"""One command that says whether this installation can do the work.

Every probe already existed behind a separate route or import, so the person
best placed to need them — someone whose daemon will not start — had nothing
single to run and nothing coherent to paste into a report.

The properties that make it worth having, each pinned below: it works without
the daemon, it separates "degraded" from "cannot proceed", and it never reports
a secret value.
"""

from __future__ import annotations

import importlib
import json
import types
from dataclasses import replace as dataclasses_replace

import pytest

from openai4s import doctor
from openai4s.config import Config, LLMConfig, RoadmapFeatureFlags


@pytest.fixture
def cfg(tmp_path):
    (tmp_path / "skills").mkdir()
    return Config(
        data_dir=tmp_path,
        llm=LLMConfig(provider="chatgpt", api_key="test-key", model="test-model"),
    )


def _by_name(result):
    return {c["name"]: c for c in result["checks"]}


def _no_ambient_key(monkeypatch):
    """Clear the suite's fake keys so a no-credential case is really one.

    conftest exports OPENAI4S_LLM_API_KEY for every test, and LLMConfig
    re-resolves from the environment on every `dataclasses.replace` — so
    without this the "no key configured" tests silently have one.
    """
    for var in (
        "OPENAI4S_LLM_API_KEY",
        "OPENAI4S_DEEPSEEK_API_KEY",
        "OPENAI4S_CLAUDE_API_KEY",
        "OPENAI4S_CHATGPT_API_KEY",
    ):
        monkeypatch.delenv(var, raising=False)


# --------------------------------------------------------------------------
# it runs at all, without a daemon
# --------------------------------------------------------------------------


def test_every_probe_reports_without_a_running_daemon(cfg):
    """The situation that motivates running it is usually one where the daemon
    will not start, so a check that needs the server is unavailable exactly
    when it is wanted."""
    result = doctor.report(cfg)
    assert set(_by_name(result)) == {
        "data",
        "model",
        "runtime",
        "isolation",
        "disk",
        "connectors",
        "remote",
    }
    for check in result["checks"]:
        assert check["status"] in (doctor.OK, doctor.WARN, doctor.FAIL)
        assert check["detail"], f"{check['name']} said nothing"


def test_a_probe_that_raises_becomes_a_finding_not_a_traceback(cfg, monkeypatch):
    """A crash here would deny the report to whoever most needs it."""

    def boom(_cfg):
        raise RuntimeError("probe exploded")

    monkeypatch.setattr(doctor, "_CHECKS", (("disk", boom),))
    result = doctor.report(cfg)

    assert result["status"] == doctor.FAIL
    assert "probe exploded" in result["checks"][0]["detail"]


# --------------------------------------------------------------------------
# degraded is not the same as broken
# --------------------------------------------------------------------------


def test_a_missing_credential_fails_rather_than_warns(cfg):
    """No key means no work can happen at all — that is not a degradation."""
    cfg.llm.api_key = ""
    assert _by_name(doctor.report(cfg))["model"]["status"] == doctor.FAIL


def test_a_configured_model_passes(cfg):
    check = _by_name(doctor.report(cfg))["model"]
    assert check["status"] == doctor.OK
    assert check["facts"]["api_key_configured"] is True


def test_low_disk_fails_because_a_run_would_die_partway(cfg, monkeypatch):
    """Refusing up front beats failing after the expensive part."""
    monkeypatch.setattr(
        doctor.shutil,
        "disk_usage",
        lambda _p: types.SimpleNamespace(total=10**9, used=10**9, free=10**8),
    )
    assert _by_name(doctor.report(cfg))["disk"]["status"] == doctor.FAIL


def test_a_disabled_sandbox_warns_rather_than_fails(cfg, monkeypatch):
    """Usable, and deliberately chosen — but never silent."""
    monkeypatch.setenv("OPENAI4S_KERNEL_SANDBOX", "off")
    check = _by_name(doctor.report(cfg))["isolation"]
    assert check["status"] == doctor.WARN
    assert "off" in check["detail"]


def test_enforce_without_a_backend_fails(cfg, monkeypatch):
    """`enforce` means refuse, so the doctor must not call it a degradation."""
    monkeypatch.setenv("OPENAI4S_KERNEL_SANDBOX", "enforce")
    monkeypatch.setattr(
        "openai4s.security.sandbox._detect_backend",
        lambda **_kw: (None, None, "no backend here"),
    )
    check = _by_name(doctor.report(cfg))["isolation"]
    assert check["status"] == doctor.FAIL
    assert "no backend here" in check["detail"]


def test_the_overall_status_is_the_worst_check(cfg, monkeypatch):
    monkeypatch.setenv("OPENAI4S_KERNEL_SANDBOX", "off")  # one warn
    assert doctor.report(cfg)["status"] in (doctor.WARN, doctor.FAIL)

    cfg.llm.api_key = ""  # now also a fail
    assert doctor.report(cfg)["status"] == doctor.FAIL


# --------------------------------------------------------------------------
# it must not leak what it is checking
# --------------------------------------------------------------------------


def test_no_credential_value_appears_anywhere_in_the_report(cfg):
    """Whether a credential is configured is a diagnostic; the credential is
    not. This output is written to be pasted into bug reports."""
    # Assembled at runtime rather than written as a literal: the source
    # credential scan matches on shape, and a realistic-looking key checked
    # into the tree is a finding whether or not it is real. The sentinel still
    # has to be distinctive enough that finding it in the output means the
    # value leaked and nothing else.
    sentinel = "sk-" + "PLEASE-DO-NOT-LEAK" + "-" + ("9" * 24)
    cfg.llm.api_key = sentinel
    result = doctor.report(cfg)

    blob = json.dumps(result) + doctor.render(result)
    assert sentinel not in blob
    assert "PLEASE-DO-NOT-LEAK" not in blob


def test_the_rendered_report_shows_a_remedy_only_where_there_is_a_problem(cfg):
    cfg.llm.api_key = ""
    text = doctor.render(doctor.report(cfg))
    assert "->" in text, "a failing check must say what to do"
    ok_lines = [ln for ln in text.splitlines() if ln.startswith("[ok  ]")]
    assert ok_lines, "this fixture should pass something"
    for line in ok_lines:
        assert "->" not in line


# --------------------------------------------------------------------------
# the CLI contract
# --------------------------------------------------------------------------


def test_the_exit_code_is_the_verdict(monkeypatch, capsys):
    """So a setup script can branch on it instead of grepping prose."""
    cli = importlib.import_module("openai4s.cli.main")

    for status, expected in (
        (doctor.OK, 0),
        (doctor.WARN, 1),
        (doctor.FAIL, 2),
    ):
        monkeypatch.setattr(
            doctor, "report", lambda _cfg, s=status: {"status": s, "checks": []}
        )
        assert cli.main(["doctor"]) == expected
    capsys.readouterr()


def test_an_unusable_data_path_is_reported_rather_than_raised(
    monkeypatch, capsys, tmp_path
):
    """Codex P2: the bootstrap failure doctor exists to diagnose.

    `get_config()` calls `ensure_dirs()`, so an OPENAI4S_DATA_DIR naming a file
    raised on the way in — a traceback instead of the verdict and the documented
    exit code 2, in exactly the situation the command is for.
    """
    cli = importlib.import_module("openai4s.cli.main")
    import openai4s.config as config_mod

    as_file = tmp_path / "data-dir-is-a-file"
    as_file.write_text("not a directory", encoding="utf-8")
    monkeypatch.setenv("OPENAI4S_DATA_DIR", str(as_file))
    monkeypatch.setattr(config_mod, "_CONFIG", None, raising=False)

    assert cli.main(["doctor", "--json"]) == 2
    parsed = json.loads(capsys.readouterr().out)
    data = {c["name"]: c for c in parsed["checks"]}["data"]
    assert data["status"] == doctor.FAIL
    assert str(as_file) in data["detail"]
    assert data["remedy"], "a failed bootstrap check must say what to do"
    # ...and nothing was created where the file is.
    assert as_file.read_text() == "not a directory"


def test_a_database_from_a_newer_release_fails_the_data_check(
    monkeypatch, capsys, tmp_path
):
    """UPG3-06. `serve` and `run` refuse a data directory whose database schema
    is newer than this release (`future_schema`, exit 2). `doctor` only checked
    that the directory was writable, so the command a user runs after that
    refusal printed "[ok] data usable" and exited 0 -- naming nothing. The
    check must fail the same way, and like the refusal it must not touch the
    database it is diagnosing."""
    import sqlite3

    import openai4s.config as config_mod
    from openai4s.storage.migrations import SCHEMA_VERSION

    cli = importlib.import_module("openai4s.cli.main")
    data_dir = tmp_path / "from-a-newer-release"
    monkeypatch.setenv("OPENAI4S_DATA_DIR", str(data_dir))
    monkeypatch.setattr(config_mod, "_CONFIG", None, raising=False)
    cfg = Config(data_dir=data_dir)
    cfg.ensure_dirs()
    with sqlite3.connect(cfg.db_path) as db:
        db.execute("CREATE TABLE sentinel(value TEXT)")
        db.execute(f"PRAGMA user_version={SCHEMA_VERSION + 1}")
    before = cfg.db_path.read_bytes()

    assert cli.main(["doctor", "--json"]) == 2
    data = _by_name(json.loads(capsys.readouterr().out))["data"]
    assert data["status"] == doctor.FAIL
    assert "future_schema" in data["detail"]
    assert str(SCHEMA_VERSION + 1) in data["detail"]
    assert data["remedy"], "a failed check must say what to do"
    assert cfg.db_path.read_bytes() == before


def _older_database(db_path, *, conflicting: bool = False) -> None:
    """A real database one schema behind this release. With ``conflicting`` its
    upgrade fails in any process: the name the last step's index needs is
    taken by a table, so the Store rolls back and keeps its backup."""
    import sqlite3

    from openai4s.storage.migrations import SCHEMA_VERSION
    from openai4s.store import Store

    Store(db_path).close()
    with sqlite3.connect(str(db_path)) as conn:
        conn.execute("DROP INDEX IF EXISTS ix_artifacts_project_created")
        if conflicting:
            conn.execute("CREATE TABLE ix_artifacts_project_created(x)")
        conn.execute(f"DELETE FROM schema_migrations WHERE version>={SCHEMA_VERSION}")
        conn.execute(f"PRAGMA user_version = {SCHEMA_VERSION - 1}")


def _user_version(db_path) -> int:
    import sqlite3

    conn = sqlite3.connect(f"{db_path.resolve().as_uri()}?mode=ro", uri=True)
    try:
        return conn.execute("PRAGMA user_version").fetchone()[0]
    finally:
        conn.close()


@pytest.mark.parametrize("conflicting", [False, True])
def test_doctor_does_not_upgrade_a_database_from_an_older_release(
    monkeypatch, capsys, tmp_path, conflicting
):
    """UPG5-01 / RB-1. doctor opened the Store read-write, which *is* the
    upgrade: a healthy older database was migrated in place by a command
    documented as a diagnosis, and one whose upgrade fails was migrated,
    rolled back and reported `[ok] data` and "All checks passed" -- the error
    only in `connectors` facts -- while `serve` and `run` refused it with exit
    2. doctor now reads the schema the read-only way and says the upgrade is
    pending; it never performs it."""
    import openai4s.config as config_mod
    from openai4s.storage.migrations import SCHEMA_VERSION

    cli = importlib.import_module("openai4s.cli.main")
    data_dir = tmp_path / "from-an-older-release"
    monkeypatch.setenv("OPENAI4S_DATA_DIR", str(data_dir))
    monkeypatch.setattr(config_mod, "_CONFIG", None, raising=False)
    cfg = Config(data_dir=data_dir)
    cfg.ensure_dirs()
    _older_database(cfg.db_path, conflicting=conflicting)
    before = cfg.db_path.read_bytes()
    backup = cfg.db_path.with_name(f"openai4s.db.v{SCHEMA_VERSION - 1}.bak")

    assert cli.main(["doctor", "--json"]) != 0
    result = json.loads(capsys.readouterr().out)
    checks = _by_name(result)
    data = checks["data"]
    assert data["status"] == doctor.WARN
    assert f"schema {SCHEMA_VERSION - 1}" in data["detail"]
    assert f"schema {SCHEMA_VERSION}" in data["detail"]
    assert "migrat" in data["detail"]
    assert data["remedy"]
    assert data["facts"]["upgrade_pending"] is True
    assert data["facts"]["schema_version"] == SCHEMA_VERSION - 1
    # No probe opened it and hid what opening it did.
    assert all("connector_store_error" not in c["facts"] for c in result["checks"])

    assert cli.main(["doctor"]) != 0
    assert "All checks passed" not in capsys.readouterr().out

    assert cfg.db_path.read_bytes() == before
    assert _user_version(cfg.db_path) == SCHEMA_VERSION - 1
    assert not backup.exists()


def test_doctor_fails_the_data_check_after_an_upgrade_that_did_not_complete(
    monkeypatch, capsys, tmp_path
):
    """The operator who runs doctor right after `serve` refused a failed
    upgrade: the kept pre-upgrade backup is the evidence that the attempt did
    not complete, and doctor reports it rather than a usable directory."""
    import os

    import openai4s.config as config_mod
    from openai4s.storage.migrations import SCHEMA_VERSION, MigrationError
    from openai4s.store import Store

    cli = importlib.import_module("openai4s.cli.main")
    data_dir = tmp_path / "failed-upgrade"
    monkeypatch.setenv("OPENAI4S_DATA_DIR", str(data_dir))
    monkeypatch.setattr(config_mod, "_CONFIG", None, raising=False)
    cfg = Config(data_dir=data_dir)
    cfg.ensure_dirs()
    _older_database(cfg.db_path, conflicting=True)
    with pytest.raises(MigrationError):
        Store(cfg.db_path)  # what `serve` / `run` did before exiting 2
    backup = cfg.db_path.with_name(f"openai4s.db.v{SCHEMA_VERSION - 1}.bak")
    assert backup.exists()
    os.utime(backup, (1_000_000_000, 1_000_000_000))
    before = cfg.db_path.read_bytes()

    assert cli.main(["doctor", "--json"]) == 2
    data = _by_name(json.loads(capsys.readouterr().out))["data"]
    assert data["status"] == doctor.FAIL
    assert str(backup) in data["detail"]
    assert "did not complete" in data["detail"]
    assert data["remedy"]
    assert data["facts"]["kept_backup"] == str(backup)
    assert cfg.db_path.read_bytes() == before
    assert _user_version(cfg.db_path) == SCHEMA_VERSION - 1
    # Not re-attempted: the kept backup was not rewritten.
    assert backup.stat().st_mtime == 1_000_000_000


def test_a_pending_upgrade_leaves_the_saved_model_settings_unread_not_failed(
    cfg, monkeypatch
):
    """The Customize -> Models key lives in the database doctor no longer
    opens, so "no key configured" would be a guess stated as a failure."""
    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    _older_database(cfg.db_path)

    checks = _by_name(doctor.report(cfg))
    assert checks["model"]["status"] == doctor.WARN
    assert "did not open" in checks["model"]["detail"]
    assert checks["model"]["facts"]["database_settings_read"] is False
    connectors = checks["connectors"]
    assert connectors["facts"]["connector_store_not_read"] == "upgrade_pending"
    assert "configured_connectors" not in connectors["facts"]


def test_a_store_that_cannot_be_opened_is_not_reported_ok_by_connectors(
    cfg, monkeypatch
):
    """RB-1's other half: an open failure was kept in facts under an `ok`."""
    from openai4s.storage.migrations import MigrationError
    from openai4s.store import get_store

    get_store(cfg.db_path)  # a current database: doctor may open it

    def refuse(_path):
        raise MigrationError("the store refused to open")

    monkeypatch.setattr("openai4s.store.get_store", refuse)
    check = _by_name(doctor.report(cfg))["connectors"]
    assert check["status"] == doctor.WARN
    assert "the store refused to open" in check["detail"]


def test_a_database_that_needs_recovery_is_not_opened_by_doctor(cfg, monkeypatch):
    """A hot journal hides the schema version from a read-only handle, and the
    read-write open that recovers it would also upgrade an older database."""
    import openai4s.storage.migrations as migrations
    from openai4s.store import Store

    Store(cfg.db_path).close()
    monkeypatch.setattr(migrations, "preflight_schema", lambda *_a, **_k: None)
    opened = []
    monkeypatch.setattr(
        "openai4s.store.get_store", lambda path: opened.append(path) or None
    )

    checks = _by_name(doctor.report(cfg))
    assert checks["data"]["status"] == doctor.WARN
    assert "interrupted write" in checks["data"]["detail"]
    assert opened == []


def test_a_database_whose_version_could_not_be_read_is_not_opened_by_doctor(
    cfg, monkeypatch
):
    """The guard failed open on everything but a newer schema or a read-only
    refusal. SQLITE_BUSY past the timeout -- an older daemon mid-commit -- is
    an OperationalError, and the model and connectors checks then opened the
    database read-write, which upgrades an older one once it gets the lock."""
    import sqlite3

    import openai4s.storage.migrations as migrations
    from openai4s.store import Store

    Store(cfg.db_path).close()

    def busy(*_a, **_k):
        raise sqlite3.OperationalError("database is locked")

    monkeypatch.setattr(migrations, "preflight_schema", busy)
    opened = []
    monkeypatch.setattr(
        "openai4s.store.get_store", lambda path: opened.append(path) or None
    )

    result = doctor.report(cfg)
    checks = _by_name(result)
    assert opened == []
    assert checks["data"]["status"] == doctor.FAIL
    assert "database is locked" in checks["data"]["detail"]
    connectors = checks["connectors"]
    assert connectors["facts"]["connector_store_not_read"] == "unreadable"
    assert connectors["status"] == doctor.WARN
    assert "database is locked" in connectors["detail"]
    assert result["status"] == doctor.FAIL


def test_the_upgrade_guide_says_doctor_does_not_migrate_and_fails_after_a_failed_one():
    """The guide says which commands upgrade the database. Both halves must
    keep doctor out of that list and say what it reports instead."""
    from pathlib import Path

    docs = Path(__file__).resolve().parent.parent / "docs"
    english = " ".join((docs / "upgrading.md").read_text("utf-8").split())
    chinese = " ".join((docs / "upgrading_zh.md").read_text("utf-8").split())
    assert "`openai4s doctor` does not: it reads the schema version" in english
    assert "`openai4s doctor` fails its data check (exit 2)" in english
    assert "`openai4s doctor` 不会" in chinese
    assert "`openai4s doctor` 的 data 检查会失败（退出码 2）" in chinese
    # The support bundle is the other diagnosis command, and it does not
    # migrate either.
    assert "`openai4s diagnostics` does not either" in english
    assert "`openai4s diagnostics` 也不会" in chinese


def test_an_unwritable_data_directory_is_reported_as_fail(cfg, tmp_path):
    """The other half: the path is a directory, and nothing may write to it."""
    locked = tmp_path / "locked"
    locked.mkdir(mode=0o500)
    try:
        result = doctor.report(dataclasses_replace(cfg, data_dir=locked))
        check = _by_name(result)["data"]
        assert check["status"] == doctor.FAIL
        assert "writable" in check["detail"]
    finally:
        locked.chmod(0o700)


def test_a_usable_data_directory_passes(cfg):
    assert _by_name(doctor.report(cfg))["data"]["status"] == doctor.OK


def test_the_json_form_is_machine_readable(monkeypatch, capsys):
    cli = importlib.import_module("openai4s.cli.main")

    monkeypatch.setattr(
        doctor,
        "report",
        lambda _cfg: {
            "status": doctor.OK,
            "checks": [
                {
                    "name": "model",
                    "status": doctor.OK,
                    "detail": "d",
                    "remedy": "",
                    "facts": {},
                }
            ],
        },
    )
    assert cli.main(["doctor", "--json"]) == 0
    parsed = json.loads(capsys.readouterr().out)
    assert parsed["status"] == doctor.OK
    assert parsed["checks"][0]["name"] == "model"


# --------------------------------------------------------------------------
# a diagnostic that disagrees with the runtime is worse than none
# --------------------------------------------------------------------------


def test_a_model_configured_only_in_the_ui_is_not_reported_as_missing(cfg, monkeypatch):
    """The regression.

    The daemon boots with no key — that is the documented path — and the model
    is configured from Customize → Models, which writes to the store. Reading
    `cfg.llm` alone therefore diagnosed `model FAIL` on an installation that
    worked, sending the user to fix something that was not broken.
    """
    from openai4s.store import get_store

    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    store = get_store(cfg.db_path)
    store.set_setting("llm_provider", "claude")
    store.set_setting("llm_model", "claude-sonnet-5")
    store.set_secret_setting("llm_api_key", "sk-configured-in-the-ui", scope="llm")

    check = _by_name(doctor.report(cfg))["model"]
    assert check["status"] == doctor.OK
    assert check["facts"]["provider"] == "claude"
    assert check["facts"]["model"] == "claude-sonnet-5"
    assert "sk-configured-in-the-ui" not in json.dumps(check)


def test_a_local_endpoint_needs_no_credential(cfg, monkeypatch):
    """Ollama, LM Studio, vLLM and llama.cpp authenticate by being unreachable
    from anywhere else. Demanding a key from them demands a credential that
    does not exist."""
    from openai4s.store import get_store

    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    store = get_store(cfg.db_path)
    store.set_setting("llm_base_url", "http://127.0.0.1:11434/v1")

    check = _by_name(doctor.report(cfg))["model"]
    assert check["status"] == doctor.OK
    assert check["facts"]["endpoint_is_local"] is True
    assert check["facts"]["api_key_configured"] is False


def test_a_dot_local_endpoint_needs_no_credential(cfg, monkeypatch):
    """The runtime allows keyless for `.local`/private/docker hosts too, so
    doctor must not report a working keyless setup as a model failure."""
    from openai4s.store import get_store

    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    store = get_store(cfg.db_path)
    store.set_setting("llm_base_url", "http://ollama.local:11434/v1")

    check = _by_name(doctor.report(cfg))["model"]
    assert check["status"] in (doctor.OK, doctor.WARN)
    assert check["facts"]["endpoint_is_local"] is True


def test_a_local_endpoint_with_embedded_credentials_is_redacted(cfg, monkeypatch):
    """doctor output is meant to be pasted into a bug report. A local endpoint
    can carry credentials in its userinfo or query; the diagnostic must not print
    them."""
    from openai4s.store import get_store

    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    store = get_store(cfg.db_path)
    store.set_setting(
        "llm_base_url", "http://user:sup3r-secret@127.0.0.1:11434/v1?token=abc123"
    )

    check = _by_name(doctor.report(cfg))["model"]
    blob = json.dumps(check)
    assert "sup3r-secret" not in blob, "an embedded password leaked into the report"
    assert "abc123" not in blob, "a query-string token leaked into the report"
    assert "user:" not in check["detail"]
    # The routable part is still there so the endpoint remains identifiable.
    assert "127.0.0.1:11434" in check["detail"]


def test_a_fresh_install_with_only_the_base_env_recommends_setup(cfg, monkeypatch):
    """`discover_environments()` always seeds a synthetic `base`, so a check for
    "no prebuilt environment" that tested emptiness never fired — a fresh install
    with a system Rscript reported OK and never told the user to run setup."""
    import types

    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *a, **k: [types.SimpleNamespace(name="base", rscript=None)],
    )
    monkeypatch.setattr(
        "openai4s.kernel.r_kernel.resolve_r_interpreter",
        lambda *a, **k: "/usr/local/bin/Rscript",
    )

    check = _by_name(doctor.report(cfg))["runtime"]
    assert check["status"] == doctor.WARN
    assert "no prebuilt environment" in check["detail"]
    assert check["remedy"], "a fresh install must be told to run setup"
    assert check["facts"]["prebuilt_environments"] == 0


@pytest.mark.parametrize(
    ("state", "expected_status"),
    [("ready", doctor.OK), ("needs_repair", doctor.FAIL)],
)
def test_stage1_doctor_runtime_uses_the_same_readiness_gate(
    cfg, monkeypatch, state, expected_status
):
    enabled = dataclasses_replace(
        cfg,
        roadmap_features=RoadmapFeatureFlags(stage1_trusted_delivery=True),
    )
    ready = state == "ready"
    plan = ["openai4s", "env", "plan", "python", "r", "--repair"]
    apply = ["openai4s", "env", "apply", "python", "r", "--repair"]
    projection = {
        "schema_version": 1,
        "enabled": True,
        "profile": "standard",
        "state": state,
        "ready": ready,
        "reason": None if ready else "environment_incomplete",
        "checked_locally": True,
        "network_contacted": False,
        "mutation_performed": False,
        "requirements_digest": "sha256:" + "c" * 64,
        "required_environments": ["python", "r"],
        "missing_environments": [],
        "missing_packages": {} if ready else {"python": ["numpy"]},
        "environments": [],
        "remediation": (
            None
            if ready
            else {
                "kind": "managed_generation_repair",
                "plan_argv": plan,
                "apply_argv": apply,
                "commands": [
                    {"label": "plan", "argv": plan, "command": " ".join(plan)},
                    {"label": "apply", "argv": apply, "command": " ".join(apply)},
                ],
                "requires_explicit_action": True,
            }
        ),
    }
    monkeypatch.setattr(
        "openai4s.kernel.readiness.standard_profile_readiness",
        lambda **_kwargs: projection,
    )

    check = doctor._runtime(enabled)

    assert check.status == expected_status
    assert check.facts["standard_profile_readiness"] is projection
    if ready:
        assert "standard profile ready" in check.detail
    else:
        assert "python: numpy" in check.detail
        assert "openai4s env plan python r --repair" in check.detail
        assert "openai4s env apply python r --repair" in check.detail


def test_flag_off_doctor_preserves_legacy_runtime_probe(cfg, monkeypatch):
    def forbidden_readiness(**_kwargs):
        raise AssertionError("flag-off doctor performed the Stage 1 readiness probe")

    monkeypatch.setattr(
        "openai4s.kernel.readiness.standard_profile_readiness",
        forbidden_readiness,
    )
    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *args, **kwargs: [types.SimpleNamespace(name="base", rscript=None)],
    )
    monkeypatch.setattr(
        "openai4s.kernel.r_kernel.resolve_r_interpreter",
        lambda *args, **kwargs: None,
    )

    check = doctor._runtime(cfg)

    assert check.status == doctor.WARN
    assert "standard_profile_readiness" not in check.facts
    assert check.facts["prebuilt_environments"] == 0


def test_a_remote_endpoint_without_a_key_still_fails(cfg, monkeypatch):
    """The loopback exemption must not become a blanket one."""
    from openai4s.store import get_store

    _no_ambient_key(monkeypatch)
    cfg.llm.api_key = ""
    store = get_store(cfg.db_path)
    store.set_setting("llm_base_url", "https://api.example.com/v1")

    check = _by_name(doctor.report(cfg))["model"]
    assert check["status"] == doctor.FAIL


def test_the_doctor_and_the_runtime_resolve_the_same_model(cfg):
    """The whole point: two implementations of one question is how they came
    to disagree. There is now one, and both call it."""
    from openai4s.llm.resolve import resolve_llm_config
    from openai4s.store import get_store

    store = get_store(cfg.db_path)
    store.set_setting("llm_provider", "claude")
    store.set_setting("llm_model", "claude-opus-4-8")

    resolved = resolve_llm_config(cfg.llm, store)
    check = _by_name(doctor.report(cfg))["model"]
    assert check["facts"]["provider"] == resolved.provider
    assert check["facts"]["model"] == resolved.model


def test_r_is_resolved_the_way_the_r_kernel_resolves_it(cfg, monkeypatch):
    """`shutil.which("Rscript")` reported "R cells will not run" on exactly the
    installations `openai4s setup` had just built an R environment for: a conda
    env's bin directory is not on the daemon's PATH."""
    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *a, **k: [
            types.SimpleNamespace(name="py", rscript=None),
            types.SimpleNamespace(name="r", rscript="/opt/envs/r/bin/Rscript"),
        ],
    )
    monkeypatch.setattr(doctor.shutil, "which", lambda _name: None)

    check = _by_name(doctor.report(cfg))["runtime"]
    assert check["status"] == doctor.OK
    assert check["facts"]["rscript"] is True
    assert check["facts"]["rscript_path"] == "/opt/envs/r/bin/Rscript"


def test_no_r_anywhere_still_warns(cfg, monkeypatch):
    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *a, **k: [types.SimpleNamespace(name="py", rscript=None)],
    )
    monkeypatch.setattr("openai4s.kernel.r_kernel.shutil.which", lambda _n: None)

    check = _by_name(doctor.report(cfg))["runtime"]
    assert check["status"] == doctor.WARN
    assert "R cells will not run" in check["detail"]


def test_no_prebuilt_env_but_r_on_path_does_not_claim_r_is_dead(cfg, monkeypatch):
    """The R channel does not need a conda env: the resolver falls back to PATH
    and `r_worker.R` runs against a system Rscript. Reporting "R cells will not
    run" whenever no env is built named an interpreter the kernel *would* use as
    unavailable."""
    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *a, **k: [],
    )
    monkeypatch.setattr(
        "openai4s.kernel.r_kernel.resolve_r_interpreter",
        lambda *a, **k: "/usr/local/bin/Rscript",
    )

    check = _by_name(doctor.report(cfg))["runtime"]
    assert check["status"] == doctor.WARN  # still no Python env built
    assert "R cells will not run" not in check["detail"]
    assert "/usr/local/bin/Rscript" in check["detail"]
    assert check["facts"]["rscript_path"] == "/usr/local/bin/Rscript"


def test_no_prebuilt_env_and_no_r_still_says_r_will_not_run(cfg, monkeypatch):
    monkeypatch.setattr(
        "openai4s.kernel.environments.discover_environments",
        lambda *a, **k: [],
    )
    monkeypatch.setattr(
        "openai4s.kernel.r_kernel.resolve_r_interpreter",
        lambda *a, **k: None,
    )

    check = _by_name(doctor.report(cfg))["runtime"]
    assert check["status"] == doctor.WARN
    assert "R cells will not run" in check["detail"]


def test_a_backend_whose_self_test_fails_is_not_reported_active(cfg, monkeypatch):
    """The most important thing this command can get wrong before a release.

    `bwrap` installed but unprivileged user namespaces disabled, or a Seatbelt
    profile the OS rejects, both leave a host where the runtime degrades in
    `auto` and refuses to start in `enforce` — while this check said "active"
    and the gate that reads it saw nothing.
    """
    from openai4s.security.sandbox import KernelSandbox, SandboxStatus

    def failing_sandbox(_workspace, **_kw):
        return KernelSandbox(
            status=SandboxStatus(
                mode="auto",
                state="degraded",
                backend="bwrap",
                enforced=False,
                self_test_passed=False,
                network_policy="not_enforced",
                workspace=str(_workspace),
                temp_dir=None,
                detail="self-test could not create a user namespace",
                warning="user namespaces are disabled by this kernel",
            )
        )

    monkeypatch.setattr(
        "openai4s.security.sandbox.create_kernel_sandbox", failing_sandbox
    )
    check = _by_name(doctor.report(cfg))["isolation"]
    assert check["status"] == doctor.WARN
    assert check["facts"]["self_test_passed"] is False
    assert "self-test failed" in check["detail"]
    assert "user namespaces" in check["detail"]


def test_enforce_with_a_failing_self_test_fails(cfg, monkeypatch):
    from openai4s.security.sandbox import SandboxUnavailableError

    monkeypatch.setenv("OPENAI4S_KERNEL_SANDBOX", "enforce")

    def refusing(_workspace, **_kw):
        raise SandboxUnavailableError("self-test failed under enforce")

    monkeypatch.setattr("openai4s.security.sandbox.create_kernel_sandbox", refusing)
    check = _by_name(doctor.report(cfg))["isolation"]
    assert check["status"] == doctor.FAIL
    assert "self-test failed under enforce" in check["detail"]


def test_the_real_network_kill_switch_is_what_decides_connector_reach(cfg, monkeypatch):
    """The global switch is OPENAI4S_ALLOW_NETWORK. OPENAI4S_EGRESS selects
    whether an *allowlist* is enforced, and its default `off` means fail-open —
    so reading `off` as "offline" inverted both answers at once."""
    monkeypatch.setenv("OPENAI4S_ALLOW_NETWORK", "0")
    check = _by_name(doctor.report(cfg))["connectors"]
    assert check["status"] == doctor.WARN
    assert check["facts"]["network_allowed"] is False
    assert "OPENAI4S_ALLOW_NETWORK" in check["detail"]


def test_the_default_egress_mode_is_not_reported_as_offline(cfg, monkeypatch):
    """`OPENAI4S_EGRESS=off` is the default and means the allowlist is not
    enforced — everything is reachable."""
    monkeypatch.setenv("OPENAI4S_EGRESS", "off")
    monkeypatch.delenv("OPENAI4S_ALLOW_NETWORK", raising=False)
    check = _by_name(doctor.report(cfg))["connectors"]
    assert check["status"] == doctor.OK
    assert check["facts"]["egress_mode"] == "off"
    assert check["facts"]["network_allowed"] is True


def test_an_enforced_allowlist_is_reported_as_such(cfg, monkeypatch):
    monkeypatch.setenv("OPENAI4S_EGRESS", "allowlist")
    monkeypatch.delenv("OPENAI4S_ALLOW_NETWORK", raising=False)
    check = _by_name(doctor.report(cfg))["connectors"]
    assert check["status"] == doctor.OK
    assert "allowlist enforced" in check["detail"]