trusty-mpm 1.8.2

//! CLI parse tests and formatter unit tests for `tm` / `trusty-mpm`.
//!
//! Why: tests live in dedicated files so main.rs stays thin. This file
//! covers short-id / banner / formatter tests and the first half of the
//! CLI parse round-trips. Install / hook / session / services / compose
//! tests live in `tests_behavior_a_tests.rs` and `tests_behavior_b_tests.rs`; the
//! managed session-manager verb surface (`session new`/`ls`/`activity`/
//! `send`/`answer`/`attach`/lifecycle aliases/`prune*`/`catchup`) lives in
//! `tests_behavior_d_tests.rs` (split out under the #1916 line-cap rebalance).
//! What: parse round-trips for short_id, banners, daemon, project, session
//! subcommands (up through daemon flag parsing).
//! Test: `cargo test -p trusty-mpm` to run all fast tests.

use clap::Parser;

use crate::cli::{
    AgentAction, CatalogAction, Cli, Command, DEFAULT_URL, DoctorFlags, McpCmd, McpTransportArg,
    MemoryAction, MetaAction, ProjectAction, SessionAction, ShellArg, SlackCmd, TelegramCmd,
};
use crate::commands::misc::{CATALOG_STALE_MSG, CATALOG_UNKNOWN_MSG, NON_GIT_FALLBACK_HINT};
use crate::formatters::banner::{
    fallback_session_name, normalize_workdir, print_launch_banner,
    print_launch_banner_reconnecting, terminal_width,
};
use crate::formatters::session::{delegation_roster_line, deploy_summary_line, short_id};

#[test]
fn session_start_roster_line_is_plain_when_the_roster_is_whole() {
    // The healthy path must be byte-identical to what `tm session start` has
    // always printed — the incompleteness wording costs nothing when nothing
    // was lost.
    assert_eq!(
        delegation_roster_line(38, &[]),
        "Instructions: 38 agents in delegation authority"
    );
}

#[test]
fn session_start_roster_line_declares_an_incomplete_roster() {
    // #5544: `agent_count` is a FLOOR once a roster read fails. Printing the
    // bare number let `tm session start` publish a truncated roster as if it
    // were the whole set — the same shape the composed prompt's banner exists
    // to remove, one layer up.
    let line = delegation_roster_line(38, &[std::path::PathBuf::from("/p/.claude/agents/qa.md")]);

    assert!(
        line.contains("ROSTER INCOMPLETE"),
        "the line must declare itself incomplete: {line}"
    );
    assert!(
        line.contains("at least 38"),
        "the count must not read as a total: {line}"
    );
    assert!(
        line.contains("qa.md"),
        "the lost path must be named: {line}"
    );
}

#[test]
fn deploy_summary_line_formats_counts() {
    // #1917: `session start` prints this exact shape for both the Agents and
    // the (previously missing) Skills deploy summary lines.
    assert_eq!(
        deploy_summary_line("Skills", 3, 1, 2),
        "Skills: 3 deployed, 1 skipped, 2 unchanged"
    );
    assert_eq!(
        deploy_summary_line("Agents", 0, 0, 0),
        "Agents: 0 deployed, 0 skipped, 0 unchanged"
    );
}

/// The wire form the daemon actually emits renders as a real id, not dashes.
///
/// Why (#7805): `GET /sessions` answers `"id":"0f1e2d3c-4b5a-…"` — serde writes
/// the `SessionId` newtype transparently — but `short_id` read only the
/// `{"0": …}` tuple shape, so EVERY row rendered `--------` and the list output
/// `-------- Starting <path>` was mistaken for a session-start progress line.
/// Test: this function IS the test; it fails on the pre-fix `short_id`.
#[test]
fn short_id_reads_the_daemon_string_wire_form() {
    let value = serde_json::json!("0f1e2d3c-4b5a-4697-8a8b-9c0d1e2f3a4b");
    assert_eq!(
        short_id(&value),
        "0f1e2d3c",
        "the bare-string wire form must render its uuid prefix, never the placeholder"
    );
}

#[test]
fn short_id_extracts_uuid_prefix() {
    // The legacy `{"0": "<uuid>"}` tuple shape stays readable (#7805).
    let value = serde_json::json!({"0": "abcd1234-5678-90ab-cdef-1234567890ab"});
    assert_eq!(short_id(&value), "abcd1234");
}

#[test]
fn short_id_truncates_to_eight_chars() {
    // Any inner uuid string must collapse to exactly 8 characters.
    let value = serde_json::json!({"0": "0123456789abcdef-rest-ignored"});
    assert_eq!(short_id(&value).chars().count(), 8);
}

#[test]
fn short_id_falls_back_when_field_missing() {
    // Missing `0` key, or a value that is neither a string nor an object → the
    // placeholder. #7805: a bare string is now the REAL wire form, so it is no
    // longer a fallback case — `short_id_reads_the_daemon_string_wire_form`
    // owns it.
    assert_eq!(short_id(&serde_json::json!({})), "--------");
    assert_eq!(short_id(&serde_json::json!(null)), "--------");
    assert_eq!(short_id(&serde_json::json!(42)), "--------");
}

#[test]
fn short_id_falls_back_when_value_not_str() {
    // `0` present but not a string → the placeholder.
    assert_eq!(short_id(&serde_json::json!({"0": 42})), "--------");
}

#[test]
fn cli_parses_status() {
    let cli = Cli::try_parse_from(["trusty-mpm", "status"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Status));
}

#[test]
fn cli_parses_internal_spawn_disclaimed() {
    // #2997: the hidden pane shim collects `<program> <args...>` as a trailing
    // var-arg, including hyphen-led flags — exactly the pane-command shape.
    let cli =
        Cli::try_parse_from(["trusty-mpm", "internal-spawn-disclaimed", "claude", "-p"]).unwrap();
    let Some(Command::InternalSpawnDisclaimed { launch_spec, argv }) = cli.command else {
        panic!("expected internal-spawn-disclaimed");
    };
    assert_eq!(argv, ["claude", "-p"]);
    assert!(launch_spec.is_none(), "the argv form carries no spec");
}

/// #8233: the managed form names a launch spec and carries no trailing argv —
/// that is what keeps the typed pane line a fixed size.
#[test]
fn cli_parses_internal_spawn_disclaimed_launch_spec() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "internal-spawn-disclaimed",
        "--launch-spec",
        "/specs/abc.json",
    ])
    .unwrap();
    let Some(Command::InternalSpawnDisclaimed { launch_spec, argv }) = cli.command else {
        panic!("expected internal-spawn-disclaimed");
    };
    assert_eq!(
        launch_spec.as_deref(),
        Some(std::path::Path::new("/specs/abc.json"))
    );
    assert!(
        argv.is_empty(),
        "the spec form takes no trailing argv: {argv:?}"
    );
}

#[test]
fn cli_parses_mcp_add() {
    // stdio (default transport): `tm mcp add echo -- echo hi`
    let cli =
        Cli::try_parse_from(["trusty-mpm", "mcp", "add", "echo", "--", "echo", "hi"]).unwrap();
    let Some(Command::Mcp {
        cmd:
            McpCmd::Add {
                name,
                transport,
                env,
                header,
                command_and_args,
                root,
                project: _,
                share_with_projects: _,
            },
    }) = cli.command
    else {
        panic!("expected mcp add");
    };
    assert_eq!(name, "echo");
    assert_eq!(transport, McpTransportArg::Stdio);
    assert!(env.is_empty() && header.is_empty() && root.is_none());
    assert_eq!(command_and_args, vec!["echo", "hi"]);
}

#[test]
fn cli_parses_mcp_add_env_and_root() {
    // `tm mcp add srv -e A=1 -e B=2 --root /x -- npx pkg`
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "mcp",
        "add",
        "srv",
        "-e",
        "A=1",
        "-e",
        "B=2",
        "--root",
        "/x",
        "--",
        "npx",
        "pkg",
    ])
    .unwrap();
    let Some(Command::Mcp {
        cmd:
            McpCmd::Add {
                env,
                root,
                command_and_args,
                ..
            },
    }) = cli.command
    else {
        panic!("expected mcp add");
    };
    assert_eq!(env, vec!["A=1", "B=2"]);
    assert_eq!(root.as_deref(), Some("/x"));
    assert_eq!(command_and_args, vec!["npx", "pkg"]);
}

#[test]
fn cli_parses_mcp_add_http() {
    // `tm mcp add sentry -t http -H "Authorization: Bearer t" https://x/mcp`
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "mcp",
        "add",
        "sentry",
        "-t",
        "http",
        "-H",
        "Authorization: Bearer t",
        "https://x/mcp",
    ])
    .unwrap();
    let Some(Command::Mcp {
        cmd:
            McpCmd::Add {
                transport,
                header,
                command_and_args,
                ..
            },
    }) = cli.command
    else {
        panic!("expected mcp add http");
    };
    assert_eq!(transport, McpTransportArg::Http);
    assert_eq!(header, vec!["Authorization: Bearer t"]);
    assert_eq!(command_and_args, vec!["https://x/mcp"]);
}

#[test]
fn cli_parses_mcp_share() {
    let cli = Cli::try_parse_from(["trusty-mpm", "mcp", "share", "slack-mcp"]).unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Share { name, .. },
    }) = cli.command
    else {
        panic!("expected mcp share");
    };
    assert_eq!(name, "slack-mcp");

    // #7672: the same grant, taken at add time, defaults OFF.
    let add = Cli::try_parse_from(["trusty-mpm", "mcp", "add", "x", "--", "echo", "hi"]).unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Add {
            share_with_projects,
            ..
        },
    }) = add.command
    else {
        panic!("expected mcp add");
    };
    assert!(
        !share_with_projects,
        "registering a server must not share it by default"
    );
}

#[test]
fn cli_parses_mcp_unshare() {
    let cli = Cli::try_parse_from(["trusty-mpm", "mcp", "unshare", "slack-mcp"]).unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Unshare { name, .. },
    }) = cli.command
    else {
        panic!("expected mcp unshare");
    };
    assert_eq!(name, "slack-mcp");

    let add = Cli::try_parse_from([
        "trusty-mpm",
        "mcp",
        "add",
        "--share-with-projects",
        "x",
        "--",
        "echo",
        "hi",
    ])
    .unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Add {
            share_with_projects,
            ..
        },
    }) = add.command
    else {
        panic!("expected mcp add");
    };
    assert!(share_with_projects);
}

#[test]
fn cli_parses_mcp_remove_list_get() {
    let rm = Cli::try_parse_from(["trusty-mpm", "mcp", "remove", "echo"]).unwrap();
    assert!(matches!(
        rm.command,
        Some(Command::Mcp {
            cmd: McpCmd::Remove { .. }
        })
    ));
    let ls = Cli::try_parse_from(["trusty-mpm", "mcp", "list", "--json"]).unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::List { json, .. },
    }) = ls.command
    else {
        panic!("expected mcp list");
    };
    assert!(json);
    let get = Cli::try_parse_from(["trusty-mpm", "mcp", "get", "echo"]).unwrap();
    assert!(matches!(
        get.command,
        Some(Command::Mcp {
            cmd: McpCmd::Get { .. }
        })
    ));
}

#[test]
fn cli_parses_mcp_test() {
    // Bare sweep: no name, no flags.
    let bare = Cli::try_parse_from(["trusty-mpm", "mcp", "test"]).unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Test { name, json, root },
    }) = bare.command
    else {
        panic!("expected mcp test");
    };
    assert!(name.is_none() && !json && root.is_none());

    // Named + --json + --root.
    let named = Cli::try_parse_from([
        "trusty-mpm",
        "mcp",
        "test",
        "trusty-memory",
        "--json",
        "--root",
        "/x",
    ])
    .unwrap();
    let Some(Command::Mcp {
        cmd: McpCmd::Test { name, json, root },
    }) = named.command
    else {
        panic!("expected mcp test named");
    };
    assert_eq!(name.as_deref(), Some("trusty-memory"));
    assert!(json);
    assert_eq!(root.as_deref(), Some("/x"));
}

#[test]
fn cli_parses_start() {
    let cli = Cli::try_parse_from(["trusty-mpm", "start"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Start));
}

#[test]
fn cli_parses_serve() {
    // Bare `serve` defaults to the non-stdio (start-like) behaviour.
    let cli = Cli::try_parse_from(["trusty-mpm", "serve"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Serve { stdio: false }
    ));
}

#[test]
fn cli_parses_serve_stdio() {
    // `serve --stdio` selects the MCP stdio bridge (#1221).
    let cli = Cli::try_parse_from(["trusty-mpm", "serve", "--stdio"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Serve { stdio: true }
    ));
}

#[test]
fn cli_parses_stop() {
    let cli = Cli::try_parse_from(["trusty-mpm", "stop"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Stop));
}

#[test]
fn cli_parses_doctor() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                prune_stale_skills: false,
                fix_skills: false,
                fix_agents: false,
                fix_launchd_secrets: false,
                fix: false,
                yes: false,
                include_frozen: false,
                quarantine_mcp: None,
                dir: None,
                network: false,
            }
        }
    ));
}

/// #8371: `--network` is opt-in; a bare `tm doctor` leaves it off.
#[test]
fn cli_parses_doctor_network() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--network"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags { network: true, .. }
        }
    ));
    let bare = Cli::try_parse_from(["trusty-mpm", "doctor"]).unwrap();
    assert!(matches!(
        bare.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags { network: false, .. }
        }
    ));
}

#[test]
fn cli_parses_doctor_dir_and_refuses_it_beside_a_write_flag() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--dir", "/tmp/x"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor { flags: DoctorFlags { dir: Some(d), .. } } if d == std::path::Path::new("/tmp/x")
    ));
    // #7757: repairs act on the cwd, so a scoped report beside them is refused.
    assert!(Cli::try_parse_from(["trusty-mpm", "doctor", "--dir", "/tmp/x", "--fix"]).is_err());
}

#[test]
fn cli_parses_doctor_prune_stale_skills() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--prune-stale-skills"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                prune_stale_skills: true,
                fix_skills: false,
                fix_agents: false,
                fix_launchd_secrets: false,
                fix: false,
                yes: false,
                include_frozen: false,
                quarantine_mcp: None,
                dir: None,
                network: false,
            }
        }
    ));
}

/// #4604: `--fix-skills` is opt-in, and overwriting a FROZEN (hand-edited)
/// skill needs a second, explicit opt-in on top of it.
///
/// Why: a frozen file is deliberate user customization; the CLI must make
/// overwriting one impossible to reach by accident. `--include-frozen` alone
/// must be REJECTED, not silently interpreted as a fix request.
/// Test: this test.
#[test]
fn cli_parses_doctor_fix_skills() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-skills"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                prune_stale_skills: false,
                fix_skills: true,
                fix_agents: false,
                fix_launchd_secrets: false,
                fix: false,
                yes: false,
                include_frozen: false,
                quarantine_mcp: None,
                dir: None,
                network: false,
            }
        }
    ));

    let cli =
        Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-skills", "--include-frozen"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix_skills: true,
                include_frozen: true,
                ..
            }
        }
    ));

    assert!(
        Cli::try_parse_from(["trusty-mpm", "doctor", "--include-frozen"]).is_err(),
        "--include-frozen without --fix-skills must be rejected"
    );

    // #6586: the project-tier sweep DELETES, so `--yes` must reach it — the
    // `writes` group is what makes `--fix-skills --yes` parse at all.
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-skills", "--yes"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix_skills: true,
                yes: true,
                ..
            }
        }
    ));
    assert!(
        Cli::try_parse_from(["trusty-mpm", "doctor", "--yes"]).is_err(),
        "--yes without a write action must still be rejected"
    );
}

/// #6649: `--fix-agents` is opt-in and previews; `--yes` must reach it.
///
/// Why: it is the second repair in this command that DELETES, so the gate that
/// keeps a bare flag inert is the CLI's, exactly as for `--fix-skills`. A
/// `--yes` that parsed without any write action would let a refactor reach a
/// removal from a flag the operator thinks is inert.
/// Test: this test.
#[test]
fn cli_parses_doctor_fix_agents() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-agents"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix_agents: true,
                fix_skills: false,
                fix: false,
                yes: false,
                ..
            }
        }
    ));

    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-agents", "--yes"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix_agents: true,
                yes: true,
                ..
            }
        }
    ));

    // `--include-frozen` belongs to the skill redeploy; it has no meaning for
    // an agent removal and must not be reachable through this flag alone.
    assert!(
        Cli::try_parse_from(["trusty-mpm", "doctor", "--fix-agents", "--include-frozen"]).is_err(),
        "--include-frozen requires a skill repair, not --fix-agents"
    );
}

/// #4948: `--fix` is a DRY RUN, and writing needs `--yes` on top of it.
///
/// Why: `--fix` rewrites project settings files and deployed skills. The CLI
/// is where "the default cannot write" is actually enforced, so it gets a test
/// — a `--yes` that parses without `--fix` would let a future refactor reach a
/// write path from a flag the operator thinks is inert.
/// Test: this test.
#[test]
fn cli_parses_doctor_fix() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix: true,
                yes: false,
                fix_skills: false,
                ..
            }
        }
    ));

    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix", "--yes"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix: true,
                yes: true,
                ..
            }
        }
    ));

    assert!(
        Cli::try_parse_from(["trusty-mpm", "doctor", "--yes"]).is_err(),
        "--yes without --fix must be rejected"
    );

    // `--include-frozen` requires EITHER repair flag (issue #4948 widened the
    // `requires` from `--fix-skills` alone to the `repair` group).
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--fix", "--include-frozen"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                fix: true,
                include_frozen: true,
                ..
            }
        }
    ));
}

#[test]
fn cli_parses_validate() {
    let cli = Cli::try_parse_from(["trusty-mpm", "validate"]).unwrap();
    match cli.command.unwrap() {
        Command::Validate { path, repair } => {
            assert_eq!(path, None);
            assert!(!repair);
        }
        other => panic!("expected Command::Validate, got {other:?}"),
    }
}

#[test]
fn cli_parses_validate_with_path_and_repair() {
    let cli =
        Cli::try_parse_from(["trusty-mpm", "validate", "--path", "/tmp/ws", "--repair"]).unwrap();
    match cli.command.unwrap() {
        Command::Validate { path, repair } => {
            assert_eq!(path, Some(std::path::PathBuf::from("/tmp/ws")));
            assert!(repair);
        }
        other => panic!("expected Command::Validate, got {other:?}"),
    }
}

#[test]
fn cli_parses_health() {
    let cli = Cli::try_parse_from(["trusty-mpm", "health"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Health));
}

#[test]
fn cli_parses_agent_list() {
    // DOC-42 / issue #2889.
    let cli = Cli::try_parse_from(["trusty-mpm", "agent", "list"]).unwrap();
    match cli.command.unwrap() {
        Command::Agent {
            action: AgentAction::List { json },
        } => assert!(!json),
        other => panic!("expected Command::Agent list, got {other:?}"),
    }
}

#[test]
fn cli_parses_agent_list_json() {
    let cli = Cli::try_parse_from(["trusty-mpm", "agent", "list", "--json"]).unwrap();
    match cli.command.unwrap() {
        Command::Agent {
            action: AgentAction::List { json },
        } => assert!(json),
        other => panic!("expected Command::Agent list --json, got {other:?}"),
    }
}

#[test]
fn cli_parses_agent_show() {
    let cli = Cli::try_parse_from(["trusty-mpm", "agent", "show", "code-critic"]).unwrap();
    match cli.command.unwrap() {
        Command::Agent {
            action: AgentAction::Show { name, json },
        } => {
            assert_eq!(name, "code-critic");
            assert!(!json);
        }
        other => panic!("expected Command::Agent show, got {other:?}"),
    }
}

#[test]
fn cli_parses_project_init() {
    let cli = Cli::try_parse_from(["trusty-mpm", "project", "init"]).unwrap();
    match cli.command.unwrap() {
        Command::Project {
            action: ProjectAction::Init { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected project init, got {other:?}"),
    }
}

#[test]
fn cli_parses_project_init_with_dir() {
    let cli = Cli::try_parse_from(["trusty-mpm", "project", "init", "--dir", "/work/p"]).unwrap();
    match cli.command.unwrap() {
        Command::Project {
            action: ProjectAction::Init { dir },
        } => assert_eq!(dir.as_deref(), Some("/work/p")),
        other => panic!("expected project init, got {other:?}"),
    }
}

#[test]
fn cli_parses_project_list() {
    let cli = Cli::try_parse_from(["trusty-mpm", "project", "list"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Project {
            action: ProjectAction::List
        }
    ));
}

#[test]
fn cli_parses_project_info() {
    let cli = Cli::try_parse_from(["trusty-mpm", "project", "info"]).unwrap();
    match cli.command.unwrap() {
        Command::Project {
            action: ProjectAction::Info { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected project info, got {other:?}"),
    }
}

// `cli_parses_project_trust`/`cli_parses_project_trust_revoke` and the
// `project trust` behavioral coverage live in
// `tests_project_trust_tests.rs` instead of here, to stay under this file's
// 1500-SLOC test cap (issue #3033).

#[test]
fn cli_project_requires_action() {
    // `project` with no action is an error.
    assert!(Cli::try_parse_from(["trusty-mpm", "project"]).is_err());
}

#[test]
fn cli_parses_meta_run() {
    // Bare `meta run` defaults to no demo, no explicit project, no-provision off,
    // and no explicit timeout (#1049/#1051).
    let cli = Cli::try_parse_from(["trusty-mpm", "meta", "run"]).unwrap();
    match cli.command.unwrap() {
        Command::Meta {
            action:
                MetaAction::Run {
                    demo,
                    project,
                    no_provision,
                    timeout_secs,
                },
        } => {
            assert!(!demo);
            assert_eq!(project, None);
            assert!(!no_provision);
            assert_eq!(timeout_secs, None);
        }
        other => panic!("expected meta run, got {other:?}"),
    }
}

#[test]
fn cli_parses_meta_run_demo() {
    // `meta run --demo` sets the demo flag.
    let cli = Cli::try_parse_from(["trusty-mpm", "meta", "run", "--demo"]).unwrap();
    match cli.command.unwrap() {
        Command::Meta {
            action: MetaAction::Run { demo, project, .. },
        } => {
            assert!(demo);
            assert_eq!(project, None);
        }
        other => panic!("expected meta run --demo, got {other:?}"),
    }
}

#[test]
fn cli_parses_meta_run_project() {
    // `meta run --demo --project <PATH>` captures both the flag and the path.
    let cli =
        Cli::try_parse_from(["trusty-mpm", "meta", "run", "--demo", "--project", "/tmp"]).unwrap();
    match cli.command.unwrap() {
        Command::Meta {
            action: MetaAction::Run { demo, project, .. },
        } => {
            assert!(demo);
            assert_eq!(project.as_deref(), Some(std::path::Path::new("/tmp")));
        }
        other => panic!("expected meta run --project, got {other:?}"),
    }
}

#[test]
fn cli_parses_meta_run_no_provision() {
    // `meta run --no-provision` sets the clone-skip flag (#1049).
    let cli = Cli::try_parse_from(["trusty-mpm", "meta", "run", "--no-provision"]).unwrap();
    match cli.command.unwrap() {
        Command::Meta {
            action: MetaAction::Run { no_provision, .. },
        } => assert!(no_provision),
        other => panic!("expected meta run --no-provision, got {other:?}"),
    }
}

#[test]
fn cli_parses_meta_run_timeout() {
    // `meta run --timeout-secs 30` overrides the poll budget (#1051).
    let cli = Cli::try_parse_from(["trusty-mpm", "meta", "run", "--timeout-secs", "30"]).unwrap();
    match cli.command.unwrap() {
        Command::Meta {
            action: MetaAction::Run { timeout_secs, .. },
        } => assert_eq!(timeout_secs, Some(30)),
        other => panic!("expected meta run --timeout-secs, got {other:?}"),
    }
}

#[test]
fn cli_meta_requires_action() {
    // `meta` with no action is an error.
    assert!(Cli::try_parse_from(["trusty-mpm", "meta"]).is_err());
}

#[test]
fn cli_parses_launch() {
    let cli = Cli::try_parse_from(["trusty-mpm", "launch"]).unwrap();
    match cli.command.unwrap() {
        Command::Launch {
            dir,
            style,
            worktree,
            ..
        } => {
            assert_eq!(dir, None);
            assert_eq!(style, None);
            assert!(!worktree, "#5274: a bare `tm launch` requests no worktree");
        }
        other => panic!("expected launch, got {other:?}"),
    }
}

#[test]
fn cli_parses_launch_with_dir() {
    let cli = Cli::try_parse_from(["trusty-mpm", "launch", "/work/p"]).unwrap();
    match cli.command.unwrap() {
        Command::Launch {
            dir,
            style,
            worktree,
            ..
        } => {
            assert_eq!(dir.as_deref(), Some("/work/p"));
            assert_eq!(style, None);
            assert!(!worktree);
        }
        other => panic!("expected launch, got {other:?}"),
    }
}

#[test]
fn cli_parses_launch_with_style() {
    // HR-4: `--style <id>` selects the active output style for this launch.
    let cli =
        Cli::try_parse_from(["trusty-mpm", "launch", "--style", "trusty-mpm-teacher"]).unwrap();
    match cli.command.unwrap() {
        Command::Launch {
            dir,
            style,
            worktree,
            ..
        } => {
            assert_eq!(dir, None);
            assert_eq!(style.as_deref(), Some("trusty-mpm-teacher"));
            assert!(!worktree);
        }
        other => panic!("expected launch, got {other:?}"),
    }
}

/// `tm launch --worktree` must reach the parser as a real, distinct request
/// (#5274 — contract row 3).
///
/// Why: rule 2 of the #5274 placement contract says an EXPLICIT user request
/// can put a session in a worktree, and rule 1 says nothing else can. That only
/// holds if such a request is expressible at launch time. Without this flag the
/// contract's third row has no way to be entered at all, and the earlier attempt
/// at this change reached for a `const fn` that no user could override.
/// What: parses `tm launch --worktree` and asserts the flag arrives `true`,
/// while `cli_parses_launch` above pins the bare form at `false`. The pair is
/// what makes "explicit" mean explicit rather than "always on".
/// Test: itself.
#[test]
fn cli_parses_launch_with_worktree() {
    let cli = Cli::try_parse_from(["trusty-mpm", "launch", "--worktree"]).unwrap();
    match cli.command.unwrap() {
        Command::Launch {
            dir,
            style,
            worktree,
            ..
        } => {
            assert_eq!(dir, None);
            assert_eq!(style, None);
            assert!(
                worktree,
                "`--worktree` must surface as an explicit worktree request (#5274)"
            );
        }
        other => panic!("expected launch, got {other:?}"),
    }
}

/// `tm launch --twin` reaches the launch as an explicit arming request, and a
/// bare `tm launch` never does (#8878, ruling D1).
#[test]
fn cli_parses_launch_with_twin() {
    for (argv, want) in [
        (&["trusty-mpm", "launch", "--twin"][..], true),
        (&["trusty-mpm", "launch"][..], false),
    ] {
        match Cli::try_parse_from(argv).unwrap().command.unwrap() {
            Command::Launch { twin, worktree, .. } => {
                assert_eq!(twin, want, "{argv:?}");
                assert!(!worktree, "{argv:?}");
            }
            other => panic!("expected launch, got {other:?}"),
        }
    }
}

/// `--twin --worktree` is refused, and only that pair (#8878 review).
#[test]
fn twin_preflight_refuses_only_twin_with_worktree() {
    use crate::commands::launch_twin::preflight;
    for (twin, worktree, refused) in [
        (false, false, false),
        (false, true, false),
        (true, false, false),
        (true, true, true),
    ] {
        let got = preflight(twin, worktree);
        assert_eq!(got.is_err(), refused, "twin={twin} worktree={worktree}");
    }
}

/// `tm launch --twin --worktree` is refused before `launch` resolves, inits
/// or provisions anything — the directory is not even read (#8878 review).
#[tokio::test]
async fn a_twin_worktree_launch_is_refused_before_anything_is_touched() {
    let root = tempfile::TempDir::new().expect("tempdir");
    let absent = root.path().join("never-created");
    let err = crate::commands::launch::launch(
        &reqwest::Client::new(),
        "http://127.0.0.1:1",
        Some(absent.to_string_lossy().into_owned()),
        None,
        true,
        crate::commands::managed_workspace::LaunchDir::OperatorCwd,
        None,
        true,
    )
    .await
    .expect_err("a twin worktree launch is refused");
    assert!(err.to_string().contains("`--worktree`"), "{err}");
    assert!(!absent.exists());
}

/// A twin session must run in the directory the grant was checked for.
#[test]
fn twin_placement_must_be_the_checked_directory() {
    use crate::commands::launch_twin::confirm_placement;
    let root = tempfile::TempDir::new().expect("tempdir");
    let (checked, other) = (root.path().join("checked"), root.path().join("other"));
    std::fs::create_dir(&checked).expect("mkdir");
    std::fs::create_dir(&other).expect("mkdir");
    assert!(confirm_placement(&checked, &checked.join(".")).is_ok());
    assert!(confirm_placement(&checked, &other).is_err());
    assert!(confirm_placement(&checked, &root.path().join("absent")).is_err());
}

/// The no-origin and reattach refusals fire for `--twin` only; a plain launch
/// passes both (#8878 review).
#[test]
fn twin_refusals_apply_only_to_twin_launches() {
    use crate::commands::launch_twin::{refuse_live_checkout, refuse_reattach};
    for twin in [false, true] {
        assert_eq!(
            refuse_live_checkout(twin).is_err(),
            twin,
            "live, twin={twin}"
        );
        assert_eq!(
            refuse_reattach(twin, "tm-x").is_err(),
            twin,
            "reattach, twin={twin}"
        );
    }
}

#[test]
fn fallback_session_name_has_tm_prefix() {
    let name = fallback_session_name(std::path::Path::new("/work/p"));
    assert!(name.starts_with("tm-"), "got {name}");
}

#[test]
fn fallback_session_name_uses_folder() {
    // The offline fallback name reflects the project folder, not a UUID.
    let name = fallback_session_name(std::path::Path::new("/Users/x/trusty-mpm"));
    assert_eq!(name, "tm-trusty-mpm");
}

#[test]
fn launch_banner_does_not_panic() {
    // Why: the banner does width math and probes PATH; exercise it to catch
    // arithmetic underflow or formatting regressions.
    print_launch_banner("/Users/test/project", "tmpm-quiet-falcon", None, None);
    print_launch_banner(
        "/Users/test/project",
        "tmpm-quiet-falcon",
        Some(std::path::Path::new("/tmp/system-prompt.txt")),
        None,
    );
}

#[test]
fn launch_reconnect_banner_does_not_panic() {
    // Why: the reconnect banner shares the render path with the launch
    // banner; exercise it to catch formatting regressions.
    print_launch_banner_reconnecting("/Users/test/project", "tmpm-quiet-falcon");
}

#[test]
fn terminal_width_is_positive() {
    // Why: callers use the width for layout; a zero or absurd value would
    // break formatting. The probe must always yield a usable column count.
    assert!(terminal_width() > 0);
}

#[test]
fn banner_title_bar_contains_version() {
    // Why: the single-box banner embeds the crate version in the title bar;
    // this ensures the version is always visible to the operator at a glance.
    use crate::formatters::banner::two_panel::{render_two_panel_banner, strip_ansi};
    use crate::formatters::info_box::{ConsoleInfo, DaemonInfo, WelcomeData};
    colored::control::set_override(false);
    let data = WelcomeData {
        project: "my-project".to_string(),
        workspace: "/Users/test/project".to_string(),
        user: "operator".to_string(),
        reconnecting: false,
        session_name: "tmpm-my-project".to_string(),
        daemon: DaemonInfo::default(),
        // #6761: the services block gained a console row.
        console: ConsoleInfo::default(),
        recent_commits: vec![],
        memory_status: "(not detected)".to_string(),
        search_status: "(not detected)".to_string(),
        review_status: "(not detected)".to_string(),
    };
    let out = render_two_panel_banner(&data, 120, false).expect("wide banner");
    let first_line = out.lines().next().unwrap_or("");
    let bare = strip_ansi(first_line);
    assert!(
        bare.contains(env!("CARGO_PKG_VERSION")),
        "title bar must contain CARGO_PKG_VERSION: {bare:?}"
    );
    assert!(
        bare.starts_with('╭'),
        "title bar must start with outer box corner ╭: {bare:?}"
    );
    colored::control::unset_override();
}

#[test]
fn banner_reconnect_label_in_wide_mode() {
    // Why: the reconnect label in the wide single-box banner must say
    // "Reconnecting..." so the operator knows no new session was started.
    use crate::formatters::banner::two_panel::{render_two_panel_banner, strip_ansi};
    use crate::formatters::info_box::{ConsoleInfo, DaemonInfo, WelcomeData};
    colored::control::set_override(false);
    let data = WelcomeData {
        project: "my-project".to_string(),
        workspace: "/Users/test/project".to_string(),
        user: "operator".to_string(),
        reconnecting: true,
        session_name: "tmpm-quiet-falcon".to_string(),
        daemon: DaemonInfo::default(),
        // #6761: the services block gained a console row.
        console: ConsoleInfo::default(),
        recent_commits: vec![],
        memory_status: "(not detected)".to_string(),
        search_status: "(not detected)".to_string(),
        review_status: "(not detected)".to_string(),
    };
    let out = render_two_panel_banner(&data, 120, true).expect("wide reconnect banner");
    let bare = strip_ansi(&out);
    assert!(
        bare.contains("Reconnecting..."),
        "wide reconnect banner must contain 'Reconnecting...': {bare:.200}"
    );
    colored::control::unset_override();
}

#[test]
fn normalize_workdir_strips_trailing_slash() {
    // Why: a daemon-stored workdir and the resolved cwd may differ only by a
    // trailing slash; reconnect detection must treat them as equal. Use a
    // path that does not exist so canonicalize falls through to the
    // string-normalization branch deterministically.
    let with = normalize_workdir("/no/such/dir/");
    let without = normalize_workdir("/no/such/dir");
    assert_eq!(with, without);
    assert_eq!(without, "/no/such/dir");
}

#[test]
fn cli_parses_session_start() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "start"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Start { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected session start, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_start_with_dir() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "start", "--dir", "/work/p"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Start { dir },
        } => assert_eq!(dir.as_deref(), Some("/work/p")),
        other => panic!("expected session start, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_stop() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "stop", "tmpm-quiet-falcon"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Stop { id_or_name },
        } => assert_eq!(id_or_name, "tmpm-quiet-falcon"),
        other => panic!("expected session stop, got {other:?}"),
    }
}

#[test]
fn cli_session_stop_requires_arg() {
    // `session stop` without an id-or-name is an error.
    assert!(Cli::try_parse_from(["trusty-mpm", "session", "stop"]).is_err());
}

#[test]
fn cli_parses_session_kill() {
    // `kill` is a visible alias (#2191) for `stop` — it parses to the same
    // `SessionAction::Stop` variant so it dispatches through the identical
    // managed-aware handler with zero other changes.
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "kill", "tmpm-quiet-falcon"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Stop { id_or_name },
        } => assert_eq!(id_or_name, "tmpm-quiet-falcon"),
        other => panic!("expected session kill (stop), got {other:?}"),
    }
}

#[test]
fn cli_parses_session_list() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "list"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::List { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected session list, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_clean() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "clean"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Clean { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected session clean, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_info() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "info", "abc-123"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Info { id_or_name },
        } => assert_eq!(id_or_name, "abc-123"),
        other => panic!("expected session info, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_instructions() {
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "instructions"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Instructions { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected session instructions, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_instructions_with_dir() {
    let cli =
        Cli::try_parse_from(["trusty-mpm", "session", "instructions", "--dir", "/tmp"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Instructions { dir },
        } => assert_eq!(dir.as_deref(), Some("/tmp")),
        other => panic!("expected session instructions, got {other:?}"),
    }
}

#[test]
fn cli_parses_events() {
    let cli = Cli::try_parse_from(["trusty-mpm", "events"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Events));
}

#[test]
fn cli_url_flag_overrides_default() {
    let cli = Cli::try_parse_from(["trusty-mpm", "--url", "http://x:9", "status"]).unwrap();
    assert_eq!(cli.url.as_deref(), Some("http://x:9"));
}

#[test]
fn cli_url_flag_equal_to_default_is_still_some() {
    // Regression test for issue #2487: `cli.url` must distinguish "the operator
    // explicitly passed --url <DEFAULT_URL>" from "nothing was passed at all".
    // Before the fix, `cli.url` was a plain `String` with
    // `default_value = DEFAULT_URL`, so both cases produced the identical
    // string and every downstream resolver had to guess — incorrectly, in
    // this exact case — which one actually happened.
    let cli = Cli::try_parse_from(["trusty-mpm", "--url", DEFAULT_URL, "status"]).unwrap();
    assert_eq!(
        cli.url.as_deref(),
        Some(DEFAULT_URL),
        "an explicit --url equal to the default must still parse as Some, not be lost"
    );
}

/// `--account` is a `global = true` flag (#7166), so it parses before ANY
/// subcommand — the shape `tm --account <login> <owner>/<repo>` needs.
#[test]
fn cli_parses_account_flag_global() {
    let cli = Cli::try_parse_from(["trusty-mpm", "--account", "bob-duetto", "status"]).unwrap();
    assert_eq!(cli.account.as_deref(), Some("bob-duetto"));
}

/// A global flag also parses AFTER the subcommand — `tm run --account
/// <login> <owner>/<repo>` and `tm register --account <login> <owner>/<repo>`
/// both need this, and neither `Command::Run` nor `Command::Register` declares
/// its own `--account` field.
#[test]
fn cli_account_flag_after_subcommand() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "run",
        "--account",
        "bob-duetto",
        "bobmatnyc/trusty-tools",
    ])
    .unwrap();
    assert_eq!(cli.account.as_deref(), Some("bob-duetto"));
    assert!(matches!(cli.command, Some(Command::Run { .. })));
}

/// 🔴 #5850 REGRESSION: `--user <login>` must bind the same field as
/// `--account <login>`.
///
/// Why this is the assertion: the owner's report was
/// `tm https://github.com/duettoresearch/jev-matching --user bob-duetto`
/// failing at clap parsing. `--user` is the spelling `gh` itself uses for the
/// same concept (`gh auth token -u`), so it has to be accepted, and it has to
/// land on `cli.account` — an alias that parsed into a SECOND field would give
/// the two spellings different behaviour downstream.
#[test]
fn cli_parses_user_alias_for_account_global() {
    let cli = Cli::try_parse_from(["trusty-mpm", "--user", "bob-duetto", "status"]).unwrap();
    assert_eq!(cli.account.as_deref(), Some("bob-duetto"));
}

/// 🔴 #9090 REGRESSION: `--u <login>` binds the same field as `--account`.
/// The form × position matrix is in `run_target_tests.rs`.
#[test]
fn cli_parses_u_alias_for_account_global() {
    let cli = Cli::try_parse_from(["trusty-mpm", "--u", "bob-duetto", "status"]).unwrap();
    assert_eq!(cli.account.as_deref(), Some("bob-duetto"));
}

/// 🔴 #5850 REGRESSION (fail-open): a blank `--user`/`--account` given BEFORE
/// the repository is refused at parse time.
///
/// Why this is the assertion: `tm --user= <url>` parsed as `Some("")`, and
/// `resolve_account` reads a blank flag as absent, so the clone ran as the
/// machine's global `gh` account. Same refusal text as the trailing form
/// (`bare_form_rejects_an_empty_account_value`).
#[test]
fn cli_rejects_a_blank_account_flag_before_the_repository() {
    for argv in [
        &["trusty-mpm", "--user=", "acme/widget"][..],
        &["trusty-mpm", "--account=", "acme/widget"][..],
        &["trusty-mpm", "--user", "", "acme/widget"][..],
        &["trusty-mpm", "--account", "   ", "acme/widget"][..],
        &["trusty-mpm", "--user=  ", "run", "acme/widget"][..],
    ] {
        let err = Cli::try_parse_from(argv)
            .expect_err("a blank account flag must refuse, not fall back to the global account");
        assert!(
            err.to_string().contains("needs a gh login"),
            "{argv:?}: {err}"
        );
    }
}

/// The alias inherits `global = true`, so it also parses AFTER the positional
/// — the exact shape the owner typed (`tm <url> --user <login>`).
#[test]
fn cli_user_alias_after_subcommand() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "run",
        "https://github.com/duettoresearch/jev-matching",
        "--user",
        "bob-duetto",
    ])
    .unwrap();
    assert_eq!(cli.account.as_deref(), Some("bob-duetto"));
    assert!(matches!(cli.command, Some(Command::Run { .. })));
}

#[test]
fn cli_bare_invocation_uses_guided_default() {
    // Since #1708, a bare `tm` invocation is valid: clap parses it with
    // command = None and the guided default fires at runtime.
    let cli = Cli::try_parse_from(["trusty-mpm"]).expect("bare tm must parse");
    assert!(
        cli.command.is_none(),
        "bare tm should produce command = None"
    );
}

#[test]
fn cli_parses_tui_defaults() {
    // The `--url` flag is passed explicitly: the `tui` subcommand's `url`
    // arg carries `env = "TRUSTY_MPM_URL"`, so an ambient `TRUSTY_MPM_URL`
    // in the test runner's environment would otherwise override the clap
    // `default_value` and make this assertion environment-dependent.
    // `interval_ms` has no env binding, so its default is asserted bare.
    let cli = Cli::try_parse_from(["trusty-mpm", "tui", "--url", DEFAULT_URL]).unwrap();
    match cli.command.unwrap() {
        Command::Tui {
            url,
            interval_ms,
            single_pane,
        } => {
            assert_eq!(url.as_deref(), Some(DEFAULT_URL));
            assert_eq!(interval_ms, 1000);
            // #6483: bare `tm tui` opts into nothing — the multipane
            // project_ctl dashboard is what `initial_view(false)` resolves to.
            assert!(!single_pane);
            assert_eq!(
                trusty_mpm::tui::initial_view(single_pane),
                trusty_mpm::tui::TuiView::Multipane
            );
        }
        other => panic!("expected Tui, got {other:?}"),
    }
}

#[test]
fn cli_parses_tui_single_pane_opt_in() {
    // #6483: the single-pane coordinator chat is still reachable, explicitly.
    let cli = Cli::try_parse_from(["trusty-mpm", "tui", "--single-pane"]).unwrap();
    match cli.command.unwrap() {
        Command::Tui { single_pane, .. } => {
            assert!(single_pane);
            assert_eq!(
                trusty_mpm::tui::initial_view(single_pane),
                trusty_mpm::tui::TuiView::SinglePane
            );
        }
        other => panic!("expected Tui, got {other:?}"),
    }
}

#[test]
fn cli_parses_tui_with_interval() {
    let cli = Cli::try_parse_from(["trusty-mpm", "tui", "--interval-ms", "500"]).unwrap();
    match cli.command.unwrap() {
        Command::Tui { interval_ms, .. } => assert_eq!(interval_ms, 500),
        other => panic!("expected Tui, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_tui() {
    // #1392: the coordinator TUI is the `tm session tui` subcommand (renamed
    // from the former top-level `tm coordinator-tui`). Its `--interval-ms`
    // defaults to 1500. The `url` arg carries `env = "TRUSTY_MPM_URL"`, so an
    // ambient `TRUSTY_MPM_URL` in the test runner would override the (absent)
    // default — assert only the env-independent interval default here, and the
    // url plumbing in `cli_parses_session_tui_with_flags`.
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "tui"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Tui { interval_ms, .. },
        } => {
            assert_eq!(interval_ms, 1500);
        }
        other => panic!("expected Session::Tui, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_tui_with_flags() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "session",
        "tui",
        "--url",
        "http://127.0.0.1:9999",
        "--interval-ms",
        "750",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::Tui { url, interval_ms },
        } => {
            assert_eq!(url.as_deref(), Some("http://127.0.0.1:9999"));
            assert_eq!(interval_ms, 750);
        }
        other => panic!("expected Session::Tui, got {other:?}"),
    }
}

#[test]
fn cli_parses_session_singular() {
    // #1916 made `session` (singular) canonical with no plural alias. #2116
    // (DOC-35 §2.2/§3.2) reverses that: `sessions` (plural) is now canonical,
    // sibling to `tm projects`, and `session` is kept as a hidden deprecated
    // alias rather than retired — so this exact invocation must keep parsing
    // identically to before, into the same `Command::Session` variant.
    let cli = Cli::try_parse_from(["trusty-mpm", "session", "list"]).unwrap();
    match cli.command.unwrap() {
        Command::Session {
            action: SessionAction::List { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected session list, got {other:?}"),
    }
}

// #2116 note: the mirror-plural parse test, the full-verb-surface parity
// sweep, and the alias-notice message-text assertion moved to
// `tests_behavior_e_tests.rs` to keep this file under the 1500-SLOC test cap
// (`cli_parses_sessions_plural_canonical`, `cli_session_and_sessions_agree_for_every_verb`,
// `top_level_alias_notice_message`).

#[test]
fn cli_rejects_removed_coordinator_tui() {
    // #1392: the old top-level `tm coordinator-tui` was deleted (not aliased),
    // and the invocation must stay refused.
    //
    // #6441 moved WHERE that refusal happens. `Command::External` is a clap
    // `external_subcommand`, so the parse itself now SUCCEEDS for any token no
    // subcommand matches — this one included. The rejection is enforced one
    // step later instead: `commands::run_target::classify_bare` answers `None`
    // for a token that does not name a repository, and
    // `run_target::reject_unknown_subcommand` then reproduces the same clap
    // usage error and exit code this test used to read off the parse. The
    // behaviour a user sees is unchanged; only the layer asserting it moved.
    let cli = Cli::try_parse_from(["trusty-mpm", "coordinator-tui"]).unwrap();
    match cli.command.unwrap() {
        Command::External(tokens) => assert_eq!(tokens, ["coordinator-tui"]),
        other => panic!("expected the External catch-all, got {other:?}"),
    }
    assert!(
        crate::commands::run_target::classify_bare("coordinator-tui").is_none(),
        "a retired subcommand must route to the usage error, never to a managed run"
    );
}

#[test]
fn cli_parses_telegram_pair() {
    let cli = Cli::try_parse_from(["trusty-mpm", "telegram", "pair"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Telegram {
            cmd: TelegramCmd::Pair
        }
    ));
}

#[test]
fn cli_parses_telegram_status() {
    let cli = Cli::try_parse_from(["trusty-mpm", "telegram", "status"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Telegram {
            cmd: TelegramCmd::Status
        }
    ));
}

#[test]
fn cli_parses_telegram_stop() {
    let cli = Cli::try_parse_from(["trusty-mpm", "telegram", "stop"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Telegram {
            cmd: TelegramCmd::Stop
        }
    ));
}

#[test]
fn cli_telegram_requires_subcommand() {
    // `telegram` with no action is an error now that it is a group.
    assert!(Cli::try_parse_from(["trusty-mpm", "telegram"]).is_err());
}

#[test]
fn cli_parses_telegram_start_with_check() {
    let cli = Cli::try_parse_from(["trusty-mpm", "telegram", "start", "--check"]).unwrap();
    match cli.command.unwrap() {
        Command::Telegram {
            cmd: TelegramCmd::Start { check, token, .. },
        } => {
            assert!(check);
            assert_eq!(token, None);
        }
        other => panic!("expected Telegram start, got {other:?}"),
    }
}

#[test]
fn cli_parses_telegram_start_with_token() {
    let cli =
        Cli::try_parse_from(["trusty-mpm", "telegram", "start", "--token", "secret"]).unwrap();
    match cli.command.unwrap() {
        Command::Telegram {
            cmd: TelegramCmd::Start { token, check, .. },
        } => {
            assert_eq!(token.as_deref(), Some("secret"));
            assert!(!check);
        }
        other => panic!("expected Telegram start, got {other:?}"),
    }
}

#[test]
fn cli_parses_telegram_start_alert_and_user_flags() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "telegram",
        "start",
        "--alert-chat-id",
        "12345",
        "--allowed-user-id",
        "67890",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Telegram {
            cmd:
                TelegramCmd::Start {
                    alert_chat_id,
                    allowed_user_id,
                    ..
                },
        } => {
            assert_eq!(alert_chat_id, Some(12345));
            assert_eq!(allowed_user_id, Some(67890));
        }
        other => panic!("expected Telegram start, got {other:?}"),
    }
}

#[test]
fn cli_parses_slack_stop() {
    let cli = Cli::try_parse_from(["trusty-mpm", "slack", "stop"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Slack {
            cmd: SlackCmd::Stop
        }
    ));
}

#[test]
fn cli_slack_requires_subcommand() {
    // `slack` with no action is an error — it is a command group.
    assert!(Cli::try_parse_from(["trusty-mpm", "slack"]).is_err());
}

#[test]
fn cli_parses_slack_start_with_check() {
    let cli = Cli::try_parse_from(["trusty-mpm", "slack", "start", "--check"]).unwrap();
    match cli.command.unwrap() {
        Command::Slack {
            cmd:
                SlackCmd::Start {
                    check,
                    bot_token,
                    app_token,
                    ..
                },
        } => {
            assert!(check);
            assert_eq!(bot_token, None);
            assert_eq!(app_token, None);
        }
        other => panic!("expected Slack start, got {other:?}"),
    }
}

#[test]
fn cli_parses_slack_start_with_tokens() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "slack",
        "start",
        "--bot-token",
        "xoxb-secret",
        "--app-token",
        "xapp-secret",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Slack {
            cmd:
                SlackCmd::Start {
                    bot_token,
                    app_token,
                    check,
                    ..
                },
        } => {
            assert_eq!(bot_token.as_deref(), Some("xoxb-secret"));
            assert_eq!(app_token.as_deref(), Some("xapp-secret"));
            assert!(!check);
        }
        other => panic!("expected Slack start, got {other:?}"),
    }
}

#[test]
fn cli_parses_daemon_defaults() {
    let cli = Cli::try_parse_from(["trusty-mpm", "daemon"]).unwrap();
    match cli.command.unwrap() {
        Command::Daemon {
            addr,
            tailscale,
            mcp,
            force,
            sandbox,
        } => {
            assert_eq!(addr.to_string(), "127.0.0.1:7880");
            assert!(!tailscale);
            assert!(!mcp);
            assert!(!force);
            assert!(!sandbox);
        }
        other => panic!("expected Daemon, got {other:?}"),
    }
}

/// #9121: `tm daemon --sandbox` must parse.
#[test]
fn cli_parses_daemon_sandbox() {
    let cli = Cli::try_parse_from(["trusty-mpm", "daemon", "--sandbox"]).unwrap();
    match cli.command.unwrap() {
        Command::Daemon { sandbox, .. } => assert!(sandbox),
        other => panic!("expected Daemon, got {other:?}"),
    }
}

#[test]
fn cli_parses_daemon_tailscale() {
    let cli = Cli::try_parse_from(["trusty-mpm", "daemon", "--tailscale"]).unwrap();
    match cli.command.unwrap() {
        Command::Daemon { tailscale, .. } => assert!(tailscale),
        other => panic!("expected Daemon, got {other:?}"),
    }
}

/// Issue #4397: `tm daemon --force` must parse — the bare-CLI opt-in past the
/// #2486 unsupervised-launchd guard.
#[test]
fn cli_parses_daemon_force() {
    let cli = Cli::try_parse_from(["trusty-mpm", "daemon", "--force"]).unwrap();
    match cli.command.unwrap() {
        Command::Daemon { force, .. } => assert!(force),
        other => panic!("expected Daemon, got {other:?}"),
    }
}

/// Issue #4398: `infer_subcommands` lets an unambiguous prefix of a
/// subcommand name stand in for the full spelling, at every nesting level.
#[test]
fn cli_infers_abbreviated_subcommands() {
    // Top level, no nested action: "doc" only ever prefixes "doctor".
    let cli = Cli::try_parse_from(["trusty-mpm", "doc"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Doctor {
            flags: DoctorFlags {
                prune_stale_skills: false,
                ..
            }
        }
    ));

    // Top level, no other command starts with "heal".
    let cli = Cli::try_parse_from(["trusty-mpm", "heal"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Health));

    // Top level, no other command starts with "rest" ("register" is "reg").
    let cli = Cli::try_parse_from(["trusty-mpm", "rest"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Restart));

    // Inference also propagates into a nested action subcommand.
    let cli = Cli::try_parse_from(["trusty-mpm", "gen", "cap"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Generate { .. }));

    // Inference applies at the nested-action level too: "project ini" for
    // "project init".
    let cli = Cli::try_parse_from(["trusty-mpm", "project", "ini"]).unwrap();
    match cli.command.unwrap() {
        Command::Project {
            action: ProjectAction::Init { dir },
        } => assert_eq!(dir, None),
        other => panic!("expected Command::Project(Init), got {other:?}"),
    }
}

/// Issue #4398: `infer_subcommands` must never break an EXACT match, even
/// when that exact name is also a valid prefix of a sibling command name
/// (`hook`/`hooks`, `project`/`projects`, `session`/`sessions`,
/// `status`/`statusline`). clap resolves exact matches before falling back
/// to prefix inference, so all 8 of these keep resolving to their own
/// command rather than erroring out as an ambiguous prefix.
#[test]
fn cli_exact_match_wins_over_prefix_ambiguity() {
    let cli = Cli::try_parse_from(["trusty-mpm", "status"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Status));

    let cli = Cli::try_parse_from(["trusty-mpm", "statusline"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Statusline));

    let cli = Cli::try_parse_from(["trusty-mpm", "hook"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Hook {
            pm_guard: false,
            divert_check: false,
            // #7688: a bare `tm hook` is still the daemon relay, never the
            // prompt-feedback capture.
            prompt_feedback: false
        }
    ));

    let cli = Cli::try_parse_from(["trusty-mpm", "hooks", "clean"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Hooks { .. }));

    let cli = Cli::try_parse_from(["trusty-mpm", "project", "list"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Project {
            action: ProjectAction::List
        }
    ));

    let cli = Cli::try_parse_from(["trusty-mpm", "projects", "list"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Projects { .. }));

    let cli = Cli::try_parse_from(["trusty-mpm", "session", "start"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Session { .. }));

    let cli = Cli::try_parse_from(["trusty-mpm", "sessions", "start"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Sessions { .. }));
}

/// #4431 critic HIGH fix: proves the vulnerability precondition AND the
/// runtime guard together close the gap. clap's `infer_subcommands` still
/// resolves every one of these abbreviated prefixes to the HIDDEN
/// `Command::InternalSpawnDisclaimed` variant (`hide = true` only suppresses
/// `--help`, it does not exempt a subcommand from prefix inference) — but
/// `commands::spawn_disclaimed::invoked_literally`, which `main` calls on the
/// RAW argv before ever reaching the disclaimed-spawn leaf, rejects every one
/// of them because the operator did not type the exact, full subcommand
/// name. The exact spelling still parses AND passes the guard, so
/// `disclaim_pane_command`'s own literal self-invocation keeps working.
#[test]
fn cli_infers_internal_spawn_disclaimed_but_runtime_guard_rejects_abbreviations() {
    for prefix in ["int", "inte", "internal"] {
        let raw_argv: Vec<String> = vec!["trusty-mpm".into(), prefix.into(), "claude".into()];
        let cli = Cli::try_parse_from(raw_argv.clone()).unwrap();
        assert!(
            matches!(cli.command, Some(Command::InternalSpawnDisclaimed { .. })),
            "expected clap to still infer {prefix:?} to InternalSpawnDisclaimed"
        );
        assert!(
            !crate::commands::spawn_disclaimed::invoked_literally(&raw_argv),
            "the runtime guard must reject the abbreviated prefix {prefix:?}"
        );
    }

    let raw_argv: Vec<String> = vec![
        "trusty-mpm".into(),
        "internal-spawn-disclaimed".into(),
        "claude".into(),
    ];
    let cli = Cli::try_parse_from(raw_argv.clone()).unwrap();
    assert!(matches!(
        cli.command,
        Some(Command::InternalSpawnDisclaimed { .. })
    ));
    assert!(crate::commands::spawn_disclaimed::invoked_literally(
        &raw_argv
    ));
}

/// #4431 critic MEDIUM: `tm ins` (an unambiguous prefix of `install` only —
/// no other top-level command starts with "ins") must keep resolving to
/// `Command::Install`, confirming the new disclaim-shim guard is scoped to
/// that one hidden variant and does not collaterally affect ordinary
/// abbreviation elsewhere on the CLI surface.
#[test]
fn cli_infers_ins_to_install_unaffected_by_disclaim_guard() {
    let cli = Cli::try_parse_from(["trusty-mpm", "ins"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Install { .. }));
}

#[test]
fn cli_parses_supervisor() {
    let cli = Cli::try_parse_from(["trusty-mpm", "supervisor"]).unwrap();
    match cli.command.unwrap() {
        Command::Supervisor {
            interval,
            auto_resume,
            no_classify,
            ..
        } => {
            assert_eq!(interval, None);
            assert!(!auto_resume);
            assert!(!no_classify);
        }
        other => panic!("expected Supervisor, got {other:?}"),
    }
}

#[test]
fn cli_parses_supervisor_flags() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "supervisor",
        "--interval",
        "60",
        "--auto-resume",
        "--no-classify",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Supervisor {
            interval,
            auto_resume,
            no_classify,
            ..
        } => {
            assert_eq!(interval, Some(60));
            assert!(auto_resume);
            assert!(no_classify);
        }
        other => panic!("expected Supervisor, got {other:?}"),
    }
}

#[test]
fn deprecation_notice_format() {
    // The deprecation helper renders a stable, single-line message (#1205).
    // We assert the pure message builder since the eprintln side-effect itself
    // is untestable without capturing process stderr.
    use crate::commands::managed::deprecation_message;
    assert_eq!(
        deprecation_message("runtime-stop", "stop"),
        "warning: 'runtime-stop' is deprecated; use 'stop'"
    );
    assert_eq!(
        deprecation_message("managed-resume", "resume"),
        "warning: 'managed-resume' is deprecated; use 'resume'"
    );
}

// The bespoke `classify_managed_target` resolver was retired in Phase 1B
// (refs #1283); the managed-vs-project routing decision for `stop`/`resume` now
// goes through the ONE canonical `client::resolve_target`. These tests assert the
// SAME routing semantics they did before, but against that shared resolver — the
// `.map(|s| s.id.clone())` mirroring what `managed_route::resolve_managed_match`
// returns to the dispatcher.

#[test]
fn resolve_managed_target_matches_by_id() {
    // #1218: the canonical `stop`/`resume` verbs must recognize a managed
    // session by its UUID and route to the managed endpoint, not project-sessions.
    use trusty_mpm::client::{ManagedSessionSummary, resolve_target};
    let uuid = "11111111-2222-3333-4444-555555555555";
    let sessions: Vec<ManagedSessionSummary> = serde_json::from_value(serde_json::json!([
        { "id": uuid, "name": "tmpm-quiet-falcon", "state": "running" }
    ]))
    .unwrap();
    assert_eq!(
        resolve_target(&sessions, uuid).map(|s| s.id.clone()),
        Some(uuid.to_string()),
        "a managed UUID must resolve to the managed id (routes to managed endpoint)"
    );
}

#[test]
fn resolve_managed_target_matches_by_name_returns_id() {
    // A friendly managed name must resolve to the canonical UUID the managed
    // endpoints require, so `tm session stop <name>` works for managed sessions.
    use trusty_mpm::client::{ManagedSessionSummary, resolve_target};
    let uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
    let sessions: Vec<ManagedSessionSummary> = serde_json::from_value(serde_json::json!([
        { "id": uuid, "name": "tmpm-brave-otter", "state": "stopped" }
    ]))
    .unwrap();
    assert_eq!(
        resolve_target(&sessions, "tmpm-brave-otter").map(|s| s.id.clone()),
        Some(uuid.to_string()),
        "a managed name must resolve to its id, not be passed through verbatim"
    );
}

#[test]
fn resolve_managed_target_unknown_falls_back_to_none() {
    // A non-managed id/name must NOT match — the caller then falls back to the
    // project-session path, preserving the local/project-session family (#1218).
    use trusty_mpm::client::{ManagedSessionSummary, resolve_target};
    let sessions: Vec<ManagedSessionSummary> = serde_json::from_value(serde_json::json!([
        { "id": "11111111-2222-3333-4444-555555555555", "name": "tmpm-quiet-falcon", "state": "running" }
    ]))
    .unwrap();
    assert_eq!(
        resolve_target(&sessions, "some-local-session-name").map(|s| s.id.clone()),
        None,
        "an unknown id/name must yield None so `stop`/`resume` fall back to project-sessions"
    );
}

#[test]
fn resolve_managed_target_empty_list_is_none() {
    // With no managed sessions, every argument falls back to project-sessions.
    use trusty_mpm::client::{ManagedSessionSummary, resolve_target};
    let sessions: Vec<ManagedSessionSummary> = Vec::new();
    assert_eq!(
        resolve_target(&sessions, "anything").map(|s| s.id.clone()),
        None
    );
}

/// #8378 PR-C: the three `tm content` verbs and their flags.
#[test]
fn cli_parses_content_install_update_and_status() {
    use crate::cli::ContentAction;
    let parse = |args: &[&str]| {
        let mut argv = vec!["trusty-mpm", "content"];
        argv.extend_from_slice(args);
        match Cli::try_parse_from(argv).unwrap().command.unwrap() {
            Command::Content { action } => action,
            other => panic!("expected content, got {other:?}"),
        }
    };
    match parse(&["install", "--from", "/b/content-v0.1.0.tar.gz"]) {
        ContentAction::Install { from } => {
            assert_eq!(from, std::path::Path::new("/b/content-v0.1.0.tar.gz"));
        }
        other => panic!("expected install, got {other:?}"),
    }
    assert!(matches!(
        parse(&["update"]),
        ContentAction::Update { content_ref: None }
    ));
    match parse(&["update", "--content-ref", "content-v0.2.0"]) {
        ContentAction::Update { content_ref } => {
            assert_eq!(content_ref.as_deref(), Some("content-v0.2.0"));
        }
        other => panic!("expected update, got {other:?}"),
    }
    assert!(matches!(parse(&["status"]), ContentAction::Status));
    assert!(Cli::try_parse_from(["trusty-mpm", "content", "install"]).is_err());
}

/// #8389 owner ruling: `install --help` and `update --help` state that the
/// sidecar is required and checks the transfer only, with a first-use pin.
#[test]
fn cli_content_help_states_the_sidecar_limit() {
    use clap::CommandFactory as _;
    for verb in ["install", "update"] {
        let mut root = Cli::command();
        let help = root
            .find_subcommand_mut("content")
            .expect("content group")
            .find_subcommand_mut(verb)
            .expect("content verb")
            .render_long_help()
            .to_string();
        for needle in ["is required", "proves the transfer only", "first use"] {
            assert!(
                help.contains(needle),
                "`content {verb} --help` omits {needle}"
            );
        }
    }
}

#[test]
fn cli_parses_catalog_sync() {
    let cli = Cli::try_parse_from(["trusty-mpm", "catalog", "sync", "--force"]).unwrap();
    match cli.command.unwrap() {
        Command::Catalog {
            action: CatalogAction::Sync { force },
        } => assert!(force),
        other => panic!("expected catalog sync, got {other:?}"),
    }
}

#[test]
fn cli_parses_catalog_ls() {
    let cli = Cli::try_parse_from(["trusty-mpm", "catalog", "ls"]).unwrap();
    match cli.command.unwrap() {
        Command::Catalog {
            action: CatalogAction::Ls { json },
        } => assert!(!json),
        other => panic!("expected catalog ls, got {other:?}"),
    }
}

#[test]
fn cli_parses_catalog_status() {
    let cli = Cli::try_parse_from(["trusty-mpm", "catalog", "status", "--json"]).unwrap();
    match cli.command.unwrap() {
        Command::Catalog {
            action: CatalogAction::Status { json },
        } => assert!(json),
        other => panic!("expected catalog status, got {other:?}"),
    }
}

#[test]
fn cli_parses_catalog_apply() {
    let cli =
        Cli::try_parse_from(["trusty-mpm", "catalog", "apply", "--force", "--prune"]).unwrap();
    match cli.command.unwrap() {
        Command::Catalog {
            action: CatalogAction::Apply { force, prune },
        } => {
            assert!(force);
            assert!(prune);
        }
        other => panic!("expected catalog apply, got {other:?}"),
    }
}

#[test]
fn cli_parses_catalog_apply_defaults() {
    // Without flags, both `force` and `prune` default to false (no surprise
    // network refetch, no surprise removals).
    let cli = Cli::try_parse_from(["trusty-mpm", "catalog", "apply"]).unwrap();
    match cli.command.unwrap() {
        Command::Catalog {
            action: CatalogAction::Apply { force, prune },
        } => {
            assert!(!force);
            assert!(!prune);
        }
        other => panic!("expected catalog apply, got {other:?}"),
    }
}

#[test]
fn cli_parses_ticket() {
    // Why: the minimal form `tm ticket <issue#>` must parse with the `gh`
    // backend as the default and an empty notes list (#1237).
    use crate::commands::ticket::system::TicketSystemKind;
    let cli = Cli::try_parse_from(["trusty-mpm", "ticket", "1232"]).unwrap();
    match cli.command.unwrap() {
        Command::Ticket {
            issue,
            system,
            notes,
            runtime,
        } => {
            assert_eq!(issue, "1232");
            assert_eq!(system, TicketSystemKind::Gh);
            assert!(notes.is_empty());
            assert_eq!(runtime, trusty_mpm::runtime::RuntimeKind::ClaudeCode);
        }
        other => panic!("expected ticket, got {other:?}"),
    }
}

#[test]
fn cli_parses_ticket_with_hash_and_system() {
    // Why: the leading `#` is allowed and the `[system]` positional selects the
    // backend (#1237).
    use crate::commands::ticket::system::TicketSystemKind;
    let cli = Cli::try_parse_from(["trusty-mpm", "ticket", "#1232", "jira"]).unwrap();
    match cli.command.unwrap() {
        Command::Ticket { issue, system, .. } => {
            assert_eq!(issue, "#1232");
            assert_eq!(system, TicketSystemKind::Jira);
        }
        other => panic!("expected ticket, got {other:?}"),
    }
}

#[test]
fn cli_parses_ticket_with_notes() {
    // Why: `--note/-m` is repeatable and each value is posted as an issue comment
    // for the audit trail (#1237).
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "ticket",
        "42",
        "-m",
        "starting work",
        "--note",
        "second note",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Ticket { issue, notes, .. } => {
            assert_eq!(issue, "42");
            assert_eq!(notes, vec!["starting work", "second note"]);
        }
        other => panic!("expected ticket, got {other:?}"),
    }
}

#[test]
fn cli_rejects_ticket_unknown_system() {
    // Why: an unknown `[system]` value must be rejected at parse time with a
    // "possible values" hint, not silently forwarded (#1237).
    let err = Cli::try_parse_from(["trusty-mpm", "ticket", "1", "bogus"]);
    assert!(err.is_err(), "expected unknown system to be rejected");
}

#[test]
fn cli_parses_issue_seed_labels() {
    // Why: `tm issue seed-labels [--dry-run]` must parse with the gh default
    // and surface the dry-run flag (#1246).
    use crate::cli::IssueCmd;
    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "seed-labels", "--dry-run"]).unwrap();
    match cli.command.unwrap() {
        Command::Issue { cmd, .. } => match cmd {
            IssueCmd::SeedLabels {
                dry_run,
                config,
                only,
            } => {
                assert!(dry_run);
                assert!(config.is_none());
                assert!(only.is_empty(), "an unscoped run has no filters");
            }
            other => panic!("expected seed-labels, got {other:?}"),
        },
        other => panic!("expected issue, got {other:?}"),
    }
}

/// #7983: `--only` is repeatable, so one run can name two families.
#[test]
fn cli_parses_issue_seed_labels_only_filters_7983() {
    use crate::cli::IssueCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "seed-labels",
        "--only",
        "status:",
        "--only",
        "trusty-mpm",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue { cmd, .. } => match cmd {
            IssueCmd::SeedLabels { only, dry_run, .. } => {
                assert_eq!(only, vec!["status:".to_string(), "trusty-mpm".to_string()]);
                assert!(!dry_run);
            }
            other => panic!("expected seed-labels, got {other:?}"),
        },
        other => panic!("expected issue, got {other:?}"),
    }
}

#[test]
fn cli_parses_issue_transition() {
    // Why: `tm issue transition <issue#> <to-state> [--note]` must parse the
    // numeric issue, the target state, and the optional note (#1246).
    use crate::cli::IssueCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "transition",
        "1232",
        "approved",
        "--note",
        "approved by reviewer",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue { cmd, .. } => match cmd {
            IssueCmd::Transition {
                issue,
                to_state,
                note,
                ..
            } => {
                assert_eq!(issue, 1232);
                assert_eq!(to_state, "approved");
                assert_eq!(note.as_deref(), Some("approved by reviewer"));
            }
            other => panic!("expected transition, got {other:?}"),
        },
        other => panic!("expected issue, got {other:?}"),
    }
}

#[test]
fn cli_parses_issue_current_and_states_and_repair() {
    // Why: the read/introspection/recovery verbs must all parse (#1246).
    use crate::cli::IssueCmd;
    let current = Cli::try_parse_from(["trusty-mpm", "issue", "current", "7"]).unwrap();
    assert!(matches!(
        current.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Current { issue: 7, .. },
            ..
        }
    ));
    let states = Cli::try_parse_from(["trusty-mpm", "issue", "states"]).unwrap();
    assert!(matches!(
        states.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::States { .. },
            ..
        }
    ));
    let repair = Cli::try_parse_from(["trusty-mpm", "issue", "repair", "9"]).unwrap();
    assert!(matches!(
        repair.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Repair { issue: 9, .. },
            ..
        }
    ));
}

#[test]
fn cli_parses_issue_seed_config_force() {
    // Why: `tm issue seed-config --force` must parse the overwrite flag (#1246).
    use crate::cli::IssueCmd;
    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "seed-config", "--force"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::SeedConfig { force: true },
            ..
        }
    ));
}

#[test]
fn cli_parses_issue_audit_single_and_window() {
    // #7097: the three shapes a script drives — one issue, a recent window, a
    // dated window — plus the conflict that keeps a number and a window from
    // being asked for at once.
    use crate::cli::IssueCmd;

    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "audit", "7093"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Audit {
                issue: Some(7093),
                recent: None,
                since: None
            },
            ..
        }
    ));

    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "audit", "--recent", "20"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Audit {
                issue: None,
                recent: Some(20),
                since: None
            },
            ..
        }
    ));

    let cli =
        Cli::try_parse_from(["trusty-mpm", "issue", "audit", "--since", "2026-09-01"]).unwrap();
    match cli.command.unwrap() {
        Command::Issue {
            cmd: IssueCmd::Audit { since, .. },
            ..
        } => assert_eq!(since.as_deref(), Some("2026-09-01")),
        other => panic!("expected issue audit --since, got {other:?}"),
    }

    // A number AND a window would leave the verb guessing which one was meant.
    assert!(
        Cli::try_parse_from(["trusty-mpm", "issue", "audit", "7093", "--recent", "5"]).is_err(),
        "an issue number and --recent must conflict"
    );
    assert!(
        Cli::try_parse_from([
            "trusty-mpm",
            "issue",
            "audit",
            "--recent",
            "5",
            "--since",
            "2026-09-01"
        ])
        .is_err(),
        "--recent and --since must conflict"
    );
}

/// #8447: `tm issue epic create --from <plan>` carries the filing inputs a plan
/// document cannot supply — milestone, component, project, session.
#[test]
fn cli_parses_issue_epic_create() {
    use crate::cli::{EpicCmd, IssueCmd};
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "epic",
        "create",
        "--from",
        "docs/research/tm-epic-cli/epic-plan.md",
        "--milestone",
        "Issue management",
        "--component",
        "trusty-mpm",
        "--project",
        "3",
        "--dry-run",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue {
            cmd:
                IssueCmd::Epic(EpicCmd::Create {
                    from,
                    milestone,
                    component,
                    phase_type,
                    project,
                    session,
                    tracker,
                    dry_run,
                }),
            ..
        } => {
            assert_eq!(
                from.to_string_lossy(),
                "docs/research/tm-epic-cli/epic-plan.md"
            );
            assert_eq!(milestone.as_deref(), Some("Issue management"));
            assert_eq!(component, vec!["trusty-mpm".to_string()]);
            assert_eq!(phase_type, "enhancement", "the default type label");
            assert_eq!(project, Some(3));
            assert!(session.is_none());
            assert!(tracker.is_none());
            assert!(dry_run);
        }
        other => panic!("expected issue epic create, got {other:?}"),
    }
}

/// #8447: `--component` is repeatable, and `--tracker` resumes an interrupted
/// run into an existing tracker.
#[test]
fn cli_parses_issue_epic_create_repeatable_components() {
    use crate::cli::{EpicCmd, IssueCmd};
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "epic",
        "create",
        "--from",
        "plan.md",
        "--milestone",
        "Backlog · mpm/core",
        "--component",
        "trusty-mpm",
        "--component",
        "trusty-common",
        "--phase-type",
        "refactor",
        "--session",
        "tm-trusty-tools-15",
        "--tracker",
        "8445",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue {
            cmd:
                IssueCmd::Epic(EpicCmd::Create {
                    component,
                    phase_type,
                    session,
                    tracker,
                    dry_run,
                    ..
                }),
            ..
        } => {
            assert_eq!(
                component,
                vec!["trusty-mpm".to_string(), "trusty-common".to_string()]
            );
            assert_eq!(phase_type, "refactor");
            assert_eq!(session.as_deref(), Some("tm-trusty-tools-15"));
            assert_eq!(tracker, Some(8445));
            assert!(!dry_run);
        }
        other => panic!("expected issue epic create, got {other:?}"),
    }
    // `--from` names the schema the whole verb reads; it is not optional.
    assert!(
        Cli::try_parse_from(["trusty-mpm", "issue", "epic", "create"]).is_err(),
        "--from must be required"
    );
}

/// #8447: `tm issue epic sync <epic#>` takes the tracker positionally.
#[test]
fn cli_parses_issue_epic_sync() {
    use crate::cli::{EpicCmd, IssueCmd};
    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "epic", "sync", "8445"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Epic(EpicCmd::Sync { epic: 8445 }),
            ..
        }
    ));
    assert!(
        Cli::try_parse_from(["trusty-mpm", "issue", "epic", "sync"]).is_err(),
        "the tracker number must be required"
    );
}

#[test]
fn cli_parses_issue_epic_defer() {
    use crate::cli::{EpicCmd, IssueCmd};
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "epic",
        "defer",
        "8445",
        "--item",
        "the gap",
        "--why",
        "later",
        "--where",
        "unscheduled",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue {
            cmd:
                IssueCmd::Epic(EpicCmd::Defer {
                    epic,
                    item,
                    why,
                    destination,
                }),
            ..
        } => {
            assert_eq!(epic, 8445);
            assert_eq!(item, "the gap");
            assert_eq!(why, "later");
            assert_eq!(destination, "unscheduled");
        }
        other => panic!("unexpected: {other:?}"),
    }
    // All three cells are required flags.
    assert!(
        Cli::try_parse_from([
            "trusty-mpm",
            "issue",
            "epic",
            "defer",
            "8445",
            "--item",
            "x"
        ])
        .is_err()
    );
}

#[test]
fn cli_parses_issue_epic_close() {
    use crate::cli::{EpicCmd, IssueCmd};
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "issue",
        "epic",
        "close",
        "8445",
        "--evidence",
        "O1: PR #1",
        "--evidence",
        "O2: PR #2",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Issue {
            cmd: IssueCmd::Epic(EpicCmd::Close { epic, evidence }),
            ..
        } => {
            assert_eq!(epic, 8445);
            assert_eq!(evidence, vec!["O1: PR #1", "O2: PR #2"]);
        }
        other => panic!("unexpected: {other:?}"),
    }
    // `--evidence` is repeatable and optional at parse time; the verb itself
    // refuses when the declared outcomes are not all covered.
    let cli = Cli::try_parse_from(["trusty-mpm", "issue", "epic", "close", "8445"]).unwrap();
    assert!(matches!(
        cli.command.unwrap(),
        Command::Issue {
            cmd: IssueCmd::Epic(EpicCmd::Close { epic: 8445, .. }),
            ..
        }
    ));
}

#[test]
fn cli_parses_watch_poll_minimal() {
    // Why: the minimal `tm watch poll <project>` must parse with safety defaults
    // (dry-run off but execute also off → dry-run behaviour) and claude-code.
    use crate::cli::WatchCmd;
    let cli = Cli::try_parse_from(["trusty-mpm", "watch", "poll", "owner/repo"]).unwrap();
    match cli.command.unwrap() {
        Command::Watch {
            cmd: WatchCmd::Poll { args },
        } => {
            assert_eq!(args.project, "owner/repo");
            assert!(args.label.is_none());
            assert!(!args.dry_run);
            assert!(!args.execute, "execute must default off (safe)");
            assert!(args.interval_secs.is_none());
            assert!(args.state.is_none());
            assert_eq!(args.runtime, trusty_mpm::runtime::RuntimeKind::ClaudeCode);
        }
        other => panic!("expected watch poll, got {other:?}"),
    }
}

#[test]
fn cli_parses_watch_poll_with_flags() {
    // Why: `--label`, `--state`, and `--execute` must all parse on poll.
    use crate::cli::WatchCmd;
    use crate::commands::watch::github::IssueState;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "watch",
        "poll",
        "acme/widget",
        "--label",
        "ship-it",
        "--state",
        "all",
        "--execute",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Watch {
            cmd: WatchCmd::Poll { args },
        } => {
            assert_eq!(args.project, "acme/widget");
            assert_eq!(args.label.as_deref(), Some("ship-it"));
            assert_eq!(args.state, Some(IssueState::All));
            assert!(args.execute);
        }
        other => panic!("expected watch poll, got {other:?}"),
    }
}

#[test]
fn cli_parses_watch_listen_with_interval() {
    // Why: `tm watch listen <project> --interval-secs N --dry-run` must parse the
    // listen-specific interval and the explicit safe flag.
    use crate::cli::WatchCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "watch",
        "listen",
        "owner/repo",
        "--interval-secs",
        "30",
        "--dry-run",
    ])
    .unwrap();
    match cli.command.unwrap() {
        Command::Watch {
            cmd: WatchCmd::Listen { args },
        } => {
            assert_eq!(args.project, "owner/repo");
            assert_eq!(args.interval_secs, Some(30));
            assert!(args.dry_run);
        }
        other => panic!("expected watch listen, got {other:?}"),
    }
}

// WI-10: `tm login` must parse to Command::Login.
#[test]
fn cli_parses_login_standalone() {
    // Why: `tm login` is the one-time keychain auth command (WI-10). It must
    // parse cleanly to the Login variant with no required arguments.
    // What: assert that `tm login` maps to Command::Login.
    // Test: direct parse round-trip.
    let cli = Cli::try_parse_from(["trusty-mpm", "login"]).unwrap();
    assert!(matches!(cli.command.unwrap(), Command::Login { .. }));
}

// ── Image-banner color tests ──────────────────────────────────────────────────

// Issue #1858: `shade_image` used to probe the process-global
// `colored::control` override internally, so these tests had to serialize on
// COLOR_LOCK and mutate/restore that global to exercise the color-on and
// color-off paths — and the sibling test in `two_panel.rs` that did the same
// without the lock was the actual flaky test. `shade_image` now takes
// `use_color` as an explicit parameter, so every test below passes it
// directly; no global mutation or lock is needed anywhere in this file.

#[test]
fn image_clip_has_correct_dimensions() {
    // Why: auto-sizing must produce rows that match the art's actual line count
    // and all rows must have the same display width (the art's max width).
    // What: call shade_image on the embedded default and check row count + col
    // consistency.
    // Test: direct call to shade_image with DEFAULT_BANNER_ART.
    use crate::formatters::banner::{shade_image, source::DEFAULT_BANNER_ART};
    let (lines, cols) = shade_image(DEFAULT_BANNER_ART, false);
    let raw_count = DEFAULT_BANNER_ART.lines().count();
    assert_eq!(
        lines.len(),
        raw_count,
        "shade_image row count must match art line count"
    );
    assert!(cols > 0, "auto-sized cols must be > 0");
    assert!(cols >= 20, "compact-splash art is at least 20 columns wide");
}

#[test]
fn art_char_shading_emits_truecolor() {
    // Why: shade_image must emit truecolor escapes when the caller asks for
    // color (#1839 Fix 3), independent of any process-global state.
    // What: call shade_image with `use_color = true` and verify at least one
    // line contains a truecolor ANSI escape (`\x1B[38;2;`).
    // Test: pure function call, no shared state to race.
    use crate::formatters::banner::{shade_image, source::DEFAULT_BANNER_ART};
    let (lines, _) = shade_image(DEFAULT_BANNER_ART, true);
    let any_colored = lines.iter().any(|l| l.contains("\x1B[38;2;"));
    assert!(
        any_colored,
        "shaded art must emit truecolor escapes when color is enabled"
    );
}

#[test]
fn art_shading_no_ansi_when_color_disabled() {
    // Why: shade_image must suppress ANSI escapes when color is disabled so that
    // banner output piped to a file or CI log is clean plain text (#1839 Fix 3).
    // What: call shade_image with `use_color = false` and assert no line
    // contains an ANSI escape byte.
    // Test: pure function call, no shared state to race.
    use crate::formatters::banner::{shade_image, source::DEFAULT_BANNER_ART};
    let (lines, _) = shade_image(DEFAULT_BANNER_ART, false);
    for line in &lines {
        assert!(
            !line.contains('\x1B'),
            "shade_image must not emit ANSI escapes when color is disabled: {line:?}"
        );
    }
}

#[test]
fn art_shading_spaces_are_uncolored() {
    // Why: spaces in the art should be transparent (no color escape), so
    // the terminal background shows through rather than applying a tint.
    // What: verify that space chars in shaded image lines have no escape prefix.
    // Test: check that strip_ansi still finds spaces in the output.
    use crate::formatters::banner::{
        shade_image, source::DEFAULT_BANNER_ART, two_panel::strip_ansi,
    };
    let (lines, _) = shade_image(DEFAULT_BANNER_ART, true);
    let has_space = lines.iter().any(|l| strip_ansi(l).contains(' '));
    assert!(has_space, "shaded art must contain some uncolored spaces");
}

#[test]
fn narrow_fallback_reconnect_box_includes_reconnecting_text() {
    // Why: the single-box narrow fallback (< MIN_WIDTH_TWO_PANEL) must include
    // "Reconnecting..." when reconnecting=true — matching the wide layout's
    // reconnect indicator. This verifies the fix from commit 54690868 is
    // preserved under the new single-box design.
    // What: render via `render_two_panel_banner` with a narrow width and
    // reconnecting=true; assert the label appears.
    // Test: pure string assertion via the public compositor.
    use crate::formatters::banner::two_panel::{render_two_panel_banner, strip_ansi};
    use crate::formatters::info_box::{ConsoleInfo, DaemonInfo, WelcomeData};
    colored::control::set_override(false);
    let data = WelcomeData {
        project: "my-project".to_string(),
        workspace: "/tmp/my-project".to_string(),
        user: String::new(),
        reconnecting: true,
        session_name: "tmpm-my-project".to_string(),
        daemon: DaemonInfo::default(),
        // #6761: the services block gained a console row.
        console: ConsoleInfo::default(),
        recent_commits: vec![],
        memory_status: "(not detected)".to_string(),
        search_status: "(not detected)".to_string(),
        review_status: "(not detected)".to_string(),
    };
    // 80-col: narrow stacked box.
    let out = render_two_panel_banner(&data, 80, true).expect("narrow box");
    let bare = strip_ansi(&out);
    assert!(
        bare.contains("Reconnecting..."),
        "narrow reconnect box must contain 'Reconnecting...' label"
    );
    // Also verify the outer box is intact.
    let first = bare.lines().next().unwrap_or("");
    assert!(first.starts_with('╭'), "must have outer box top border");
    colored::control::unset_override();
}

#[test]
fn narrow_fallback_normal_box_does_not_include_reconnecting_text() {
    // Why: normal launch (reconnecting=false) narrow box must NOT show
    // "Reconnecting..." — the operator should see the launch context only.
    use crate::formatters::banner::two_panel::{render_two_panel_banner, strip_ansi};
    use crate::formatters::info_box::{ConsoleInfo, DaemonInfo, WelcomeData};
    colored::control::set_override(false);
    let data = WelcomeData {
        project: "my-project".to_string(),
        workspace: "/tmp/my-project".to_string(),
        user: String::new(),
        reconnecting: false,
        session_name: String::new(),
        daemon: DaemonInfo::default(),
        // #6761: the services block gained a console row.
        console: ConsoleInfo::default(),
        recent_commits: vec![],
        memory_status: "(not detected)".to_string(),
        search_status: "(not detected)".to_string(),
        review_status: "(not detected)".to_string(),
    };
    let out = render_two_panel_banner(&data, 80, false).expect("narrow box");
    let bare = strip_ansi(&out);
    assert!(
        !bare.contains("Reconnecting..."),
        "normal launch narrow box must not contain 'Reconnecting...' label"
    );
    colored::control::unset_override();
}

#[test]
fn cli_parses_banner() {
    // Why: `tm banner` must parse and default `--reconnecting` to false.
    // What: parse "banner" and assert the variant and flag are correct.
    // Test: direct clap parse.
    use crate::cli::{Cli, Command};
    use clap::Parser;
    let cli = Cli::try_parse_from(["tm", "banner"]).expect("banner must parse");
    assert!(
        matches!(
            cli.command,
            Some(Command::Banner {
                reconnecting: false
            })
        ),
        "expected Banner {{ reconnecting: false }}"
    );
}

#[test]
fn cli_parses_banner_reconnecting() {
    // Why: `tm banner --reconnecting` must set the flag to true.
    // What: parse "banner --reconnecting" and assert the reconnecting flag.
    // Test: direct clap parse.
    use crate::cli::{Cli, Command};
    use clap::Parser;
    let cli = Cli::try_parse_from(["tm", "banner", "--reconnecting"])
        .expect("banner --reconnecting must parse");
    assert!(
        matches!(cli.command, Some(Command::Banner { reconnecting: true })),
        "expected Banner {{ reconnecting: true }}"
    );
}

#[test]
fn banner_preview_no_clear_escape() {
    // Why: the `tm banner` preview must NOT begin with the full-screen clear
    // sequence — that would wipe the user's scrollback.
    // What: capture whether the print_banner_preview output starts with the
    // clear escape. Since it writes to stdout, we verify indirectly via the
    // single-box compositor which is used for the preview path.
    use crate::formatters::banner::two_panel::{render_two_panel_banner, strip_ansi};
    use crate::formatters::info_box::{ConsoleInfo, DaemonInfo, WelcomeData};
    colored::control::set_override(false);
    let data = WelcomeData {
        project: "p".to_string(),
        workspace: "/tmp/p".to_string(),
        user: String::new(),
        reconnecting: false,
        session_name: String::new(),
        daemon: DaemonInfo::default(),
        // #6761: the services block gained a console row.
        console: ConsoleInfo::default(),
        recent_commits: vec![],
        memory_status: "(not detected)".to_string(),
        search_status: "(not detected)".to_string(),
        review_status: "(not detected)".to_string(),
    };
    let out = render_two_panel_banner(&data, 120, false).expect("banner");
    // The compositor never emits a screen-clear — that is added by the print
    // wrappers only, and only for the launch (not preview) path.
    assert!(
        !out.starts_with("\x1B[2J"),
        "compositor output must not start with screen-clear escape"
    );
    // Version appears in the title bar.
    let bare = strip_ansi(&out);
    assert!(
        bare.contains(env!("CARGO_PKG_VERSION")),
        "compositor output must contain version in title bar"
    );
    colored::control::unset_override();
}

#[test]
fn banner_preview_does_not_panic() {
    // Why: `print_banner_preview` probes env/files that may or may not be present;
    // it must never panic in a clean environment.
    // What: call print_banner_preview with both reconnecting states; assert no panic.
    // Test: if the function returns, the assertion is trivially met.
    // Note: output goes to stdout; suppress by redirecting in the test environment.
    crate::formatters::banner::print_banner_preview(false);
    crate::formatters::banner::print_banner_preview(true);
}

#[test]
fn health_catalog_stale_message_contains_action() {
    // Why: operators should see an actionable command when the catalog is stale
    // or never synced — "updates available" without a fix is unhelpful (#1839 Fix 4).
    // What: asserts against the production constants from misc.rs so any change to
    // the actual output string is caught here rather than silently diverging.
    // Test: if `CATALOG_STALE_MSG` or `CATALOG_UNKNOWN_MSG` in misc.rs no longer
    // contains "tm catalog sync", this test fails and flags the regression.
    assert!(
        CATALOG_STALE_MSG.contains("tm catalog sync"),
        "CATALOG_STALE_MSG must name the fix command: {CATALOG_STALE_MSG:?}"
    );
    assert!(
        CATALOG_UNKNOWN_MSG.contains("tm catalog sync"),
        "CATALOG_UNKNOWN_MSG must name the fix command: {CATALOG_UNKNOWN_MSG:?}"
    );
}

#[test]
fn non_git_dir_fallback_prints_help_hint() {
    // Why: `tm` run from a non-git directory should exit cleanly with a help hint
    // rather than an error exit code (#1839 Fix 2).
    // What: asserts against `NON_GIT_FALLBACK_HINT` from misc.rs — the constant
    // that `fallback_protected` in guided.rs actually passes to `eprintln!`. If
    // the hint string is changed to drop "--help", this test catches it immediately.
    // Test: if `NON_GIT_FALLBACK_HINT` no longer mentions "--help", this fails.
    assert!(
        NON_GIT_FALLBACK_HINT.contains("--help"),
        "NON_GIT_FALLBACK_HINT must reference --help for discoverability: \
         {NON_GIT_FALLBACK_HINT:?}"
    );
}

/// Why (#8352): `tm memory recall` is the fallback a PM reaches for when the
/// `mcp__trusty-memory__*` tools are dead, so the verb, its bare form, and every
/// flag that mirrors the `memory_recall` schema must parse. Before #8352 this
/// argv was `error: unrecognized subcommand 'recall'` (exit 2).
#[test]
fn cli_parses_memory_recall() {
    let cli = Cli::try_parse_from(["trusty-mpm", "memory", "recall", "who owns the ledger"])
        .expect("`tm memory recall <query>` must parse");
    match cli.command.unwrap() {
        Command::Memory {
            action:
                MemoryAction::Recall {
                    query,
                    palace,
                    top_k,
                    room,
                    wing,
                    min_score,
                    json,
                    memory_socket,
                },
        } => {
            assert_eq!(query, "who owns the ledger");
            assert!(palace.is_none(), "the palace defaults to the session's own");
            assert!(top_k.is_none(), "top_k defaults to trusty-memory's own");
            assert!(room.is_none());
            assert!(wing.is_none());
            assert!(min_score.is_none());
            assert!(!json);
            assert!(memory_socket.is_none());
        }
        other => panic!("expected Memory/Recall, got {other:?}"),
    }
}

/// Why (#8352): the overrides are what make the verb usable from a script — the
/// palace override, the machine-readable envelope, and the socket a test rig or
/// a second daemon is reached on.
#[test]
fn cli_parses_memory_recall_with_overrides() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "memory",
        "recall",
        "q",
        "--palace",
        "other-palace",
        "--top-k",
        "3",
        "--room",
        "Planning",
        "--min-score",
        "0.4",
        "--json",
        "--memory-socket",
        "/tmp/trusty-memory.sock",
    ])
    .expect("every recall flag must parse");
    match cli.command.unwrap() {
        Command::Memory {
            action:
                MemoryAction::Recall {
                    palace,
                    top_k,
                    room,
                    min_score,
                    json,
                    memory_socket,
                    ..
                },
        } => {
            assert_eq!(palace.as_deref(), Some("other-palace"));
            assert_eq!(top_k, Some(3));
            assert_eq!(room.as_deref(), Some("Planning"));
            assert_eq!(min_score, Some(0.4));
            assert!(json);
            assert_eq!(
                memory_socket.as_deref(),
                Some(std::path::Path::new("/tmp/trusty-memory.sock"))
            );
        }
        other => panic!("expected Memory/Recall, got {other:?}"),
    }
}

/// Why (#8352): `--wing` and `--room` scope the same search two ways, and
/// trusty-memory refuses them together — so the CLI refuses them at parse time
/// rather than spending a round trip to be told.
#[test]
fn cli_refuses_memory_recall_wing_with_room() {
    let err = Cli::try_parse_from([
        "trusty-mpm",
        "memory",
        "recall",
        "q",
        "--room",
        "Planning",
        "--wing",
        "engineer",
    ])
    .expect_err("wing and room together must be refused at parse time");
    assert_eq!(err.kind(), clap::error::ErrorKind::ArgumentConflict);
}

/// Why (#8352): the write verbs are the other half of the fallback. `--tag`
/// repeats, because a drawer carries several.
#[test]
fn cli_parses_memory_remember_with_tags() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "memory",
        "remember",
        "the ledger is owned by ops",
        "--tag",
        "ownership",
        "--tag",
        "ledger",
        "--room",
        "Planning",
        "--fact-key=ws:s1/resume",
        "--expires-at=2026-10-06T12:00:00Z",
    ])
    .expect("`tm memory remember <text>` must parse");
    match cli.command.unwrap() {
        Command::Memory {
            action:
                MemoryAction::Remember {
                    text,
                    palace,
                    room,
                    tags,
                    fact_key,
                    expires_at,
                    json,
                    memory_socket,
                },
        } => {
            assert_eq!(text, "the ledger is owned by ops");
            assert_eq!(fact_key.as_deref(), Some("ws:s1/resume")); // #9142
            assert_eq!(expires_at.as_deref(), Some("2026-10-06T12:00:00Z"));
            assert!(palace.is_none());
            assert_eq!(room.as_deref(), Some("Planning"));
            assert_eq!(tags, vec!["ownership".to_string(), "ledger".to_string()]);
            assert!(!json);
            assert!(memory_socket.is_none());
        }
        other => panic!("expected Memory/Remember, got {other:?}"),
    }
}

/// Why (#8352): `note` takes `content`, not `text` — the same split the MCP
/// schema draws, so a caller who knows one surface knows the other.
#[test]
fn cli_parses_memory_note() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "memory",
        "note",
        "deploy target is prod-east",
        "--palace",
        "p",
        "--json",
    ])
    .expect("`tm memory note <content>` must parse");
    match cli.command.unwrap() {
        Command::Memory {
            action:
                MemoryAction::Note {
                    content,
                    palace,
                    tags,
                    json,
                    ..
                },
        } => {
            assert_eq!(content, "deploy target is prod-east");
            assert_eq!(palace.as_deref(), Some("p"));
            assert!(tags.is_empty());
            assert!(json);
        }
        other => panic!("expected Memory/Note, got {other:?}"),
    }
}

/// #9340: `tm memory forget <drawer-id>` takes the id positionally, plus the
/// same `--palace`/`--memory-socket`/`--json` flags as the other verbs.
#[test]
fn cli_parses_memory_forget() {
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "memory",
        "forget",
        "0b6f3c1e-8a52-4c1d-9e0f-2a7b5c4d3e21",
        "--palace",
        "p",
        "--memory-socket",
        "/tmp/m.sock",
        "--json",
    ])
    .expect("`tm memory forget <drawer-id>` must parse");
    match cli.command.unwrap() {
        Command::Memory {
            action:
                MemoryAction::Forget {
                    drawer_id,
                    fact_key,
                    palace,
                    json,
                    memory_socket,
                },
        } => {
            assert_eq!(
                drawer_id.as_deref(),
                Some("0b6f3c1e-8a52-4c1d-9e0f-2a7b5c4d3e21")
            );
            assert_eq!(fact_key, None);
            assert_eq!(palace.as_deref(), Some("p"));
            assert_eq!(memory_socket, Some(std::path::PathBuf::from("/tmp/m.sock")));
            assert!(json);
        }
        other => panic!("expected Memory/Forget, got {other:?}"),
    }
    // The id is required: a bare `forget` is a usage error, not a no-op.
    assert!(Cli::try_parse_from(["trusty-mpm", "memory", "forget"]).is_err());
}

/// #9340 arm 7: `--fact-key` stands in for the positional id, never beside it,
/// and one of the two is required.
#[test]
fn cli_parses_memory_forget_by_fact_key() {
    let forget = |extra: &[&str]| {
        let mut argv = vec!["trusty-mpm", "memory", "forget"];
        argv.extend_from_slice(extra);
        Cli::try_parse_from(argv)
    };
    assert!(
        forget(&["--fact-key", "pr:9340/state"]).is_ok(),
        "`forget --fact-key <key>` must parse"
    );
    assert!(
        forget(&[
            "0b6f3c1e-8a52-4c1d-9e0f-2a7b5c4d3e21",
            "--fact-key",
            "pr:9340/state"
        ])
        .is_err(),
        "an id and --fact-key together must be refused"
    );
    assert!(
        forget(&[]).is_err(),
        "neither an id nor --fact-key: refused"
    );
}

#[test]
fn cli_parses_shell_init() {
    // The dialect is a closed set: a typo must be refused at parse time rather
    // than reaching the emitter and printing a snippet for the wrong shell.
    for (arg, want) in [
        ("zsh", ShellArg::Zsh),
        ("bash", ShellArg::Bash),
        ("fish", ShellArg::Fish),
    ] {
        let cli = Cli::try_parse_from(["trusty-mpm", "shell-init", arg]).unwrap();
        match cli.command.unwrap() {
            Command::ShellInit { shell } => assert_eq!(shell, want),
            other => panic!("expected ShellInit, got {other:?}"),
        }
    }
    assert!(Cli::try_parse_from(["trusty-mpm", "shell-init", "ksh"]).is_err());
    assert!(Cli::try_parse_from(["trusty-mpm", "shell-init"]).is_err());
}

/// `--quarantine-mcp <PATH>` parses, and `--yes` promotes it.
///
/// Why: this flag is the operator's only route to clearing a stray `.mcp.json`
/// written before the provenance ledger existed, so both halves of its
/// contract are pinned here — it takes a path, and it stays a preview until
/// `--yes`. `--yes` had `requires = "fix"`; widening it to the `writes` group
/// is what lets this flag apply at all, and a regression there would silently
/// leave the operator with a permanent dry run.
/// Test: this test.
#[test]
fn cli_parses_doctor_quarantine_mcp() {
    let cli = Cli::try_parse_from(["trusty-mpm", "doctor", "--quarantine-mcp", "/tmp/.mcp.json"])
        .unwrap();
    let Command::Doctor { flags } = cli.command.unwrap() else {
        panic!("expected doctor");
    };
    assert_eq!(
        flags.quarantine_mcp.as_deref(),
        Some(std::path::Path::new("/tmp/.mcp.json"))
    );
    assert!(!flags.yes, "it must default to a preview");
    assert!(!flags.fix, "it must not imply the full --fix sweep");

    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "doctor",
        "--quarantine-mcp",
        "/tmp/.mcp.json",
        "--yes",
    ])
    .unwrap();
    let Command::Doctor { flags } = cli.command.unwrap() else {
        panic!("expected doctor");
    };
    assert!(flags.yes, "--yes must promote a quarantine, not just --fix");
}

/// `--yes` still requires a write action, and `--quarantine-mcp` needs a value.
///
/// Why: `--yes` is the second deliberate act that lets a write happen; if it
/// ever parsed alone it would read as "yes to whatever a later flag adds".
/// Test: this test.
#[test]
fn cli_rejects_doctor_yes_without_a_write_action() {
    assert!(Cli::try_parse_from(["trusty-mpm", "doctor", "--yes"]).is_err());
    // #6586: `--fix-skills` DID have nothing to promote until it grew the
    // project-tier sweep, which deletes. `cli_parses_doctor_fix_skills` pins
    // the pair parsing now; what stays rejected is `--yes` with no action.
    assert!(Cli::try_parse_from(["trusty-mpm", "doctor", "--quarantine-mcp"]).is_err());
}

/// `tm pr open` parses its title, body file, and the four pre-flight switches.
///
/// Why (#6653): the flag surface IS the agent-facing contract — a `--rung`
/// that silently accepted 9, or a `--closes` that defaulted on, would push the
/// judgment this command exists to remove back onto the caller.
/// Test: this test.
#[test]
fn cli_parses_pr_open() {
    use crate::cli::PrCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "pr",
        "open",
        "--title",
        "feat(x): a thing",
        "--body-file",
        "/tmp/body.md",
        "--issue",
        "6653",
        "--rung",
        "3",
        "--docs-only",
        "--dry-run",
    ])
    .unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Open(args),
    }) = cli.command
    else {
        panic!("expected pr open");
    };
    assert_eq!(args.title, "feat(x): a thing");
    assert_eq!(args.body_file.to_string_lossy(), "/tmp/body.md");
    assert_eq!(args.issue, Some(6653));
    assert_eq!(args.rung, Some(3));
    assert_eq!(args.base, "main", "base defaults to main");
    assert!(args.docs_only);
    assert!(args.dry_run);
    assert!(!args.closes, "Closes is opt-in, never the default");
    assert!(
        !args.minimal,
        "the nine-field contract is the default, never opt-in (#7615)"
    );
}

/// `tm pr open --minimal` parses, so a project with its own PR-body standard
/// has a flag to reach for instead of a hand-assembled `gh pr create` (#7615).
#[test]
fn cli_parses_pr_open_minimal() {
    use crate::cli::PrCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "pr",
        "open",
        "--title",
        "fix(x): a thing",
        "--body-file",
        "/tmp/body.md",
        "--minimal",
    ])
    .unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Open(args),
    }) = cli.command
    else {
        panic!("expected pr open");
    };
    assert!(args.minimal);
    assert!(!args.docs_only, "--minimal is not --docs-only");
}

/// `tm pr merge <n>` parses its number and its three switches (#6808).
#[test]
fn cli_parses_pr_merge() {
    use crate::cli::PrCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "pr",
        "merge",
        "6808",
        "--auto",
        "--no-delete-branch",
        "--repo",
        "bobmatnyc/trusty-tools",
    ])
    .unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Merge(args),
    }) = cli.command
    else {
        panic!("expected pr merge");
    };
    assert_eq!(args.pr, 6808);
    assert!(args.auto);
    assert!(args.no_delete_branch);
    assert_eq!(args.repo.as_deref(), Some("bobmatnyc/trusty-tools"));

    let bare = Cli::try_parse_from(["trusty-mpm", "pr", "merge", "6808"]).unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Merge(args),
    }) = bare.command
    else {
        panic!("expected pr merge");
    };
    assert!(!args.auto, "auto-merge is opt-in");
    assert!(
        !args.no_delete_branch,
        "the remote branch is deleted by default"
    );
}

/// `tm pr cleanup <n>` parses, with `--repo` and `--dry-run` (#7275).
///
/// Why: the argv wiring IS the command's surface — the owner asked for one
/// deterministic verb run as the final step after merge confirmation, so a
/// missing subcommand or a renamed flag breaks the whole trigger chain.
/// Test: this.
#[test]
fn cli_parses_pr_cleanup() {
    use crate::cli::PrCmd;
    let cli = Cli::try_parse_from([
        "trusty-mpm",
        "pr",
        "cleanup",
        "7275",
        "--repo",
        "bobmatnyc/trusty-tools",
        "--dry-run",
    ])
    .unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Cleanup(args),
    }) = cli.command
    else {
        panic!("expected pr cleanup");
    };
    assert_eq!(args.pr, 7275);
    assert_eq!(args.repo.as_deref(), Some("bobmatnyc/trusty-tools"));
    assert!(args.dry_run);

    let bare = Cli::try_parse_from(["trusty-mpm", "pr", "cleanup", "7275"]).unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::Cleanup(args),
    }) = bare.command
    else {
        panic!("expected pr cleanup");
    };
    assert!(
        !args.dry_run,
        "cleanup performs the work by default; --dry-run is the preview"
    );
    assert_eq!(args.repo, None);
}

/// `tm pr cleanup --help` names the five steps and the one refusal (#7275).
#[test]
fn cli_pr_cleanup_help_states_the_steps() {
    use clap::CommandFactory as _;
    let mut root = Cli::command();
    let help = root
        .find_subcommand_mut("pr")
        .expect("pr group")
        .find_subcommand_mut("cleanup")
        .expect("cleanup verb")
        .render_long_help()
        .to_string();
    for needle in [
        "MERGED",
        "remote-branch",
        "worktree",
        "local-branch",
        "prune",
        "never passes `--force`",
        "record-only",
        "--dry-run",
    ] {
        assert!(help.contains(needle), "`pr cleanup --help` omits {needle}");
    }
}

/// `tm pr merge --help` names every refusal and the `--auto` semantics (#6808).
#[test]
fn cli_pr_merge_help_states_the_refusals() {
    use clap::CommandFactory as _;
    let mut root = Cli::command();
    let help = root
        .find_subcommand_mut("pr")
        .expect("pr group")
        .find_subcommand_mut("merge")
        .expect("merge verb")
        .render_long_help()
        .to_string();
    for needle in [
        "draft",
        "do-not-merge",
        "CHANGES_REQUESTED",
        "CONFLICTING",
        "DIRTY",
        "gh pr update-branch",
        "BEHIND is NOT a refusal",
        "left to `gh pr merge` to accept or reject",
        "auto-merge fires",
        "merge queue",
    ] {
        assert!(
            help.contains(needle),
            "`--help` must state {needle}:\n{help}"
        );
    }
}

/// `--rung` outside 1-6 is rejected at parse time.
#[test]
fn cli_rejects_pr_open_rung_out_of_range() {
    let args = [
        "trusty-mpm",
        "pr",
        "open",
        "--title",
        "t",
        "--body-file",
        "/tmp/b.md",
        "--rung",
        "7",
    ];
    assert!(Cli::try_parse_from(args).is_err(), "rung 7 must not parse");
}

/// `tm pr queue-check` defaults to `main` and takes an optional PR number.
///
/// Why: the no-argument form is the whole-queue read, and it must not require
/// a base to be spelled out every time.
/// Test: this test.
#[test]
fn cli_parses_pr_queue_check() {
    use crate::cli::PrCmd;
    let cli = Cli::try_parse_from(["trusty-mpm", "pr", "queue-check"]).unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::QueueCheck(args),
    }) = cli.command
    else {
        panic!("expected pr queue-check");
    };
    assert_eq!(args.base, "main");
    assert_eq!(args.pr, None);
    assert!(!args.json);

    let cli = Cli::try_parse_from(["trusty-mpm", "pr", "queue-check", "42", "--json"]).unwrap();
    let Some(Command::Pr {
        cmd: PrCmd::QueueCheck(args),
    }) = cli.command
    else {
        panic!("expected pr queue-check");
    };
    assert_eq!(args.pr, Some(42));
    assert!(args.json);
}

/// `tm statusline --help` names every stdin JSON field the `💸` savings
/// segment reads, and nothing it does not (#7907).
///
/// Why: a verifier building a synthetic `statusLine` payload by hand had no
/// way to learn which stdin fields key the `💸` segment's ledger lookup from
/// `--help` alone — a hand-built `session_id` with no matching ledger row
/// rendered `💸—` and nothing said why (surfaced verifying #7867). This test
/// fails the moment `--help`'s "Stdin fields read:" sentence and
/// [`crate::commands::statusline::SAVINGS_SEGMENT_STDIN_FIELDS`] — the same
/// source of truth `render_statusline_from` reads those fields from — drift
/// apart in either direction: a field the segment reads goes missing from
/// `--help`, or `--help` names a field the code does not read.
/// What: extracts the field list from the `Stdin fields read: <a>, <b>.`
/// sentence in the `statusline` subcommand's rendered long help and asserts
/// its set (order-independent) equals `SAVINGS_SEGMENT_STDIN_FIELDS`'s field
/// names.
/// Test: this test.
#[test]
fn statusline_help_names_every_savings_stdin_field() {
    use crate::commands::statusline::SAVINGS_SEGMENT_STDIN_FIELDS;
    use clap::CommandFactory as _;

    let mut root = Cli::command();
    let help = root
        .find_subcommand_mut("statusline")
        .expect("statusline subcommand exists")
        .render_long_help()
        .to_string();

    let marker = "Stdin fields read: ";
    let start = help
        .find(marker)
        .expect("--help names the stdin fields the 💸 segment reads")
        + marker.len();
    let rest = &help[start..];
    let end = rest
        .find(". ")
        .expect("the 'Stdin fields read:' sentence ends with '. '");
    let sentence = &rest[..end];

    let mut help_fields: Vec<&str> = sentence
        .split(", ")
        .map(|field| field.trim().trim_matches('`'))
        .collect();
    help_fields.sort_unstable();

    let mut expected: Vec<&str> = SAVINGS_SEGMENT_STDIN_FIELDS
        .iter()
        .map(|(field, _reason)| *field)
        .collect();
    expected.sort_unstable();

    assert_eq!(
        help_fields, expected,
        "`tm statusline --help`'s stdin field list must match \
         SAVINGS_SEGMENT_STDIN_FIELDS exactly -- a field the 💸 segment reads \
         went missing from --help, or --help names one the code does not read"
    );
}