hermes-agent/tests/gateway/test_wisdom_command.py

"""Contract tests for the presentation-neutral `/wisdom` gateway controller."""

from __future__ import annotations

from types import SimpleNamespace
from unittest.mock import Mock
from tests.wisdom.test_native_install_policy import native_install as native_install

import pytest

import gateway.wisdom_command as command_module
from gateway.wisdom_command import (
    WisdomAction,
    WisdomView,
    WisdomCommandContext,
    WisdomCommandController,
    _CallbackTokens,
    bind_view_callbacks,
    command_error_text,
    issue_continuation,
    render_local_view,
    resolve_continuation,
)


def _context(**overrides) -> WisdomCommandContext:
    values = {
        "user_id": "user-1",
        "chat_id": "chat-1",
        "profile": "default",
        "organization_id": "org-1",
        "is_group": False,
    }
    values.update(overrides)
    return WisdomCommandContext(**values)


def test_shared_mute_command_is_private_and_preserves_pending_feedback(monkeypatch):
    from unittest.mock import Mock

    preferences = Mock()
    preferences.native_mute_command.return_value = {
        "mute": {"muted": False, "muted_until": None},
        "sync": {"preference_sync": "pending"},
    }
    preferences.prepare_mute_control.side_effect = TimeoutError
    monkeypatch.setattr("hermes_wisdom.preferences.WisdomPreferences", lambda service: preferences)
    controller = WisdomCommandController()
    service = _Service()
    private = controller.execute("mute 1w", service, _context())
    preferences.native_mute_command.assert_called_once_with("1w")
    assert "waiting to sync" in private.notice
    assert "enabled" in private.to_text()
    assert private.actions[0].label == "Refresh settings"
    preferences.native_mute_command.reset_mock()
    group = controller.execute("mute forever", service, _context(is_group=True))
    preferences.native_mute_command.assert_not_called()
    assert group.actions[0].label == "Continue in DM"


def test_sync_status_and_retry_stay_private_and_use_bound_controls():
    counts = dict.fromkeys(('pending', 'syncing', 'retryable', 'conflict', 'uncertain', 'waiting_for_receipt'), 0)
    service = Mock()
    service.sync_status.return_value = {'delivery': counts, 'operation': {**counts, 'retryable': 1}, 'can_retry': True}
    service.retry_sync.return_value = {'delivery': counts, 'operation': counts, 'can_retry': False}
    controller = WisdomCommandController()
    context = _context()
    group = controller.execute('sync retry', service, _context(is_group=True))
    assert group.actions[0].label == 'Continue in DM'
    service.sync_status.assert_not_called()
    service.retry_sync.assert_not_called()
    view = controller.execute('sync', service, context)
    assert 'Retry available: 1' in view.to_text()
    service.retry_sync.assert_not_called()
    bind_view_callbacks(view, context)
    token = next(a for a in view.actions if a.operation == 'sync_retry').callback_data.removeprefix('wi:cmd:')
    with pytest.raises(PermissionError):
        controller.execute_token(token, service, _context(user_id='other'))
    result = controller.execute_token(token, service, context)
    service.retry_sync.assert_called_once()
    assert not any(a.operation == 'sync_retry' for a in result.actions)
    with pytest.raises(ValueError):
        controller.execute_token(token, service, context)


class _Service:
    def __init__(self) -> None:
        self.store = SimpleNamespace(active_org_id=lambda: "org-1", installations=lambda: [])
        self.local_installation = None
        self.calls: list[tuple] = []

    def status(self):
        return {
            "configured": True,
            "gateway_available": True,
            "error_kind": None,
            "capability_advertised": True,
            "entitled": True,
            "dogfood_admin_claim": True,
            "verified_org_id": "org-1",
            "installation_id": "installation-1",
            "display_scopes": ["wisdom:read", "wisdom:install"],
            "pending_operations": [],
        }

    def setup(self, *, disclosure_accepted=False):
        self.calls.append(("setup", disclosure_accepted))
        return {"organization_id": "org-1"}

    def command_home(self):
        self.calls.append(("command_home",))
        return {
            "status": self.status(),
            "organization_id": "org-1",
            "counts": {
                "published": 1,
                "suggested": 2,
                "drafts": 3,
                "installed": 4,
                "notifications": 5,
            },
        }

    def search_skills(self, query=""):
        self.calls.append(("search_skills", query))
        return [
            {
                "id": "skill-1",
                "slug": "incident-handoff",
                "latest_version": 2,
                "author_description": "Summarize an incident",
            }
        ]

    def resolve_skill(self, reference, *, include_compatibility=True):
        self.calls.append(("resolve_skill", reference, include_compatibility))
        return {
            "skill": {
                "id": "skill-1",
                "slug": "incident-handoff",
            },
            "versions": [{"version": 2}, {"version": 1}],
            "local_compatibility": {"outcome": "compatible"},
            "latest_version_detail": {
                "version": {
                    "author_description": "Summarize an incident",
                    "scan": {"verdict": "pass"},
                    "verified_facts": {"scan_verdict": "pass"},
                    "system_spec": {
                        "hermes": {"minimum_version": "0.20.5"},
                        "platforms": ["macOS"],
                        "runtime": {"shell": True},
                    },
                }
            },
            "local_installation": self.local_installation,
        }

    def list_candidates(self, *, qualified_only=True, query=None):
        self.calls.append(("list_candidates", qualified_only, query))
        return [
            {
                "name": "incident-handoff",
                "editorial_name": "Incident Handoff",
                "editorial_description": "Transfer incident context between responders.",
                "local_skill_id": "local-1",
                "eligibility": "eligible",
                "qualification": "high_usage",
                "qualification_sequence": 1,
                "notice_variant": "first",
                "organization_name": "Nous Research",
            }
        ]

    def install_plan(self, reference, *, update_mode=None):
        self.calls.append(("install_plan", reference, update_mode))
        return {
            "receipt": "receipt-1",
            "skill_id": "skill-1",
            "slug": "incident-handoff",
            "version": 2,
            "update_mode": update_mode,
            "compatibility": {"outcome": "compatible"},
            "allowed": True,
        }

    def install_apply(self, receipt, *, accept_partial=False):
        self.calls.append(("install_apply", receipt, accept_partial))
        return {"skill_id": "skill-1", "version": 2}

    def version_detail(self, reference, version, *, include_compatibility=True):
        return {"version": {
            "version": version,
            "security_check": {
                "status": "pass", "summary": "No known matches detected.",
                "checks": [{"key": "private_keys", "label": "Private keys", "status": "pass"}],
            },
            "professionalism_check": {"status": "unavailable"},
        }}

    def review(self, draft_id, *, acknowledge, portal=False):
        self.calls.append(("review", draft_id, acknowledge, portal))
        return {
            "draft": {
                "id": draft_id,
                "slug": "incident-handoff",
                "state": "ready",
                "authorDescription": "Summarize an incident",
                "scanVerdict": "pass",
                "scan": {"findings": []},
            },
            "hashes": {
                "content": "sha256:content",
                "author_description": "sha256:description",
                "package_manifest": "sha256:manifest",
            },
            "effective_policy": {"publication_mode": "moderated"},
        }

    def portal_review_url(self, draft_id):
        return f"https://portal.example/review/{draft_id}"

    def approve_owner_draft(self, draft_id):
        self.calls.append(("approve_owner_draft", draft_id))
        return {"publication_state": "pending_moderation"}

    def decline_owner_draft(self, draft_id):
        self.calls.append(("decline_owner_draft", draft_id))
        return {"state": "declined"}

    def list_installations(self):
        return [
            {
                "skill_id": "skill-1",
                "slug": "incident-handoff",
                "state": "active",
                "version": 1,
                "latest_version": 2,
                "update_mode": "MANUAL",
                "effective_update_mode": "AUTO_WITH_NOTICE",
                "skill_state": "active",
            }
        ]

    def update_all(self, *, apply=False):
        self.calls.append(("update_all", apply))
        return {
            "installations": [
                {
                    "skill_id": "skill-1",
                    "slug": "incident-handoff",
                    "state": "update_available",
                }
            ]
        }

    def update_plan(self, skill_id):
        self.calls.append(("update_plan", skill_id))
        return {
            "receipt": "update-receipt-1",
            "skill_id": skill_id,
            "slug": "incident-handoff",
            "version": 2,
            "compatibility": {"outcome": "compatible"},
            "allowed": True,
        }

    def update_apply(self, receipt):
        self.calls.append(("update_apply", receipt))
        return {"skill_id": "skill-1", "version": 2}

    def uninstall(self, skill_id):
        self.calls.append(("uninstall", skill_id))
        return {"skill_id": skill_id}

    def notifications(self, *, mark_seen=False):
        self.calls.append(("notifications", mark_seen))
        return {
            "events": []
            if mark_seen
            else [
                {
                    "message": "incident-handoff v2 is available",
                    "occurred_at": "2026-08-31T00:00:00Z",
                }
            ]
        }


@pytest.fixture(autouse=True)
def _fresh_callback_store(monkeypatch):
    monkeypatch.setattr(command_module, "CALLBACK_TOKENS", _CallbackTokens())
    monkeypatch.setattr(command_module, "require_entitlement", lambda _org_id=None: None)


def test_controller_checks_entitlement_for_commands_and_callbacks(monkeypatch):
    checked = []
    monkeypatch.setattr(command_module, "require_entitlement", lambda org=None: checked.append(org))
    controller = WisdomCommandController()
    context = _context()

    view = bind_view_callbacks(controller.execute("browse", _Service(), context), context)
    token = view.items[0].actions[0].callback_data.removeprefix("wi:cmd:")
    controller.execute_token(token, _Service(), context)

    assert len(checked) >= 2
    assert set(checked) == {None, "org-1"}


def test_parse_supports_quoted_search_and_cli_aliases():
    controller = WisdomCommandController()

    assert controller.parse('browse "incident handoff"') == (
        "browse",
        ["incident handoff"],
    )
    assert controller.parse("list deploy") == ("browse", ["deploy"])
    assert controller.parse("suggest local-skill") == (
        "submit",
        ["local-skill"],
    )


def test_candidates_lists_skill_details_without_onboarding_announcement():
    service = _Service()

    view = WisdomCommandController().execute("candidates", service, _context())

    assert view.items[0].detail == (
        "Transfer incident context between responders.\n"
        "Why others might benefit: high usage"
    )
    assert view.items[0].title == "Incident Handoff"
    assert view.items[0].actions[0].label == "Create private draft"
    assert view.items[0].actions[0].arguments == {"skill_name": "incident-handoff"}


def test_skill_preview_keeps_install_as_the_trailing_action():
    view = WisdomCommandController().execute("show skill-1", _Service(), _context())

    assert [action.label for action in view.actions] == [
        "Versions",
        "View in Portal ↗",
        "Install",
    ]


def test_browse_install_opens_exact_version_review_without_applying():
    service = _Service()
    context = _context()
    controller = WisdomCommandController()
    browse = controller.execute("browse", service, context)
    bind_view_callbacks(browse, context)
    install = next(a for a in browse.items[0].actions if a.operation == "install_modes")
    assert install.arguments["reference"] == "skill-1@v2"
    modes = controller.execute_token(
        install.callback_data.removeprefix("wi:cmd:"), service, context
    )
    assert service.calls == [("search_skills", "")]
    bind_view_callbacks(modes, context)
    manual = next(a for a in modes.actions if a.arguments.get("update_mode") == "MANUAL")
    plan = controller.execute_token(
        manual.callback_data.removeprefix("wi:cmd:"), service, context
    )
    assert plan.title == "Confirm install"
    assert ("install_plan", "skill-1@v2", "MANUAL") in service.calls
    assert not any(call[0] == "install_apply" for call in service.calls)


def test_browse_install_control_is_session_bound_and_has_local_command():
    service = _Service()
    context = _context()
    controller = WisdomCommandController()
    browse = controller.execute("browse", service, context)
    bind_view_callbacks(browse, context)
    install = next(a for a in browse.items[0].actions if a.operation == "install_modes")
    assert install.local_command == "/wisdom install skill-1@v2"
    with pytest.raises(PermissionError):
        controller.execute_token(
            install.callback_data.removeprefix("wi:cmd:"),
            service,
            _context(user_id="someone-else"),
        )
    assert service.calls == [("search_skills", "")]


@pytest.mark.parametrize("version, state, org, expected", [
    (1, "active", "org-1", "update_plan"),
    (2, "active", "org-1", None),
    (3, "active", "org-1", None),
    (2, "inactive", "org-1", "install_modes"),
    (2, "active", "other-org", "install_modes"),
])
@pytest.mark.parametrize("command", ["browse", "show skill-1"])
def test_discovery_actions_match_current_org_installation(tmp_path, version, state, org, expected, command):
    from hermes_wisdom.store import WisdomStore

    service = _Service()
    service.store = WisdomStore(tmp_path / "profile")
    service.store.activate_installation_identity("installation-1", "org-1")
    service.store.record_install(dict(
        skill_id="skill-1", org_id=org, slug="incident-handoff",
        version=version, state=state, content_hash="sha256:fixture",
        baseline={}, target_path=str(tmp_path / "skill"), update_mode="MANUAL",
    ))
    detail = service.resolve_skill("skill-1")
    detail["local_installation"] = service.store.installation("skill-1")
    service.resolve_skill = lambda *args, **kwargs: detail
    service.calls.clear()
    controller = WisdomCommandController()
    view = controller.execute(command, service, _context())
    actions = view.items[0].actions if view.items else view.actions
    device_actions = [a for a in actions if a.operation in {"install_modes", "update_plan"}]
    assert [a.operation for a in device_actions] == ([expected] if expected else [])
    if state == "active" and org == "org-1":
        assert f"Installed: v{version}" in view.to_text()
        if expected:
            assert device_actions[0].label == "Review update"
            assert device_actions[0].local_command == "/wisdom update skill-1"
            bind_view_callbacks(view, _context())
            token = device_actions[0].callback_data.removeprefix("wi:cmd:")
            with pytest.raises(PermissionError):
                controller.execute_token(token, service, _context(user_id="other-user"))
            review = controller.execute_token(token, service, _context())
            assert review.title == "Confirm update"
            assert any(a.operation == "update_apply" for a in review.actions)
    else:
        assert f"Installed: v{version}" not in view.to_text()
    assert not any(call[0].endswith("_apply") for call in service.calls)
    from plugins.platforms.slack.wisdom_blocks import render_wisdom_blocks
    from plugins.platforms.telegram.adapter import TelegramAdapter

    bind_view_callbacks(view, _context())
    telegram = TelegramAdapter._wisdom_command_html(view)
    slack = render_wisdom_blocks(view)
    buttons = [
        element for block in slack for element in block.get("elements", [])
        if element.get("type") == "button"
    ]
    for action in device_actions:
        assert action.callback_data in telegram
        assert any(button.get("value") == action.callback_data for button in buttons)
    if not expected:
        assert not any(button["text"]["text"] in {"Install", "Review update"} for button in buttons)


@pytest.mark.parametrize("command", ["browse", "versions skill-1", "show skill-1"])
@pytest.mark.parametrize("status", ["pass", "pending", "unavailable", "blocked"])
def test_public_discovery_checks_preserve_state_without_private_findings(command, status):
    from hermes_wisdom.review_presentation import review_check_line
    from plugins.platforms.slack.wisdom_blocks import render_wisdom_blocks
    from plugins.platforms.telegram.adapter import TelegramAdapter

    service = _Service()
    checks = {
        key: {"status": status, "summary": "PRIVATE_SUMMARY",
              "checks": [{"label": "PRIVATE_CHECK", "details": ["PRIVATE_DETAIL"]}]}
        for key in ("security_check", "professionalism_check")
    }
    rows = service.search_skills()
    rows[0].update(checks)
    detail = service.resolve_skill("skill-1")
    detail["latest_version_detail"]["version"].update(checks)
    for version in detail["versions"]:
        version.update(checks)
    service.search_skills = lambda query="": rows
    service.resolve_skill = lambda *args, **kwargs: detail
    context = _context(is_group=True)
    view = WisdomCommandController().execute(command, service, context)
    bind_view_callbacks(view, context)
    for rendered in (
        view.to_text(), TelegramAdapter._wisdom_command_html(view),
        str(render_wisdom_blocks(view)),
    ):
        assert review_check_line("Security check", status) in rendered
        assert "PRIVATE_" not in rendered
        assert "Pass" not in rendered
    assert not any(call[0].endswith("_apply") for call in service.calls)


def test_group_browse_and_page_navigation_do_not_read_device_state():
    service = _Service()
    service.store.installations = Mock(side_effect=AssertionError("private device read"))
    skills = service.search_skills() * (command_module.PAGE_SIZE + 1)
    service.search_skills = lambda query="": skills
    controller = WisdomCommandController()
    context = _context(is_group=True)
    view = controller.execute("browse", service, context)
    bind_view_callbacks(view, context)
    page = next(a for a in view.actions if a.operation == "browse_page")
    next_view = controller.execute_token(page.callback_data.removeprefix("wi:cmd:"), service, context)
    for result in (view, next_view):
        assert "Installed:" not in result.to_text()
        assert all(a.operation == "show" for item in result.items for a in item.actions)
        assert any(a.operation == "continue_dm" for a in result.actions)
    service.store.installations.assert_not_called()


def test_private_browse_pagination_refreshes_install_state_without_planning():
    service = _Service()
    skill = service.search_skills()[0]
    service.search_skills = lambda query="": [
        {**skill, "id": f"skill-{index}"} for index in range(command_module.PAGE_SIZE + 1)
    ]
    installed_id = f"skill-{command_module.PAGE_SIZE}"
    rows = [{"skill_id": installed_id, "version": 1, "state": "active", "org_id": "org-1"}]
    service.store.installations = lambda: rows
    controller = WisdomCommandController()
    context = _context()
    first = controller.execute("browse", service, context)
    bind_view_callbacks(first, context)
    next_token = next(a for a in first.actions if a.label == "Next").callback_data.removeprefix("wi:cmd:")
    second = controller.execute_token(next_token, service, context)
    assert second.items[0].actions[-1].operation == "update_plan"
    assert second.items[0].actions[-1].arguments == {"skill_id": installed_id}
    rows[0]["version"] = skill["latest_version"]
    refreshed = controller.execute_token(next_token, service, context)
    assert [a.operation for a in refreshed.items[0].actions] == ["show"]
    assert not any(call[0].endswith(("_plan", "_apply")) for call in service.calls)


def test_local_action_command_resumes_bound_controller_action(native_install):
    service, _, _ = native_install
    context = _context(user_id="local-user", chat_id="local:session-1")
    view = WisdomCommandController().execute("install skill-1", service, context)
    rendered = render_local_view(view, context)

    action_line = next(
        line for line in rendered.splitlines() if line.startswith("Manual:")
    )
    token = action_line.rsplit(" ", 1)[-1]
    resumed = WisdomCommandController().execute(f"action {token}", service, context)

    assert "Future updates: Manual" in resumed.to_text()
    assert any((a.callback_data or "").startswith("wi:agent:confirm:") for a in resumed.actions)
    assert service.client.records == []


def test_local_action_command_rejects_another_session():
    context = _context(chat_id="local:session-1")
    view = WisdomCommandController().execute("install skill-1", _Service(), context)
    render_local_view(view, context)
    token = view.actions[0].callback_data.removeprefix("wi:cmd:")

    with pytest.raises(PermissionError, match="another session"):
        WisdomCommandController().execute(
            f"action {token}",
            _Service(),
            _context(chat_id="local:session-2"),
        )


def test_unknown_keyword_returns_focused_help():
    view = WisdomCommandController().execute("wat", _Service(), _context())

    assert view.title == "Collective Wisdom commands"
    assert view.notice == "Unknown /wisdom keyword: wat"


def test_help_explains_every_workflow_and_includes_examples():
    view = WisdomCommandController().execute("help", _Service(), _context())
    rendered = view.to_text()

    assert [item.title for item in view.items] == [
        "Discover",
        "Contribute",
        "Manage installed skills",
        "Account and activity",
        "Examples",
    ]
    assert "/wisdom show <skill> — View its description" in rendered
    assert "/wisdom installed — List and manage skills installed" in rendered
    assert "/wisdom submit my-local-skill" in rendered


def test_group_home_does_not_read_private_counts():
    service = _Service()
    view = WisdomCommandController().execute(
        "", service, _context(is_group=True, chat_id="group-1")
    )

    assert service.calls == []
    assert [action.label for action in view.actions] == [
        "Browse",
        "Continue in DM",
        "Help",
    ]


def test_connected_home_includes_help_action():
    view = WisdomCommandController().execute("", _Service(), _context())

    help_action = next(action for action in view.actions if action.label == "Help")
    assert help_action.local_command == "/wisdom help"


def test_setup_disclosure_precedes_profile_mutation():
    service = _Service()
    service.command_home = lambda: {"status": {"configured": False}}
    controller = WisdomCommandController()
    context = _context()

    home = controller.execute("", service, context)
    bind_view_callbacks(home, context)
    setup_token = home.actions[0].callback_data.removeprefix("wi:cmd:")
    disclosure = controller.execute_token(setup_token, service, context)

    assert service.calls == []
    assert "Candidate qualification stays on this profile" in disclosure.summary
    bind_view_callbacks(disclosure, context)
    confirm_token = disclosure.actions[0].callback_data.removeprefix("wi:cmd:")
    controller.execute_token(confirm_token, service, context)
    assert service.calls == [("setup", True)]


def test_home_turns_authentication_failure_into_sign_in_card():
    service = _Service()
    status = service.status()
    status.update({"gateway_available": False, "error_kind": "authentication"})
    service.command_home = lambda: {"status": status}

    view = WisdomCommandController().execute("", service, _context())

    assert view.title == "Sign in to use Collective Wisdom"
    assert any(action.url for action in view.actions)


def test_status_reports_local_and_degraded_state_without_raw_error():
    service = _Service()
    status = service.status()
    status.update({
        "gateway_available": False,
        "error_kind": "unavailable",
        "error": "Authorization: Bearer secret-token",
        "pending_operations": [{"id": "one"}],
    })
    service.status = lambda: status

    view = WisdomCommandController().execute("status", service, _context())

    assert "Local store: ready · 1 pending operation(s)" in view.summary
    assert "State: Gateway unavailable" in view.summary
    assert "secret-token" not in view.summary


def test_group_show_removes_install_and_keeps_portal_link():
    service = _Service()
    view = WisdomCommandController().execute(
        "show skill-1", service, _context(is_group=True, chat_id="group-1")
    )

    assert "Install" not in [action.label for action in view.actions]
    assert "Continue in DM" in [action.label for action in view.actions]
    assert any(action.url for action in view.actions)
    assert ("resolve_skill", "skill-1", False) in service.calls


def test_group_versions_pagination_never_reintroduces_install_controls():
    service = _Service()
    original = service.resolve_skill

    def six_versions(reference, *, include_compatibility=True):
        value = original(reference, include_compatibility=include_compatibility)
        value["versions"] = [{"version": version} for version in range(6, 0, -1)]
        return value

    service.resolve_skill = six_versions
    controller = WisdomCommandController()
    context = _context(is_group=True, chat_id="group-1")
    first = controller.execute("versions skill-1", service, context)
    bind_view_callbacks(first, context)
    next_action = next(action for action in first.actions if action.label == "Next")

    second = controller.execute_token(
        next_action.callback_data.removeprefix("wi:cmd:"), service, context
    )

    assert all(
        action.label != "Install" for item in second.items for action in item.actions
    )
    assert any(action.label == "Continue in DM" for action in second.actions)


def test_private_show_includes_requirements_and_installation_state():
    service = _Service()
    service.local_installation = {
        "version": 1, "update_mode": "MANUAL", "state": "active", "org_id": "org-1",
    }
    view = WisdomCommandController().execute("show skill-1", service, _context())

    assert "Summarize an incident" in view.summary
    assert "Latest: v2 · scan: pass" in view.summary
    assert "Requirements: Hermes 0.20.5+; OS: macOS; runtime: shell" in view.summary
    assert "Installed: v1 · MANUAL" in view.summary


def test_browse_navigation_can_step_back_through_show_and_versions():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()

    browse = controller.execute("browse", service, context)
    assert browse.navigation_actions == []
    bind_view_callbacks(browse, context)
    show_action = browse.items[0].actions[0]
    show = controller.execute_token(
        show_action.callback_data.removeprefix("wi:cmd:"), service, context
    )

    assert [action.label for action in show.navigation_actions] == ["← Back"]
    bind_view_callbacks(show, context)
    versions_action = next(
        action for action in show.actions if action.operation == "versions"
    )
    versions = controller.execute_token(
        versions_action.callback_data.removeprefix("wi:cmd:"), service, context
    )

    assert versions.title == "incident-handoff versions"
    bind_view_callbacks(versions, context)
    back_to_show = controller.execute_token(
        versions.navigation_actions[0].callback_data.removeprefix("wi:cmd:"),
        service,
        context,
    )

    assert back_to_show.title == "incident-handoff"
    bind_view_callbacks(back_to_show, context)
    back_to_browse = controller.execute_token(
        back_to_show.navigation_actions[0].callback_data.removeprefix("wi:cmd:"),
        service,
        context,
    )

    assert back_to_browse.title == "Shared skills"
    assert back_to_browse.navigation_actions == []


def test_review_shows_exact_hashes_scan_and_effective_policy():
    service = _Service()
    view = WisdomCommandController().execute("review draft-1", service, _context())

    assert "Content: sha256:content" in view.summary
    assert "Description: sha256:description" in view.summary
    assert "Manifest: sha256:manifest" in view.summary
    assert "Server scan: pass" in view.summary
    assert "Publication policy: moderated" in view.summary


def test_publish_callback_uses_race_safe_service_operation():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    review = controller.execute("review draft-1", service, context)
    bind_view_callbacks(review, context)
    publish = next(action for action in review.actions if action.operation == "publish")

    result = controller.execute_token(
        publish.callback_data.removeprefix("wi:cmd:"), service, context
    )

    assert ("approve_owner_draft", "draft-1") in service.calls
    assert result.summary == "Sent to your collective administrator for approval."


def test_installed_view_shows_installed_latest_and_effective_mode():
    view = WisdomCommandController().execute("installed", _Service(), _context())

    assert view.items[0].detail == ("installed v1 · latest v2 · AUTO_WITH_NOTICE")


def test_install_requires_mode_plan_and_second_confirmation():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    modes = controller.execute("install skill-1", service, context)
    bind_view_callbacks(modes, context)

    assert not service.calls
    plan_token = modes.actions[0].callback_data.removeprefix("wi:cmd:")
    plan = controller.execute_token(plan_token, service, context)
    bind_view_callbacks(plan, context)
    assert service.calls == [("install_plan", "skill-1", None)]
    assert not any(call[0] == "install_apply" for call in service.calls)

    apply_token = plan.actions[0].callback_data.removeprefix("wi:cmd:")
    controller.execute_token(apply_token, service, context)
    assert service.calls[-1] == ("install_apply", "receipt-1", False)


def test_install_preview_can_step_back_to_modes_and_skill():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    show = controller.execute("show skill-1", service, context)
    bind_view_callbacks(show, context)

    install = next(
        action for action in show.actions if action.operation == "install_modes"
    )
    modes = controller.execute_token(
        install.callback_data.removeprefix("wi:cmd:"), service, context
    )
    bind_view_callbacks(modes, context)
    manual = next(
        action
        for action in modes.actions
        if action.arguments.get("update_mode") == "MANUAL"
    )
    plan = controller.execute_token(
        manual.callback_data.removeprefix("wi:cmd:"), service, context
    )
    bind_view_callbacks(plan, context)

    back_to_modes = controller.execute_token(
        plan.navigation_actions[0].callback_data.removeprefix("wi:cmd:"),
        service,
        context,
    )
    assert back_to_modes.title == "Choose how future updates are handled"
    bind_view_callbacks(back_to_modes, context)

    back_to_skill = controller.execute_token(
        back_to_modes.navigation_actions[0].callback_data.removeprefix("wi:cmd:"),
        service,
        context,
    )
    assert back_to_skill.title == "incident-handoff"


def test_blocked_install_plan_never_offers_quick_application():
    service = _Service()
    service.install_plan = lambda *_args, **_kwargs: {
        "receipt": "blocked-receipt",
        "skill_id": "skill-1",
        "slug": "incident-handoff",
        "version": 2,
        "compatibility": {"outcome": "blocked_pending_action"},
        "allowed": False,
    }
    controller = WisdomCommandController()
    context = _context()
    modes = controller.execute("install skill-1", service, context)
    bind_view_callbacks(modes, context)

    plan = controller.execute_token(
        modes.actions[0].callback_data.removeprefix("wi:cmd:"), service, context
    )

    assert not any(action.operation == "install_apply" for action in plan.actions)
    assert "full compatibility review" in str(plan.notice)


@pytest.mark.parametrize("route", ["install", "update", "update_callback"])
def test_plan_checks_preserve_exact_approval_and_navigation(route):
    from plugins.platforms.slack.wisdom_blocks import render_wisdom_blocks
    from plugins.platforms.telegram.adapter import TelegramAdapter

    service = _Service()
    service.version_detail = Mock(wraps=service.version_detail)
    controller, context = WisdomCommandController(), _context()
    kind = "install" if route == "install" else "update"
    if route == "update":
        view = controller.execute("update skill-1", service, context)
    else:
        entry = controller.execute("install skill-1@v2" if kind == "install" else "installed", service, context)
        bind_view_callbacks(entry, context)
        action = entry.actions[0] if kind == "install" else entry.items[0].actions[0]
        view = controller.execute_token(action.callback_data.removeprefix("wi:cmd:"), service, context)

    service.version_detail.assert_called_once_with("skill-1", 2, include_compatibility=False)
    assert "✅ Security check" in view.summary
    assert "No issues detected" in view.summary
    assert "Unavailable" in view.summary  # Advisory absence is not a security pass.
    assert "Private keys" not in view.summary
    original_history = view._navigation_history
    bind_view_callbacks(view, context)
    original_receipt = next(a.arguments["receipt"] for a in view.actions if a.operation == f"{kind}_apply")
    original_approval = next(a.arguments for a in view.actions if a.operation == f"{kind}_apply")
    for expanded in (True, False):
        toggle = next(a for a in view.actions if a.operation == "plan_checks")
        assert toggle.label == ("Show checks" if expanded else "Hide checks")
        token = toggle.callback_data.removeprefix("wi:cmd:")
        with pytest.raises(PermissionError):
            controller.execute_token(token, service, _context(user_id="other"))
        view = controller.execute_token(token, service, context)
        assert ("Private keys" in view.summary) is expanded
        assert "✅ Pass" not in view.summary
        assert view._navigation_history == original_history
        bind_view_callbacks(view, context)
        apply = next(a for a in view.actions if a.operation == f"{kind}_apply")
        assert apply.arguments == original_approval
        assert apply.arguments["receipt"] == original_receipt
        assert apply.callback_data in TelegramAdapter._wisdom_command_html(view)
        assert apply.callback_data in str(render_wisdom_blocks(view))
    assert service.version_detail.call_count == 1
    assert len([c for c in service.calls if c[0] == f"{kind}_plan"]) == 1
    assert not any(c[0].endswith("_apply") for c in service.calls)
    if view.navigation_actions:
        back = controller.execute_token(view.navigation_actions[0].callback_data.removeprefix("wi:cmd:"), service, context)
        assert back.title == entry.title
    controller.execute_token(apply.callback_data.removeprefix("wi:cmd:"), service, context)
    assert service.calls[-1][0:2] == (f"{kind}_apply", original_receipt)


@pytest.mark.parametrize("failure", ["blocked", "pending", "unavailable", "hash_changed", "offline"])
def test_plan_confirmation_never_hides_failed_or_unverified_security(failure):
    service = _Service()
    original_plan = service.install_plan
    service.install_plan = lambda *args, **kwargs: {**original_plan(*args, **kwargs), "content_hash": "sha256:planned"}
    metadata = service.version_detail("skill-1", 2)["version"]
    metadata["content_hash"] = "sha256:changed" if failure == "hash_changed" else "sha256:planned"
    metadata["security_check"]["status"] = failure if failure in {"blocked", "pending", "unavailable"} else "pass"
    service.version_detail = Mock(return_value={"version": metadata})
    controller, context = WisdomCommandController(), _context()
    modes = bind_view_callbacks(controller.execute("install skill-1@v2", service, context), context)
    token = modes.actions[0].callback_data.removeprefix("wi:cmd:")
    if failure == "offline":
        service.version_detail.side_effect = TimeoutError("temporary")
        with pytest.raises(TimeoutError):
            controller.execute_token(token, service, context)
        service.version_detail.side_effect = None
        assert controller.execute_token(token, service, context).title == "Confirm install"
    elif failure == "hash_changed":
        with pytest.raises(command_module.WisdomConflict):
            controller.execute_token(token, service, context)
    else:
        view = controller.execute_token(token, service, context)
        assert failure.title() in view.summary
        assert not any(a.operation == "install_apply" for a in view.actions)
        assert "security review" in view.notice.lower()
    assert not any(c[0] == "install_apply" for c in service.calls)


def test_update_all_only_presents_eligible_updates():
    service = _Service()

    view = WisdomCommandController().execute("update all", service, _context())

    assert ("update_all", False) in service.calls
    assert not any(call[0] == "update_apply" for call in service.calls)
    assert view.items[0].actions[0].label == "Review update"


def test_uninstall_requires_callback_confirmation_before_mutation():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()

    confirmation = controller.execute("uninstall incident-handoff", service, context)

    assert not any(call[0] == "uninstall" for call in service.calls)
    bind_view_callbacks(confirmation, context)
    token = confirmation.actions[0].callback_data.removeprefix("wi:cmd:")
    result = controller.execute_token(token, service, context)
    assert ("uninstall", "skill-1") in service.calls
    assert result.title == "Skill uninstalled"


def test_notifications_are_not_marked_read_until_confirmation():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()

    view = controller.execute("notifications", service, context)

    assert service.calls == [("notifications", False)]
    bind_view_callbacks(view, context)
    token = next(action for action in view.actions if action.operation == "mark_notifications").callback_data.removeprefix("wi:cmd:")
    controller.execute_token(token, service, context)
    assert service.calls[-1] == ("notifications", True)


def test_callback_is_short_scoped_and_single_use_after_success():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    view = controller.execute("install skill-1", service, context)
    bind_view_callbacks(view, context)
    callback_data = view.actions[0].callback_data
    token = callback_data.removeprefix("wi:cmd:")

    assert len(callback_data.encode("utf-8")) <= 64
    with pytest.raises(PermissionError):
        controller.execute_token(token, service, _context(user_id="user-2"))
    with pytest.raises(PermissionError):
        controller.execute_token(token, service, _context(chat_id="chat-2"))
    with pytest.raises(PermissionError):
        controller.execute_token(token, service, _context(profile="other"))
    with pytest.raises(PermissionError):
        controller.execute_token(token, service, _context(organization_id="org-2"))

    plan = controller.execute_token(token, service, context)
    bind_view_callbacks(plan, context)
    mutation_token = plan.actions[0].callback_data.removeprefix("wi:cmd:")
    controller.execute_token(mutation_token, service, context)
    with pytest.raises(ValueError, match="expired"):
        controller.execute_token(mutation_token, service, context)


def test_transient_mutation_failure_keeps_callback_retryable():
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    view = controller.execute("install skill-1", service, context)
    bind_view_callbacks(view, context)
    token = view.actions[0].callback_data.removeprefix("wi:cmd:")
    original = service.install_plan
    service.install_plan = lambda *_args, **_kwargs: (_ for _ in ()).throw(
        RuntimeError("temporary")
    )

    with pytest.raises(RuntimeError, match="temporary"):
        controller.execute_token(token, service, context)

    service.install_plan = original
    assert controller.execute_token(token, service, context).title == "Confirm install"


def test_expired_callback_is_rejected(monkeypatch):
    now = [100.0]
    monkeypatch.setattr(command_module.time, "monotonic", lambda: now[0])
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    view = controller.execute("install skill-1", service, context)
    bind_view_callbacks(view, context)
    token = view.actions[0].callback_data.removeprefix("wi:cmd:")
    now[0] = 800.0

    with pytest.raises(ValueError, match="expired"):
        controller.execute_token(token, service, context)


@pytest.mark.parametrize("kind", ["install", "update"])
@pytest.mark.parametrize("expired_action", ["confirm", "checks"])
def test_check_toggles_do_not_extend_review_authority(monkeypatch, kind, expired_action):
    now = [100.0]
    monkeypatch.setattr(command_module.time, "monotonic", lambda: now[0])
    service = _Service()
    controller = WisdomCommandController()
    context = _context()
    initial = WisdomView("Review", actions=[WisdomAction(
        "Review", f"{kind}_plan", {
            "reference": "skill-1", "skill_id": "skill-1", "update_mode": "MANUAL",
        },
    )])
    bind_view_callbacks(initial, context)
    view = controller.execute_token(initial.actions[0].callback_data.removeprefix("wi:cmd:"), service, context)

    def token_for(view, operation):
        bind_view_callbacks(view, context)
        return next(a.callback_data.removeprefix("wi:cmd:") for a in view.actions if a.operation == operation)

    checks = token_for(view, "plan_checks")
    now[0] = 650.0  # Still within the first review's ten-minute deadline.
    expanded = controller.execute_token(checks, service, context)
    late_control = token_for(expanded, f"{kind}_apply" if expired_action == "confirm" else "plan_checks")
    # The transport token remains valid, but the underlying review has expired.
    now[0] = 701.0
    expired = controller.execute_token(late_control, service, context)
    assert not any(call[0].endswith("_apply") for call in service.calls)
    assert not any(a.operation == f"{kind}_apply" for a in expired.actions)
    recheck = token_for(expired, f"{kind}_plan")
    refreshed = controller.execute_token(recheck, service, context)
    assert sum(call[0] == f"{kind}_plan" for call in service.calls) == 2
    if kind == "install":
        assert service.calls[-1] == ("install_plan", "skill-1@v2", "MANUAL")
    assert not any(call[0].endswith("_apply") for call in service.calls)
    confirm = token_for(refreshed, f"{kind}_apply")
    controller.execute_token(confirm, service, context)
    assert sum(call[0] == f"{kind}_apply" for call in service.calls) == 1


def test_group_continuation_is_user_profile_and_org_bound():
    from dataclasses import replace

    group = _context(chat_id="group-1", is_group=True, scope_id="team-1", thread_id="parent")
    dm = _context(chat_id="dm-1", scope_id="team-1", thread_id="different-private-thread")
    token = issue_continuation("drafts", group)

    with pytest.raises(PermissionError):
        resolve_continuation(token, replace(dm, user_id="user-2"))
    with pytest.raises(PermissionError):
        resolve_continuation(token, replace(dm, profile="other"))
    with pytest.raises(PermissionError):
        resolve_continuation(
            token,
            replace(dm, organization_id="org-2"),
        )
    with pytest.raises(PermissionError):
        resolve_continuation(token, replace(dm, scope_id="team-2"))

    assert resolve_continuation(token, dm) == "drafts"
    with pytest.raises(ValueError, match="expired"):
        resolve_continuation(token, dm)


def test_group_continuation_cannot_be_redeemed_in_another_group():
    token = issue_continuation(
        "installed",
        _context(chat_id="group-1", is_group=True),
    )

    with pytest.raises(PermissionError):
        resolve_continuation(
            token,
            _context(chat_id="group-2", is_group=True),
        )


def test_unexpected_errors_are_not_echoed_to_text_fallbacks():
    assert "secret-token" not in command_error_text(
        RuntimeError("Authorization: Bearer secret-token")
    )


def test_text_fallback_keeps_portal_links_but_not_callback_payloads():
    view = command_module.WisdomView(
        "Collective Wisdom",
        items=[
            command_module.WisdomItem(
                "incident-handoff",
                actions=[
                    command_module.WisdomAction(
                        "View in Portal", url="https://portal.example/skill-1"
                    ),
                    command_module.WisdomAction(
                        "Install", callback_data="wi:cmd:private-token"
                    ),
                ],
            )
        ],
    )

    rendered = view.to_text()

    assert "View in Portal: https://portal.example/skill-1" in rendered
    assert "private-token" not in rendered


def test_local_text_prefers_readable_commands_without_changing_shared_fallback():
    context = _context(chat_id="local:session-1")
    view = command_module.WisdomView(
        "Collective Wisdom",
        actions=[
            command_module.WisdomAction(
                "Browse", "browse", local_command="/wisdom browse"
            )
        ],
    )

    rendered = render_local_view(view, context)

    assert "Browse: /wisdom browse" in rendered
    assert "/wisdom action" not in rendered
    assert "wi:cmd:" not in rendered
    assert view.to_text() == "Collective Wisdom"


def test_local_browse_renders_show_by_skill_name_instead_of_action_token():
    view = WisdomCommandController().execute("browse", _Service(), _context())

    rendered = render_local_view(view, _context())

    assert "View: /wisdom show incident-handoff" in rendered
    assert "/wisdom action" not in rendered