package native

import (
	"testing"
	"time"

	"agent-native/runtime/llm"
	"agent-native/runtime/tools"
	"agent-squad/squad"
)

func TestBuildOptionsBashPermissionGating(t *testing.T) {
	base := Config{
		Client:       &llm.Client{BaseURL: "http://x", APIKey: "k"},
		DefaultModel: "m1", MaxTurns: 5, Timeout: time.Minute,
		Exec:        &tools.ExecConfig{Bash: "/bin/bash"},
		SkillsRoots: []string{"/skills"},
	}
	deny, err := buildOptions(base, squad.RoleSpec{Role: "r", BashPermission: squad.BashPermissionDeny})
	if err != nil {
		t.Fatal(err)
	}
	if deny.Exec != nil {
		t.Fatal("deny role must not get exec tools even when config provides them")
	}
	ask, _ := buildOptions(base, squad.RoleSpec{Role: "r", BashPermission: squad.BashPermissionAsk})
	if ask.Exec == nil {
		t.Fatal("ask role gets exec tools")
	}
	allow, _ := buildOptions(base, squad.RoleSpec{Role: "r", BashPermission: squad.BashPermissionAllow})
	if allow.Exec == nil {
		t.Fatal("allow role gets exec tools")
	}
	empty, _ := buildOptions(base, squad.RoleSpec{Role: "r"})
	if empty.Exec != nil {
		t.Fatal("unset bash_permission defaults to deny")
	}
	none, _ := buildOptions(Config{Client: base.Client, DefaultModel: "m"}, squad.RoleSpec{Role: "r", BashPermission: squad.BashPermissionAllow})
	if none.Exec != nil {
		t.Fatal("no Exec config = no exec tools")
	}
	roleModel, _ := buildOptions(base, squad.RoleSpec{Role: "r", Model: "big"})
	if roleModel.Model != "big" {
		t.Fatalf("role model must win, got %s", roleModel.Model)
	}
	if _, err := buildOptions(Config{Client: base.Client}, squad.RoleSpec{Role: "r"}); err == nil {
		t.Fatal("missing model must fail-closed")
	}
}