termaxa 0.11.4

use crate::audit::{now, AuditEntry, AuditLog};
use crate::context;
use crate::policy::{Action, Policy};
use anyhow::Result;
use serde_json::json;
use std::io::Read;

/// Which agent is calling us. Detected from the input's shape, so
/// `termaxa hook` is ONE command that speaks every agent's dialect.
#[derive(Debug, Clone, Copy, PartialEq)]
pub enum Dialect {
    /// Claude Code PreToolUse: {"tool_name":"Bash","tool_input":{"command":...}}
    /// -> {"hookSpecificOutput":{"permissionDecision":...}}
    ClaudeCode,
    /// Cursor beforeShellExecution (v1.7+): {"hook_event_name":"beforeShellExecution","command":...}
    /// -> {"permission":..., "agent_message":...}
    Cursor,
    /// OpenAI Codex CLI: same PreToolUse/hookSpecificOutput shape as Claude Code,
    /// but the event self-identifies as codex via `agent` / hook_event_name.
    Codex,
    /// GitHub Copilot CLI: {"toolName":"shell","toolArgs":"{\"command\":...}"}
    /// -> bare {"permissionDecision":..., "permissionDecisionReason":...} (no wrapper)
    Copilot,
}

pub struct ParsedHook {
    pub dialect: Dialect,
    pub command: String,
    pub cwd: String,
    pub session: Option<String>,
    /// True for post-execution events (afterShellExecution / postToolUse /
    /// PostToolUse): the command already ran, so this is a receipt, not a gate.
    pub is_post: bool,
}

/// Raw JSON in -> normalized hook event out. None = not for us; step aside.

/// Normalize a URI-style path to a native one.
/// Cursor emits workspace roots like "/c:/Users/User/code/proj" on Windows;
/// convert to "c:/Users/User/code/proj" (which Rust's Path handles fine).
/// On Unix, a leading-slash path is already native, so leave it alone.
fn normalize_uri_path(p: &str) -> String {
    // "/c:/..." -> "c:/..."  (strip the leading slash before a drive letter)
    let bytes = p.as_bytes();
    if bytes.len() >= 3 && bytes[0] == b'/' && bytes[2] == b':' && bytes[1].is_ascii_alphabetic() {
        return p[1..].to_string();
    }
    p.to_string()
}

pub fn parse_input(raw: &str) -> Option<ParsedHook> {
    // Cursor (and some Windows shells) prepend a UTF-8 BOM; strip it or the
    // JSON parse fails on the leading bytes.
    let raw = raw.trim_start_matches('\u{feff}').trim();
    let v: serde_json::Value = serde_json::from_str(raw).ok()?;
    let s = |k: &str| v.get(k).and_then(|x| x.as_str()).map(str::to_string);

    // Event name, lowercased for version-tolerant matching. Cursor renamed its
    // hooks between versions: older builds sent `beforeShellExecution` /
    // `afterShellExecution`; Cursor 3.11+ sends `preToolUse` / `postToolUse`
    // (camelCase) with `tool_name:"Shell"`. Claude Code sends `PreToolUse` /
    // `PostToolUse`. Match all of them case-insensitively.
    let event = s("hook_event_name").map(|e| e.to_lowercase());
    let is_pre = matches!(
        event.as_deref(),
        Some("pretooluse") | Some("beforeshellexecution")
    );
    let is_post = matches!(
        event.as_deref(),
        Some("posttooluse") | Some("aftershellexecution")
    );

    // Cursor identifies itself several ways across versions: `cursor_version`
    // (3.11+), `tool_name:"Shell"` + `conversation_id` (3.11+), OR the legacy
    // `beforeShellExecution`/`afterShellExecution` event names (older builds,
    // which no other agent uses). Detect all so every Cursor version routes here.
    let is_cursor = v.get("cursor_version").is_some()
        || matches!(
            event.as_deref(),
            Some("beforeshellexecution") | Some("aftershellexecution")
        )
        || (s("tool_name").as_deref() == Some("Shell") && v.get("conversation_id").is_some());

    // Command from either top-level `command` (old Cursor) or
    // `tool_input.command` (Claude/Codex/Cursor 3.11).
    let command_from = || -> String {
        if let Some(c) = s("command") {
            return c;
        }
        v.get("tool_input")
            .and_then(|t| t.get("command"))
            .and_then(|c| c.as_str())
            .unwrap_or("")
            .to_string()
    };

    // cwd: prefer explicit non-empty top-level cwd, then tool_input.cwd, then
    // the first workspace root (URI-normalized for Windows drive paths).
    let resolve_cwd = || -> String {
        let top = s("cwd").unwrap_or_default();
        if !top.is_empty() {
            return top;
        }
        let ti = v
            .get("tool_input")
            .and_then(|t| t.get("cwd"))
            .and_then(|c| c.as_str())
            .unwrap_or("")
            .to_string();
        if !ti.is_empty() {
            return ti;
        }
        v.get("workspace_roots")
            .and_then(|w| w.as_array())
            .and_then(|a| a.first())
            .and_then(|x| x.as_str())
            .map(normalize_uri_path)
            .unwrap_or_default()
    };

    // ---- Cursor (any version): pre gates, post is a receipt ----
    if is_cursor && (is_pre || is_post) {
        let command = command_from();
        if command.is_empty() {
            return None;
        }
        return Some(ParsedHook {
            dialect: Dialect::Cursor,
            command,
            cwd: resolve_cwd(),
            session: s("conversation_id").or_else(|| s("session_id")),
            is_post,
        });
    }

    // ---- Copilot CLI: toolName + toolArgs (a JSON *string* holding the args) ----
    if let Some(tool) = s("toolName") {
        if tool == "shell" || tool == "bash" || tool == "run_in_terminal" {
            let args_val = match v.get("toolArgs") {
                Some(serde_json::Value::String(st)) => {
                    serde_json::from_str::<serde_json::Value>(st).unwrap_or(serde_json::Value::Null)
                }
                Some(other) => other.clone(),
                None => serde_json::Value::Null,
            };
            let command = args_val
                .get("command")
                .and_then(|c| c.as_str())
                .unwrap_or("")
                .to_string();
            if command.is_empty() {
                return None;
            }
            return Some(ParsedHook {
                dialect: Dialect::Copilot,
                command,
                cwd: s("cwd")
                    .or_else(|| s("workingDirectory"))
                    .unwrap_or_default(),
                session: s("sessionId").or_else(|| s("session_id")),
                is_post,
            });
        }
    }

    // ---- Claude Code & Codex: PreToolUse/PostToolUse + tool_input.command ----
    // (Cursor already handled above, so a bare tool_name:"Bash" here is Claude/Codex.)
    if s("tool_name").as_deref() == Some("Bash") || is_pre || is_post {
        let command = v
            .get("tool_input")
            .and_then(|t| t.get("command"))
            .and_then(|c| c.as_str())
            .unwrap_or("")
            .to_string();
        if command.is_empty() {
            return None;
        }
        let looks_codex = s("agent")
            .map(|a| a.to_lowercase().contains("codex"))
            .unwrap_or(false)
            || s("source")
                .map(|a| a.to_lowercase().contains("codex"))
                .unwrap_or(false);
        return Some(ParsedHook {
            dialect: if looks_codex {
                Dialect::Codex
            } else {
                Dialect::ClaudeCode
            },
            command,
            cwd: s("cwd").unwrap_or_default(),
            session: s("session_id").or_else(|| s("conversation_id")),
            is_post,
        });
    }

    None
}

/// Decision -> the JSON each agent expects on stdout.
pub fn render_response(dialect: Dialect, permission: &str, reason: &str) -> String {
    match dialect {
        Dialect::ClaudeCode => json!({
            "hookSpecificOutput": {
                "hookEventName": "PreToolUse",
                "permissionDecision": permission,
                "permissionDecisionReason": reason,
            }
        })
        .to_string(),
        // Official docs use snake_case; early builds used camelCase. Emit both —
        // unknown keys are ignored, and this survives either Cursor version.
        Dialect::Cursor => json!({
            "permission": permission,
            "agent_message": reason,
            "user_message": reason,
            "agentMessage": reason,
            "userMessage": reason,
        })
        .to_string(),
        // Codex uses the same PreToolUse/hookSpecificOutput contract as Claude Code.
        Dialect::Codex => json!({
            "hookSpecificOutput": {
                "hookEventName": "PreToolUse",
                "permissionDecision": permission,
                "permissionDecisionReason": reason,
            }
        })
        .to_string(),
        // Copilot CLI expects the decision at the top level (no hookSpecificOutput wrapper).
        Dialect::Copilot => json!({
            "permissionDecision": permission,
            "permissionDecisionReason": reason,
        })
        .to_string(),
    }
}

/// Run as a Claude Code PreToolUse hook.
///
/// Reads the hook event JSON from stdin and prints a JSON decision:
///   allow -> permissionDecision "allow"  (command runs without prompting)
///   ask   -> permissionDecision "ask"    (Claude Code shows its own approval prompt)
///   deny  -> permissionDecision "deny"   (blocked; reason is fed back to the model)
///
/// Non-Bash tools and unparsable input fall through with no decision
/// (exit 0, no output), leaving Claude Code's normal permission flow intact.
pub fn run() -> Result<()> {
    let mut buf = String::new();
    std::io::stdin().read_to_string(&mut buf)?;

    // Diagnostic: set TERMAXA_HOOK_DEBUG=<path> to capture exactly what the
    // agent delivered (raw stdin + argv). Invaluable for debugging Windows
    // hook invocation where stdin delivery varies by agent.
    if let Ok(dbg) = std::env::var("TERMAXA_HOOK_DEBUG") {
        use std::io::Write as _;
        if let Ok(mut f) = std::fs::OpenOptions::new()
            .create(true)
            .append(true)
            .open(&dbg)
        {
            let argv: Vec<String> = std::env::args().collect();
            let _ = writeln!(
                f,
                "--- {} ---\nARGV: {:?}\nSTDIN_LEN: {}\nSTDIN: {}\n",
                now().1,
                argv,
                buf.len(),
                buf
            );
        }
    }

    let input = match parse_input(&buf) {
        Some(p) => p,
        None => return Ok(()), // not for us; stay out of the way
    };
    let command = input.command.clone();

    // Post-execution event: the command already ran. Record a receipt
    // (source "post") so the circuit breaker can exclude human-approved
    // commands from the retry threshold (decision #13). No policy eval, no
    // gating, no output — append and exit.
    if input.is_post {
        let start_dir = if !input.cwd.is_empty() && std::path::Path::new(&input.cwd).is_dir() {
            std::path::PathBuf::from(&input.cwd)
        } else {
            std::env::current_dir().unwrap_or_default()
        };
        if let Ok(paths) = crate::paths::resolve_from(&start_dir) {
            if let Ok(log) = AuditLog::new(&paths.state_dir) {
                let (ts_ms, ts) = now();
                let _ = log.append(&AuditEntry {
                    ts_ms,
                    ts,
                    source: "post".into(),
                    command: command.clone(),
                    decision: "executed".into(),
                    matched_rule: None,
                    reason: "post-execution receipt".into(),
                    signals: vec![],
                    escalated: false,
                    session: input.session.clone(),
                    backup: None,
                    preview: None,
                    intent: crate::intent::classify_command(&command)
                        .map(|i| i.label().to_string()),
                    approved: Some(true),
                    exit_code: None,
                    cwd: input.cwd.clone(),
                });
            }
        }
        return Ok(());
    }

    // Post-execution event: the command already ran. Record a receipt
    // (source "post") so the circuit breaker can exclude human-approved
    // commands from the retry threshold (decision #13). No policy eval, no
    // gating, no output — just append and exit.
    if input.is_post {
        let start_dir = if !input.cwd.is_empty() && std::path::Path::new(&input.cwd).is_dir() {
            std::path::PathBuf::from(&input.cwd)
        } else {
            std::env::current_dir().unwrap_or_default()
        };
        if let Ok(paths) = crate::paths::resolve_from(&start_dir) {
            if let Ok(log) = AuditLog::new(&paths.state_dir) {
                let (ts_ms, ts) = now();
                let _ = log.append(&AuditEntry {
                    ts_ms,
                    ts,
                    source: "post".into(),
                    command: command.clone(),
                    decision: "executed".into(),
                    matched_rule: None,
                    reason: "post-execution receipt".into(),
                    signals: vec![],
                    escalated: false,
                    session: input.session.clone(),
                    backup: None,
                    preview: None,
                    intent: crate::intent::classify_command(&command)
                        .map(|i| i.label().to_string()),
                    approved: Some(true),
                    exit_code: None,
                    cwd: input.cwd.clone(),
                });
            }
        }
        return Ok(());
    }

    // Agents spawn the hook with an arbitrary working directory, but they tell us
    // the real project dir in the payload's `cwd`. Resolve the policy explicitly
    // from THAT path rather than mutating the global process cwd (which would make
    // any later relative-path logic ambiguous). This bug affected every agent; it
    // only surfaced with Cursor because Claude Code happened to spawn hooks inside
    // the project dir, masking the incorrect assumption.
    let start_dir = if !input.cwd.is_empty() && std::path::Path::new(&input.cwd).is_dir() {
        std::path::PathBuf::from(&input.cwd)
    } else {
        std::env::current_dir().unwrap_or_default()
    };
    let paths = crate::paths::resolve_from(&start_dir)?;

    // One-line resolution trace (reviewer request): set TERMAXA_HOOK_DEBUG to a
    // file path and this records exactly what got resolved, so future debugging
    // is minutes not hours.
    if let Ok(dbg) = std::env::var("TERMAXA_HOOK_DEBUG") {
        use std::io::Write as _;
        if let Ok(mut f) = std::fs::OpenOptions::new()
            .create(true)
            .append(true)
            .open(&dbg)
        {
            let _ = writeln!(
                f,
                "[{}] dialect={:?} process_cwd={:?} payload_cwd={:?} resolved_policy={}",
                now().1,
                input.dialect,
                std::env::current_dir().ok(),
                input.cwd,
                paths.policy_file().display()
            );
        }
    }

    let policy = Policy::load(&paths.policy_file())?;

    let base = policy.evaluate_command(&command);
    let signals = context::gather(&command);
    let (mut decision, escalated) = context::apply(base, &signals);

    // Destructive-intent classification (v0.11) — recorded on every entry so
    // the breaker can count attempts without re-parsing history.
    let intent_label = crate::intent::classify_command(&command).map(|i| i.label().to_string());

    // Session circuit breaker: repeated destructive intent in one session
    // escalates ask -> deny. Only ASK is ever touched — explicit allow/deny
    // rules are deliberate user policy. Runs BEFORE the backup step so a
    // breaker-denied command never triggers insurance (nothing will run).
    if decision.action == Action::Ask {
        let log_path = paths.state_dir.join("logs").join("audit.jsonl");
        if let Some((_intent, _prior, reason)) = crate::intent::maybe_trip(
            &paths.policy_file(),
            &log_path,
            input.session.as_deref(),
            &command,
        ) {
            decision = crate::policy::Decision {
                action: Action::Deny,
                matched_rule: Some(crate::intent::BREAKER_RULE.to_string()),
                reason,
            };
        }
    }

    let preview_summary = crate::preview::generate(&command).map(|p| p.summary);

    // Insure before allowing: PreToolUse runs before execution, so a backup
    // taken here is guaranteed to predate the command. Never for deny.
    let mut backup_id: Option<String> = None;
    if decision.action != Action::Deny {
        if let Ok(Some(rec)) = crate::backup::take(&paths.state_dir, &command) {
            backup_id = Some(rec.id);
        }
    }

    // Audit first, decide second: even denied attempts are part of the record.
    if let Ok(log) = AuditLog::new(&paths.state_dir) {
        let (ts_ms, ts) = now();
        let _ = log.append(&AuditEntry {
            ts_ms,
            ts,
            source: "hook".into(),
            command: command.clone(),
            decision: decision.action.to_string(),
            matched_rule: decision.matched_rule.clone(),
            reason: decision.reason.clone(),
            signals: signals.iter().map(|s| s.label.clone()).collect(),
            escalated,
            session: input.session.clone(),
            backup: backup_id.clone(),
            preview: preview_summary.clone(),
            intent: intent_label.clone(),
            approved: None,
            exit_code: None,
            cwd: input.cwd.clone(),
        });
    }

    let permission = match decision.action {
        Action::Allow => "allow",
        Action::Ask => "ask",
        Action::Deny => "deny",
    };

    let mut reason = format!("[termaxa] {}", decision.reason);
    if escalated {
        reason.push_str(" (context-escalated)");
    }
    if matches!(decision.action, Action::Ask | Action::Deny) {
        if let Some(s) = &preview_summary {
            reason.push_str(&format!(" | {}", s));
        }
    }
    if let Some(id) = &backup_id {
        reason.push_str(&format!(" | backup {}", id));
    }

    crate::notify::maybe_send(
        &policy,
        &decision.action.to_string(),
        &command,
        &decision.reason,
        "hook",
    );

    println!("{}", render_response(input.dialect, permission, &reason));

    // Belt and suspenders: Cursor and Copilot also honor the process exit code
    // (2 = block). On Windows especially, stdout JSON delivery can be finicky,
    // so a denied command exits non-zero to guarantee the block lands.
    use std::io::Write as _;
    let _ = std::io::stdout().flush();
    if decision.action == Action::Deny {
        std::process::exit(2);
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn cursor_real_payload_uses_workspace_roots_when_cwd_empty() {
        // The EXACT shape Cursor 3.10 sends on Windows: empty cwd, path in
        // workspace_roots as a URI, plus a UTF-8 BOM prefix.
        let raw = "\u{feff}{\"command\":\"rm -rf .cursor .git\",\"cwd\":\"\",\"hook_event_name\":\"beforeShellExecution\",\"workspace_roots\":[\"/c:/Users/User/code/proj\"],\"conversation_id\":\"c9\"}";
        let p = parse_input(raw).expect("must parse Cursor payload with BOM + empty cwd");
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "rm -rf .cursor .git");
        // cwd must be recovered from workspace_roots, normalized off the URI slash
        assert_eq!(p.cwd, "c:/Users/User/code/proj");
    }

    #[test]
    fn normalize_uri_path_handles_windows_and_unix() {
        assert_eq!(normalize_uri_path("/c:/Users/x"), "c:/Users/x");
        assert_eq!(normalize_uri_path("/home/user/proj"), "/home/user/proj"); // unix untouched
        assert_eq!(normalize_uri_path("c:/already/native"), "c:/already/native");
    }

    #[test]
    fn bom_prefixed_json_still_parses() {
        let raw = "\u{feff}{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":\"ls\"}}";
        assert_eq!(parse_input(raw).unwrap().command, "ls");
    }

    #[test]
    fn detects_cursor_dialect() {
        let raw = r#"{"hook_event_name":"beforeShellExecution","command":"git push --force","cwd":"/w","conversation_id":"c-1"}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "git push --force");
        assert_eq!(p.session.as_deref(), Some("c-1"));
    }

    #[test]
    fn cursor_311_pretooluse_is_gated() {
        // The EXACT shape Cursor 3.11.25 sends on Windows (captured live).
        // Old parse_input matched none of this -> Termaxa silently no-op'd.
        let raw = r#"{"conversation_id":"758","tool_name":"Shell","tool_input":{"command":"git status","cwd":"C:\\Users\\User\\code\\p","timeout":30000},"cwd":"C:\\Users\\User\\code\\p","session_id":"758","hook_event_name":"preToolUse","cursor_version":"3.11.25","workspace_roots":["/C:/Users/User/code/p"]}"#;
        let p = parse_input(raw).expect("Cursor 3.11 preToolUse must be recognized");
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "git status");
        assert!(!p.is_post, "preToolUse must gate, not receipt");
        assert_eq!(p.session.as_deref(), Some("758"));
    }

    #[test]
    fn cursor_311_posttooluse_is_receipt() {
        let raw = r#"{"conversation_id":"758","tool_name":"Shell","tool_input":{"command":"git status","cwd":"C:\\Users\\User\\code\\p"},"tool_output":"{\"output\":\"\",\"exitCode\":0}","duration":174.96,"cwd":"C:\\Users\\User\\code\\p","session_id":"758","hook_event_name":"postToolUse","cursor_version":"3.11.25","workspace_roots":["/C:/Users/User/code/p"]}"#;
        let p = parse_input(raw).expect("Cursor 3.11 postToolUse must be recognized");
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "git status");
        assert!(p.is_post, "postToolUse must be a receipt");
    }

    #[test]
    fn cursor_311_empty_cwd_recovers_from_tool_input_or_roots() {
        // 3.11 sometimes sends empty top-level cwd; recover from tool_input.cwd
        // or workspace_roots.
        let raw = r#"{"conversation_id":"758","tool_name":"Shell","tool_input":{"command":"where.exe git","cwd":""},"cwd":"","session_id":"758","hook_event_name":"preToolUse","cursor_version":"3.11.25","workspace_roots":["/C:/Users/User/code/p"]}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(
            p.cwd, "C:/Users/User/code/p",
            "must recover cwd from workspace_roots"
        );
    }

    #[test]
    fn old_cursor_beforeshellexecution_still_works() {
        // Backward-compat: pre-3.11 Cursor must still be gated.
        let raw = "\u{feff}{\"command\":\"rm -rf .cursor .git\",\"cwd\":\"\",\"hook_event_name\":\"beforeShellExecution\",\"workspace_roots\":[\"/c:/Users/User/code/proj\"],\"conversation_id\":\"c9\"}";
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "rm -rf .cursor .git");
        assert!(!p.is_post);
    }

    #[test]
    fn detects_claude_dialect() {
        let raw = r#"{"tool_name":"Bash","tool_input":{"command":"git status"},"session_id":"s-1","cwd":"/w"}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::ClaudeCode);
        assert_eq!(p.command, "git status");
    }

    #[test]
    fn detects_post_execution_events() {
        // Cursor afterShellExecution → receipt
        let cur = r#"{"hook_event_name":"afterShellExecution","command":"rm -rf ./cache","cwd":"/w","conversation_id":"c1"}"#;
        let p = parse_input(cur).unwrap();
        assert!(p.is_post);
        assert_eq!(p.dialect, Dialect::Cursor);
        assert_eq!(p.command, "rm -rf ./cache");

        // Claude PostToolUse → receipt
        let cc = r#"{"hook_event_name":"PostToolUse","tool_name":"Bash","tool_input":{"command":"git commit -m x"},"session_id":"s1"}"#;
        let p = parse_input(cc).unwrap();
        assert!(p.is_post);
        assert_eq!(p.dialect, Dialect::ClaudeCode);

        // Pre-events are NOT post
        let pre = r#"{"tool_name":"Bash","tool_input":{"command":"ls"}}"#;
        assert!(!parse_input(pre).unwrap().is_post);
    }

    #[test]
    fn ignores_unrelated_input() {
        assert!(parse_input(r#"{"hook_event_name":"afterFileEdit"}"#).is_none());
        assert!(parse_input("not json").is_none());
    }

    #[test]
    fn renders_each_dialect() {
        let c = render_response(Dialect::Cursor, "deny", "[termaxa] blocked");
        assert!(c.contains("\"permission\":\"deny\"") && c.contains("agent_message"));
        let cc = render_response(Dialect::ClaudeCode, "ask", "[termaxa] careful");
        assert!(cc.contains("hookSpecificOutput") && cc.contains("permissionDecision"));
    }

    #[test]
    fn detects_copilot_dialect() {
        let raw =
            r#"{"toolName":"shell","toolArgs":"{\"command\":\"rm -rf /\"}","sessionId":"cop-1"}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::Copilot);
        assert_eq!(p.command, "rm -rf /");
        assert_eq!(p.session.as_deref(), Some("cop-1"));
    }

    #[test]
    fn copilot_accepts_inline_toolargs_object() {
        let raw = r#"{"toolName":"shell","toolArgs":{"command":"git status"}}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::Copilot);
        assert_eq!(p.command, "git status");
    }

    #[test]
    fn detects_codex_dialect() {
        let raw = r#"{"hook_event_name":"PreToolUse","agent":"codex-cli","tool_input":{"command":"git push --force"}}"#;
        let p = parse_input(raw).unwrap();
        assert_eq!(p.dialect, Dialect::Codex);
        assert_eq!(p.command, "git push --force");
    }

    #[test]
    fn shared_shape_without_tag_defaults_to_claude() {
        let raw = r#"{"tool_name":"Bash","tool_input":{"command":"ls"}}"#;
        assert_eq!(parse_input(raw).unwrap().dialect, Dialect::ClaudeCode);
    }

    #[test]
    fn copilot_render_is_unwrapped() {
        let r = render_response(Dialect::Copilot, "deny", "[termaxa] no");
        assert!(r.contains("permissionDecision") && !r.contains("hookSpecificOutput"));
    }
}