instances: []string{"solo"},
			input:     []string{"version"},
			wantID:    "solo",
			wantArgs:  []string{"version"},
		},
		{
			name:      "multiple non-default instances require selector",
			instances: []string{"research", "ops"},
			input:     []string{"version"},
			wantErr:   "multiple Hermes instances found",
		},
		{
			name:      "explicit agent equals syntax",
			instances: []string{agentruntime.DefaultInstanceID, "research"},
			input:     []string{"--agent=research", "config", "show"},
			wantID:    "research",
			wantArgs:  []string{"config", "show"},
		},
		{
			name:      "separator preserves native flags",
			instances: []string{agentruntime.DefaultInstanceID},
			input:     []string{"--agent", agentruntime.DefaultInstanceID, "--", "--help"},
			wantID:    agentruntime.DefaultInstanceID,
			wantArgs:  []string{"--help"},
		},
		{
			name:      "missing agent value",
			instances: []string{agentruntime.DefaultInstanceID},
			input:     []string{"--agent"},
			wantErr:   "--agent requires an instance name",
		},
		{
			name:      "duplicate agent selector",
			instances: []string{agentruntime.DefaultInstanceID, "research"},
			input:     []string{"--agent", agentruntime.DefaultInstanceID, "--agent=research", "version"},
			wantErr:   "--agent specified multiple times",
		},
		{
			name:      "unknown explicit agent",
			instances: []string{agentruntime.DefaultInstanceID},
			input:     []string{"--agent", "missing", "version"},
			wantErr:   `Hermes instance "missing" not found`,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := testConfig(t)
			for _, id := range tt.instances {
				mkdirInstance(t, cfg, id)
			}

			gotID, gotArgs, err := ResolveCLIInvocation(cfg, tt.input)
			if tt.wantErr != "" {
				if err == nil {
					t.Fatalf("expected error containing %q, got nil", tt.wantErr)
				}
				if !strings.Contains(err.Error(), tt.wantErr) {
					t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantErr)
				}
				return
			}
			if err != nil {
				t.Fatalf("ResolveCLIInvocation() error = %v", err)
			}
			if gotID != tt.wantID {
				t.Fatalf("id = %q, want %q", gotID, tt.wantID)
			}
			if !reflect.DeepEqual(gotArgs, tt.wantArgs) {
				t.Fatalf("args = %#v, want %#v", gotArgs, tt.wantArgs)
			}
		})
	}
}

func mkdirInstance(t *testing.T, cfg *config.Config, id string) {
	t.Helper()
	if err := os.MkdirAll(DeploymentPath(cfg, id), 0o755); err != nil {
		t.Fatalf("create Hermes instance %q: %v", id, err)
	}
}

func TestGenerateConfig_IncludesPayAgentAllowlist(t *testing.T) {
	raw, err := generateConfig(testConfig(t), "claude-sonnet-4-6")
	if err != nil {
		t.Fatalf("generateConfig: %v", err)
	}
	var cfg map[string]any
	if err := yaml.Unmarshal(raw, &cfg); err != nil {
		t.Fatalf("yaml.Unmarshal: %v", err)
	}
	allowlist, ok := cfg["command_allowlist"].([]any)
	if !ok || len(allowlist) == 0 {
		t.Fatalf("command_allowlist = %#v, want non-empty list", cfg["command_allowlist"])
	}
	if allowlist[0] != "tirith:lookalike_tld" {
		t.Fatalf("command_allowlist[0] = %v, want tirith:lookalike_tld", allowlist[0])
	}
	term, ok := cfg["terminal"].(map[string]any)
	if !ok {
		t.Fatal("terminal config missing")
	}
	if term["timeout"] != 3600 {
		t.Fatalf("terminal.timeout = %v, want 3600 for pay-agent", term["timeout"])
	}
}

func TestMergePreservedHermesConfigKeys_UnionsAllowlist(t *testing.T) {
	cfg := testConfig(t)
	id := "obol-agent"
	home := agentruntime.HomePath(cfg, agentruntime.Hermes, id)
	if err := os.MkdirAll(home, 0o755); err != nil {
		t.Fatalf("mkdir home: %v", err)
	}
	existing := []byte("command_allowlist:\n  - custom:rule\n")
	if err := os.WriteFile(filepath.Join(home, "config.yaml"), existing, 0o600); err != nil {
		t.Fatalf("write existing config: %v", err)
	}
	generated, err := generateConfig(cfg, "claude-sonnet-4-6")
	if err != nil {
		t.Fatalf("generateConfig: %v", err)
	}
	merged, err := mergePreservedHermesConfigKeys(cfg, id, generated)
	if err != nil {
		t.Fatalf("mergePreservedHermesConfigKeys: %v", err)
	}
	var out map[string]any
	if err := yaml.Unmarshal(merged, &out); err != nil {
		t.Fatalf("yaml.Unmarshal merged: %v", err)
	}
	got := stringSliceFromConfig(out["command_allowlist"])
	want := []string{"tirith:lookalike_tld", "custom:rule"}
	if !reflect.DeepEqual(got, want) {
		t.Fatalf("command_allowlist = %#v, want %#v", got, want)
	}
}