import { requestHostOps } from './request-host-ops.mjs';
// #1873 Phase A slice A3: root and project agent copies through the real bus and launcher. The
// cli's boot step reads the root file once and hands the snapshot to the broker and the launcher;
// a bound copy launches as an ordinary instance of the organization, an unbound or refused one
// refuses at the verb, and a project agent gets only its own project. Real runners in the bwrap
// sandbox on the fake adapter, with the in-process host lifecycle.test.mjs uses.

import { test } from "node:test";
import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { DatabaseSync } from "node:sqlite";
import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, symlinkSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import { fileURLToPath } from "node:url";
import { businessDoc, launchDoc, tokenFile, writeJson } from "../../organization/tests/helpers.mjs";
import { BusError } from "../../bus/src/broker.mjs";
import { Client } from "../../bus/src/client.mjs";
import { startBroker } from "../../bus/src/runtime.mjs";
import { gitEnv } from "../../seat/src/checkout.mjs";
import { launchLogFile } from "../../seat/src/session.mjs";
import { sandboxProblem } from "../../seat/src/sandbox.mjs";
import { bootConfig, loadSystem } from "../src/config.mjs";
import { startTimeOf } from "../src/host.mjs";
import { createLauncher } from "../src/launcher.mjs";
import { fakeHarnesses, fixture, tmp, withoutHostCredentials } from "./helpers.mjs";
import { fakeGiteaApi } from "../../bus/tests/fake-gitea-api.mjs";
import { send as giteaSend } from "../../bus/src/gitea-grant.mjs";
import { organizationWriter } from "../../organization/src/organization.mjs";
import { activateOrg, reserveOrg } from "../../organization/src/org-registry.mjs";
import { copyBotLogin } from "../../organization/src/copy-bindings.mjs";

const FAKE = fileURLToPath(new URL("../../harness/tests/fixtures/fake-adapter.mjs", import.meta.url));
const skip = sandboxProblem() ?? false;
const SECRET = "sk-test-NOT-A-SECRET-1234";
const VARS = { harness: "pi", model: "claude-sonnet-5-5", thinking: "high" };

async function until(fn, ms = 15000) {
  const end = Date.now() + ms;
  while (Date.now() < end) {
    const v = await fn();
    if (v) return v;
    await new Promise((r) => setTimeout(r, 50));
  }
  throw new Error("timed out waiting");
}

function gitRepo(dir) {
  mkdirSync(dir, { recursive: true });
  const git = (...args) => {
    const r = spawnSync("git", ["-c", "maintenance.auto=false", "-c", "gc.auto=0", "-c", "user.name=test", "-c", "user.email=test@example.invalid", "-C", dir, ...args], { env: gitEnv(), encoding: "utf8" });
    assert.equal(r.status, 0, r.stderr);
  };
  git("init", "-q", "-b", "main");
  writeFileSync(join(dir, "file.txt"), "one\n");
  git("add", "file.txt");
  git("commit", "-q", "-m", "one");
}

// acme: two code projects, stack and web. stack defines the project agent checker. The root file
// holds gate (merge-gate, no credential: bound), researcher (research, needs gitea: unbound in every
// organization) and sec (security-reviewer, excluded from acme). The coder's gitea token file is
// named for, and holds, the test secret, so it is bound elsewhere in the organization.
function prepare(t, edit = (doc) => doc) {
  const root = tmp(t, "mosaic-copy-");
  const f = fixture(root, "acme", (doc) => {
    doc.roles.chief.vars = { harness: "pi", model: "claude-opus-5-5", thinking: "high" };
    doc.roles.coder.vars.model = "claude-sonnet-5-5";
    const secret = tokenFile(join(root, "secrets"), SECRET);
    writeFileSync(secret, SECRET);
    doc.roles.coder.credentials.gitea = { ...doc.roles.coder.credentials.gitea, file: secret };
    doc.launch = launchDoc("chief", ["coder"], { opus: 1, sonnet: 4 });
    doc.projects.stack.agents = { checker: { definition: "merge-gate", vars: VARS } };
    doc.projects.web = { root: join(root, "web") };
    return edit(doc);
  });
  withoutHostCredentials(f.env, { piKey: true });
  gitRepo(f.doc.projects.stack.root);
  gitRepo(f.doc.projects.web.root);
  writeJson(join(root, "config", "agents.json"), { agentsVersion: 1, agents: {
    gate: { definition: "merge-gate", vars: VARS },
    researcher: { definition: "research", vars: VARS },
    sec: { definition: "security-reviewer", vars: VARS, excludeOrgs: ["acme"] },
  } }, 0o600);
  const adapter = join(root, "adapter.sh");
  writeFileSync(adapter, `exec '${process.execPath}' '${FAKE}'\n`, { mode: 0o644 });
  return { root, f, adapter };
}

async function start(t, { f, adapter }, { businessId = "acme", orgRoot, copyTransport = null, beforeBind = null } = {}) {
  const system = loadSystem({ env: f.env });
  const { trackers, ...boot } = bootConfig({ system, businessId, env: f.env, ...(orgRoot ? { orgRoot } : {}) });
  const runtime = await startBroker({ ...boot, ...(copyTransport ? { copyTransport } : {}) });
  const dataRoot = boot.dataRoot;
  mkdirSync(join(dataRoot, "bus-host"), { recursive: true, mode: 0o700 });
  const ops = {
    ...requestHostOps(runtime),
    identity: (m) => runtime.identity(m.cap),
    authorizeLaunch: (m) => runtime.authorizeLaunch(m.cap, m.instance),
    refuse: (m) => runtime.refuse(m.cap, m.code, m.subject),
    endLaunch: (m) => runtime.endLaunch(m.record),
    credentialStatus: (m) => runtime.credentialStatus(m.business, m.role),
    threadsState: (m) => runtime.threadsState(m.business),
    threadIdle: (m) => runtime.threadIdle(m.record),
    mayLaunch: (m) => runtime.mayLaunch(m),
    landHeld: (m) => runtime.landHeld(m.record),
    landHolders: (m) => runtime.landHolders(m.business),
    landRelease: (m) => runtime.landRelease(m.record),
    lifecycleRequests: (m) => runtime.lifecycleRequests(m.business),
    lifecycleTake: (m) => runtime.lifecycleTake(m.record),
    lifecycleDelete: (m) => runtime.lifecycleDelete(m.record),
    lifecycleDone: (m) => runtime.lifecycleDone(m.record),
    copyLaunch: (m) => runtime.copyLaunch(m),
  };
  const refusing = (what, fn) => async (m) => {
    try {
      return fn(m);
    } catch (e) {
      const code = e instanceof BusError ? e.code : `${what}-refused`;
      throw Object.assign(new Error(`${what} refused: ${code}`), { code });
    }
  };
  const hooks = [];
  let closing = null;
  const host = {
    business: businessId,
    path: runtime.path,
    dataRoot,
    op: refusing("launch-op", (m) => {
      if (!Object.hasOwn(ops, m.op)) throw new BusError("invalid-host-request");
      return ops[m.op](m);
    }),
    bindLaunch: beforeBind
      ? async (r) => { await beforeBind(r); return refusing("launch bind", (x) => runtime.bindLaunch(x))(r); }
      : refusing("launch bind", (r) => runtime.bindLaunch(r)),
    beforeClose: (fn) => void hooks.push(fn),
    copyBound: runtime.copyBound,
  };
  const logs = [];
  const launcher = createLauncher({
    host,
    system: orgRoot ? { ...system, dataRoot } : system,
    env: f.env,
    makeLoader: await fakeHarnesses(t, { pi: adapter, "claude-code": adapter }),
    sessionDefaults: { pollInterval: 100 },
    harnessVersion: "0.85.1",
    readOnly: [FAKE],
    threadTickMs: 3600000,
    stopTimeoutMs: 1000,
    log: (l) => logs.push(l),
    copies: boot.copies ?? null,
  });
  const close = () =>
    (closing ??= (async () => {
      for (const fn of hooks) await fn(0);
      await runtime.close();
    })());
  t.after(close);
  await launcher.listen();
  const human = runtime.broker.bindHuman({ business: businessId, human: f.doc.human, via: "cli", outsideAgent: true });
  const call = (verb, args = {}) => runtime.broker.request(human, { verb, args });
  const carry = async (request) => {
    await launcher.tick();
    return call("instance.request", { request });
  };
  const running = (instance) => launcher.registry.sessions.filter((s) => s.instance === instance);
  return { boot, dataRoot, runtime, launcher, host, call, carry, running, logs, close };
}

// What the bus's trail holds: every event body, as text.
function trail(dataRoot) {
  const db = new DatabaseSync(join(dataRoot, "bus", "bus.sqlite"), { readOnly: true });
  try {
    return db.prepare("SELECT kind, body FROM events").all().map((e) => `${e.kind} ${e.body}`).join("\n");
  } finally {
    db.close();
  }
}

const refusedAt = (s, instance) => {
  try {
    s.call("instance.launch", { instance });
  } catch (e) {
    assert.ok(e instanceof BusError, String(e));
    return e;
  }
  assert.fail(`${instance} launched`);
};

test("A3: a bound root copy launches as an instance of the organization; the excluded one and the root assistant aren't there", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  assert.deepEqual(Object.keys(s.boot.copies.copies).sort(), ["checker.stack", "gate", "researcher"]);
  const done = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(done.done.refusal, null, JSON.stringify(done));
  const [run] = s.running("gate");
  assert.equal(run.run, done.done.run);
  // The grid read names it running from the bus's own claims.
  await until(() => readFileSync(join(s.dataRoot, "launches", "acme", run.run, "runner.log"), "utf8").includes("claimed by run"));
  const grid = s.call("instances");
  assert.equal(grid.copies.gate.state, "instance");
  assert.deepEqual(grid.copies.gate.running, [run.run]);
  // sec is excluded from acme: no copy, no instance, and a launch names it unknown.
  assert.equal(Object.hasOwn(grid.copies, "sec"), false);
  assert.equal(refusedAt(s, "sec").code, "unknown-role");
});

test("A3: an unbound copy refuses at the verb by name and binding; no value reaches the refusal, the trail or the grid", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  const e = refusedAt(s, "researcher");
  assert.equal(e.code, "credential-unbound");
  assert.match(e.reason, /^researcher has no binding in acme for gitea$/);
  const grid = JSON.stringify(s.call("instances"));
  assert.match(grid, /"researcher":\{[^}]*"state":"unbound"/);
  for (const text of [e.message, e.reason, grid, trail(s.dataRoot), s.logs.join("\n")]) {
    assert.equal(text.includes(SECRET), false);
    assert.equal(text.includes(p.root), false, "no host path");
  }
  // Nothing was asked of the launcher.
  await s.launcher.tick();
  assert.equal(s.running("researcher").length, 0);
});

test("A3: a project agent launches with only its own project's mapping; a project whose union refuses refuses every agent in it", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  const done = await s.carry(s.call("instance.launch", { instance: "checker.stack" }).request);
  assert.equal(done.done.refusal, null, JSON.stringify(done));
  const [run] = s.running("checker.stack");
  const manifest = JSON.parse(readFileSync(join(run.runDir, "bundle", "manifest.json"), "utf8"));
  assert.deepEqual(manifest.projects, ["stack"]);
  // An org instance of the same role takes both code projects.
  const coder = await s.carry(s.call("instance.launch", { instance: "coder" }).request);
  assert.equal(coder.done.refusal, null, JSON.stringify(coder));
  const [c] = s.running("coder");
  assert.deepEqual(JSON.parse(readFileSync(join(c.runDir, "bundle", "manifest.json"), "utf8")).projects.sort(), ["stack", "web"]);

  // web excludes an agent nothing defines: its union refuses, so its agents refuse, naming web.
  const q = prepare(t, (doc) => {
    doc.projects.web.agents = { checker: { definition: "merge-gate", vars: VARS }, lint: { definition: "security-reviewer", vars: VARS }, ghost: { exclude: true } };
    return doc;
  });
  const r = await start(t, q);
  for (const name of ["checker.web", "lint.web"]) {
    const e = refusedAt(r, name);
    assert.equal(e.code, "project-refused");
    assert.match(e.reason, new RegExp(`^${name.replace(".", "\\.")} can't launch in acme: project web refuses its agents: .*ghost`));
  }
  // The other project's agent is untouched.
  assert.equal((await r.carry(r.call("instance.launch", { instance: "checker.stack" }).request)).done.refusal, null);
  // An inherited root copy and an organization instance still launch, without web's mount.
  for (const instance of ["gate", "coder"]) {
    const out = await r.carry(r.call("instance.launch", { instance }).request);
    assert.equal(out.done.refusal, null, JSON.stringify(out));
    const [inherited] = r.running(instance);
    assert.deepEqual(projectsOf(inherited), ["stack"], instance);
  }
});

const projectsOf = (run) => JSON.parse(readFileSync(join(run.runDir, "bundle", "manifest.json"), "utf8")).projects.sort();
const bundleOf = (run, file) => JSON.parse(readFileSync(join(run.runDir, "bundle", file), "utf8"));

test("A3: a project's exclude takes its mount from an inherited agent, and its narrow reaches the agent's real bundle", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t, (doc) => {
    doc.projects.stack.agents.gate = { vars: { "limits.tools": ["read"] } };
    doc.projects.web.agents = { gate: { exclude: true } };
    return doc;
  });
  const s = await start(t, p);
  const done = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(done.done.refusal, null, JSON.stringify(done));
  const [run] = s.running("gate");
  assert.deepEqual(projectsOf(run), ["stack"]);
  const tools = bundleOf(run, "policy.json").tools;
  assert.ok(tools.includes("read"), JSON.stringify(tools));
  assert.equal(tools.includes("grep"), false, JSON.stringify(tools));
  // The launch record names the skipped project and the code, never a reason text.
  const skipped = readFileSync(launchLogFile(s.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l)).filter((e) => e.event === "checkout-skipped");
  assert.deepEqual(skipped.map(({ instance, project, reason }) => ({ instance, project, reason })), [{ instance: "gate", project: "web", reason: "project-refused" }]);
});

// Writes the organization file the way a human edit does, outside any writer verb.
const editOrg = (p, change) => {
  const file = join(p.root, "config", "businesses", "acme.json");
  const doc = JSON.parse(readFileSync(file, "utf8"));
  change(doc);
  writeFileSync(file, JSON.stringify(doc, null, 2) + "\n", { mode: 0o600 });
};
// A writer verb reloads the broker from the file. Keeping coder twice changes nothing and refuses,
// so a repeat reload drops the keep instead.
const reload = (s) => {
  try { return s.call("veto.set", { revision: s.call("instances").revision, op: "keep", name: "coder" }); }
  catch (e) { if (e.code !== "organization-no-change") throw e; }
  return s.call("veto.set", { revision: s.call("instances").revision, op: "unkeep", name: "coder" });
};
// What the run's first turn said, from inside the real sandbox, about the web checkout.
async function webSeen(s, run) {
  await until(() => existsSync(join(run.runDir, "runner.log")) && readFileSync(join(run.runDir, "runner.log"), "utf8").includes("claimed by run"));
  s.call("message.send", { to: run.instance, class: "REQUEST", body: "fixture" });
  const said = join(run.runDir, "turns", "0001.stderr");
  await until(() => existsSync(said) && /WEB-(READABLE|ABSENT)/.test(readFileSync(said, "utf8")));
  return readFileSync(said, "utf8").match(/WEB-(READABLE|ABSENT)/)[1];
}

test("A3: a checkout an earlier launch made is out of sight in the sandbox once its project excludes the agent, and stays on the host", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  // The adapter runs inside the sandbox and says only whether the web checkout's file is readable.
  writeFileSync(p.adapter, `if test -r "$MOSAIC_WORKSPACE/web/file.txt"; then echo WEB-READABLE >&2; else echo WEB-ABSENT >&2; fi\nexec '${process.execPath}' '${FAKE}'\n`);
  const s = await start(t, p);
  let out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(out.done.refusal, null, JSON.stringify(out));
  let [run] = s.running("gate");
  assert.deepEqual(projectsOf(run), ["stack", "web"]);
  assert.equal(await webSeen(s, run), "READABLE");
  await s.carry(s.call("instance.end", { instance: "gate" }).request);
  await until(() => s.running("gate").length === 0);
  for (const exclude of [{ gate: { exclude: true } }, { ghost: { exclude: true } }]) {
    // The project excludes gate, then refuses its whole union.
    editOrg(p, (d) => { d.projects.web.agents = exclude; });
    reload(s);
    out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
    assert.equal(out.done.refusal, null, JSON.stringify(out));
    [run] = s.running("gate");
    assert.deepEqual(projectsOf(run), ["stack"]);
    assert.equal(await webSeen(s, run), "ABSENT");
    await s.carry(s.call("instance.end", { instance: "gate" }).request);
    await until(() => s.running("gate").length === 0);
  }
  // The earlier work is still on the host, untouched.
  assert.equal(readFileSync(join(s.dataRoot, "workspaces", "acme", "gate", "web", "file.txt"), "utf8"), "one\n");
});

test("A3: a project that excludes the agent while its launch is prepared refuses the launch; the bus's last admission asks too", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  const op = s.host.op;
  let changed = false;
  s.host.op = async (m) => {
    const out = await op(m);
    if (!changed && m.op === "request.admission" && m.project === "web") {
      changed = true;
      editOrg(p, (d) => { d.projects.web.agents = { gate: { exclude: true } }; });
    }
    return out;
  };
  const out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(changed, true);
  assert.equal(out.done.refusal, "project-refused", JSON.stringify(out));
  assert.equal(s.running("gate").length, 0);
  // Once the bus has the change, its launch-boundary admission refuses the instance there too.
  reload(s);
  const revision = s.call("instances").revision;
  assert.deepEqual(s.runtime.admission({ business: "acme", projects: ["stack", "web"], instance: "gate", revision }).code, "project-refused");
  assert.equal(s.runtime.admission({ business: "acme", projects: ["stack"], instance: "gate", revision }).ready, true);
  assert.equal(s.runtime.admission({ business: "acme", projects: ["stack", "web"] }).ready, true);
  // The launch boundary takes an instance only with the revision its bundle came from.
  assert.equal(s.runtime.admission({ business: "acme", projects: ["stack"], instance: "gate" }).code, "project-unknown");
  assert.equal(s.runtime.admission({ business: "acme", projects: ["stack"], instance: "gate", revision: "0".repeat(64) }).code, "organization-changed");
});

// Launches gate with both projects, reads web from inside the sandbox, and ends the run, so the
// workspace keeps a web checkout an earlier launch made.
async function launchBoth(s) {
  const out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(out.done.refusal, null, JSON.stringify(out));
  const [run] = s.running("gate");
  assert.deepEqual(projectsOf(run), ["stack", "web"]);
  assert.equal(await webSeen(s, run), "READABLE");
  await s.carry(s.call("instance.end", { instance: "gate" }).request);
  await until(() => s.running("gate").length === 0);
}
const readsWeb = (p) => writeFileSync(p.adapter, `if test -r "$MOSAIC_WORKSPACE/web/file.txt"; then echo WEB-READABLE >&2; else echo WEB-ABSENT >&2; fi\nexec '${process.execPath}' '${FAKE}'\n`);

test("A3: a checkout of a project the bus doesn't admit now is out of sight too, not only an excluded one", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  readsWeb(p);
  const s = await start(t, p);
  await launchBoth(s);
  // web is declared and gate is in its union, but the bus doesn't admit the project for this launch.
  const op = s.host.op;
  s.host.op = async (m) => (m.op === "request.admission" && m.project === "web" ? { ready: false, revision: null, code: "project-pending" } : op(m));
  const out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(out.done.refusal, null, JSON.stringify(out));
  const [run] = s.running("gate");
  assert.deepEqual(projectsOf(run), ["stack"]);
  assert.equal(await webSeen(s, run), "ABSENT");
  assert.equal(readFileSync(join(s.dataRoot, "workspaces", "acme", "gate", "web", "file.txt"), "utf8"), "one\n");
});

test("A3: a symlink or a file where a hidden checkout would be refuses the launch, and nothing on the host is touched", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  readsWeb(p);
  const s = await start(t, p);
  await launchBoth(s);
  const ws = join(s.dataRoot, "workspaces", "acme", "gate");
  // The run's own workspace moves the checkout aside and leaves a link at web, then web excludes gate.
  renameSync(join(ws, "web"), join(ws, "kept"));
  symlinkSync(join(ws, "kept"), join(ws, "web"));
  editOrg(p, (d) => { d.projects.web.agents = { gate: { exclude: true } }; });
  reload(s);
  let out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(out.done.refusal, "checkout-unsafe", JSON.stringify(out));
  assert.equal(s.running("gate").length, 0);
  assert.equal(lstatSync(join(ws, "web")).isSymbolicLink(), true);
  assert.equal(readFileSync(join(ws, "kept", "file.txt"), "utf8"), "one\n");
  // A plain file there refuses the same way.
  renameSync(join(ws, "web"), join(ws, "link"));
  writeFileSync(join(ws, "web"), "not a checkout\n");
  out = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(out.done.refusal, "checkout-unsafe", JSON.stringify(out));
  assert.equal(readFileSync(join(ws, "web"), "utf8"), "not a checkout\n");
});

test("A3: a narrow that lands after the launcher's recheck and before the bus's last admission refuses the launch; the next one takes it", { skip, timeout: 90000 }, async (t) => {
  for (const [instance, narrow, after] of [
    // An inherited agent's narrow in its project.
    ["gate", (d) => { d.projects.stack.agents.gate = { vars: { "limits.tools": ["read"] } }; }, "launches"],
    // A project agent's define: its vars change after boot.
    ["checker.stack", (d) => { d.projects.stack.agents.checker.vars["limits.tools"] = ["read"]; }, "project-refused"],
  ]) {
    const p = prepare(t);
    const s = await start(t, p);
    const op = s.host.op;
    let landed = false;
    // The narrow lands after every launcher read, just before the bus's last admission answers.
    s.host.op = async (m) => {
      if (!landed && m.op === "request.admission" && m.projects !== undefined) { landed = true; editOrg(p, narrow); reload(s); }
      return op(m);
    };
    let out = await s.carry(s.call("instance.launch", { instance }).request);
    assert.equal(landed, true, instance);
    assert.equal(out.done.refusal, "organization-changed", `${instance} ${JSON.stringify(out)}`);
    assert.equal(s.running(instance).length, 0, instance);
    // The next launch resolves from the narrowed file.
    if (after === "launches") {
      out = await s.carry(s.call("instance.launch", { instance }).request);
      assert.equal(out.done.refusal, null, JSON.stringify(out));
      const tools = bundleOf(s.running(instance)[0], "policy.json").tools;
      assert.ok(tools.includes("read"), JSON.stringify(tools));
      assert.equal(tools.includes("grep"), false, JSON.stringify(tools));
    } else {
      assert.equal(refusedAt(s, instance).code, after, instance);
    }
    await s.close();
  }
});

test("A3: a project define whose vars change after boot refuses until the next start rather than launch with the old ones", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  let s = await start(t, p);
  editOrg(p, (d) => { d.projects.stack.agents.checker.vars["limits.tools"] = ["read"]; });
  reload(s);
  const copy = s.call("instances").copies["checker.stack"];
  assert.equal(copy.state, "refused");
  assert.match(copy.reason, /^project stack changed checker's vars since the bus started/);
  assert.equal(refusedAt(s, "checker.stack").code, "project-refused");
  await s.close();
  s = await start(t, p);
  const out = await s.carry(s.call("instance.launch", { instance: "checker.stack" }).request);
  assert.equal(out.done.refusal, null, JSON.stringify(out));
  const tools = bundleOf(s.running("checker.stack")[0], "policy.json").tools;
  assert.ok(tools.includes("read"), JSON.stringify(tools));
  assert.equal(tools.includes("grep"), false, JSON.stringify(tools));
});

test("A3: a collision a project brings in after boot refuses the copy it collides with, naming both claimants", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const rootFile = join(p.root, "config", "agents.json");
  const root = JSON.parse(readFileSync(rootFile, "utf8"));
  root.agents["new.stack"] = { definition: "security-reviewer", vars: VARS };
  writeFileSync(rootFile, JSON.stringify(root));
  const s = await start(t, p);
  assert.equal(s.call("instances").copies["new.stack"].state, "instance");
  editOrg(p, (d) => { d.projects.stack.agents.new = { definition: "merge-gate", vars: VARS }; });
  reload(s);
  const copy = s.call("instances").copies["new.stack"];
  assert.equal(copy.state, "refused");
  assert.deepEqual(copy.claims, [{ name: "new.stack", project: null }, { name: "new", project: "stack" }]);
  assert.equal(copy.reason, "the instance name new.stack is claimed by root agent new.stack and project stack's new");
  assert.equal(refusedAt(s, "new.stack").code, "copy-refused");
  // Taking the project's define back out frees the root copy again.
  editOrg(p, (d) => { delete d.projects.stack.agents.new; });
  reload(s);
  assert.equal(s.call("instances").copies["new.stack"].state, "instance");
});

test("A3: an organization instance written over a root copy after boot launches as itself, with its own role", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  assert.equal(s.call("instances").copies.gate.state, "instance");
  const file = join(p.root, "config", "businesses", "acme.json");
  const doc = JSON.parse(readFileSync(file, "utf8"));
  doc.roles.gate = { definition: "security-reviewer", vars: VARS };
  writeFileSync(file, JSON.stringify(doc, null, 2) + "\n", { mode: 0o600 });
  // A writer verb reloads the broker from the file, as any human edit would.
  const { revision } = s.call("instances");
  s.call("veto.set", { revision, op: "keep", name: "coder" });
  assert.equal(Object.hasOwn(s.call("instances").copies ?? {}, "gate"), false);
  const done = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
  assert.equal(done.done.refusal, null, JSON.stringify(done));
  const [run] = s.running("gate");
  assert.equal(bundleOf(run, "manifest.json").definition, "security-reviewer");
});

test("A3: two organizations each launch their own gate copy; runs, sessions and trails stay under each one's data root", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  const beta = businessDoc(p.root, "beta");
  for (const r of Object.values(beta.roles)) r.vars = { ...VARS, ...r.vars, model: r.vars?.model ?? "claude-sonnet-5-5" };
  beta.roles.chief.vars = { harness: "pi", model: "claude-opus-5-5", thinking: "high" };
  beta.launch = launchDoc("chief", ["coder"], { opus: 1, sonnet: 4 });
  beta.plugins = { ...beta.plugins, harness: ["pi", "claude-code"] };
  writeJson(join(p.root, "config", "businesses", "beta.json"), beta);
  const a = await start(t, p);
  mkdirSync(join(p.root, "ob"), { mode: 0o700 });
  const b = await start(t, p, { businessId: "beta", orgRoot: join(p.root, "ob") });
  const runs = {};
  for (const [id, s] of [["acme", a], ["beta", b]]) {
    const done = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
    assert.equal(done.done.refusal, null, JSON.stringify(done));
    const [run] = s.running("gate");
    runs[id] = run;
    assert.ok(run.runDir.startsWith(join(s.dataRoot, "launches", id) + "/"), run.runDir);
    await until(() => existsSync(join(run.runDir, "session")));
    await until(() => readFileSync(join(run.runDir, "runner.log"), "utf8").includes("claimed by run"));
    assert.deepEqual(s.call("instances").copies.gate.running, [run.run]);
  }
  assert.notEqual(runs.acme.run, runs.beta.run);
  // Neither bus, trail or data root holds the other's run.
  for (const [mine, other, s] of [["acme", "beta", a], ["beta", "acme", b]]) {
    assert.equal(trail(s.dataRoot).includes(runs[other].run), false, mine);
    assert.equal(existsSync(join(s.dataRoot, "launches", other)), false, mine);
    assert.equal(readdirSync(s.dataRoot, { recursive: true }).join("\n").includes(runs[other].run), false, mine);
  }
  assert.equal(b.running("gate").some((r) => r.run === runs.acme.run), false);
});

test("A3: a root file change while the bus runs reaches no relaunch or reload; the next boot takes it", { skip, timeout: 90000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  const rootFile = join(p.root, "config", "agents.json");
  writeJson(rootFile, { agentsVersion: 1, agents: { fresh: { definition: "merge-gate", vars: VARS } } }, 0o600);
  // A launch, a relaunch and a reload all keep the boot's copy set.
  for (let i = 0; i < 2; i++) {
    const done = await s.carry(s.call("instance.launch", { instance: "gate" }).request);
    assert.equal(done.done.refusal, null, JSON.stringify(done));
    await until(() => s.running("gate").length === 1 && readFileSync(join(s.running("gate")[0].runDir, "runner.log"), "utf8").includes("claimed by run"));
    const { revision } = s.call("instances");
    s.call("veto.set", { revision, op: i ? "unkeep" : "keep", name: "coder" });
    assert.deepEqual(Object.keys(s.call("instances").copies).sort(), ["checker.stack", "gate", "researcher"]);
    assert.equal(refusedAt(s, "fresh").code, "unknown-role");
    await s.carry(s.call("instance.end", { instance: "gate" }).request);
    await until(() => s.running("gate").length === 0);
  }
  await s.close();
  // A restart reads the file again.
  const next = await start(t, p);
  assert.deepEqual(Object.keys(next.boot.copies.copies).sort(), ["checker.stack", "fresh"]);
  assert.equal(refusedAt(next, "gate").code, "unknown-role");
  assert.equal((await next.carry(next.call("instance.launch", { instance: "fresh" }).request)).done.refusal, null);
});

test("A3: the chief can't launch a copy; only the human or a thread names one", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const s = await start(t, p);
  const chief = await s.host.bindLaunch({ business: "acme", role: "chief", run: "chief-test", harness: "pi", pid: process.pid, startTime: startTimeOf(process.pid) });
  await new Client({ path: s.runtime.path, cap: chief.cap }).call("role.claim");
  for (const instance of ["gate", "checker.stack"]) {
    const out = await s.launcher.fromSession(chief.cap, instance);
    assert.deepEqual(out, { ok: false, error: "instance-not-listed" }, instance);
  }
  const unbound = await s.launcher.fromSession(chief.cap, "researcher");
  assert.deepEqual(unbound, { ok: false, error: "credential-unbound" });
  assert.equal(s.launcher.registry.sessions.length, 0);
});

test("A3: a second organization boots its own copies from the same root file and shares no record, request or session with the first", { skip, timeout: 60000 }, async (t) => {
  const p = prepare(t);
  const beta = businessDoc(p.root, "beta");
  for (const r of Object.values(beta.roles)) r.vars = { ...VARS, ...r.vars, model: r.vars?.model ?? "claude-sonnet-5-5" };
  beta.roles.chief.vars = { harness: "pi", model: "claude-opus-5-5", thinking: "high" };
  beta.launch = launchDoc("chief", ["coder"], { opus: 1, sonnet: 4 });
  beta.plugins = { ...beta.plugins, harness: ["pi", "claude-code"] };
  writeJson(join(p.root, "config", "businesses", "beta.json"), beta);
  const a = await start(t, p);
  mkdirSync(join(p.root, "ob"), { mode: 0o700 });
  const b = await start(t, p, { businessId: "beta", orgRoot: join(p.root, "ob") });
  assert.notEqual(a.dataRoot, b.dataRoot);
  assert.equal(a.boot.copies.org, "acme");
  assert.equal(b.boot.copies.org, "beta");
  // beta isn't excluded from sec, and has no project agent of acme's.
  assert.deepEqual(Object.keys(b.boot.copies.copies).sort(), ["gate", "researcher", "sec"]);
  const { request } = a.call("instance.launch", { instance: "gate" });
  const done = await a.carry(request);
  assert.equal(done.done.refusal, null, JSON.stringify(done));
  const [run] = a.running("gate");
  // beta's bus holds none of it: no request, no claim, no run, no session.
  assert.throws(() => b.call("instance.request", { request }), BusError);
  assert.deepEqual(b.call("instances").copies.gate.running, []);
  assert.equal(trail(b.dataRoot).includes(run.run), false);
  assert.equal(existsSync(join(b.dataRoot, "launches", "acme")), false);
  const sessions = (root) => existsSync(join(root, "sessions")) ? readdirSync(join(root, "sessions"), { recursive: true }).join("\n") : "";
  assert.equal(sessions(b.dataRoot).includes(run.run), false);
  assert.equal(b.running("gate").length, 0);
});

// #1873 CB3: the researcher copy (research, gitea alone) bound and granted on a fake Gitea, through
// the real bus, its boot check and the launcher. `sent` is every request the bus sends to the service.
async function boundCopy(t) {
  const api = await fakeGiteaApi(t, tmp(t, "cb3-api-"));
  const p = prepare(t, (doc) => {
    doc.projects.stack.remote = `${api.url}/owner/stack`;
    return doc;
  });
  const ctx = { configDir: join(p.root, "config"), dataRoot: p.f.dataRoot, instance: "test" };
  chmodSync(ctx.configDir, 0o700);
  await reserveOrg(ctx, "acme");
  await activateOrg(ctx, "acme");
  const sent = [];
  const copyTransport = { ca: api.ca, send: (req) => { sent.push(`${req.method} ${req.path.split("?")[0]}`); return giteaSend(req); } };
  const repo = api.addRepo("owner", "stack");
  const writer = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles });
  const rec = () => writer.read("acme").document.copyBindings?.researcher;
  const day = (n) => new Date(Date.now() + n * 86400000).toISOString().slice(0, 10);
  // Bind (the owner's console) and issue (the human), on a bus that is already up.
  const bind = async (s) => {
    const owner = s.runtime.broker.bindConsole({ business: "acme", human: p.f.doc.human, subject: { provider: "test", iss: "https://issuer.test", sub: "owner" } });
    await s.runtime.broker.request(owner, { verb: "hire.start.console", args: { op: "change", level: "root", name: "researcher", reason: "Bind the copy",
      binding: { services: { gitea: { scopes: ["read:repository", "read:user"], projects: ["stack"] } } } } });
    const r = rec();
    const login = copyBotLogin(r.orgIncarnation, r.copyId, "gitea");
    api.addUser(login);
    repo.collaborators.push(login); repo.permissions[login] = "read";
    await s.call("credentials.issue", { agent: "researcher", service: "gitea", date: day(30), token: api.addToken(login, "t1", ["read:repository", "read:user"]).sha1 });
    return login;
  };
  return { ...p, api, sent, copyTransport, rec, bind };
}

const launchEvents = (s) => existsSync(launchLogFile(s.dataRoot, "acme"))
  ? readFileSync(launchLogFile(s.dataRoot, "acme"), "utf8").trim().split("\n").map((l) => JSON.parse(l)) : [];
// One message to a new researcher thread, and the launcher's tick that takes it: the launch or the refusal.
async function threadLaunch(s, name) {
  const project = s.call("project.list").find((x) => x.name === "stack work")?.id ?? s.call("project.create", { name: "stack work", repo: "stack" }).id;
  const thread = s.call("thread.create", { project, name, instance: "researcher" }).id;
  s.call("thread.send", { thread, body: "hello" });
  await s.launcher.tick();
  return until(() => launchEvents(s).find((e) => e.thread === thread && ["launch", "refused"].includes(e.event)));
}

test("CB3: a binding approved after boot answers restart-required; after a restart the bus proves it live, and the launcher carries one launch authority to bind", { skip, timeout: 120000 }, async (t) => {
  const p = await boundCopy(t);
  const first = await start(t, p, { copyTransport: p.copyTransport });
  assert.deepEqual(first.runtime.copyBound, {});
  const login = await p.bind(first);
  assert.equal(p.rec().state, "bound");
  // The issue's own check (CB2) is the last request this bus sends for the copy.
  const issued = p.sent.length;
  assert.ok(issued > 0);
  // Bound and granted after this boot: restart-required at the verb, at the bus's prepare, and at its admission.
  assert.equal(refusedAt(first, "researcher").code, "restart-required");
  const revision = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
  // A copy launch carries the revision its bundle came from; without one it is not a request.
  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher" }), (e) => e.code === "invalid-request");
  await assert.rejects(first.runtime.copyLaunch({ business: "acme", instance: "researcher", revision }), (e) => e.code === "restart-required");
  assert.equal(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision }).code, "copy-authority-changed");
  assert.deepEqual(first.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision, authority: "0".repeat(64) }), { ready: false, revision: null, code: "restart-required" });
  assert.equal(p.sent.length, issued);
  await first.close();

  // The next boot proves the slot live as the copy's account, and the launcher sees it bound.
  const s = await start(t, p, { copyTransport: p.copyTransport });
  assert.deepEqual(s.runtime.copyBound, { researcher: ["gitea"] });
  assert.ok(p.sent.slice(issued).includes("GET /api/v1/token"));
  assert.ok(p.api.requests.filter((e) => e.path === "/api/v1/token").every((e) => e.as === login));
  // Final admission with an empty project list still needs the authority.
  const rev2 = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
  assert.equal(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2 }).code, "copy-authority-changed");
  const { authority } = await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: rev2 });
  assert.match(authority, /^[0-9a-f]{64}$/);
  assert.deepEqual(s.runtime.admission({ business: "acme", projects: [], instance: "researcher", revision: rev2, authority }), { ready: true, revision: null, code: null });
  // Any other instance has no authority to carry.
  assert.deepEqual(await s.runtime.copyLaunch({ business: "acme", instance: "gate" }), { authority: null, services: [] });

  const before = p.sent.length;
  const launched = await threadLaunch(s, "one");
  assert.equal(launched.event, "launch", JSON.stringify(launched));
  // The launcher's prepare proved the slot live again at launch.
  assert.ok(p.sent.slice(before).includes("GET /api/v1/token"));
  assert.equal(s.running("researcher").length, 1);
  assert.equal(p.sent.filter((x) => x.includes("/api/v1/repos/")).length, 0);
});

// A reissue is a new generation: the slot the launch proved is not the slot it would use.
const reissue = (p, s, login, name) => s.call("credentials.issue", { agent: "researcher", service: "gitea",
  date: new Date(Date.now() + 30 * 86400000).toISOString().slice(0, 10), token: p.api.addToken(login, name, ["read:repository", "read:user"]).sha1 });
const restarted = async (t, p, opts = {}) => {
  const first = await start(t, p, { copyTransport: p.copyTransport });
  const login = await p.bind(first);
  await first.close();
  return { login, s: await start(t, p, { copyTransport: p.copyTransport, ...opts }) };
};
const repoCalls = (p) => p.sent.filter((x) => x.includes("/api/v1/repos/")).length;

test("CB3 race: a reissue while the launcher's live proof is in flight refuses the launch restart-required; nothing runs and no credential call is made", { skip, timeout: 120000 }, async (t) => {
  const p = await boundCopy(t);
  const { login, s } = await restarted(t, p);
  let go, arrived;
  const held = new Promise((r) => { arrived = r; });
  const unrule = p.api.rule((e) => e.path === "/api/v1/token", async () => { unrule(); arrived(); await new Promise((r) => { go = r; }); return { pass: true }; });
  const launching = threadLaunch(s, "raced");
  await held;
  await reissue(p, s, login, "t2");
  go();
  const event = await launching;
  assert.equal(event.event, "refused", JSON.stringify(event));
  assert.equal(event.code, "restart-required");
  assert.equal(s.running("researcher").length, 0);
  assert.equal(repoCalls(p), 0);
});

test("CB3 race: a reissue between the launcher's admission and bind refuses at bind; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
  const p = await boundCopy(t);
  let s, login, raced = 0;
  ({ login, s } = await restarted(t, p, { beforeBind: async (r) => { if (r.role === "researcher" && raced++ === 0) await reissue(p, s, login, "t3"); } }));
  const event = await threadLaunch(s, "bindrace");
  assert.equal(raced, 1);
  await until(() => s.running("researcher").length === 0);
  assert.equal(repoCalls(p), 0);
  const events = launchEvents(s).filter((e) => e.instance === "researcher");
  // The launcher reports any bind refusal as launch-failed, naming the bus's code.
  assert.equal(event.event, "refused", JSON.stringify(event));
  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: restart-required"), JSON.stringify(events));
  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
});

test("CB3 race: an organization file change between the launcher's admission and bind refuses at bind, even with the copy authority unchanged; the spawned run is stopped and makes no credential call", { skip, timeout: 120000 }, async (t) => {
  const p = await boundCopy(t);
  const file = join(p.root, "config", "businesses", "acme.json");
  let s, raced = 0, authority = null;
  // Same document, other bytes: the revision moves, the launch authority does not.
  ({ s } = await restarted(t, p, { beforeBind: async (r) => {
    if (r.role !== "researcher" || raced++ !== 0) return;
    authority = r.copyAuthority;
    writeFileSync(file, JSON.stringify(JSON.parse(readFileSync(file, "utf8"))) + "\n", { mode: 0o600 });
  } }));
  const event = await threadLaunch(s, "revrace");
  assert.equal(raced, 1);
  assert.match(authority, /^[0-9a-f]{64}$/);
  await until(() => s.running("researcher").length === 0);
  assert.equal(repoCalls(p), 0);
  // The refusal was the revision's: on the file as it stands the same authority comes back.
  const fresh = organizationWriter({ dir: join(p.root, "config"), rolesDir: p.f.roles }).read("acme").revision;
  assert.equal((await s.runtime.copyLaunch({ business: "acme", instance: "researcher", revision: fresh })).authority, authority);
  const events = launchEvents(s).filter((e) => e.instance === "researcher");
  assert.equal(event.event, "refused", JSON.stringify(event));
  assert.ok(events.some((e) => e.event === "refused" && e.why === "launch bind refused: organization-changed"), JSON.stringify(events));
  assert.ok(!events.some((e) => e.event === "launch"), JSON.stringify(events));
});