openlatch-client 0.6.18

//! Manifest parsing and path expansion for the configuration-plane monitor.
//!
//! The manifest is embedded into the binary via `include_str!` at compile
//! time. Tests (and only tests, gated behind `insecure-test-keys`) may
//! override the source via `OPENLATCH_INVENTORY_MANIFEST_PATH`.

use std::path::{Path, PathBuf};

use serde::{Deserialize, Serialize};

/// Top-level manifest document. One of these is parsed from
/// `manifests/agent_configs.toml`.
#[derive(Debug, Clone, Deserialize)]
pub struct Manifest {
    #[serde(default, rename = "agent")]
    pub agents: Vec<AgentManifest>,
}

impl Manifest {
    /// The same manifest narrowed to the agents named in `agents`.
    ///
    /// The monitor reports only agents that detection finds: a config file on
    /// disk is not proof its agent is installed, and leftovers of a removed
    /// agent must not surface as that agent's inventory.
    pub fn only_agents(&self, agents: &std::collections::HashSet<String>) -> Manifest {
        Manifest {
            agents: self
                .agents
                .iter()
                .filter(|a| agents.contains(&a.name))
                .cloned()
                .collect(),
        }
    }
}

/// Per-agent manifest section.
#[derive(Debug, Clone, Deserialize)]
pub struct AgentManifest {
    pub name: String,
    #[serde(default, rename = "path")]
    pub paths: Vec<AgentPath>,
    #[serde(default)]
    pub exclude: Option<ExcludeBlock>,
}

/// Precedence tier the cloud's routing engine uses to resolve same-named
/// MCP servers (and other layered config) discovered on the same machine.
/// Order: `Enterprise` > `Personal` > `Project` > `Local` — most-specific
/// scope wins. Serialised to lowercase wire strings.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum ConfigScope {
    Enterprise,
    Personal,
    Project,
    Local,
}

impl ConfigScope {
    pub fn as_str(self) -> &'static str {
        match self {
            ConfigScope::Enterprise => "enterprise",
            ConfigScope::Personal => "personal",
            ConfigScope::Project => "project",
            ConfigScope::Local => "local",
        }
    }

    /// Whether this scope's manifest entries are rooted at the active
    /// project (cwd) rather than the user / system home. The monitor uses
    /// this to gate user-scope walks vs. project-scope walks.
    pub fn is_project_rooted(self) -> bool {
        matches!(self, ConfigScope::Project | ConfigScope::Local)
    }
}

/// One declared watch entry. The combination of `paths` / `paths_glob` /
/// `paths_relative` / `paths_glob_relative` / `json_slice_paths` is governed
/// by the `watch_strategy` discriminant; `manifest::validate` checks the
/// invariants at load time.
#[derive(Debug, Clone, Deserialize)]
pub struct AgentPath {
    pub kind: String,
    #[serde(default)]
    pub scope: Option<ConfigScope>,
    #[serde(default)]
    pub paths: Vec<String>,
    #[serde(default)]
    pub paths_relative: Vec<String>,
    #[serde(default)]
    pub paths_glob: Option<String>,
    #[serde(default)]
    pub paths_glob_relative: Vec<String>,
    #[serde(default)]
    pub json_slice_paths: Vec<JsonSlicePath>,
    pub watch_strategy: WatchStrategy,
    #[serde(default)]
    pub slice_kind_subpath: bool,
    /// The file's contents never leave the host: it is hashed as text, and the
    /// body carries only its name. For files that are not ours to forward and
    /// may hold anything — Cline's hook scripts (PRD C-6).
    #[serde(default)]
    pub opaque: bool,
    /// An MCP settings file read through a projection that never materialises
    /// a server's `env` or `headers` — they are skipped in the parser — and
    /// whose per-server hash covers only what is left. For a file that mixes
    /// server definitions with their credentials: Cline's
    /// `cline_mcp_settings.json`, the one file C-6 admits under its data root.
    #[serde(default)]
    pub projected: bool,
    /// The glob runs over Claude Code's plugin cache, and a match counts only
    /// under an installed plugin's install root — the one version an agent
    /// loads, not every version the cache kept. See `claude_plugins`.
    #[serde(default)]
    pub claude_plugins: bool,
    /// OpenCode's loader rules decide which candidates are read: first-match
    /// instruction files, the `OPENCODE_DISABLE_*` switches, the roots each
    /// OpenCode environment adds, and the paths its config files name. The
    /// templates stay the full list of what may be opened. See
    /// `opencode_select` (AGT-6 C-4, D-9).
    #[serde(default)]
    pub opencode_select: bool,
    /// A per-format projection applied to the file **before** it is hashed or
    /// forwarded, so nothing outside it ever leaves the host. See
    /// [`Projection`].
    #[serde(default)]
    pub projection: Option<Projection>,
}

/// A projection of a whole settings file onto the keys that may leave the host.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Projection {
    /// OpenCode's `opencode.json(c)` (AGT-5 C-7): `permission`, `plugin`,
    /// `share`, `instructions`, `experimental.policies`,
    /// `provider.*.options.baseURL` and `mcp.*.{type, command, url, enabled}`
    /// only — URLs reduced to scheme, host and port. Never `apiKey`, `headers`
    /// or `environment`.
    OpencodeConfig,
    /// The MCP servers of OpenCode's `opencode.json(c)` (AGT-6 C-4, D-12),
    /// fanned out one item per server and read from the file's ORIGINAL text,
    /// never from [`Projection::OpencodeConfig`]'s output. Each server keeps
    /// `type`, `enabled`, `command` and `url` only — `headers`, `environment`,
    /// `oauth` and every other field are skipped in the parser. The hash
    /// covers the full `command` and the URL less its userinfo; what may leave
    /// is the executable's base name and the URL's origin. On an `mcp` entry
    /// with `slice_kind_subpath = true`.
    OpencodeMcp,
}

impl AgentPath {
    /// Whether this entry is anchored at the active project root (cwd) and
    /// therefore must be processed by `run_project_scope_scan` instead of
    /// the user-scope walk. Currently true for `project` + `local` scopes.
    pub fn is_project_scoped(&self) -> bool {
        self.scope.is_some_and(|s| s.is_project_rooted())
    }
}

#[derive(Debug, Clone, Deserialize)]
pub struct JsonSlicePath {
    pub path: String,
    /// RFC 6901-style JSON Pointer (e.g. `/mcpServers`).
    pub json_pointer: String,
}

#[derive(Debug, Clone, Deserialize)]
pub struct ExcludeBlock {
    #[serde(default)]
    pub patterns: Vec<String>,
}

/// Watch strategy discriminant for an `[[agent.path]]` block.
#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)]
#[serde(rename_all = "snake_case")]
pub enum WatchStrategy {
    /// Watch a single fixed file.
    ExactFile,
    /// Watch a single fixed file and hash a JSON Pointer slice of it.
    ExactFileWithSlice,
    /// Watch a directory glob; one path per matching file.
    Glob,
    /// Watch both a fixed file AND a directory glob.
    ExactFileAndGlob,
}

/// Errors raised while loading or parsing the manifest.
#[derive(thiserror::Error, Debug)]
pub enum ManifestError {
    #[error("manifest read failed at {0}: {1}")]
    ReadFailed(String, std::io::Error),
    #[error("manifest parse failed at {0}: {1}")]
    ParseFailed(String, String),
}

/// Errors raised while expanding a manifest path template.
#[derive(thiserror::Error, Debug, PartialEq, Eq)]
pub enum PathExpansionError {
    #[error("home directory not found")]
    HomeNotFound,
    #[error("app-data directory not found")]
    AppDataNotFound,
    #[error("project-scope path used without a project root")]
    ProjectScopeWithoutRoot,
    #[error("unknown variable: {0}")]
    UnknownVariable(String),
    #[error("env var missing: {0}")]
    EnvVarMissing(String),
    #[error("unterminated variable expansion in: {0}")]
    UnterminatedVariable(String),
    /// A resolver variable with no value on this host right now — an OpenCode
    /// environment root no load report names. The template is skipped, never
    /// a manifest failure.
    #[error("variable unset: {0}")]
    Unset(String),
}

/// Source of the embedded manifest TOML.
const EMBEDDED_MANIFEST: &str = include_str!("../../../manifests/agent_configs.toml");

/// The parsed embedded manifest, computed once and cloned on each request so
/// production callers can re-load (e.g. on a `manual rescan`) without paying
/// the toml-parser cost again.
static EMBEDDED_PARSED: std::sync::LazyLock<Result<Manifest, String>> =
    std::sync::LazyLock::new(|| {
        toml::from_str::<Manifest>(EMBEDDED_MANIFEST).map_err(|e| e.to_string())
    });

/// Load the manifest. In production this returns the embedded copy parsed at
/// startup. Test builds (with the `insecure-test-keys` feature OR running
/// under `cfg(test)`) honour the `OPENLATCH_INVENTORY_MANIFEST_PATH` env var
/// for fixture overrides.
pub fn load_embedded() -> Result<Manifest, ManifestError> {
    #[cfg(any(test, feature = "insecure-test-keys"))]
    if let Ok(path) = std::env::var("OPENLATCH_INVENTORY_MANIFEST_PATH") {
        if !path.is_empty() {
            let raw = std::fs::read_to_string(&path)
                .map_err(|e| ManifestError::ReadFailed(path.clone(), e))?;
            return parse_str(&raw, &path);
        }
    }
    EMBEDDED_PARSED
        .clone()
        .map_err(|msg| ManifestError::ParseFailed("embedded".to_string(), msg))
}

#[cfg(any(test, feature = "insecure-test-keys"))]
fn parse_str(raw: &str, source: &str) -> Result<Manifest, ManifestError> {
    toml::from_str::<Manifest>(raw)
        .map_err(|e| ManifestError::ParseFailed(source.to_string(), e.to_string()))
}

/// Expand a manifest path template. Supports the thirteen variables documented in
/// `manifests/agent_configs.toml`:
///
/// - `${CLAUDE_CONFIG_DIR}` — `hooks::claude_code::config_dir`: the relocated
///   directory when `$CLAUDE_CONFIG_DIR` is set, else `~/.claude`.
/// - `${CLAUDE_STATE_DIR}` — `hooks::claude_code::state_dir`: the parent of
///   `.claude.json`, which is that same relocated directory when the variable
///   is set but `$HOME` — one component shallower — when it is not.
/// - `${CODEX_HOME}` — `hooks::codex_cli::config_dir`: the relocated directory
///   when `$CODEX_HOME` is set, else `~/.codex`.
/// - `${CLINE_DIR}` — `hooks::cline::store_root`: `$CLINE_DIR` when set,
///   else `~/.cline`.
/// - `${CLINE_DATA_DIR}` — `hooks::cline::data_root`: `$CLINE_DATA_DIR` when
///   set, else `data/` under the store.
/// - `${CLINE_ASSETS_DIR}` — `hooks::cline::asset_root`:
///   `$OPENLATCH_CLINE_ASSETS_DIR` when set, else `~/Documents/Cline`.
/// - `${CURSOR_DIR}` — `hooks::cursor::root`: `$OPENLATCH_CURSOR_DIR` when
///   set, else `~/.cursor`.
/// - `${OPENCODE_DIR}` — `hooks::opencode::root`: `$XDG_CONFIG_HOME/opencode`
///   when set, else `~/.config/opencode`.
/// - `${OPENCODE_MANAGED_DIR}` — `hooks::opencode::managed_dir`: OpenCode's
///   managed config, per OS.
/// - `${OPENCODE_MANAGED_PREFS}` — `opencode_select::managed_prefs_dirs`:
///   macOS managed preferences, the user's directory then the machine's;
///   unset off macOS.
/// - `${HOME}` — `dirs::home_dir`
/// - `${APPDATA}` — `dirs::data_dir`
/// - `${VSCODE_USER}` — `dirs::config_dir().join("Code/User")`
/// - `${CURSOR_USER}` — `dirs::config_dir().join("Cursor/User")`
/// - `${OPENLATCH_DIR}` — `crate::config::openlatch_dir`
/// - `${SYSTEM_CLAUDE_DIR}` — per-OS Claude Code system / org-managed config
///   dir: `/etc/claude-code` (Linux), `/Library/Application Support/Claude`
///   (macOS), `%ProgramData%\Claude` (Windows). Used by enterprise-scope paths.
/// - `${PROJECT}` — only valid when `project_root` is `Some`; otherwise
///   returns `ProjectScopeWithoutRoot`.
/// - `${env:VAR}` — `std::env::var` lookup.
///
/// The two Claude variables, `${CODEX_HOME}` and `${CURSOR_DIR}` are **resolvers, not
/// environment reads**: each has a defined answer with its variable unset,
/// where the raw `${env:...}` form would fail the whole template with
/// `EnvVarMissing` — and on a normal host `$CODEX_HOME` *is* unset, because
/// `~/.codex` is the default. Every Claude Code and Codex CLI path in the
/// manifest must go through them.
/// Anchoring one on `${HOME}/.claude` instead is how this subsystem shipped a
/// release watching `~/.claude` while hook installation, model relay wiring and
/// identity all followed the user's relocated directory — the drift and tamper
/// perimeter covering a directory the agent no longer reads.
///
/// Unknown variables return `UnknownVariable`. Unterminated `${...` blocks
/// return `UnterminatedVariable`.
pub fn expand_path(
    input: &str,
    project_root: Option<&Path>,
) -> Result<PathBuf, PathExpansionError> {
    let mut out = String::with_capacity(input.len());
    let mut chars = input.chars().peekable();
    while let Some(c) = chars.next() {
        if c == '$' && chars.peek() == Some(&'{') {
            chars.next();
            let mut var = String::new();
            let mut closed = false;
            for c in chars.by_ref() {
                if c == '}' {
                    closed = true;
                    break;
                }
                var.push(c);
            }
            if !closed {
                return Err(PathExpansionError::UnterminatedVariable(input.to_string()));
            }
            out.push_str(&resolve_var(&var, project_root)?);
        } else {
            out.push(c);
        }
    }
    Ok(PathBuf::from(out))
}

/// Every expansion of `input`: one per value of a multi-valued variable
/// (`${OPENCODE_ENV_DIR}`, `${OPENCODE_ENV_CONFIG}` — one per OpenCode
/// environment the kept load reports name; `${OPENCODE_MANAGED_PREFS}` — the
/// user's managed-preferences directory, then the machine's), else
/// [`expand_path`]'s one. A
/// template that does not expand yields nothing.
pub fn expand_path_all(input: &str, project_root: Option<&Path>) -> Vec<PathBuf> {
    let multi = [
        (
            "${OPENCODE_ENV_DIR}",
            super::opencode_select::env_dirs as fn() -> Vec<PathBuf>,
        ),
        (
            "${OPENCODE_ENV_CONFIG}",
            super::opencode_select::env_config_files,
        ),
        (
            "${OPENCODE_MANAGED_PREFS}",
            super::opencode_select::managed_prefs_dirs,
        ),
    ];
    for (token, values) in multi {
        if input.contains(token) {
            return values()
                .into_iter()
                .filter_map(|v| {
                    let v = v.display().to_string();
                    // A value is a path, never a template of its own.
                    if v.contains("${") {
                        return None;
                    }
                    expand_path(&input.replace(token, &v), project_root).ok()
                })
                .collect();
        }
    }
    expand_path(input, project_root).into_iter().collect()
}

fn resolve_var(name: &str, project_root: Option<&Path>) -> Result<String, PathExpansionError> {
    match name {
        "CLAUDE_CONFIG_DIR" => crate::hooks::claude_code::config_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        "CLAUDE_STATE_DIR" => crate::hooks::claude_code::state_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // A resolver arm, never `${env:CODEX_HOME}`. On a normal host
        // `CODEX_HOME` is unset — `~/.codex` is the default — and the `env:`
        // branch below answers `EnvVarMissing` for an unset variable, which
        // would fail the template and take the whole manifest with it. Same
        // shape, and the same reason, as `CLAUDE_CONFIG_DIR` above.
        "CODEX_HOME" => crate::hooks::codex_cli::config_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // Resolvers, for the `CODEX_HOME` reason: both seams are unset on a
        // normal host, and the default root is the one Cline itself reads.
        "CLINE_DIR" => crate::hooks::cline::store_root()
            .map(|(p, _)| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        "CLINE_ASSETS_DIR" => crate::hooks::cline::asset_root()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // Its own resolver, not `${CLINE_DIR}/data`: `$CLINE_DATA_DIR` moves the
        // data root independently of the store.
        "CLINE_DATA_DIR" => crate::hooks::cline::data_root()
            .map(|(p, _)| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // A resolver, for the `CODEX_HOME` reason: `OPENLATCH_CURSOR_DIR` is
        // unset on a normal host, and `~/.cursor` is what Cursor itself reads.
        "CURSOR_DIR" => crate::hooks::cursor::root()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // The machine-wide hook file an administrator deploys. The same
        // definition `doctor` names under `other_hook_sources`.
        // A resolver, for the `CODEX_HOME` reason: `$XDG_CONFIG_HOME` is unset
        // on most hosts, and `~/.config/opencode` is what OpenCode itself reads.
        "OPENCODE_DIR" => crate::hooks::opencode::root()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // OpenCode's home — the root of `~/.opencode`, `~/.claude` and
        // `~/.agents` as OpenCode reads them (`opencode_select::user_home`).
        "OPENCODE_USER_HOME" => super::opencode_select::user_home()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // `~/.opencode`, a config directory OpenCode always reads (AGT-6 C-4).
        "OPENCODE_HOME_DIR" => super::opencode_select::user_home()
            .map(|p| p.join(".opencode").display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        // `OPENCODE_CONFIG_DIR` / `OPENCODE_CONFIG` from OpenCode's own
        // environment (its load reports, AGT-6 D-10) — the most recent one.
        // `expand_path_all` yields every one the kept reports name.
        "OPENCODE_ENV_DIR" => super::opencode_select::env_dirs()
            .into_iter()
            .next()
            .map(|p| p.display().to_string())
            .ok_or_else(|| PathExpansionError::Unset(name.into())),
        "OPENCODE_ENV_CONFIG" => super::opencode_select::env_config_files()
            .into_iter()
            .next()
            .map(|p| p.display().to_string())
            .ok_or_else(|| PathExpansionError::Unset(name.into())),
        // macOS managed preferences (`/Library/Managed Preferences/[<user>/]`,
        // AGT-6 D-14) — the user's first; `expand_path_all` yields both. No
        // value off macOS: the template is skipped.
        "OPENCODE_MANAGED_PREFS" => super::opencode_select::managed_prefs_dirs()
            .into_iter()
            .next()
            .map(|p| p.display().to_string())
            .ok_or_else(|| PathExpansionError::Unset(name.into())),
        // OpenCode's managed config — read as inventory, never written.
        "OPENCODE_MANAGED_DIR" => crate::hooks::opencode::managed_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::AppDataNotFound),
        "CURSOR_ENTERPRISE_DIR" => crate::hooks::cursor::enterprise_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::AppDataNotFound),
        "HOME" => dirs::home_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::HomeNotFound),
        "APPDATA" => dirs::data_dir()
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::AppDataNotFound),
        "VSCODE_USER" => dirs::config_dir()
            .map(|p| p.join("Code").join("User").display().to_string())
            .ok_or(PathExpansionError::AppDataNotFound),
        // Cursor is a VS Code fork: its editor state sits beside VS Code's.
        "CURSOR_USER" => dirs::config_dir()
            .map(|p| p.join("Cursor").join("User").display().to_string())
            .ok_or(PathExpansionError::AppDataNotFound),
        "OPENLATCH_DIR" => Ok(crate::config::openlatch_dir().display().to_string()),
        "SYSTEM_CLAUDE_DIR" => Ok(system_claude_dir()),
        "PROJECT" => project_root
            .map(|p| p.display().to_string())
            .ok_or(PathExpansionError::ProjectScopeWithoutRoot),
        other if other.starts_with("env:") => {
            let env_name = &other[4..];
            std::env::var(env_name).map_err(|_| PathExpansionError::EnvVarMissing(env_name.into()))
        }
        other => Err(PathExpansionError::UnknownVariable(other.into())),
    }
}

/// Resolve the platform-specific Claude Code system / org-managed config
/// directory. Returned as a string so it composes cleanly with the rest of
/// the manifest's template expansion. The directory is not required to
/// exist — non-existent paths are skipped downstream like any other.
fn system_claude_dir() -> String {
    #[cfg(target_os = "linux")]
    {
        return "/etc/claude-code".to_string();
    }
    #[cfg(target_os = "macos")]
    {
        return "/Library/Application Support/Claude".to_string();
    }
    #[cfg(target_os = "windows")]
    {
        let base = std::env::var("ProgramData").unwrap_or_else(|_| "C:\\ProgramData".to_string());
        return format!("{base}\\Claude");
    }
    #[allow(unreachable_code)]
    String::new()
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn embedded_manifest_parses() {
        let m = load_embedded().expect("embedded manifest must parse");
        assert!(!m.agents.is_empty(), "embedded manifest declares agents");
        let claude = m
            .agents
            .iter()
            .find(|a| a.name == "claude-code")
            .expect("claude-code agent present");
        assert!(
            claude.paths.iter().any(|p| p.kind == "mcp"),
            "claude-code includes an mcp path entry"
        );
    }

    /// Every absolute template the `claude-code` agent declares, in declaration
    /// order: `paths`, `paths_glob`, `json_slice_paths`, and the exclude block.
    ///
    /// The `*_relative` fields are deliberately absent — those are anchored on
    /// a per-event project root, never on the user's config directory, so they
    /// have no business in a test about where that directory is.
    fn claude_code_absolute_templates() -> Vec<String> {
        let m = load_embedded().expect("embedded manifest must parse");
        let agent = m
            .agents
            .iter()
            .find(|a| a.name == "claude-code")
            .expect("claude-code agent present");

        let mut out = Vec::new();
        for ap in &agent.paths {
            out.extend(ap.paths.iter().cloned());
            out.extend(ap.paths_glob.iter().cloned());
            out.extend(ap.json_slice_paths.iter().map(|s| s.path.clone()));
        }
        out.extend(
            agent
                .exclude
                .iter()
                .flat_map(|e| e.patterns.iter().cloned()),
        );
        out
    }

    /// **The regression gate for the fourth resolver.**
    ///
    /// With `$CLAUDE_CONFIG_DIR` pointed somewhere real, not one absolute
    /// template in the embedded manifest may still resolve into the default
    /// `~/.claude` — that is the whole failure this test exists to catch. The
    /// config monitor used to reach its paths through `${HOME}/.claude/...`,
    /// which `dirs::home_dir()` answers without ever consulting the variable,
    /// so a user who relocated their Claude config had hooks, model relay wiring
    /// and identity follow the new directory while drift and tamper monitoring
    /// kept watching the old one.
    ///
    /// It fails on *any* future `${HOME}/.claude` entry, which is the point: the
    /// manifest is data, so nothing in the type system stops the next one.
    ///
    /// The temp directory is the custom path on purpose — a sandbox that sets
    /// `$CLAUDE_CONFIG_DIR` to `$HOME/.claude` proves nothing, since a resolver
    /// that ignores the variable entirely lands on the same answer.
    #[test]
    fn embedded_manifest_follows_a_relocated_config_dir() {
        let _lock = crate::daemon::identity::ENV_LOCK.blocking_lock();
        let env = crate::daemon::identity::test_support::EnvGuard::clear();
        let relocated = tempfile::tempdir().expect("temp dir");
        env.set("CLAUDE_CONFIG_DIR", relocated.path());

        let home = dirs::home_dir().expect("home dir");
        let default_config_dir = home.join(".claude");
        let default_state_file = home.join(".claude.json");

        let templates = claude_code_absolute_templates();
        assert!(
            !templates.is_empty(),
            "the sweep must actually see the manifest's templates"
        );

        let mut under_relocated = 0usize;
        for template in &templates {
            let expanded = expand_path(template, None)
                .unwrap_or_else(|e| panic!("{template} must expand: {e}"));
            assert!(
                !expanded.starts_with(&default_config_dir),
                "{template} resolved to {} — inside the default config directory \
                 while $CLAUDE_CONFIG_DIR points at {}",
                expanded.display(),
                relocated.path().display()
            );
            assert_ne!(
                expanded,
                default_state_file,
                "{template} resolved to the default state file while \
                 $CLAUDE_CONFIG_DIR points at {}",
                relocated.path().display()
            );
            if expanded.starts_with(relocated.path()) {
                under_relocated += 1;
            }
        }

        // Everything except the one enterprise-scope `${SYSTEM_CLAUDE_DIR}`
        // entry, which is org-managed and rightly ignores the user's variable.
        assert_eq!(
            under_relocated,
            templates.len() - 1,
            "exactly one template (the SYSTEM_CLAUDE_DIR one) may sit outside \
             the relocated directory"
        );
    }

    /// `${CLAUDE_CONFIG_DIR}` and `${CLAUDE_STATE_DIR}` differ by exactly one
    /// component when the variable is unset and collapse onto the same
    /// directory when it is set — the asymmetry `provider_account` documents,
    /// asserted here because the manifest is the second consumer of it.
    #[test]
    fn claude_dir_variables_track_the_env_var() {
        let _lock = crate::daemon::identity::ENV_LOCK.blocking_lock();
        let env = crate::daemon::identity::test_support::EnvGuard::clear();
        let home = dirs::home_dir().expect("home dir");

        // Unset: settings live one level below the state file.
        assert_eq!(
            expand_path("${CLAUDE_CONFIG_DIR}/settings.json", None).unwrap(),
            home.join(".claude").join("settings.json")
        );
        assert_eq!(
            expand_path("${CLAUDE_STATE_DIR}/.claude.json", None).unwrap(),
            home.join(".claude.json")
        );

        // Relocated: both land in the same directory.
        let relocated = tempfile::tempdir().expect("temp dir");
        env.set("CLAUDE_CONFIG_DIR", relocated.path());
        assert_eq!(
            expand_path("${CLAUDE_CONFIG_DIR}/settings.json", None).unwrap(),
            relocated.path().join("settings.json")
        );
        assert_eq!(
            expand_path("${CLAUDE_STATE_DIR}/.claude.json", None).unwrap(),
            relocated.path().join(".claude.json")
        );

        // Empty reads as unset, matching every other reader of the variable —
        // an exported-but-blank value would otherwise anchor the whole
        // monitoring perimeter on the daemon's working directory.
        env.set("CLAUDE_CONFIG_DIR", "");
        assert_eq!(
            expand_path("${CLAUDE_CONFIG_DIR}/settings.json", None).unwrap(),
            home.join(".claude").join("settings.json")
        );
    }

    /// `${CODEX_HOME}` must answer on a host that has never heard of the
    /// variable, because that is the normal host: `~/.codex` is Codex CLI's
    /// default and nothing exports `CODEX_HOME` unless a sandbox does.
    ///
    /// The contrast is the whole point. `${env:CODEX_HOME}` fails with
    /// `EnvVarMissing` when unset, and a manifest template that fails takes the
    /// entire manifest with it — so the `codex-cli` block would watch nothing,
    /// silently, on every machine but a sandbox.
    ///
    /// Takes `codex_cli::CONFIG_DIR_ENV_LOCK` and restores `CODEX_HOME` by
    /// hand: the variable is absent from `identity::MANAGED`, so `EnvGuard`
    /// neither clears nor restores it.
    #[test]
    fn codex_home_resolver_falls_back_when_unset() {
        let _lock = crate::hooks::codex_cli::CONFIG_DIR_ENV_LOCK
            .lock()
            .unwrap_or_else(|e| e.into_inner());
        let previous = std::env::var_os("CODEX_HOME");
        std::env::remove_var("CODEX_HOME");

        let resolved = resolve_var("CODEX_HOME", None);
        let env_form = resolve_var("env:CODEX_HOME", None);
        let expanded = expand_path("${CODEX_HOME}/hooks.json", None);

        match previous {
            Some(v) => std::env::set_var("CODEX_HOME", v),
            None => std::env::remove_var("CODEX_HOME"),
        }

        let home = dirs::home_dir().expect("home dir");
        assert_eq!(
            resolved.expect("the resolver answers with the variable unset"),
            home.join(".codex").display().to_string()
        );
        assert_eq!(
            env_form.unwrap_err(),
            PathExpansionError::EnvVarMissing("CODEX_HOME".into()),
            "the `env:` form is why this arm exists — it fails when unset"
        );
        assert_eq!(
            expanded.expect("the manifest's own template expands"),
            home.join(".codex").join("hooks.json")
        );
    }

    /// The `codex-cli` block watches something. `paths` is `#[serde(default)]`,
    /// so a block with no `[[agent.path]]` entries parses fine, watches nothing
    /// and emits nothing — the entries **are** the block.
    #[test]
    fn embedded_manifest_declares_the_codex_hooks_file() {
        let m = load_embedded().expect("embedded manifest must parse");
        let codex = m
            .agents
            .iter()
            .find(|a| a.name == "codex-cli")
            .expect("codex-cli agent present");

        let hooks: Vec<&AgentPath> = codex.paths.iter().filter(|p| p.kind == "hooks").collect();
        // TWO files carry Codex's OpenLatch perimeter, and both take
        // `kind = "hooks"`: `hooks.json` holds the hook registrations, and
        // `config.toml` holds the model-relay wiring — the
        // `[model_providers.openlatch]` table and the `model_provider` key that
        // points at it. An edit to either one can disable OpenLatch's
        // monitoring perimeter, which is the criticality this kind encodes.
        //
        // `kind = "hooks"` is load-bearing twice over: `severity_for` maps
        // ("hooks","modified") to Critical and an unrecognised kind falls to
        // Severity::Low, and `build_filtered_body` dispatches on the same key —
        // a `"config"` kind would be a low-severity event whose body the
        // platform 400s.
        let paths: Vec<&String> = hooks.iter().flat_map(|h| h.paths.iter()).collect();
        assert_eq!(
            paths,
            vec![
                &"${CODEX_HOME}/hooks.json".to_string(),
                &"${CODEX_HOME}/config.toml".to_string(),
            ],
            "both Codex perimeter files are watched, got {paths:?}"
        );
        for h in &hooks {
            assert_eq!(h.watch_strategy, WatchStrategy::ExactFile);
            assert!(
                h.json_slice_paths.is_empty(),
                "neither file has a JSON slice to point at — the no-slice shape is what \
                 makes hash_for_kind hash the file itself"
            );
        }
    }

    /// AGT-6 C-4 (AGT-5 C-7, AC-14): OpenCode's block names every candidate
    /// path of C-4 — its config files projected, plugins opaque, commands filed
    /// as `command` — each behind the selector, and never its storage, auth,
    /// logs or cache.
    #[test]
    fn opencode_reads_exactly_the_c4_paths() {
        let m = load_embedded().expect("embedded manifest must parse");
        let opencode = m
            .agents
            .iter()
            .find(|a| a.name == "opencode")
            .expect("opencode agent present");
        let mut templates = Vec::new();
        for ap in &opencode.paths {
            assert!(
                ap.opencode_select,
                "every OpenCode entry is selected: {ap:?}"
            );
            let all: Vec<String> = ap
                .paths
                .iter()
                .chain(ap.paths_relative.iter())
                .chain(ap.paths_glob.iter())
                .chain(ap.paths_glob_relative.iter())
                .cloned()
                .collect();
            for t in &all {
                for banned in [
                    "auth.json",
                    "storage",
                    "opencode.db",
                    "/log",
                    "cache",
                    ".dat",
                    "well-known",
                ] {
                    assert!(!t.contains(banned), "{t} reaches {banned}");
                }
                if t.contains("opencode.json")
                    || t.ends_with("config.json")
                    || t == "${OPENCODE_ENV_CONFIG}"
                    || t.ends_with(".plist")
                {
                    // A settings file is two artifacts: the settings (`hooks`)
                    // and its MCP servers (`mcp`), each through its own
                    // projection (D-12).
                    let want = if ap.kind == "mcp" {
                        Projection::OpencodeMcp
                    } else {
                        Projection::OpencodeConfig
                    };
                    assert_eq!(ap.projection, Some(want), "{t} must be projected");
                }
                if t.contains("plugin") || t.ends_with("package.json") {
                    assert!(ap.opaque, "{t} must be opaque");
                }
                if t.contains("command") {
                    assert_eq!(ap.kind, "command", "{t} is a command");
                }
                if t.contains("agent/") || t.contains("agents/") || t.contains("mode") {
                    assert_eq!(ap.kind, "skill", "{t} is filed as a skill");
                }
            }
            templates.extend(all);
        }
        let mut expected: Vec<String> = [
            "${OPENCODE_DIR}/config.json",
            "${OPENCODE_DIR}/opencode.json",
            "${OPENCODE_DIR}/opencode.jsonc",
            "${OPENCODE_ENV_CONFIG}",
            "${OPENCODE_HOME_DIR}/opencode.json",
            "${OPENCODE_ENV_DIR}/opencode.jsonc",
            "opencode.json",
            ".opencode/opencode.jsonc",
            "${OPENCODE_MANAGED_DIR}/opencode.json",
            "${OPENCODE_MANAGED_PREFS}/ai.opencode.managed.plist",
            ".opencode/package.json",
            ".opencode/plugins/*.[jt]s",
            ".opencode/plugin/*.[jt]s",
            "${OPENCODE_DIR}/AGENTS.md",
            "${OPENCODE_ENV_DIR}/AGENTS.md",
            "${OPENCODE_USER_HOME}/.claude/CLAUDE.md",
            "AGENTS.md",
            "CLAUDE.md",
            "CONTEXT.md",
            "${OPENCODE_USER_HOME}/.claude/skills/**/SKILL.md",
            "${OPENCODE_USER_HOME}/.agents/skills/**/SKILL.md",
            ".opencode/skills/**/SKILL.md",
            ".opencode/skill/**/SKILL.md",
            ".opencode/agent/**/*.md",
            ".opencode/mode/*.md",
            ".opencode/commands/**/*.md",
            ".opencode/command/**/*.md",
            ".claude/skills/**/SKILL.md",
            ".agents/skills/**/SKILL.md",
        ]
        .map(String::from)
        .to_vec();
        for dir in [
            "${OPENCODE_DIR}",
            "${OPENCODE_HOME_DIR}",
            "${OPENCODE_ENV_DIR}",
        ] {
            for rel in [
                "package.json",
                "plugins/*.[jt]s",
                "plugin/*.[jt]s",
                "skills/**/SKILL.md",
                "skill/**/SKILL.md",
                "agents/**/*.md",
                "agent/**/*.md",
                "modes/*.md",
                "mode/*.md",
                "commands/**/*.md",
                "command/**/*.md",
            ] {
                expected.push(format!("{dir}/{rel}"));
            }
        }
        for e in &expected {
            assert!(
                templates.iter().any(|t| t == e),
                "{e} missing from {templates:?}"
            );
        }
        // The `projected == (kind == "mcp")` rule of the other agents' blocks
        // holds for OpenCode's MCP entries (D-12): every one is a projected
        // per-server fan-out. Its settings entries are projected through
        // `projection`, not the `projected` MCP flag.
        for ap in opencode.paths.iter().filter(|ap| ap.kind == "mcp") {
            assert!(ap.projected, "OpenCode MCP servers carry credentials");
            assert!(ap.slice_kind_subpath, "one item per server");
            assert_eq!(ap.projection, Some(Projection::OpencodeMcp));
        }
        assert!(opencode
            .paths
            .iter()
            .all(|ap| ap.projected == (ap.kind == "mcp")));

        // Every settings file is also an `mcp` artifact, under that file's
        // scope: global and the environment roots personal, the project
        // project, managed enterprise.
        let settings_files = |pred: &dyn Fn(&AgentPath) -> bool| -> Vec<String> {
            let mut v: Vec<String> = opencode
                .paths
                .iter()
                .filter(|ap| pred(ap))
                .flat_map(|ap| ap.paths.iter().chain(ap.paths_relative.iter()).cloned())
                .collect();
            v.sort();
            v
        };
        let hooks_settings = settings_files(&|ap: &AgentPath| {
            ap.kind == "hooks" && ap.projection == Some(Projection::OpencodeConfig)
        });
        let mcp_files =
            settings_files(&|ap: &AgentPath| ap.projection == Some(Projection::OpencodeMcp));
        assert_eq!(
            mcp_files, hooks_settings,
            "one mcp artifact per settings file"
        );
        let scope_of = |template: &str| {
            opencode
                .paths
                .iter()
                .filter(|ap| ap.kind == "mcp")
                .find(|ap| {
                    ap.paths
                        .iter()
                        .chain(ap.paths_relative.iter())
                        .any(|t| t == template)
                })
                .and_then(|ap| ap.scope)
        };
        for (template, scope) in [
            ("${OPENCODE_DIR}/opencode.json", ConfigScope::Personal),
            ("${OPENCODE_DIR}/config.json", ConfigScope::Personal),
            ("${OPENCODE_HOME_DIR}/opencode.jsonc", ConfigScope::Personal),
            ("${OPENCODE_ENV_DIR}/opencode.json", ConfigScope::Personal),
            ("${OPENCODE_ENV_CONFIG}", ConfigScope::Personal),
            ("opencode.json", ConfigScope::Project),
            (".opencode/opencode.jsonc", ConfigScope::Project),
            (
                "${OPENCODE_MANAGED_DIR}/opencode.json",
                ConfigScope::Enterprise,
            ),
            (
                "${OPENCODE_MANAGED_PREFS}/ai.opencode.managed.plist",
                ConfigScope::Enterprise,
            ),
        ] {
            assert_eq!(scope_of(template), Some(scope), "{template}");
        }
    }

    /// The managed-preferences directories, as OpenCode looks them up: the
    /// user's first, then the machine's; a user name that is not one path
    /// segment adds nothing. Pure — run on every OS.
    #[test]
    fn opencode_managed_prefs_paths_put_the_user_first() {
        use super::super::opencode_select::{managed_prefs_dirs_for, MANAGED_PLIST_NAME};
        let root = PathBuf::from("/Library/Managed Preferences");
        assert_eq!(
            managed_prefs_dirs_for(Some("alice")),
            vec![root.join("alice"), root.clone()]
        );
        for odd in [None, Some(""), Some(".."), Some("a/b"), Some("a\\b")] {
            assert_eq!(managed_prefs_dirs_for(odd), vec![root.clone()], "{odd:?}");
        }
        assert_eq!(MANAGED_PLIST_NAME, "ai.opencode.managed.plist");
        if !cfg!(target_os = "macos") {
            assert!(
                expand_path_all("${OPENCODE_MANAGED_PREFS}/ai.opencode.managed.plist", None)
                    .is_empty(),
                "managed preferences are read on macOS only"
            );
            assert_eq!(
                expand_path("${OPENCODE_MANAGED_PREFS}/x", None),
                Err(PathExpansionError::Unset("OPENCODE_MANAGED_PREFS".into()))
            );
        } else {
            let got = expand_path_all("${OPENCODE_MANAGED_PREFS}/ai.opencode.managed.plist", None);
            assert_eq!(got.last(), Some(&root.join(MANAGED_PLIST_NAME)));
        }
    }

    /// The OpenCode environment roots expand once per kept report, and not at
    /// all before one names them.
    #[test]
    fn opencode_env_dir_expands_once_per_kept_report() {
        let _serial = super::super::opencode_select::TEST_LOCK
            .lock()
            .unwrap_or_else(|e| e.into_inner());
        super::super::opencode_select::reset_reports();
        let a = std::env::temp_dir().join("oc-a");
        let b = std::env::temp_dir().join("oc-b");
        for dir in [&a, &b] {
            super::super::opencode_select::record(super::super::opencode_select::LoaderEnv {
                config_dir: Some(dir.display().to_string()),
                ..Default::default()
            });
        }
        let got = expand_path_all("${OPENCODE_ENV_DIR}/AGENTS.md", None);
        assert_eq!(got, vec![b.join("AGENTS.md"), a.join("AGENTS.md")]);
        assert_eq!(
            expand_path("${OPENCODE_ENV_DIR}/x", None).unwrap(),
            b.join("x"),
            "the single expansion is the most recent report"
        );
        super::super::opencode_select::reset_reports();
    }

    /// Narrowing keeps each kept agent's block whole and drops the rest.
    #[test]
    fn only_agents_keeps_the_named_agents_whole() {
        let m = load_embedded().expect("embedded manifest must parse");
        let keep: std::collections::HashSet<String> = ["claude-code".to_string()].into();

        let narrowed = m.only_agents(&keep);

        assert_eq!(narrowed.agents.len(), 1);
        assert_eq!(narrowed.agents[0].name, "claude-code");
        let full = m.agents.iter().find(|a| a.name == "claude-code").unwrap();
        assert_eq!(narrowed.agents[0].paths.len(), full.paths.len());
        assert!(m.only_agents(&Default::default()).agents.is_empty());
    }

    /// The `cline` block covers hooks, rules, workflows, skills and its MCP
    /// settings, and nothing else on the PRD's C-6 deny side (as amended): of
    /// `data/` only `settings/cline_mcp_settings.json`, projected — never
    /// `secrets.json`, `providers.json`, `sessions/`, `tasks/` or `db/` — and
    /// no store-level lowercase `hooks/`. Hook scripts are opaque — their
    /// bodies can hold anything and never leave the host.
    #[test]
    fn embedded_manifest_declares_cline_hooks_rules_workflows() {
        let m = load_embedded().expect("embedded manifest must parse");
        let cline = m
            .agents
            .iter()
            .find(|a| a.name == "cline")
            .expect("cline agent present");
        let count = |kind: &str| cline.paths.iter().filter(|p| p.kind == kind).count();

        let hooks: Vec<&AgentPath> = cline.paths.iter().filter(|p| p.kind == "hooks").collect();
        assert_eq!(hooks.len(), 1);
        assert!(hooks[0].opaque, "Cline hook scripts must be opaque");
        assert_eq!(
            count("rules"),
            4,
            "store, asset root, global extras, workspace"
        );
        assert_eq!(
            count("command"),
            3,
            "store, asset root, workspace workflows"
        );
        assert_eq!(count("skill"), 3, "~/.cline, ~/.agents, workspace");

        let mcp: Vec<&str> = cline
            .paths
            .iter()
            .filter(|p| p.kind == "mcp")
            .flat_map(|p| p.paths.iter().map(String::as_str))
            .collect();
        assert_eq!(
            mcp,
            [
                "${CLINE_DATA_DIR}/settings/cline_mcp_settings.json",
                "${VSCODE_USER}/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json",
                "${CURSOR_USER}/globalStorage/saoudrizwan.claude-dev/settings/cline_mcp_settings.json",
            ],
            "the store's data root and the editor extension's"
        );

        for ap in &cline.paths {
            let templates = ap
                .paths
                .iter()
                .chain(ap.paths_glob.iter())
                .chain(ap.paths_glob_relative.iter());
            for template in templates {
                for denied in [
                    "secrets.json",
                    "providers.json",
                    "/sessions",
                    "/tasks",
                    "/db",
                    "/hooks/",
                    "/plugins",
                ] {
                    assert!(
                        !template.contains(denied),
                        "{template} reaches {denied}, outside PRD C-6's allow-list"
                    );
                }
                if template.contains("CLINE_DATA_DIR") || template.contains("/data") {
                    assert!(ap.projected, "{template} is under data/ unprojected");
                }
            }
            assert!(ap.json_slice_paths.is_empty());
            assert_eq!(ap.opaque, ap.kind == "hooks");
            assert_eq!(ap.projected, ap.kind == "mcp");
        }
    }

    #[test]
    fn cline_resolvers_track_the_seams() {
        let root = tempfile::tempdir().expect("seam root");
        let seams = crate::hooks::cline::absent_seams(root.path());
        let _seam = crate::hooks::cline::cline_isolated(
            seams
                .iter()
                .map(|(k, v)| (*k, Some(v.clone().into_os_string()))),
        );

        assert_eq!(
            expand_path("${CLINE_DIR}/rules/a.md", None).unwrap(),
            seams[0].1.join("rules/a.md")
        );
        assert_eq!(
            expand_path("${CLINE_ASSETS_DIR}/Hooks/PreToolUse", None).unwrap(),
            seams[2].1.join("Hooks/PreToolUse")
        );
        assert_eq!(
            expand_path("${CLINE_DATA_DIR}/settings/x.json", None).unwrap(),
            seams[1].1.join("settings/x.json")
        );
    }

    /// `${CURSOR_DIR}` follows the seam `absent_seams` sets beside Cline's —
    /// the same resolver the binding uses, never a second copy of `~/.cursor`.
    #[test]
    fn cursor_resolver_tracks_the_seam() {
        let root = tempfile::tempdir().expect("seam root");
        let seams = crate::hooks::cline::absent_seams(root.path());
        let _seam = crate::hooks::cline::cline_isolated(
            seams
                .iter()
                .map(|(k, v)| (*k, Some(v.clone().into_os_string()))),
        );

        assert_eq!(
            expand_path("${CURSOR_DIR}/hooks.json", None).unwrap(),
            crate::hooks::cursor::absent_seam(root.path())
                .1
                .join("hooks.json")
        );
    }

    fn cursor_block() -> AgentManifest {
        load_embedded()
            .expect("embedded manifest must parse")
            .agents
            .into_iter()
            .find(|a| a.name == "cursor")
            .expect("cursor agent present")
    }

    /// D-23: hooks (user, enterprise, project), projected MCP (personal,
    /// project), rules (project) and skills — within the five kinds the
    /// platform accepts, and nothing it would reject.
    #[test]
    fn embedded_manifest_declares_the_cursor_block() {
        let cursor = cursor_block();
        let count = |kind: &str| cursor.paths.iter().filter(|p| p.kind == kind).count();
        assert_eq!(count("hooks"), 2, "user + enterprise, and project");
        assert_eq!(
            count("mcp"),
            4,
            "personal, project, local plugins and Claude Code plugins"
        );
        assert_eq!(
            count("rules"),
            3,
            ".cursor/rules/*.mdc, .cursorrules and local plugins"
        );
        assert_eq!(
            count("skill"),
            7,
            "~/.cursor, built-in, ~/.agents, ~/.claude, ~/.codex, project, local plugins"
        );
        assert_eq!(cursor.paths.len(), 16, "no kind outside the five");

        let hooks = cursor
            .paths
            .iter()
            .find(|p| p.kind == "hooks" && !p.is_project_scoped())
            .expect("user hooks entry");
        assert_eq!(
            hooks.paths,
            [
                "${CURSOR_DIR}/hooks.json",
                "${CURSOR_ENTERPRISE_DIR}/hooks.json"
            ]
        );
        for ap in &cursor.paths {
            assert_eq!(ap.projected, ap.kind == "mcp", "MCP carries credentials");
            assert!(ap.json_slice_paths.is_empty());
            assert!(!ap.opaque);
        }
        for ap in cursor.paths.iter().filter(|p| p.kind == "mcp") {
            assert!(ap.slice_kind_subpath);
            assert!(
                ap.scope.is_some(),
                "MCP entries declare their precedence tier"
            );
        }
    }

    /// Workspace AGENTS.md is read by every agent (Claude Code when no
    /// CLAUDE.md is present), so every block declares it: each agent reports
    /// its own copy, and a block that left it out would hide that agent's.
    #[test]
    fn workspace_agents_md_is_declared_by_every_reader() {
        let m = load_embedded().unwrap();
        let readers: Vec<&str> = m
            .agents
            .iter()
            .filter(|a| {
                a.paths.iter().any(|p| {
                    p.is_project_scoped() && p.paths_relative.iter().any(|r| r == "AGENTS.md")
                })
            })
            .map(|a| a.name.as_str())
            .collect();
        assert_eq!(
            readers,
            ["claude-code", "codex-cli", "cline", "cursor", "opencode"]
        );
    }

    /// Codex CLI's instructions, skills, MCP servers and command rules, at the
    /// locations its documentation gives and the ones a stock install uses.
    #[test]
    fn embedded_manifest_declares_codex_rules_skills_and_mcp() {
        let m = load_embedded().unwrap();
        let codex = m.agents.iter().find(|a| a.name == "codex-cli").unwrap();
        let declares = |kind: &str, template: &str| {
            codex.paths.iter().any(|p| {
                p.kind == kind
                    && (p.paths.iter().any(|t| t == template)
                        || p.paths_glob.as_deref() == Some(template)
                        || p.paths_relative.iter().any(|t| t == template)
                        || p.paths_glob_relative.iter().any(|t| t == template))
            })
        };
        assert!(declares("rules", "${CODEX_HOME}/AGENTS.md"));
        assert!(declares("rules", "${CODEX_HOME}/AGENTS.override.md"));
        assert!(declares("rules", "AGENTS.override.md"));
        assert!(declares("skill", "${HOME}/.agents/skills/*/SKILL.md"));
        assert!(declares("skill", "/etc/codex/skills/*/SKILL.md"));
        assert!(declares("skill", ".agents/skills/*/SKILL.md"));
        assert!(declares("mcp", "${CODEX_HOME}/config.toml"));
        assert!(declares("mcp", ".codex/config.toml"));
        // Where a stock install actually keeps its skills, MCP servers and
        // command rules.
        assert!(declares("skill", "${CODEX_HOME}/skills/*/SKILL.md"));
        assert!(declares("skill", "${CODEX_HOME}/skills/.system/*/SKILL.md"));
        assert!(declares(
            "skill",
            "${CODEX_HOME}/plugins/cache/*/*/*/skills/*/SKILL.md"
        ));
        assert!(declares(
            "mcp",
            "${CODEX_HOME}/plugins/cache/*/*/*/.mcp.json"
        ));
        assert!(declares("rules", "${CODEX_HOME}/rules/*.rules"));
        assert!(declares("rules", ".codex/rules/*.rules"));
        for ap in codex.paths.iter().filter(|p| p.kind == "mcp") {
            assert!(ap.projected, "Codex MCP servers carry credentials");
            assert!(ap.slice_kind_subpath);
        }
    }

    /// A relative path without a project scope falls into the user-scope walk,
    /// which never resolves it: every relative Cursor entry is project-scoped.
    #[test]
    fn cursor_relative_blocks_are_project_scoped() {
        for ap in &cursor_block().paths {
            if !ap.paths_relative.is_empty() || !ap.paths_glob_relative.is_empty() {
                assert!(
                    ap.is_project_scoped(),
                    "{:?} is relative but not project-scoped",
                    ap.paths_relative
                );
                assert!(ap.paths.is_empty() && ap.paths_glob.is_none());
            }
        }
    }

    /// Every path the Cursor block can resolve — absolute, glob or
    /// project-relative — stays out of `~/.cursor/projects/` (transcripts) and
    /// `~/.cursor/chats/`.
    #[test]
    fn cursor_manifest_never_resolves_transcripts() {
        let root = tempfile::tempdir().expect("seam root");
        let seams = crate::hooks::cline::absent_seams(root.path());
        let _seam = crate::hooks::cline::cline_isolated(
            seams
                .iter()
                .map(|(k, v)| (*k, Some(v.clone().into_os_string()))),
        );
        let cursor_root = crate::hooks::cursor::absent_seam(root.path()).1;
        let project = root.path().join("project");
        let denied = [
            cursor_root.join("projects"),
            cursor_root.join("chats"),
            project.join(".cursor").join("projects"),
            project.join(".cursor").join("chats"),
        ];

        let mut resolved: Vec<PathBuf> = Vec::new();
        for ap in &cursor_block().paths {
            for template in ap.paths.iter().chain(ap.paths_glob.iter()) {
                if let Ok(p) = expand_path(template, None) {
                    resolved.push(p);
                }
            }
            for rel in ap
                .paths_relative
                .iter()
                .chain(ap.paths_glob_relative.iter())
            {
                resolved.push(project.join(rel));
            }
        }
        assert!(
            resolved.iter().any(|p| p.starts_with(&cursor_root)),
            "the premise: the block resolves under the seam: {resolved:?}"
        );
        for path in &resolved {
            for deny in &denied {
                assert!(
                    !path.starts_with(deny),
                    "{} is under {}",
                    path.display(),
                    deny.display()
                );
            }
            let text = path.to_string_lossy();
            assert!(!text.contains("transcript"), "{text}");
        }
    }

    /// `${CURSOR_ENTERPRISE_DIR}` is `hooks::cursor::enterprise_dir()` — one
    /// definition for the monitor and `doctor`.
    #[test]
    fn cursor_enterprise_resolver_is_the_one_definition() {
        match crate::hooks::cursor::enterprise_dir() {
            Some(dir) => assert_eq!(
                expand_path("${CURSOR_ENTERPRISE_DIR}/hooks.json", None).unwrap(),
                dir.join("hooks.json")
            ),
            None => assert!(expand_path("${CURSOR_ENTERPRISE_DIR}/hooks.json", None).is_err()),
        }
    }

    /// The bare form is a resolver, not an env read: `${env:CLAUDE_CONFIG_DIR}`
    /// fails the whole template when the variable is unset, which is why the
    /// manifest cannot use it for a path that must also work by default.
    #[test]
    fn claude_config_dir_resolver_is_not_the_env_form() {
        let _lock = crate::daemon::identity::ENV_LOCK.blocking_lock();
        let _env = crate::daemon::identity::test_support::EnvGuard::clear();

        assert!(expand_path("${CLAUDE_CONFIG_DIR}/settings.json", None).is_ok());
        assert_eq!(
            expand_path("${env:CLAUDE_CONFIG_DIR}/settings.json", None).unwrap_err(),
            PathExpansionError::EnvVarMissing("CLAUDE_CONFIG_DIR".into())
        );
    }

    #[test]
    fn expand_path_home() {
        let p = expand_path("${HOME}/.claude/.mcp.json", None).unwrap();
        let home = dirs::home_dir().unwrap();
        assert_eq!(p, home.join(".claude").join(".mcp.json"));
    }

    #[test]
    fn expand_path_cursor_user() {
        let p = expand_path("${CURSOR_USER}/globalStorage", None).unwrap();
        let config = dirs::config_dir().unwrap();
        assert_eq!(p, config.join("Cursor").join("User").join("globalStorage"));
    }

    #[test]
    fn expand_path_no_vars_returns_input() {
        let p = expand_path("/etc/openlatch/config.toml", None).unwrap();
        assert_eq!(p, PathBuf::from("/etc/openlatch/config.toml"));
    }

    #[test]
    fn expand_path_project_without_root_errors() {
        let err = expand_path("${PROJECT}/.claude/CLAUDE.md", None).unwrap_err();
        assert_eq!(err, PathExpansionError::ProjectScopeWithoutRoot);
    }

    #[test]
    fn expand_path_project_with_root() {
        let root = PathBuf::from("/tmp/myproject");
        let p = expand_path("${PROJECT}/.claude/CLAUDE.md", Some(&root)).unwrap();
        assert_eq!(p, root.join(".claude").join("CLAUDE.md"));
    }

    #[test]
    fn expand_path_env_var_present() {
        // SAFETY: tests that mutate process env are inherently global; pick a
        // unique name to avoid colliding with concurrent tests.
        let key = "OPENLATCH_TEST_EXPAND_PATH_PRESENT";
        std::env::set_var(key, "/x/y");
        let p = expand_path(&format!("${{env:{key}}}/file"), None).unwrap();
        std::env::remove_var(key);
        assert_eq!(p, PathBuf::from("/x/y/file"));
    }

    #[test]
    fn expand_path_env_var_missing() {
        let key = "OPENLATCH_TEST_EXPAND_PATH_MISSING";
        std::env::remove_var(key);
        let err = expand_path(&format!("${{env:{key}}}/file"), None).unwrap_err();
        assert_eq!(err, PathExpansionError::EnvVarMissing(key.into()));
    }

    #[test]
    fn expand_path_unknown_variable() {
        let err = expand_path("${NOPE}/file", None).unwrap_err();
        assert_eq!(err, PathExpansionError::UnknownVariable("NOPE".into()));
    }

    #[test]
    fn expand_path_unterminated_variable() {
        let err = expand_path("${HOME/file", None).unwrap_err();
        assert!(matches!(err, PathExpansionError::UnterminatedVariable(_)));
    }

    #[test]
    fn expand_path_openlatch_dir() {
        let p = expand_path("${OPENLATCH_DIR}/state.json", None).unwrap();
        let expected = crate::config::openlatch_dir().join("state.json");
        assert_eq!(p, expected);
    }

    #[test]
    fn parse_str_invalid_toml_reports_source() {
        let err = parse_str("not toml = =", "fixture").unwrap_err();
        match err {
            ManifestError::ParseFailed(source, _) => assert_eq!(source, "fixture"),
            _ => panic!("expected ParseFailed"),
        }
    }

    #[test]
    fn watch_strategy_round_trip() {
        let raw = r#"
            [[agent]]
            name = "demo"
            [[agent.path]]
            kind = "mcp"
            paths = ["/tmp/x.json"]
            watch_strategy = "exact_file"
        "#;
        let m: Manifest = toml::from_str(raw).unwrap();
        assert_eq!(
            m.agents[0].paths[0].watch_strategy,
            WatchStrategy::ExactFile
        );
    }

    #[test]
    fn config_scope_round_trip() {
        for (variant, wire) in [
            (ConfigScope::Enterprise, "enterprise"),
            (ConfigScope::Personal, "personal"),
            (ConfigScope::Project, "project"),
            (ConfigScope::Local, "local"),
        ] {
            let s = serde_json::to_string(&variant).unwrap();
            assert_eq!(s, format!("\"{wire}\""));
            let parsed: ConfigScope = serde_json::from_str(&s).unwrap();
            assert_eq!(parsed, variant);
            assert_eq!(variant.as_str(), wire);
        }
    }

    #[test]
    fn config_scope_parsed_from_toml() {
        let raw = r#"
            [[agent]]
            name = "demo"
            [[agent.path]]
            kind = "mcp"
            scope = "personal"
            paths = ["/tmp/x.json"]
            watch_strategy = "exact_file"
        "#;
        let m: Manifest = toml::from_str(raw).unwrap();
        assert_eq!(m.agents[0].paths[0].scope, Some(ConfigScope::Personal));
    }

    #[test]
    fn config_scope_rejects_unknown_variant() {
        let raw = r#"
            [[agent]]
            name = "demo"
            [[agent.path]]
            kind = "mcp"
            scope = "bogus"
            paths = ["/tmp/x.json"]
            watch_strategy = "exact_file"
        "#;
        let err = parse_str(raw, "fixture").unwrap_err();
        assert!(matches!(err, ManifestError::ParseFailed(_, _)));
    }

    #[test]
    fn expand_path_system_claude_dir() {
        let p = expand_path("${SYSTEM_CLAUDE_DIR}/mcp.json", None).unwrap();
        // Final component must be the literal we appended.
        assert_eq!(p.file_name().and_then(|s| s.to_str()), Some("mcp.json"));
        let parent = p
            .parent()
            .expect("system claude dir resolves to a non-empty path");
        #[cfg(target_os = "linux")]
        assert_eq!(parent, std::path::Path::new("/etc/claude-code"));
        #[cfg(target_os = "macos")]
        assert_eq!(
            parent,
            std::path::Path::new("/Library/Application Support/Claude")
        );
        #[cfg(target_os = "windows")]
        {
            // ProgramData base is env-resolved at runtime; just verify the
            // resolved dir ends with the `Claude` segment.
            assert_eq!(
                parent.file_name().and_then(|s| s.to_str()),
                Some("Claude"),
                "{}",
                parent.display()
            );
        }
    }
}