supercode-core 0.2.1

//! P5-3 (COMPOSABLE-HARNESS-DESIGN.md §2 module 9 `subagents`): spawn tool,
//! native-write lineage, foreground result-join, background+C6, resource
//! bounds, and monotonic posture — driven end to end through
//! `Agent::send`.
//!
//! **LIVE-AGENT-TEST SAFETY (non-negotiable, per the build brief).** Every
//! test in this file drives `Agent`/child `Agent`s through a scripted MOCK
//! `Provider` (the same `ScriptedProvider` idiom `tests/agent_loop.rs` and
//! `tests/model_switch.rs` already use) — never a real model endpoint, real
//! coding-CLI, or real termfleet provider. A subagent spawn creates a real
//! child agent LOOP; pairing that with a real billed provider in a test
//! would spawn a real billed agent, which is forbidden. Every `Provider`
//! implementation below is a plain in-memory state machine with `assert!`s
//! encoding the exact expected call shape — no network, no subprocess, no
//! cost.

use std::sync::atomic::{AtomicUsize, Ordering};
use std::sync::{Arc, Mutex};

use async_trait::async_trait;
use supercode::session::{Session, SessionSource};
use supercode::store::SessionStore;
use supercode::subagents::{BackgroundPromptsPolicy, NamedAgentDefinition};
use supercode::tools::SandboxPolicy;
use supercode::{
    Agent, ChatMessage, ChatRequest, Config, Error, FunctionCall, Provider, Role, ToolCall, Usage,
};

fn temp_store() -> (Arc<SessionStore>, std::path::PathBuf) {
    static N: AtomicUsize = AtomicUsize::new(0);
    let dir = std::env::temp_dir().join(format!(
        "supercode-subagents-test-{}-{}",
        std::process::id(),
        N.fetch_add(1, Ordering::SeqCst)
    ));
    (Arc::new(SessionStore::open(&dir).unwrap()), dir)
}

fn tool_call(id: &str, name: &str, args: serde_json::Value) -> ToolCall {
    ToolCall {
        id: id.to_string(),
        kind: "function".to_string(),
        function: FunctionCall {
            name: name.to_string(),
            arguments: args.to_string(),
        },
    }
}

fn assistant_with_calls(calls: Vec<ToolCall>) -> ChatMessage {
    ChatMessage {
        role: Role::Assistant,
        content: None,
        content_parts: None,
        tool_calls: Some(calls),
        tool_call_id: None,
        name: None,
        metadata: Default::default(),
    }
}

fn last_tool_content(req: &ChatRequest) -> String {
    let last = req.messages.last().expect("at least one message");
    assert_eq!(
        last.role,
        Role::Tool,
        "expected the last message to be a tool result"
    );
    last.content.clone().unwrap_or_default()
}

// ---------------------------------------------------------------------------
// 1. Default-off: byte-identical to today's no-subagents behavior.
// ---------------------------------------------------------------------------

struct PlainProvider;
#[async_trait]
impl Provider for PlainProvider {
    async fn complete(
        &self,
        _req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        Ok((ChatMessage::assistant("ok"), Usage::default()))
    }
}

#[tokio::test]
async fn default_off_never_advertises_spawn_subagent() {
    let config = Config::builder().build();
    let agent = Agent::with_provider(config, Box::new(PlainProvider));
    let schemas = agent.tool_schemas();
    let names: Vec<&str> = schemas.iter().map(|s| s.name.as_str()).collect();
    assert!(!names.contains(&"spawn_subagent"));
    assert!(!names.contains(&"subagent_status"));
}

#[tokio::test]
async fn default_off_agent_still_answers_normally() {
    let config = Config::builder().build();
    let mut agent = Agent::with_provider(config, Box::new(PlainProvider));
    let reply = agent.send("hi").await.unwrap();
    assert_eq!(reply, "ok");
}

// ---------------------------------------------------------------------------
// 2. Foreground spawn: result join + native-write lineage/transcript,
//    proven lossless through the store.
// ---------------------------------------------------------------------------

struct ForegroundJoinProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for ForegroundJoinProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => {
                assert!(req.tools.iter().any(|t| t.name == "spawn_subagent"));
                Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_1",
                        "spawn_subagent",
                        serde_json::json!({"task": "say hi"}),
                    )]),
                    Usage::default(),
                ))
            }
            1 => {
                // The CHILD's own first turn: a fresh conversation with no
                // memory of the parent's system prompt other than what was
                // passed as `task`.
                assert_eq!(req.messages.len(), 2, "system + user only");
                assert_eq!(req.messages[1].content.as_deref(), Some("say hi"));
                Ok((
                    ChatMessage::assistant("hello from the child"),
                    Usage::default(),
                ))
            }
            2 => {
                assert_eq!(last_tool_content(req), "hello from the child");
                Ok((ChatMessage::assistant("parent done"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn foreground_spawn_joins_child_result_and_persists_lossless_lineage_transcript() {
    let config = Config::builder().subagents_enabled(true).build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ForegroundJoinProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let (store, dir) = temp_store();
    store.save("parent-sess", "t", "[]").unwrap();
    agent.set_subagent_store(store.clone(), "parent-sess");

    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");

    // D5: the child's transcript + lineage landed in the store, folded
    // under the parent session's own `.subagents/` family member.
    let ids = store.list_subagent_ids("parent-sess").unwrap();
    assert_eq!(ids.len(), 1, "exactly one child spawned");
    let child_id = &ids[0];

    let lineage = store
        .load_subagent_lineage("parent-sess", child_id)
        .unwrap()
        .expect("lineage persisted");
    assert_eq!(lineage.parent_tool_use_id, "call_1");
    assert_eq!(lineage.parent_session_id.as_deref(), Some("parent-sess"));
    assert_eq!(lineage.depth, 1);
    assert_eq!(lineage.task, "say hi");
    assert!(!lineage.background);

    // §1.13 lossless proof: the persisted sidecar round-trips through
    // Session::from_native_str with the SAME lineage AND the child's own
    // conversation content intact.
    let sidecar = store
        .load_subagent_transcript("parent-sess", child_id)
        .unwrap()
        .expect("transcript persisted");
    let parsed = Session::from_native_str(&sidecar).unwrap();
    assert_eq!(parsed.meta.agent_id.as_deref(), Some(child_id.as_str()));
    assert_eq!(parsed.meta.parent_tool_use_id.as_deref(), Some("call_1"));
    assert_eq!(
        parsed.meta.lineage.get("parent_thread_id"),
        Some(&"parent-sess".to_string())
    );
    let texts: Vec<String> = parsed
        .messages
        .iter()
        .filter_map(|m| m.content.clone())
        .collect();
    assert!(texts.iter().any(|t| t == "say hi"));
    assert!(texts.iter().any(|t| t == "hello from the child"));

    let _ = std::fs::remove_dir_all(&dir);
}

// ---------------------------------------------------------------------------
// 3/4. Named agent definitions.
// ---------------------------------------------------------------------------

struct NamedDefProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for NamedDefProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "find x", "agent_type": "researcher"}),
                )]),
                Usage::default(),
            )),
            1 => {
                assert_eq!(
                    req.messages[0].content.as_deref(),
                    Some("You are a researcher.")
                );
                Ok((ChatMessage::assistant("found it"), Usage::default()))
            }
            2 => {
                assert_eq!(last_tool_content(req), "found it");
                Ok((ChatMessage::assistant("done"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn named_agent_type_uses_its_own_system_prompt() {
    let config = Config::builder()
        .subagents_enabled(true)
        .subagent_definition(NamedAgentDefinition {
            name: "researcher".to_string(),
            system_prompt: "You are a researcher.".to_string(),
            tools: None,
            model: None,
        })
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(NamedDefProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "done");
}

struct ClaudeAgentAliasProvider {
    calls: AtomicUsize,
}

#[async_trait]
impl Provider for ClaudeAgentAliasProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => {
                assert!(req.tools.iter().any(|tool| tool.name == "Agent"));
                Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_claude_agent",
                        "Agent",
                        serde_json::json!({
                            "prompt": "run the pilot drill",
                            "subagent_type": "pilot-tick",
                            "model": "sonnet",
                            "run_in_background": false
                        }),
                    )]),
                    Usage::default(),
                ))
            }
            1 => {
                assert_eq!(req.model, "anthropic/claude-sonnet-4-6");
                assert_eq!(req.messages[0].content.as_deref(), Some("Pilot exactly."));
                assert_eq!(
                    req.messages[1].content.as_deref(),
                    Some("run the pilot drill")
                );
                Ok((ChatMessage::assistant("pilot complete"), Usage::default()))
            }
            2 => {
                assert_eq!(last_tool_content(req), "pilot complete");
                Ok((ChatMessage::assistant("done"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn claude_agent_alias_translates_names_and_resolves_child_model() {
    let config = Config::builder()
        .model("z-ai/glm-5.2")
        .subagents_enabled(true)
        .subagents_claude_agent_alias(true)
        .subagent_definition(NamedAgentDefinition {
            name: "pilot-tick".to_string(),
            system_prompt: "Pilot exactly.".to_string(),
            tools: None,
            model: Some("anthropic/claude-sonnet-4-6".to_string()),
        })
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ClaudeAgentAliasProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    assert_eq!(agent.send("continue").await.unwrap(), "done");
}

struct ClaudeGeneralPurposeProvider {
    calls: AtomicUsize,
}

#[async_trait]
impl Provider for ClaudeGeneralPurposeProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_general",
                    "Agent",
                    serde_json::json!({
                        "prompt": "do general work",
                        "subagent_type": "general-purpose",
                        "run_in_background": false
                    }),
                )]),
                Usage::default(),
            )),
            1 => {
                assert_eq!(req.messages[1].content.as_deref(), Some("do general work"));
                Ok((ChatMessage::assistant("general complete"), Usage::default()))
            }
            2 => {
                assert_eq!(last_tool_content(req), "general complete");
                Ok((ChatMessage::assistant("done"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn claude_general_purpose_agent_maps_to_an_ad_hoc_child() {
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_claude_agent_alias(true)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ClaudeGeneralPurposeProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    assert_eq!(agent.send("continue").await.unwrap(), "done");
}

struct UnknownAgentTypeProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for UnknownAgentTypeProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "x", "agent_type": "does-not-exist"}),
                )]),
                Usage::default(),
            )),
            1 => {
                let content = last_tool_content(req);
                assert!(
                    content.contains("unknown subagent agent_type"),
                    "content: {content}"
                );
                Ok((ChatMessage::assistant("handled"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn unknown_agent_type_is_refused_with_a_named_error() {
    let config = Config::builder().subagents_enabled(true).build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(UnknownAgentTypeProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "handled");
}

// ---------------------------------------------------------------------------
// 5. Depth cap: fail-closed, named error.
// ---------------------------------------------------------------------------

struct DepthCapProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for DepthCapProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go"}),
                )]),
                Usage::default(),
            )),
            1 => {
                // The child (now at depth 1, max_depth=1) tries to spawn
                // its own child — must be refused.
                Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_2",
                        "spawn_subagent",
                        serde_json::json!({"task": "nested"}),
                    )]),
                    Usage::default(),
                ))
            }
            2 => {
                let content = last_tool_content(req);
                assert!(
                    content.contains("SubagentDepthExceeded") || content.contains("would exceed"),
                    "content: {content}"
                );
                Ok((
                    ChatMessage::assistant("nested spawn correctly refused"),
                    Usage::default(),
                ))
            }
            3 => {
                assert_eq!(last_tool_content(req), "nested spawn correctly refused");
                Ok((ChatMessage::assistant("parent finished"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn depth_cap_refuses_a_nested_spawn_past_max_depth() {
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_max_depth(1)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(DepthCapProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent finished");
}

/// The depth cap is a config-level knob (§3.1 `capabilities.subagents.max_depth`):
/// depth 0 (a top-level agent) with `max_depth = 0` refuses EVERY spawn, and
/// `max_depth = N` allows exactly N levels — both directly exercise
/// `crate::subagents::check_depth`'s arithmetic at the `Error` surface a
/// caller actually sees.
#[tokio::test]
async fn zero_max_depth_refuses_the_very_first_spawn() {
    struct ZeroDepthProvider {
        calls: AtomicUsize,
    }
    #[async_trait]
    impl Provider for ZeroDepthProvider {
        async fn complete(
            &self,
            req: &ChatRequest,
            _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
        ) -> supercode::Result<(ChatMessage, Usage)> {
            match self.calls.fetch_add(1, Ordering::SeqCst) {
                0 => Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_1",
                        "spawn_subagent",
                        serde_json::json!({"task": "go"}),
                    )]),
                    Usage::default(),
                )),
                1 => {
                    let content = last_tool_content(req);
                    assert!(content.contains("would exceed"), "content: {content}");
                    Ok((
                        ChatMessage::assistant("refused immediately"),
                        Usage::default(),
                    ))
                }
                n => panic!("unexpected call {n}"),
            }
        }
    }
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_max_depth(0)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ZeroDepthProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "refused immediately");
}

// ---------------------------------------------------------------------------
// 6. Concurrency cap: fail-closed, named error, never a stray held slot.
// ---------------------------------------------------------------------------

struct ConcurrencyCapProvider {
    calls: AtomicUsize,
    /// Never notified in this test — a background child whose `system_prompt`
    /// carries this marker blocks forever, so its concurrency slot is
    /// PROVABLY still held for the rest of the test (no race with the real
    /// scheduler: the block point is a `Notify::notified().await` this test
    /// never signals).
    block_forever: Arc<tokio::sync::Notify>,
}
#[async_trait]
impl Provider for ConcurrencyCapProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("BLOCK_FOREVER") {
            self.block_forever.notified().await;
            unreachable!("test never signals this notify");
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![
                    tool_call(
                        "call_1",
                        "spawn_subagent",
                        serde_json::json!({
                            "task": "block",
                            "system_prompt": "BLOCK_FOREVER",
                            "background": true
                        }),
                    ),
                    tool_call(
                        "call_2",
                        "spawn_subagent",
                        serde_json::json!({"task": "second"}),
                    ),
                ]),
                Usage::default(),
            )),
            1 => {
                // Two tool results now sit at the tail, in call order.
                let n = req.messages.len();
                let first = req.messages[n - 2].content.clone().unwrap_or_default();
                let second = req.messages[n - 1].content.clone().unwrap_or_default();
                assert!(first.contains("\"status\":\"spawned\""), "first: {first}");
                assert!(
                    second.contains("SubagentConcurrencyExceeded")
                        || second.contains("already running"),
                    "second: {second}"
                );
                Ok((ChatMessage::assistant("both handled"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn concurrency_cap_refuses_a_spawn_past_max_concurrent() {
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_max_depth(2)
        .subagents_max_concurrent(1)
        .subagents_background(true)
        .subagents_background_prompts(BackgroundPromptsPolicy::AutoPolicy)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ConcurrencyCapProvider {
            calls: AtomicUsize::new(0),
            block_forever: Arc::new(tokio::sync::Notify::new()),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "both handled");
}

// ---------------------------------------------------------------------------
// 7. Background spawn + status poll to completion.
// ---------------------------------------------------------------------------

struct BackgroundStatusProvider {
    calls: AtomicUsize,
    captured_id: Mutex<Option<String>>,
}
#[async_trait]
impl Provider for BackgroundStatusProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        // Note on ordering: a BACKGROUND `spawn_subagent` call returns
        // immediately (the child runs via `tokio::spawn`, never awaited
        // inline) — nothing in the parent's own remaining turns yields
        // control back to the scheduler in a way that would let the mock
        // (fully synchronous, no real I/O) child actually run. So the
        // parent's whole first `send()` (calls 0-1) completes BEFORE the
        // child ever gets its first poll; the child's own turn (call 2)
        // only happens once the TEST explicitly yields after that `send()`
        // returns. The second `send()` (calls 3-4) polls the by-then-
        // finished child.
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "bg task", "background": true}),
                )]),
                Usage::default(),
            )),
            1 => {
                let content = last_tool_content(req);
                let v: serde_json::Value = serde_json::from_str(&content).unwrap();
                assert_eq!(v["status"], "spawned");
                *self.captured_id.lock().unwrap() =
                    Some(v["subagent_id"].as_str().unwrap().to_string());
                Ok((ChatMessage::assistant("spawned"), Usage::default()))
            }
            2 => Ok((ChatMessage::assistant("bg done"), Usage::default())),
            3 => {
                let id = self.captured_id.lock().unwrap().clone().unwrap();
                Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_2",
                        "subagent_status",
                        serde_json::json!({"subagent_id": id}),
                    )]),
                    Usage::default(),
                ))
            }
            4 => {
                let content = last_tool_content(req);
                let v: serde_json::Value = serde_json::from_str(&content).unwrap();
                assert_eq!(v["status"], "done", "content: {content}");
                assert_eq!(v["result"], "bg done");
                Ok((ChatMessage::assistant("poll complete"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn background_spawn_returns_immediately_then_status_polls_to_done() {
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_background(true)
        .subagents_background_prompts(BackgroundPromptsPolicy::AutoPolicy)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(BackgroundStatusProvider {
            calls: AtomicUsize::new(0),
            captured_id: Mutex::new(None),
        }),
    );
    let reply = tokio::time::timeout(std::time::Duration::from_secs(10), agent.send("start"))
        .await
        .expect("must not hang")
        .unwrap();
    assert_eq!(reply, "spawned");

    // Give the (already-spawned, already-fast) background task every
    // opportunity to run to completion on this current-thread runtime
    // before polling it — cooperative, not a sleep: each yield just lets
    // any READY task make progress; there is no real I/O for it to wait on.
    for _ in 0..200 {
        tokio::task::yield_now().await;
    }

    let reply = tokio::time::timeout(std::time::Duration::from_secs(10), agent.send("check"))
        .await
        .expect("must not hang")
        .unwrap();
    assert_eq!(reply, "poll complete");
}

// ---------------------------------------------------------------------------
// 8/9. §2.2 C6: background requires an auto-policy; refused otherwise.
// ---------------------------------------------------------------------------

struct SpawnOnceProvider {
    args: serde_json::Value,
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for SpawnOnceProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    self.args.clone(),
                )]),
                Usage::default(),
            )),
            1 => {
                let content = last_tool_content(req);
                Ok((ChatMessage::assistant(content), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn background_spawn_without_a_configured_policy_is_refused_c6() {
    // Hand-built Config (bypassing the configfile resolver's own C6 check,
    // §2.2/§3.5 step 6) — proves the RUNTIME independently enforces C6, not
    // just the resolver.
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_background(true)
        // Deliberately NOT calling `.subagents_background_prompts(..)`.
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(SpawnOnceProvider {
            args: serde_json::json!({"task": "x", "background": true}),
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert!(
        reply.contains("SubagentBackgroundPolicyMissing") || reply.contains("background_prompts"),
        "reply: {reply}"
    );
}

#[tokio::test]
async fn background_spawn_with_background_module_off_is_refused() {
    let config = Config::builder().subagents_enabled(true).build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(SpawnOnceProvider {
            args: serde_json::json!({"task": "x", "background": true}),
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert!(
        reply.contains("capabilities.subagents.background"),
        "reply: {reply}"
    );
}

// ---------------------------------------------------------------------------
// 10/11. §2.2 C6 background policy ENFORCEMENT: a background child's tool
// approvals route through auto_policy/parent, never an interactive prompt
// that can't be answered — proven by never hanging (bounded `timeout`) and
// by checking the concrete resolution each policy produces.
// ---------------------------------------------------------------------------

struct C6PolicyProvider {
    calls: AtomicUsize,
    captured_id: Mutex<Option<String>>,
}
#[async_trait]
impl Provider for C6PolicyProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "try bash", "background": true}),
                )]),
                Usage::default(),
            )),
            1 => {
                let content = last_tool_content(req);
                let v: serde_json::Value = serde_json::from_str(&content).unwrap();
                assert_eq!(v["status"], "spawned");
                *self.captured_id.lock().unwrap() =
                    Some(v["subagent_id"].as_str().unwrap().to_string());
                Ok((ChatMessage::assistant("spawn kicked off"), Usage::default()))
            }
            // ---- from here on, calls belong to the CHILD's own
            // conversation (the parent already finished above; nothing
            // yields control back to the background task until the test
            // explicitly does so after `send()` returns) ----
            2 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_bash",
                    "bash",
                    serde_json::json!({"command": "echo hi"}),
                )]),
                Usage::default(),
            )),
            3 => {
                let content = last_tool_content(req);
                assert!(
                    content.contains("not approved"),
                    "an Ask-tier bash call under a background child must fail closed \
                     (never an interactive prompt it can't answer): {content}"
                );
                Ok((ChatMessage::assistant(content), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

fn c6_test_config(policy: BackgroundPromptsPolicy) -> Config {
    let mut config = Config::builder()
        .subagents_enabled(true)
        .subagents_background(true)
        .subagents_background_prompts(policy)
        .build();
    // Force `bash` to the engine's Ask tier so a background child's call
    // reaches the interactive-decision seam this test proves never
    // actually goes interactive.
    config.permissions_enabled = true;
    config.permissions_ask_patterns = vec!["bash".to_string()];
    config
}

#[tokio::test]
async fn background_auto_policy_denies_without_ever_hanging() {
    let config = c6_test_config(BackgroundPromptsPolicy::AutoPolicy);
    let mut agent = Agent::with_provider(
        config,
        Box::new(C6PolicyProvider {
            calls: AtomicUsize::new(0),
            captured_id: Mutex::new(None),
        }),
    );
    let reply = tokio::time::timeout(std::time::Duration::from_secs(10), agent.send("start"))
        .await
        .expect("must not hang")
        .unwrap();
    assert_eq!(reply, "spawn kicked off");

    // Let the background child run its (now fully scripted) turns.
    for _ in 0..200 {
        tokio::task::yield_now().await;
    }
    // auto_policy NEVER queues to the parent — that's the "parent" policy's
    // job. No handler at all is installed, so the engine's pre-existing
    // fail-closed default (`resolve_ask` with `None`) denies directly.
    assert!(agent.pending_child_approvals().is_empty());
}

#[tokio::test]
async fn background_parent_policy_queues_the_denied_request_without_hanging() {
    let config = c6_test_config(BackgroundPromptsPolicy::Parent);
    let mut agent = Agent::with_provider(
        config,
        Box::new(C6PolicyProvider {
            calls: AtomicUsize::new(0),
            captured_id: Mutex::new(None),
        }),
    );
    let reply = tokio::time::timeout(std::time::Duration::from_secs(10), agent.send("start"))
        .await
        .expect("must not hang")
        .unwrap();
    assert_eq!(reply, "spawn kicked off");

    for _ in 0..200 {
        tokio::task::yield_now().await;
    }
    let pending = agent.pending_child_approvals();
    assert_eq!(
        pending.len(),
        1,
        "the child's bash call must be queued exactly once"
    );
    assert_eq!(pending[0].tool, "bash");
    let expected_id = agent
        .pending_child_approvals()
        .first()
        .map(|q| q.child_agent_id.clone());
    assert!(expected_id.is_some());
}

// ---------------------------------------------------------------------------
// 12. Monotonic posture: a spawned child never gets a looser sandbox or a
// wider tool surface than its parent.
// ---------------------------------------------------------------------------

struct MonotonicPostureProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for MonotonicPostureProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "try to escalate"}),
                )]),
                Usage::default(),
            )),
            1 => {
                // The CHILD's own first request: the parent had `bash`
                // disabled — a widened child would advertise it anyway.
                assert!(
                    !req.tools.iter().any(|t| t.name == "bash"),
                    "child must not regain a tool its parent disabled: {:?}",
                    req.tools.iter().map(|t| &t.name).collect::<Vec<_>>()
                );
                // Attempt a write despite the parent's `ReadOnly` sandbox —
                // this call is FOREGROUND (no tokio::spawn boundary), so a
                // failed assertion here fails the test directly.
                Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_write",
                        "write_file",
                        serde_json::json!({"path": "escape.txt", "content": "pwn"}),
                    )]),
                    Usage::default(),
                ))
            }
            2 => {
                let content = last_tool_content(req);
                assert!(
                    content.contains("read-only") || content.contains("read only"),
                    "child must inherit the parent's ReadOnly sandbox, never widen it: {content}"
                );
                Ok((
                    ChatMessage::assistant("could not escalate"),
                    Usage::default(),
                ))
            }
            3 => {
                assert_eq!(last_tool_content(req), "could not escalate");
                Ok((
                    ChatMessage::assistant("parent confirms containment"),
                    Usage::default(),
                ))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

#[tokio::test]
async fn monotonic_posture_child_cannot_escalate_sandbox_or_tools() {
    let config = Config::builder()
        .subagents_enabled(true)
        .sandbox(SandboxPolicy::ReadOnly)
        .disable_tool("bash")
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(MonotonicPostureProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent confirms containment");
}

// ---------------------------------------------------------------------------
// 13. Safety hardening (Fable-5 review, MEDIUM-LOW "orphaned billed spend"):
// dropping the parent must abort a still-running BACKGROUND child rather
// than leaving it detached, running to completion against the (mock)
// provider with nobody watching.
// ---------------------------------------------------------------------------

struct DropAbortProvider {
    calls: AtomicUsize,
    /// Incremented once per CHILD turn (identified by its system-prompt
    /// marker), with a real `yield_now().await` right after — giving the
    /// cooperative single-threaded test runtime genuine scheduling points
    /// to interleave the test driver's own progress (including the parent
    /// drop) between the child's turns, instead of running the child's
    /// effectively-unbounded loop to completion inside one
    /// uninterruptible poll.
    child_turns: Arc<AtomicUsize>,
}
#[async_trait]
impl Provider for DropAbortProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("LOOP_FOREVER") {
            self.child_turns.fetch_add(1, Ordering::SeqCst);
            tokio::task::yield_now().await;
            // An unregistered tool name: `run_tool` refuses it with a
            // plain error result and the child's loop simply continues to
            // the next turn — an effectively unbounded sequence of turns,
            // bounded only by `max_iterations` (set enormous below), never
            // by anything this mock does.
            return Ok((
                assistant_with_calls(vec![tool_call(
                    "loop_call",
                    "definitely_not_a_real_tool",
                    serde_json::json!({}),
                )]),
                Usage::default(),
            ));
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({
                        "task": "loop forever",
                        "system_prompt": "LOOP_FOREVER",
                        "background": true
                    }),
                )]),
                Usage::default(),
            )),
            1 => Ok((ChatMessage::assistant("spawned ok"), Usage::default())),
            n => panic!("unexpected parent call {n}"),
        }
    }
}

async fn yield_many(n: usize) {
    for _ in 0..n {
        tokio::task::yield_now().await;
    }
}

/// Fail-on-revert: without `impl Drop for Agent` aborting still-running
/// background children, this test observes `after_drop > before_drop` (the
/// mock's `yield_now`-driven loop keeps advancing after the parent is
/// gone) instead of the counter holding steady.
#[tokio::test]
async fn dropping_the_parent_aborts_a_still_running_background_child() {
    let child_turns = Arc::new(AtomicUsize::new(0));
    let config = Config::builder()
        .subagents_enabled(true)
        .subagents_background(true)
        .subagents_background_prompts(BackgroundPromptsPolicy::AutoPolicy)
        .max_iterations(1_000_000)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(DropAbortProvider {
            calls: AtomicUsize::new(0),
            child_turns: child_turns.clone(),
        }),
    );
    let reply = tokio::time::timeout(std::time::Duration::from_secs(10), agent.send("start"))
        .await
        .expect("must not hang")
        .unwrap();
    assert_eq!(reply, "spawned ok");

    // Wait (bounded) until the background child has made real, OBSERVABLE
    // progress — proving it was genuinely running, not merely
    // never-scheduled — before the parent ever drops.
    let before_drop = tokio::time::timeout(std::time::Duration::from_secs(10), async {
        loop {
            yield_many(50).await;
            let n = child_turns.load(Ordering::SeqCst);
            if n > 0 {
                return n;
            }
        }
    })
    .await
    .expect("the background child must make progress before the parent drops");

    drop(agent);

    // Give the runtime every remaining opportunity to advance the (now
    // aborted) child task, if it were somehow still alive — the count must
    // never move again.
    let mut last = before_drop;
    for _ in 0..20 {
        yield_many(50).await;
        let n = child_turns.load(Ordering::SeqCst);
        assert_eq!(
            n, last,
            "an aborted background child must not issue any further provider \
             turns after its parent is dropped"
        );
        last = n;
    }
}

// ---------------------------------------------------------------------------
// 14. Safety hardening (Fable-5 review, LOW-MEDIUM "child safety-limit
// inheritance"): a spawned child must inherit its parent's safety-limit
// fields verbatim, never silently defaulting looser.
// ---------------------------------------------------------------------------

struct MaxTokensInheritProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for MaxTokensInheritProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go"}),
                )]),
                Usage::default(),
            )),
            1 => {
                // The CHILD's own first request.
                assert_eq!(
                    req.max_tokens,
                    Some(777),
                    "the child's own request must carry the parent's max_tokens verbatim"
                );
                Ok((ChatMessage::assistant("child done"), Usage::default()))
            }
            2 => {
                assert_eq!(last_tool_content(req), "child done");
                Ok((ChatMessage::assistant("parent done"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

/// Fail-on-revert: without `child.max_tokens = self.config.max_tokens;` in
/// `build_child_config`, the child's request carries `max_tokens: None`
/// (`Config::default()`'s value) instead of the parent's `Some(777)`.
#[tokio::test]
async fn max_tokens_is_inherited_by_the_child() {
    let config = Config::builder()
        .subagents_enabled(true)
        .max_tokens(777)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(MaxTokensInheritProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");
}

struct MaxTotalOutputTokensInheritProvider {
    calls: AtomicUsize,
    child_turns: Arc<AtomicUsize>,
}
#[async_trait]
impl Provider for MaxTotalOutputTokensInheritProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("BUDGET_CHILD") {
            self.child_turns.fetch_add(1, Ordering::SeqCst);
            // A tool call plus enough output tokens to exceed the
            // (inherited) budget of 1 the instant this first turn lands.
            return Ok((
                assistant_with_calls(vec![tool_call(
                    "child_call",
                    "definitely_not_a_real_tool",
                    serde_json::json!({}),
                )]),
                Usage {
                    completion_tokens: 5,
                    ..Usage::default()
                },
            ));
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go", "system_prompt": "BUDGET_CHILD"}),
                )]),
                Usage::default(),
            )),
            1 => Ok((ChatMessage::assistant("parent done"), Usage::default())),
            n => panic!("unexpected parent call {n}"),
        }
    }
}

/// Fail-on-revert: without `child.max_total_output_tokens = ...` in
/// `build_child_config`, the child defaults to an unbounded budget and
/// would take a SECOND turn (attempting — and failing on — the
/// unregistered tool, then asking again) instead of stopping after
/// exactly one.
#[tokio::test]
async fn max_total_output_tokens_is_inherited_by_the_child() {
    let child_turns = Arc::new(AtomicUsize::new(0));
    let config = Config::builder()
        .subagents_enabled(true)
        .max_total_output_tokens(1)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(MaxTotalOutputTokensInheritProvider {
            calls: AtomicUsize::new(0),
            child_turns: child_turns.clone(),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");
    assert_eq!(
        child_turns.load(Ordering::SeqCst),
        1,
        "the child must inherit the parent's max_total_output_tokens and stop after one turn"
    );
}

struct MaxToolOutputBytesInheritProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for MaxToolOutputBytesInheritProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("BASH_CHILD") {
            if req.messages.len() == 2 {
                // The child's first turn: ask for a real ~300-byte
                // command output.
                return Ok((
                    assistant_with_calls(vec![tool_call(
                        "bash_call",
                        "bash",
                        serde_json::json!({"command": "yes x | head -c 300"}),
                    )]),
                    Usage::default(),
                ));
            }
            // The child's second turn: its own tool result is now in
            // `req.messages` — capped if the (inherited) 50-byte limit is
            // honored, or the full ~300 bytes if not.
            let content = last_tool_content(req);
            assert!(
                content.contains("truncated"),
                "the child must inherit the parent's max_tool_output_bytes cap: {content}"
            );
            assert!(
                content.len() < 300,
                "an uncapped child would carry the full ~300-byte echo: {content}"
            );
            return Ok((ChatMessage::assistant("child done"), Usage::default()));
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go", "system_prompt": "BASH_CHILD"}),
                )]),
                Usage::default(),
            )),
            1 => {
                assert_eq!(last_tool_content(req), "child done");
                Ok((ChatMessage::assistant("parent done"), Usage::default()))
            }
            n => panic!("unexpected parent call {n}"),
        }
    }
}

/// Fail-on-revert: without `child.max_tool_output_bytes = ...` in
/// `build_child_config`, the child defaults to `Some(100_000)`
/// (`Config::default()`'s value) — an uncapped ~300-byte echo would sail
/// through untouched instead of getting truncated at 50 bytes.
#[tokio::test]
async fn max_tool_output_bytes_is_inherited_by_the_child() {
    let config = Config::builder()
        .subagents_enabled(true)
        .max_tool_output_bytes(50)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(MaxToolOutputBytesInheritProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");
}

struct DoomLoopInheritProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for DoomLoopInheritProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("DOOM_CHILD") {
            return match req.messages.len() {
                2 => Ok((
                    assistant_with_calls(vec![tool_call(
                        "call_a",
                        "bash",
                        serde_json::json!({"command": "echo hi"}),
                    )]),
                    Usage::default(),
                )),
                4 => {
                    // The FIRST call already ran once above — repeat it
                    // byte-for-byte to trip the (inherited) threshold=2
                    // breaker on this SECOND consecutive identical call.
                    Ok((
                        assistant_with_calls(vec![tool_call(
                            "call_b",
                            "bash",
                            serde_json::json!({"command": "echo hi"}),
                        )]),
                        Usage::default(),
                    ))
                }
                _ => {
                    let content = last_tool_content(req);
                    assert!(
                        content.contains("doom-loop breaker"),
                        "the child must inherit the parent's doom_loop_threshold: {content}"
                    );
                    Ok((ChatMessage::assistant("child done"), Usage::default()))
                }
            };
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go", "system_prompt": "DOOM_CHILD"}),
                )]),
                Usage::default(),
            )),
            1 => {
                assert_eq!(last_tool_content(req), "child done");
                Ok((ChatMessage::assistant("parent done"), Usage::default()))
            }
            n => panic!("unexpected parent call {n}"),
        }
    }
}

/// Fail-on-revert: without `child.doom_loop_threshold = ...` in
/// `build_child_config`, the child defaults to `None` (breaker off) and
/// the second identical `bash` call would actually run again instead of
/// being refused.
#[tokio::test]
async fn doom_loop_threshold_is_inherited_by_the_child() {
    let config = Config::builder()
        .subagents_enabled(true)
        .doom_loop_threshold(2)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(DoomLoopInheritProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");
}

struct EditFileRequireReadInheritProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for EditFileRequireReadInheritProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        if req.messages[0].content.as_deref() == Some("EDIT_CHILD") {
            if req.messages.len() == 2 {
                // The child's first turn: edit a path it never `read_file`d
                // first, in its own fresh conversation (a brand-new
                // history — the parent having read it, if it ever did,
                // carries no weight here).
                return Ok((
                    assistant_with_calls(vec![tool_call(
                        "edit_call",
                        "edit_file",
                        serde_json::json!({
                            "path": "never-read.txt",
                            "old_string": "hello",
                            "new_string": "world",
                        }),
                    )]),
                    Usage::default(),
                ));
            }
            let content = last_tool_content(req);
            assert!(
                content.contains("must be read with"),
                "the child must inherit the parent's edit_file_require_read_before_edit: {content}"
            );
            return Ok((ChatMessage::assistant("child done"), Usage::default()));
        }
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "spawn_subagent",
                    serde_json::json!({"task": "go", "system_prompt": "EDIT_CHILD"}),
                )]),
                Usage::default(),
            )),
            1 => {
                assert_eq!(last_tool_content(req), "child done");
                Ok((ChatMessage::assistant("parent done"), Usage::default()))
            }
            n => panic!("unexpected parent call {n}"),
        }
    }
}

/// Fail-on-revert: without `child.edit_file_require_read_before_edit = ...`
/// in `build_child_config`, the child defaults to `false` and the blind
/// edit would succeed instead of being refused.
#[tokio::test]
async fn edit_file_require_read_before_edit_is_inherited_by_the_child() {
    let config = Config::builder()
        .subagents_enabled(true)
        .edit_file_require_read_before_edit(true)
        .build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(EditFileRequireReadInheritProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");
}

// ---------------------------------------------------------------------------
// 15. Safety hardening (Fable-5 review, LOW "wrong error when disabled"):
// `subagent_status` must not intercept when subagents are disabled — a
// hallucinated call falls through to the plain unknown-tool error, byte-
// identical to `spawn_subagent`'s already-correct disabled behavior (and to
// pre-P5-3 behavior for both).
// ---------------------------------------------------------------------------

struct SubagentStatusWhenDisabledProvider {
    calls: AtomicUsize,
}
#[async_trait]
impl Provider for SubagentStatusWhenDisabledProvider {
    async fn complete(
        &self,
        req: &ChatRequest,
        _on_delta: &(dyn for<'a> Fn(&'a str) + Send + Sync),
    ) -> supercode::Result<(ChatMessage, Usage)> {
        match self.calls.fetch_add(1, Ordering::SeqCst) {
            0 => Ok((
                assistant_with_calls(vec![tool_call(
                    "call_1",
                    "subagent_status",
                    serde_json::json!({"subagent_id": "agent-bogus"}),
                )]),
                Usage::default(),
            )),
            1 => {
                let content = last_tool_content(req);
                assert_eq!(
                    content, "Error: model requested unknown tool: subagent_status",
                    "must be byte-identical to spawn_subagent's own disabled-path error text"
                );
                assert!(
                    !content.contains("unknown subagent id"),
                    "a disabled `subagent_status` call must not fall through to \
                     `Error::SubagentNotFound` — that would wrongly imply subagents \
                     are on but this particular id is bogus: {content}"
                );
                Ok((ChatMessage::assistant("handled"), Usage::default()))
            }
            n => panic!("unexpected call {n}"),
        }
    }
}

/// Fail-on-revert: before this fix, `run_subagent_status` intercepted
/// unconditionally regardless of `subagents_enabled`, so this hallucinated
/// call would resolve against the (always-empty, subagents off)
/// `background_subagents` map and return `Error::SubagentNotFound`'s
/// "unknown subagent id `agent-bogus`" text instead.
#[tokio::test]
async fn subagent_status_when_disabled_returns_unknown_tool_not_unknown_subagent_id() {
    // `subagents_enabled` defaults to `false` — deliberately NOT calling
    // `.subagents_enabled(true)`.
    let config = Config::builder().build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(SubagentStatusWhenDisabledProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "handled");
}

// ---------------------------------------------------------------------------
// 16. Safety hardening (Fable-5 review, LOW "translation-fidelity
// cosmetic"): a native-spawned child's persisted sidecar identifies its
// OWN source correctly (`SessionSource::Native`), never mislabeled as an
// imported Claude Code session.
// ---------------------------------------------------------------------------

/// Fail-on-revert: before this fix, `persist_subagent_transcript` built its
/// blank `Session` via `Session::from_claude_code_str("")` and never
/// corrected `meta.source` afterward, so both the on-disk header's
/// `"source"` field and the round-tripped `Session::meta.source` read
/// `SessionSource::ClaudeCode` — a native `spawn_subagent` child
/// mislabeled as an imported CC transcript.
#[tokio::test]
async fn native_spawned_child_transcript_round_trips_with_the_native_source_not_claude_code() {
    let config = Config::builder().subagents_enabled(true).build();
    let mut agent = Agent::with_provider(
        config,
        Box::new(ForegroundJoinProvider {
            calls: AtomicUsize::new(0),
        }),
    );
    let (store, dir) = temp_store();
    store.save("parent-sess-native", "t", "[]").unwrap();
    agent.set_subagent_store(store.clone(), "parent-sess-native");

    let reply = agent.send("start").await.unwrap();
    assert_eq!(reply, "parent done");

    let ids = store.list_subagent_ids("parent-sess-native").unwrap();
    assert_eq!(ids.len(), 1, "exactly one child spawned");
    let child_id = &ids[0];

    let sidecar = store
        .load_subagent_transcript("parent-sess-native", child_id)
        .unwrap()
        .expect("transcript persisted");
    let header_line = sidecar.lines().next().expect("at least a header line");
    assert!(
        header_line.contains("\"source\":\"native\""),
        "header: {header_line}"
    );
    assert!(
        !header_line.contains("\"source\":\"claude_code\""),
        "a native spawn must never be labeled claude_code on disk: {header_line}"
    );

    let parsed = Session::from_native_str(&sidecar).unwrap();
    assert_eq!(parsed.meta.source, SessionSource::Native);

    let _ = std::fs::remove_dir_all(&dir);
}

// ---------------------------------------------------------------------------
// Sanity: the `Error` variants this module introduces are constructible and
// render the fields they claim to (a cheap, no-mock proof the Display text
// the tests above grep for is the SAME text `agent.rs` actually returns —
// not a coincidental substring).
// ---------------------------------------------------------------------------

#[test]
fn subagent_error_variants_render_the_documented_text() {
    let e = Error::SubagentDepthExceeded {
        max_depth: 2,
        attempted_depth: 3,
    };
    assert!(e.to_string().contains("max_depth=2"));
    assert!(e.to_string().contains("depth 3"));

    let e = Error::SubagentConcurrencyExceeded { max_concurrent: 4 };
    assert!(e.to_string().contains("4 subagent(s) already running"));

    let e = Error::SubagentBackgroundPolicyMissing;
    assert!(e.to_string().contains("background_prompts"));

    let e = Error::SubagentDefinitionNotFound("bogus".to_string());
    assert!(e
        .to_string()
        .contains("unknown subagent agent_type `bogus`"));

    let e = Error::SubagentNotFound("agent-x".to_string());
    assert!(e.to_string().contains("unknown subagent id `agent-x`"));
}