magi/

config.rs

//! Run configuration: the agent roster, the shape of the graph, and the
//! blindness / verification policy.
//!
//! Discovery order (first hit wins):
//!
//! 1. `--config <path>`
//! 2. `<repo>/magi.toml`
//! 3. `<repo>/.magi/config.toml`
//! 4. `<config_dir>/magi/config.toml`
//! 5. built-in defaults, with the agent roster derived from the agent CLIs
//!    actually installed on this machine
use std::collections::BTreeMap;
use std::path::{Path, PathBuf};

use anyhow::{Context as _, Result, bail};
use serde::{Deserialize, Serialize};

/// Which CLI drives an agent.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum AgentKind {
    /// Anthropic Claude Code (`claude -p`).
    Claude,
    /// opencode (`opencode run`).
    Opencode,
    /// Antigravity CLI (`agy -p`). Gemini CLI is deliberately absent: Google
    /// retired the standalone client for individual accounts in favour of this
    /// one, so an adapter for it would be dead code on a live machine.
    Antigravity,
    /// OpenAI Codex CLI (`codex exec`). The one roster member with a real
    /// read-only mode: `--sandbox read-only` is enforced by the CLI, not by
    /// the prompt.
    Codex,
    /// oh-my-pi (`omp -p --mode=json`). Another CLI with no read-only mode of
    /// its own - `--auto-approve` gates reads and writes together - so a
    /// read-only seat rests on the prompt and on the worktree discipline the
    /// other non-codex seats already rely on. It is also the roster member that
    /// reaches DeepSeek, whose models ship in `omp`'s own catalog.
    Omp,
    /// Arbitrary command. The escape hatch, and what the test suite drives.
    Command,
}

impl AgentKind {
    /// Executable that must be on `PATH` for this kind, if any.
    pub fn program(self) -> Option<&'static str> {
        match self {
            Self::Claude => Some("claude"),
            Self::Opencode => Some("opencode"),
            Self::Antigravity => Some("agy"),
            Self::Codex => Some("codex"),
            Self::Omp => Some("omp"),
            Self::Command => None,
        }
    }

    /// Lowercase name as written in the config file.
    pub fn as_str(self) -> &'static str {
        match self {
            Self::Claude => "claude",
            Self::Opencode => "opencode",
            Self::Antigravity => "antigravity",
            Self::Codex => "codex",
            Self::Omp => "omp",
            Self::Command => "command",
        }
    }

    /// Every kind the roster can name, in display order.
    ///
    /// This is what `magi doctor` lists, and it has to be one list rather than
    /// the same set typed out again wherever a kind is enumerated. The last
    /// time it was typed out twice, `omp` was added as a roster member and the
    /// doctor output went on saying the machine had four CLIs - which reads as
    /// "that agent is not installed" to the person the command exists for.
    pub const ALL: [Self; 6] = [
        Self::Claude,
        Self::Opencode,
        Self::Antigravity,
        Self::Codex,
        Self::Omp,
        Self::Command,
    ];
}

/// How the prompt reaches the agent process.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum Delivery {
    /// Piped on stdin.
    Stdin,
    /// Passed as a positional argument. Beware OS command-line limits.
    Argv,
    /// Written to a file; the agent is told to read it. No length limit.
    File,
}

/// One addressable agent in the roster.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields)]
pub struct AgentSpec {
    /// Stable identifier used by `[roles]` and by the stats tables.
    pub id: String,
    /// Which CLI to drive.
    pub kind: AgentKind,
    /// Model passed through to the CLI (`--model` / `-m`). CLI default if unset.
    #[serde(default)]
    pub model: Option<String>,
    /// `kind = "command"` only: argv. Supports `{prompt_file}`, `{cwd}`,
    /// `{label}`, `{session}` placeholders.
    #[serde(default)]
    pub command: Vec<String>,
    /// Extra arguments appended to the built command line.
    #[serde(default)]
    pub extra_args: Vec<String>,
    /// Extra environment variables for the child process.
    #[serde(default)]
    pub env: BTreeMap<String, String>,
    /// Override the per-kind prompt delivery default.
    #[serde(default)]
    pub prompt_delivery: Option<Delivery>,
}

impl AgentSpec {
    /// Default prompt delivery for this agent.
    ///
    /// `opencode` and `agy` take the prompt as an argument, which on Windows
    /// caps out around 32 KiB — well under a judging prompt carrying three
    /// patches — so both get a file instead.
    pub fn delivery(&self) -> Delivery {
        self.prompt_delivery.unwrap_or(match self.kind {
            AgentKind::Claude | AgentKind::Command => Delivery::Stdin,
            // `codex exec -` reads the prompt from stdin, so the whole
            // instruction arrives without an argv length limit and without a
            // tool round-trip to open a file.
            AgentKind::Codex => Delivery::Stdin,
            // `omp -p` reads the prompt from stdin too, and a judging prompt
            // carrying three patches is well past the Windows argv cap, so this
            // is the only delivery that works for every node.
            AgentKind::Omp => Delivery::Stdin,
            AgentKind::Opencode | AgentKind::Antigravity => Delivery::File,
        })
    }

    /// Human-facing label, e.g. `opus (claude:opus)`.
    pub fn display(&self) -> String {
        match &self.model {
            Some(m) => format!("{} ({}:{m})", self.id, self.kind.as_str()),
            None => format!("{} ({})", self.id, self.kind.as_str()),
        }
    }
}

/// A standalone seat's agent: one roster id, or an ordered fallback chain.
///
/// The string form is what every existing config uses and serializes back as
/// a string; the array form tries each id at most once, in order, moving on
/// when a call ends in quota or fails (see [`crate::agent::pick_chain`]).
/// An empty string or array is the same as unset.
#[derive(Debug, Clone, PartialEq, Eq, Deserialize, Serialize)]
#[serde(untagged)]
pub enum AgentChoice {
    /// One agent id.
    One(String),
    /// Ordered fallback chain of agent ids.
    Chain(Vec<String>),
}

impl AgentChoice {
    /// The ids named, in order, with blanks dropped. Empty means unset.
    pub fn ids(&self) -> Vec<&str> {
        let all: Vec<&str> = match self {
            Self::One(id) => vec![id.as_str()],
            Self::Chain(ids) => ids.iter().map(String::as_str).collect(),
        };
        all.into_iter()
            .map(str::trim)
            .filter(|id| !id.is_empty())
            .collect()
    }

    /// The first id named, if any.
    pub fn primary(&self) -> Option<&str> {
        self.ids().into_iter().next()
    }
}

impl From<&str> for AgentChoice {
    fn from(id: &str) -> Self {
        Self::One(id.to_owned())
    }
}

/// The first id of an optional choice: what a single-seat caller resolves.
pub fn primary(choice: Option<&AgentChoice>) -> Option<&str> {
    choice.and_then(AgentChoice::primary)
}

/// Explicit role assignment. Empty lists are filled in by
/// [`Config::resolve_roles`] by rotating the roster.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Roles {
    /// Agents that implement the task, one worktree each.
    pub implementers: Vec<String>,
    /// Agents that rank the candidates blind.
    pub judges: Vec<String>,
    /// Agents that review the winning patch.
    pub reviewers: Vec<String>,
    /// Agent that applies review findings. Defaults to the winner's author.
    pub fixer: Option<String>,
    /// Agent that answers the standing chat's turns (`src/talk.rs`).
    ///
    /// Unset picks a `claude` seat, else the first runnable agent in roster
    /// order (see [`crate::agent::pick`]) - which is roster *order*, not a
    /// judgement about who converses well. Naming one here matters once an
    /// agent is also sitting as a judge: the chat is opened far more often
    /// than any single competition, and every open competes with that judge
    /// seat for the same account's concurrency. A timeout on an ordinary chat
    /// turn traced to exactly this - `opus` triple-booked as chatter and judge
    /// - is what this field exists to let an operator break apart.
    ///
    /// Accepts one id or an ordered array of ids: a fallback chain, see
    /// [`AgentChoice`].
    pub chatter: Option<AgentChoice>,
    /// Agent that arranges the queue between polls: `crate::conduct`'s single
    /// seat, called once per cycle to decide a runnable task's `blocked_by`
    /// and how a stalled or finished task recovers.
    ///
    /// The same precedent as [`Self::chatter`] for a seat that stands alone
    /// rather than rotating through the roster - resolved through
    /// [`crate::agent::pick`], so unset falls back to its own default order
    /// (a claude seat, else the first runnable agent) rather than reusing a
    /// judge or reviewer seat that the conductor's own poll-cycle cadence
    /// would otherwise compete with for the same account's concurrency.
    ///
    /// Accepts a string or a fallback chain, like [`Self::chatter`].
    pub conductor: Option<AgentChoice>,
    /// Seats for the design-deliberation stage `graph::Runner::advise` runs
    /// before `implement`: independent, read-only design proposals gathered
    /// once a run has a settled task instruction and before any implementer
    /// touches the repository.
    ///
    /// Empty falls back to `judges` rather than to the whole roster: a panel
    /// trusted to rank patches independently is exactly the panel worth
    /// asking to sketch a design independently, and an operator who has
    /// already thought about judge diversity gets advisor diversity for free
    /// instead of a fourth roster to maintain.
    pub advisors: Vec<String>,
    /// Agent that blends [`Self::advisors`]' proposals into the one design
    /// brief `graph::Runner::synthesize_brief` carries into every
    /// implementer's prompt.
    ///
    /// The same precedent as [`Self::chatter`] and [`Self::conductor`] for a
    /// seat that stands alone rather than rotating through the roster -
    /// resolved through [`crate::agent::pick`], so unset falls back to its
    /// own default order (a claude seat, else the first runnable agent in
    /// roster order) - exactly today's behavior, unchanged by leaving this
    /// field out.
    ///
    /// Accepts a string or a fallback chain, like [`Self::chatter`].
    pub synthesizer: Option<AgentChoice>,
}

/// Graph shape and limits.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Graph {
    /// Parallel implementations of the same task. **One by default.**
    ///
    /// Competition is the thing magi is for, and it is still here - it is just
    /// no longer what every task buys without being asked. Three days and 13
    /// runs on this repository, which is the workload these numbers are drawn
    /// from:
    ///
    /// - **0 of 13** competed runs reached a merge. Everything that landed in
    ///   that window went through `magi review` - the cheap half, no
    ///   competition - and passed on the first try.
    /// - The judges' first choices **split 73% of the time** (8 of 11
    ///   tallies). Candidates that close together make the ranking a weak
    ///   signal for what it costs to produce.
    /// - One run's own breakdown: implement 60min, judge 40min, fix 40min,
    ///   review 28min, **verify 5min** - and verify is the node that caught a
    ///   defect every reviewer had passed as clean. The cheapest step is the
    ///   one that earns its place every time.
    ///
    /// It is not worthless: `oc` won 3 of those tallies against `sonnet`, so a
    /// single-seat default would have shipped the worse implementation in
    /// roughly a quarter of them. That is exactly why this is a *default* and
    /// not a removal - `magi run --candidates N` and a per-task seat count are
    /// how a task that deserves a competition gets one.
    ///
    /// A single-candidate run needs no special case: `Runner::review`'s doc
    /// records that `execute` already degrades to implement -> review -> gate
    /// -> merge, because `judge` skips a one-candidate field, `deliberate` has
    /// no two first choices to reconcile and `vote` returns early.
    pub candidates: usize,
    /// Independent judges.
    pub judges: usize,
    /// Deliberation rounds when the judges' first choices disagree.
    pub deliberate_rounds: usize,
    /// Reviewers per review round. **Three by default** - the smallest panel
    /// a lens cycle (see [`crate::prompt::Lens`]) covers exactly once, so the
    /// default panel reads the patch for spec compliance, regressions, and
    /// simplicity without repeating an angle. Review is also the one stage
    /// [`Self::candidates`]'s doc describes as running on every task
    /// regardless of competition, which is what makes a panel worth its cost
    /// here even though `candidates` itself defaults to one.
    pub reviewers: usize,
    /// Maximum review+fix rounds before the run is declared blocked.
    pub review_rounds: usize,
    /// Fix rounds a failing `verify.gate` gets before the run is blocked. The
    /// fixer is handed the gate's own output; `0` keeps the old behaviour of
    /// blocking on the first red gate. Independent of [`Self::review_rounds`]
    /// so a run that spent its review budget can still repair a one-line gate
    /// failure.
    pub gate_fix_rounds: usize,
    /// Maximum agent processes running at once.
    pub max_parallel: usize,
    /// Language for the prose the agents write (`en` / `ja` / any language name).
    pub language: String,
    /// Keep one CLI conversation per seat, so a judge remembers its own
    /// argument across deliberation rounds and the fixer remembers its own
    /// implementation across review rounds.
    ///
    /// Sessions are scoped to a *seat*, never to an agent id: the same model
    /// sitting as implementer and as judge gets two unrelated conversations,
    /// which is what keeps blind judging blind.
    pub sessions: bool,
    /// Per-node timeouts, seconds.
    pub timeout_implement: u64,
    /// Per-node timeouts, seconds.
    pub timeout_judge: u64,
    /// Per-node timeouts, seconds.
    pub timeout_review: u64,
    /// Timeout for `verify.e2e` and `verify.gate`, seconds. Separate from
    /// [`Self::timeout_review`] so shrinking a reviewer's budget cannot
    /// silently shrink a real-machine command's budget too — the two used to
    /// share `timeout_review`, and turning a slow reviewer down cut the
    /// timeout `cargo test --all-targets` runs under along with it. When
    /// omitted, preserves legacy configurations by using
    /// [`Self::timeout_review`]. Set an explicit value to make verification
    /// independent of later review-seat budget changes.
    pub timeout_verify: Option<u64>,
    /// Per-node timeouts, seconds.
    pub timeout_fix: u64,
    /// Wall-clock limit for one turn of [`crate::talk`]'s standing
    /// conversation, seconds.
    ///
    /// An hour: the operator is not watching this turn resolve in real time,
    /// so the budget can match what the work - reading files, running
    /// commands, checking their output - actually needs rather than what a
    /// person waiting on a phone can tolerate.
    pub timeout_talk: u64,
    /// Retries for an agent invocation that fails or returns nothing usable.
    pub retries: usize,
    /// Root for candidate / judge worktrees. Defaults to `~/wt/magi`.
    pub worktree_root: Option<PathBuf>,
    /// After the pull request is open, keep going: watch its checks and
    /// reviews, run a fix round when they are unhappy, and ask to merge.
    ///
    /// On, because stopping at an open pull request left the operator doing
    /// the watching by hand - six times in the session this was built in - and
    /// that is the work the loop exists to take. It only engages for
    /// `merge = "pr"`; every other merge mode ends the run as before.
    ///
    /// Turning this on does **not** hand magi the merge button:
    /// [`Graph::land_approval`] is on too, and nothing merges without an
    /// explicit answer. Setting both to their non-defaults is the only way to
    /// get an unattended merge, and it has to be chosen twice.
    pub land: bool,
    /// Land rounds - watch, fix, push - before the run is left for a human.
    pub land_rounds: usize,
    /// Ask the owner before merging, showing what is about to land.
    ///
    /// On, and it is what makes `land` safe to have on: the question carries a
    /// rendered panel - the diffstat, the patch, the checks, the review
    /// comments that were addressed, and the subject the squash will use - so
    /// the decision is made on evidence rather than on trust, from wherever
    /// the operator happens to be.
    ///
    /// Silence is a hold. An unanswered approval never merges, and neither
    /// does any answer other than the word `merge`.
    pub land_approval: bool,
    /// Ask the owner before merging a run whose review loop handed off over a
    /// contested finding: the last round ended with a Major-or-above finding
    /// still open *and* at least one reviewer's final vote (after
    /// reconsideration) was reject. Findings raised in the last round are
    /// never fixed or re-reviewed, so this is the one case an unattended
    /// merge would land over a reviewer's explicit objection.
    ///
    /// On. Interaction with [`Self::land_approval`]: when that is on, every
    /// merge is asked about and this key changes nothing. When it is off,
    /// this key alone decides whether a contested hand-off is asked about
    /// (the question says why); every other run still merges unattended.
    /// Read at land time, so turning it off restores the unattended merge at
    /// once. The pull request is opened either way; only the merge waits.
    pub hold_contested_merge: bool,
    /// After a run's pull request merges, file the findings its last review
    /// round left open as follow-up tasks (`crate::followup`) instead of
    /// letting them vanish with the merge: every Major-or-above finding, and
    /// every finding of a seat whose final vote was reject. Other Minor/Nit
    /// findings are only listed in the pull-request comment. Does not affect
    /// whether the merge happens. On; best-effort, a failure is a run event.
    pub file_followups: bool,
    /// How long to wait for an owner to answer a question before the run is
    /// abandoned, seconds. A parked run costs nothing, so this is generous;
    /// it exists so a forgotten question cannot pin a worktree forever.
    pub answer_timeout: u64,
    /// What a round does when one or more reviewer seats never answered
    /// (timeout, crash, unparsable output).
    pub incomplete_review: IncompleteReviewPolicy,
    /// Run `verify.e2e` on every round, even one that already has blocking
    /// findings and another round left to try.
    ///
    /// Off by default: a round with a blocking finding and rounds still left
    /// is going back to the fixer regardless of what `verify.e2e` says, so
    /// running it first only spends the round's slowest step (minutes, on a
    /// Rust repo's `cargo test --all-targets`) on a head about to be
    /// rewritten anyway. `verify.e2e` still runs once a round has no
    /// blocking findings left (a round cannot go `clean` without it) and the
    /// final `verify.gate` always runs on the actual tree that would land —
    /// deferring is about *when* e2e runs mid-loop, never about skipping it.
    ///
    /// Set this to restore the old every-round diagnostic behaviour: e2e
    /// output from a round that still has blocking findings is occasionally
    /// useful on its own (a runtime failure a reviewer's panel would not
    /// have caught by reading), and this is the way back to seeing it every
    /// round instead of only once the panel has nothing left to flag.
    pub e2e_every_round: bool,
    /// Run the design-deliberation stage before `implement`: independent
    /// advisor seats each sketch a design, and (when at least one produced a
    /// usable proposal) a synthesis blends them into a brief carried in the
    /// implementer's prompt. See `graph::Runner::advise`.
    ///
    /// On by default. A design sketch is a few paragraphs an agent can write
    /// without touching the repository, where a full implementation is a
    /// tool loop that re-reads the codebase on every turn - so three
    /// sketches, gathered once before `implement` starts, cost a fraction of
    /// a fourth candidate and buy back a form of the same disagreement
    /// [`Self::candidates`]'s doc describes moving away from being the
    /// default, on every run rather than only the ones an operator remembers
    /// to ask for with `--candidates`.
    pub advise: bool,
    /// How many independent design proposals the deliberation stage gathers.
    /// **Three by default** - the same number [`Self::candidates`]'s doc
    /// names as the point where a fourth judge's first choice stopped
    /// changing the tally.
    pub advisors: usize,
}

impl Default for Graph {
    fn default() -> Self {
        Self {
            candidates: 1,
            judges: 3,
            deliberate_rounds: 1,
            reviewers: 3,
            review_rounds: 6,
            gate_fix_rounds: 1,
            max_parallel: 4,
            language: "en".to_owned(),
            sessions: true,
            timeout_implement: 3600,
            timeout_judge: 1200,
            timeout_review: 1200,
            timeout_verify: None,
            timeout_fix: 1800,
            timeout_talk: 3600,
            retries: 1,
            worktree_root: None,
            land: true,
            land_rounds: 4,
            land_approval: true,
            hold_contested_merge: true,
            file_followups: true,
            answer_timeout: 86_400,
            incomplete_review: IncompleteReviewPolicy::Block,
            e2e_every_round: false,
            advise: true,
            advisors: 3,
        }
    }
}

impl Graph {
    /// Effective machine-command budget. Older configuration files had only
    /// `timeout_review`, which also governed verification, so absence is a
    /// compatibility fallback rather than a new 1200-second default.
    pub fn verify_timeout(&self) -> u64 {
        self.timeout_verify.unwrap_or(self.timeout_review)
    }
}

/// What a review round does when a reviewer seat never answered.
///
/// A round where half the panel timed out is not evidence of a clean patch —
/// it is evidence of nothing. The default refuses to call that clean; `warn`
/// exists for an operator who would rather keep a flaky seat from stalling
/// every run, and accepts that the gap is on them to read in the report.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum IncompleteReviewPolicy {
    /// A round with a missing seat is never `clean`: with nothing raised to
    /// fix, the round is re-reviewed instead of gating; with the max rounds
    /// exhausted, the run is left `Blocked` rather than declared ready.
    Block,
    /// A round with a missing seat can still gate as clean, once every seat
    /// that *did* answer raised nothing blocking and verification is green.
    /// The record keeps the gap visible (`magi show`, `magi stats`) even
    /// though the run does not wait on it.
    Warn,
}

/// What to do when vendor-identifying text is found in material shown to judges.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum LeakPolicy {
    /// Record the leak, show the patch unmodified.
    Warn,
    /// Replace the token with `[REDACTED]` in the presented patch.
    Redact,
    /// Abort the run.
    Fail,
}

/// Blindness policy.
///
/// Commit messages and candidate summaries are *always* stripped of
/// attribution trailers and redacted — that is where signatures actually
/// appear. [`Blind::on_leak`] governs the patch body only, where blanket
/// redaction would corrupt the artifact under judgement.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Blind {
    /// Install a per-worktree `commit-msg` hook that deletes attribution
    /// trailers before they can land in a candidate's history.
    pub commit_msg_hook: bool,
    /// Literal, case-insensitive substrings. A line containing any of them is
    /// dropped from commit messages and summaries; the `commit-msg` hook is
    /// generated from the same list.
    pub strip_lines: Vec<String>,
    /// Case-insensitive substrings that identify a vendor or model.
    pub vendor_tokens: Vec<String>,
    /// Policy for vendor tokens found in the patch body.
    pub on_leak: LeakPolicy,
    /// Seed for label assignment and per-judge presentation order. Derived from
    /// the run id when unset; set it to make a run reproducible.
    pub seed: Option<u64>,
}

impl Default for Blind {
    fn default() -> Self {
        Self {
            commit_msg_hook: true,
            strip_lines: [
                "Co-Authored-By:",
                "Signed-off-by:",
                "Assisted-by:",
                "Generated-by:",
                "Generated with",
                "\u{1f916}",
            ]
            .iter()
            .map(|s| (*s).to_owned())
            .collect(),
            vendor_tokens: [
                "claude",
                "anthropic",
                "codex",
                "openai",
                "chatgpt",
                "gemini",
                "grok",
                "xai",
                "copilot",
                "opencode",
                "qoder",
                "cursor",
                "\u{1f916}",
            ]
            .iter()
            .map(|s| (*s).to_owned())
            .collect(),
            on_leak: LeakPolicy::Warn,
            seed: None,
        }
    }
}

/// Shell commands that gate the winner.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Verify {
    /// Run in the winner's worktree once per review round. Its output is fed
    /// back to the fixer. This is the "real machine" leg of the review.
    pub e2e: Vec<String>,
    /// Final gate. Must all exit 0 before a merge is attempted.
    pub gate: Vec<String>,
    /// Mechanical fixers (formatters) run in the winner's worktree just before
    /// `gate`, after review is clean. Anything they change is committed as one
    /// neutral-identity commit so the gate and the PR see it. A command that
    /// fails or times out is a warning, never a failed run: the gate stays the
    /// single arbiter. Empty (the default) turns the feature off. Runs under
    /// `graph.verify_timeout()` per command, like the gate. Meant for light
    /// tools: it is not scanned for `CARGO_TARGET_DIR`, and it should be
    /// idempotent since a resumed run may repeat it.
    #[serde(default)]
    pub pre_gate: Vec<String>,
    /// Shell used to run the commands above. Defaults to `sh -c`, or
    /// `cmd /C` when `sh` is not on `PATH`.
    pub shell: Option<Vec<String>>,
}

impl Verify {
    /// The `CARGO_TARGET_DIR=` value of the first rendered command that sets
    /// one, if any. See [`crate::disk::extract_cargo_target_dir`] for the shape
    /// this reads back. One rendering is enough - they all set the same
    /// rendered `{{ vars.cache }}` path via the same shell - and the first e2e
    /// command is checked before the gate because the e2e rebuilds the crate.
    pub fn cache_dir(&self) -> Option<PathBuf> {
        self.e2e
            .iter()
            .chain(self.gate.iter())
            .find_map(|cmd| crate::disk::extract_cargo_target_dir(cmd))
    }
}

/// Disk hygiene: how hard magi is allowed to press on the machine's free space.
///
/// The numbers below come from one incident, not from theory: a machine with
/// 951.8 GB free ran a few competitions and plans and best read 6.7 GB free.
/// Three multi-gigabyte classes of junk accumulated side by side - per-run
/// worktrees that end as `Merged`/`Ready`/`Failed`, a shared build cache whose
/// each verify round and each implementation wave recompiles the derived
/// section of the project into, and the outputs of runs that were removed but
/// whose folders nobody deleted.
#[derive(Debug, Clone, PartialEq, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Disk {
    /// Free space, in bytes, below which no new run may start: the daemon and
    /// the `magi run` gate answer with "the disk is full" instead of letting
    /// the graph fill it the rest of the way. `0` turns the gate off.
    ///
    /// Default 8 GiB. The incident ran down to 6.7 GB free of 951.8 GB total
    /// before anybody noticed; 8 GiB is enough headroom for the compile a fresh
    /// competition triggers and small enough that a 1 TB disk with 100 GB free
    /// is nowhere near the threshold.
    pub min_free_bytes: u64,
    /// Fold finished runs without being asked. `Merged`, `Ready` and `Failed`
    /// runs older than [`fold_grace_secs`](Self::fold_grace_secs) have their
    /// worktrees removed. `0` turns the janitor off.
    ///
    /// Default true.
    pub auto_fold: bool,
    /// How old a finished run must be before the janitor folds it, seconds.
    ///
    /// Default 6 hours. A run that `Ready` at 8am is the operator's answer; a
    /// run that `Ready` a week ago is worktrees holding a compile each. Six
    /// hours is long enough that nobody loses an answer in the gap between
    /// reading the report and starting from it, and short enough that a backlog
    /// cannot pile up across two nights.
    pub fold_grace_secs: u64,
    /// Ceiling for the shared build cache (`CARGO_TARGET_DIR` in the rendered
    /// verify commands), in bytes. When the janitor runs and the cache is over
    /// it, files are dropped oldest-first until it is not. `0` turns pruning
    /// off - the cache then only ever grows, which is the operator's call.
    ///
    /// Default 10 GiB. This is what the incident measured: 30.61 GB sat in the
    /// shared cache on top of ~16 GB in the primary target directory and 6.7-
    /// 11.15 GB in each of four per-worktree targets. 10 GiB holds a healthy
    /// stack of prebuilt dependencies (cargo's per-file fingerprinting means
    /// pruning only costs the rebuild of the dropped files, not of the world)
    /// without letting one addled cache swallow the machine.
    pub cache_limit_bytes: u64,
}

impl Default for Disk {
    fn default() -> Self {
        Self {
            min_free_bytes: 8 * 1024 * 1024 * 1024,
            auto_fold: true,
            fold_grace_secs: 6 * 60 * 60,
            cache_limit_bytes: 10 * 1024 * 1024 * 1024,
        }
    }
}

/// What to do with the winning branch.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MergeMode {
    /// Leave the branch alone and print the merge command matching
    /// [`Merge::style`].
    None,
    /// Merge into the base branch in the primary worktree, using
    /// [`Merge::style`].
    Local,
    /// Push the branch and open a PR with `gh pr create`. Landing this PR
    /// (`[graph] land`) always squashes — see `land`'s module doc — so
    /// [`Merge::style`] does not apply here.
    Pr,
}

/// How the winning branch is attached to the base branch: what
/// `mode = "local"` runs, and what `mode = "none"`'s printed guidance tells
/// the operator to run by hand.
///
/// Read from configuration rather than asked of the repository at run time
/// (e.g. `gh api repos/{owner}/{repo}/rulesets`) for two reasons: it keeps
/// `mode = "none"`'s guidance a pure function of `RunState`, assertable in a
/// unit test the same way `land::decide` is kept pure (see that module's
/// doc), and it works for a base branch that is not hosted on GitHub, or not
/// reachable at all, at the moment the report is rendered. An operator whose
/// base branch enforces a ruleset already knows what it allows; declaring it
/// once here is cheaper than magi re-discovering it, with a network call, on
/// every render.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum MergeStyle {
    /// `git merge --no-ff`: every candidate commit lands, plus a merge
    /// commit that records the merge as its own event in history. Rejected
    /// by a base branch whose ruleset requires linear history or forbids
    /// merge commits outright.
    #[default]
    Merge,
    /// `git merge --squash` followed by a commit under an explicit message:
    /// every candidate commit folds into one, and none of the candidate's
    /// own placeholder subjects (`magi: candidate A (uncommitted work)`)
    /// reach the base branch. No merge commit, so this satisfies a linear-
    /// history ruleset.
    Squash,
    /// A fast-forward-only merge: every candidate commit lands verbatim, in
    /// order, with no merge commit. Only succeeds because the winner was
    /// already rebased onto the tracked base tip before this runs (see
    /// `Runner::sync_to_base`) — equivalent to GitHub's "rebase and merge"
    /// once that has happened.
    Rebase,
}

/// Merge policy.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Merge {
    /// Default is [`MergeMode::None`]: magi never touches your base branch
    /// unless you ask it to.
    pub mode: MergeMode,
    /// Base branch. Defaults to the branch checked out when the run started.
    pub base: Option<String>,
    /// How the winner is attached to `base`; see [`MergeStyle`]. Ignored by
    /// `mode = "pr"`.
    pub style: MergeStyle,
    /// Remote for `mode = "pr"`.
    pub remote: String,
    /// After a `mode = "pr"` run lands, open a `chore/release-vX.Y.Z` pull
    /// request sized to the change by an agent's own judgement, so a version
    /// bump does not depend on a human remembering to cut one.
    ///
    /// Only acts on Rust repositories (a `Cargo.toml` at the root of the base
    /// branch); on any other repository it is a no-op that records one event.
    ///
    /// On by default. **Turning this off means a merge landed from the phone
    /// never becomes a release**, so `POST /api/upgrade` keeps reporting
    /// "already on the newest release" against a `main` that has moved past
    /// it - the same gap this feature exists to close. Only for a repository
    /// that wants to keep cutting releases by hand.
    pub release_bump: bool,
}

impl Default for Merge {
    fn default() -> Self {
        Self {
            mode: MergeMode::None,
            base: None,
            style: MergeStyle::default(),
            remote: "origin".to_owned(),
            release_bump: true,
        }
    }
}

/// How magi keeps itself current.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "lowercase")]
pub enum UpdateMode {
    /// Never check.
    Off,
    /// Check in the background and print a one-line banner when a newer
    /// release exists.
    Notify,
    /// Check and install silently.
    Install,
}

/// Self-update policy.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Update {
    /// Default is [`UpdateMode::Notify`]: magi tells you, and lets you decide.
    pub mode: UpdateMode,
    /// Minimum time between checks, e.g. `24h`. kaishin's default when unset.
    pub interval: Option<String>,
}

impl Default for Update {
    fn default() -> Self {
        Self {
            mode: UpdateMode::Notify,
            interval: None,
        }
    }
}

/// Top-level configuration.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Config {
    /// Agent roster.
    pub agents: Vec<AgentSpec>,
    /// Role assignment.
    pub roles: Roles,
    /// Graph shape.
    pub graph: Graph,
    /// Blindness policy.
    pub blind: Blind,
    /// Verification commands.
    pub verify: Verify,
    /// Disk hygiene.
    pub disk: Disk,
    /// Merge policy.
    pub merge: Merge,
    /// Self-update policy.
    pub update: Update,
    /// Project-specific text appended to the node prompts.
    pub prompts: Prompts,
    /// How the operator is told a run is waiting on them.
    pub notify: Notify,
    /// Local repositories the plan surface can start or derive a conversation
    /// against.
    pub repos: Repos,
    /// Policy for the standing conversation ([`crate::talk`]).
    pub talk: Talk,
    /// How many runs `magi serve`'s own loop drives at once.
    pub daemon: Daemon,
    /// Context-window sizes in tokens, keyed by model name, merged over
    /// [`BUILTIN_CONTEXT_WINDOWS`]. See [`Config::context_window`].
    pub context_windows: BTreeMap<String, u64>,
}

/// Context windows of models magi commonly drives, in tokens.
///
/// A convenience, not a source of truth: vendors resize windows and ship new
/// models faster than this table is edited, so an entry that is stale or
/// missing is fixed by `[context_windows]` in `magi.toml`, which wins. Matched
/// by [`Config::context_window`]: exact name first, then the longest key that
/// prefixes the model name (so a dated or suffixed id such as
/// `claude-sonnet-4-5-20250929` finds `claude-sonnet-4-5`). A model matching
/// nothing has no percentage - the UI shows the raw count.
const BUILTIN_CONTEXT_WINDOWS: &[(&str, u64)] = &[
    ("claude-opus-4", 200_000),
    ("claude-sonnet-4", 200_000),
    ("claude-haiku-4", 200_000),
    ("claude-3", 200_000),
    ("opus", 200_000),
    ("sonnet", 200_000),
    ("haiku", 200_000),
    ("gpt-5", 400_000),
    ("gpt-4.1", 1_000_000),
    ("gpt-4o", 128_000),
    ("o3", 200_000),
    ("o4-mini", 200_000),
    ("gemini-2.5", 1_000_000),
    ("deepseek", 128_000),
];

impl Config {
    /// Context window in tokens for `model`: `[context_windows]` first, then
    /// the built-in table; within each, an exact name beats the longest
    /// prefix. `None` for an unknown model, which is a deliberate answer -
    /// guessing a denominator would print a confident wrong percentage.
    pub fn context_window(&self, model: &str) -> Option<u64> {
        fn lookup<'a>(model: &str, entries: impl Iterator<Item = (&'a str, u64)>) -> Option<u64> {
            let mut best: Option<(usize, u64)> = None;
            for (key, window) in entries {
                if key == model {
                    return Some(window);
                }
                if model.starts_with(key) && best.is_none_or(|(len, _)| key.len() > len) {
                    best = Some((key.len(), window));
                }
            }
            best.map(|(_, w)| w)
        }
        lookup(
            model,
            self.context_windows.iter().map(|(k, w)| (k.as_str(), *w)),
        )
        .or_else(|| lookup(model, BUILTIN_CONTEXT_WINDOWS.iter().copied()))
    }
}

/// How the daemon loop itself behaves, as opposed to what one run does.
///
/// Machine-layer material in the same sense [`Repos::roots`] is: how many
/// competitions this machine's own loop is willing to babysit at once is a
/// fact about the machine running `magi serve`, not about any one
/// repository's task, so it belongs in `<config_dir>/magi/config.toml`
/// rather than a repository's own `magi.toml` - though, like `Repos::roots`,
/// nothing stops a repository from setting it too, since a scalar field
/// takes whichever layer has the highest precedence.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Daemon {
    /// How many runs `magi serve` may have actively in flight at once.
    /// **One by default** - today's behaviour, one run at a time.
    ///
    /// This is a different knob from [`Graph::max_parallel`], and the two
    /// must not be confused: `max_parallel` bounds how many agent *processes*
    /// one run starts inside itself (implementers, judges, reviewers -
    /// candidates competing on a single task); this field bounds how many
    /// *runs* - whole competitions, each with its own `max_parallel` budget -
    /// the loop drives side by side, possibly across different tasks and
    /// different repositories. Raising `max_parallel` buys a bigger panel for
    /// one task; raising this buys more tasks worked at once. A config file
    /// that meant one and wrote the other would either starve a competition
    /// of judges or leave the rest of the backlog waiting for no reason.
    ///
    /// A run parked waiting on the operator's land-merge approval - see
    /// [`crate::land`] - does not hold one of these slots while it waits: the
    /// whole point of parking there is to let the loop spend the slot on
    /// something runnable instead of sitting on a decision only a human can
    /// make. So even at the default of `1`, an approval that comes back does
    /// not queue behind whatever else the loop happens to be running.
    pub max_concurrent_runs: usize,
    /// Let a task marked [`crate::queue::Task::interrupt`] (`magi task
    /// interrupt`) cut ahead of whatever `magi serve` already has in flight,
    /// instead of waiting for it to finish.
    ///
    /// **Off by default.** When enabled, a run that is in flight and is not
    /// itself the interrupt candidate may be paused at its next safe node
    /// boundary - see [`crate::graph::Runner::park_here`] - so the marked
    /// task can run alone; the paused run resumes automatically, through the
    /// same path any other parked run does, the moment the interrupting
    /// task's own run reaches a terminal status. This is opt-in because it
    /// bends the loop's own "one run at a time" principle (see this repository's
    /// `magi serve` help) for a specific, explicit operator request, and a
    /// repository that never files an interrupt task pays nothing for having
    /// it on - but an operator who does not want any run of theirs preempted,
    /// ever, should leave this `false`.
    pub pause_for_interrupts: bool,
    /// How many deputies `magi serve` runs at once. A deputy is the short-lived
    /// seat that waits on one open conductor question (see [`crate::deputy`]);
    /// each is a live agent conversation, so this is bounded - **two by
    /// default**, because the agent CLIs' quota is the scarce resource. A
    /// question over the limit keeps its place and starts when a deputy
    /// finishes; `0` runs none.
    pub max_deputies: usize,
}

impl Default for Daemon {
    fn default() -> Self {
        Self {
            max_concurrent_runs: 1,
            pause_for_interrupts: false,
            max_deputies: 2,
        }
    }
}

/// Where `magi repos` and `GET /api/repos` look for local checkouts.
///
/// `roots` is one of the array keys [`array_merge_policy`] marks as
/// append-across-layers: which checkouts exist in general is a *machine*
/// fact in the same way the agent roster is - a repository's own `magi.toml`
/// cannot state where its siblings live before magi has resolved which
/// repository to read that file from in the first place - but a repository
/// that genuinely has an extra root worth scanning is not forced to choose
/// between an error and losing the machine's roots outright. Both layers'
/// roots are scanned; see [`Config::refuse_split_arrays`] for the keys that
/// are still refused.
#[derive(Debug, Clone, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Repos {
    /// Roots to scan for a ghq-layout checkout: `<root>/<host>/<owner>/<repo>`
    /// with a `.git` directory. Empty by default - nothing is scanned unless
    /// asked to be.
    pub roots: Vec<PathBuf>,
    /// How long a scan is trusted before the next request re-scans it,
    /// seconds. `0` means never trust it: scan on every request. Defaults to
    /// a day, the same order of magnitude as [`Graph::answer_timeout`] for
    /// the same reason - a checkout does not usually appear or vanish inside
    /// a session, so there is little to gain from scanning more often than
    /// that, and an explicit refresh exists for the moment one does.
    pub scan_ttl: u64,
}

impl Default for Repos {
    fn default() -> Self {
        Self {
            roots: Vec::new(),
            scan_ttl: 86_400,
        }
    }
}

/// Project-specific text appended to each node's prompt.
///
/// **Additive by construction.** These fields cannot replace magi's prompts,
/// only extend them, and that restriction is the whole design. The built-in
/// prompts carry the invariants the competition rests on: a judging prompt
/// names no authors, every structured answer must arrive as one fenced `json`
/// block, and a judge is told not to speculate about who wrote what. A config
/// that could overwrite them would let a typo silently un-blind the panel or
/// break the parser, and the symptom would be "the judges got worse" rather
/// than an error.
///
/// Repository-wide context belongs in `AGENTS.md`, which every agent already
/// reads from the checkout. Use these fields for the things a *magi node*
/// needs to know and a repository file cannot say - for instance that
/// reviewers here should ignore formatting because a hook owns it.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Prompts {
    /// Appended to every node's prompt.
    pub all: String,
    /// Appended for implementers.
    pub implement: String,
    /// Appended for judges, both ranking and voting.
    pub judge: String,
    /// Appended for reviewers.
    pub review: String,
    /// Appended for the fixer.
    pub fix: String,
}

impl Prompts {
    /// The overlay for one node, or `None` when nothing is configured.
    ///
    /// `node` is the graph's own node name, so a new node gets no overlay
    /// rather than the wrong one.
    pub fn overlay(&self, node: &str) -> Option<String> {
        let specific = match node {
            "implement" => &self.implement,
            "judge" | "vote" | "deliberate" => &self.judge,
            "review" => &self.review,
            "fix" => &self.fix,
            _ => "",
        };
        let mut parts: Vec<&str> = Vec::new();
        for p in [self.all.trim(), specific.trim()] {
            if !p.is_empty() {
                parts.push(p);
            }
        }
        if parts.is_empty() {
            return None;
        }
        Some(parts.join("\n\n"))
    }
}

/// How the operator is told that a run is waiting on them.
///
/// A command rather than a built-in integration: magi is one binary with no
/// network dependencies, and every operator's notification path is different -
/// ntfy, a Slack webhook, a Windows toast, an SSH to a machine that beeps.
/// Shelling out keeps all of them possible and none of them magi's problem.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Notify {
    /// Command and arguments. `{summary}`, `{run}` and `{url}` are replaced.
    /// Empty means no notification - the web UI is then the only surface.
    pub command: Vec<String>,
}

/// Policy for [`crate::talk`], the standing conversation.
#[derive(Debug, Clone, Default, Deserialize, Serialize)]
#[serde(deny_unknown_fields, default)]
pub struct Talk {
    /// Let the conversation's agent edit files in the repository instead of
    /// filing a task for one. **Off by default** - see
    /// [`crate::talk`]'s module doc for why an edit made mid-conversation is
    /// an edit no run and no review can be attributed to, which is exactly
    /// the property a repository entered in a competition depends on. A
    /// repository that is never judged - dotfiles, a personal config
    /// checkout - has nothing to lose by turning this on in its own
    /// `magi.toml`, and a one-line fix stops costing a queued task to get.
    pub allow_write: bool,
}

/// Roles resolved to concrete agent specs for one run.
#[derive(Debug, Clone)]
pub struct ResolvedRoles {
    /// One per candidate.
    pub implementers: Vec<AgentSpec>,
    /// One per judge.
    pub judges: Vec<AgentSpec>,
    /// One per reviewer slot.
    pub reviewers: Vec<AgentSpec>,
    /// Explicit fixer, if configured.
    pub fixer: Option<AgentSpec>,
    /// Queue conductor, explicitly selected or resolved by the standalone-seat fallback.
    pub conductor: AgentSpec,
    /// The full ordered implementer roster, in [`Roles::implementers`]'s own
    /// order — or `[[agents]]` in file order, when that list is empty. Unlike
    /// [`Self::implementers`], never truncated to `graph.candidates` and
    /// never `rotate`d/wrapped: a solo run (`candidates = 1`) resolves
    /// `implementers` down to a single slot, but `graph::Runner`'s per-seat
    /// quota fallback needs the *whole* list to walk forward through when
    /// that one slot's agent runs out of quota mid-run.
    pub implementer_roster: Vec<AgentSpec>,
    /// [`Self::implementer_roster`]'s counterpart for judge seats: the whole
    /// `[roles] judges` list (or every agent), untruncated and unrotated, for
    /// the per-seat handover when a judge's agent fails.
    pub judge_roster: Vec<AgentSpec>,
    /// Likewise for reviewer seats.
    pub reviewer_roster: Vec<AgentSpec>,
}

/// Every array-valued key in a config table, as a dotted path.
///
/// Dotted so the error names `roles.implementers` rather than `implementers`:
/// an operator with three config files needs to know which key, not just that
/// there was one. `vars` is skipped because it is teravars' own input, merged
/// on purpose and never deserialised into `Config`.
fn array_keys(table: &toml::value::Table, prefix: &str) -> Vec<String> {
    let mut out = Vec::new();
    for (k, v) in table {
        if prefix.is_empty() && k == "vars" {
            continue;
        }
        let path = if prefix.is_empty() {
            k.clone()
        } else {
            format!("{prefix}.{k}")
        };
        match v {
            toml::Value::Array(_) => out.push(path),
            toml::Value::Table(t) => out.extend(array_keys(t, &path)),
            _ => {}
        }
    }
    out
}

/// How an array key behaves when two config layers both declare it.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum ArrayMerge {
    /// Two layers may both declare it; the composed value is the
    /// low-to-high-priority concatenation teravars already produces (see
    /// [`Config::load_layers`]'s doc for why that order and no dedup).
    Append,
    /// Two layers declaring it is refused; see
    /// [`Config::refuse_split_arrays`].
    Replace,
}

/// The single place that decides, for a dotted array key (as returned by
/// [`array_keys`]), whether declaring it in two config layers is a
/// concatenation the operator asked for or a silent accident.
///
/// Kept as one match so the whole policy is visible in one place - the same
/// reason `claude_quota` and `dropped_stream` close their own classification
/// in one spot elsewhere in this codebase. Anything not listed defaults to
/// [`ArrayMerge::Replace`]: refusing is the safe default for a key nobody has
/// reasoned about yet, and a new array key added later has to be added here
/// deliberately to become appendable.
///
/// - `verify.e2e` / `verify.gate` — a "run all of these, all must exit 0"
///   gate. Concatenating two of them is exactly the checks both layers
///   wanted, which is what lets a common gate (e.g. `editorconfig-checker`)
///   live in a shared layer while a repository's own layer adds its own
///   command, instead of every repository copying the shared command into
///   its own file.
/// - `repos.roots` — a set of directories to scan for checkouts. A
///   repository adding its own root on top of the machine's is additive by
///   nature, not a replacement of where the machine looks; see
///   [`Repos::roots`].
///
/// Left on the refuse side, and why:
/// - `roles.implementers` / `roles.judges` / `roles.reviewers` — an ordered
///   list of *seats*, not a set. A machine's two implementers plus a
///   repository's one is three seats nobody asked for and nobody is paying
///   for on purpose.
/// - `notify.command` — an argv. Concatenating two argvs does not produce a
///   program that runs; it produces `["ntfy", "publish", "curl", "-X"]`.
/// - `blind.strip_lines` — technically safe to concatenate (each entry is
///   matched as an independent substring, so a longer list only strips
///   *more*), but left on the refuse side anyway: the same list also drives
///   `commit_msg_hook`'s generated `sed` addresses, where position matters,
///   and a silent three-layer merge is exactly the kind of surprise
///   `refuse_split_arrays` exists to catch rather than to reason about
///   case-by-case. A repository that wants one more stripped phrase restates
///   the whole list; that restatement is visible in review, an accidental
///   concatenation would not be.
fn array_merge_policy(key: &str) -> ArrayMerge {
    match key {
        "verify.e2e" | "verify.gate" | "verify.pre_gate" | "repos.roots" => ArrayMerge::Append,
        _ => ArrayMerge::Replace,
    }
}

impl Config {
    /// Load one file through teravars: Tera rendering, `[vars]` resolution,
    /// and the `include = [...]` directive.
    pub fn load(path: &Path) -> Result<Self> {
        Self::load_layers(&[path.to_path_buf()])
    }

    /// The Tera render context shared by every layer: `system.*` (from
    /// teravars), `env` (magi's own addition - a config that names a shared
    /// build-cache directory or a machine-specific path needs
    /// `{{ env.NAME | default(value='...') }}`), and `repo` / `repo_name`
    /// derived from the last (highest-priority) path's parent directory.
    ///
    /// Factored out so [`Config::array_provenance`] can re-render a single
    /// layer under the exact same context [`Config::load_layers`] uses for
    /// the joint render, rather than drifting from it by accident.
    fn render_ctx(paths: &[PathBuf]) -> teravars::Context {
        let mut ctx = teravars::system_context();
        let env: std::collections::BTreeMap<String, String> = std::env::vars().collect();
        ctx.insert("env", &env);
        if let Some(last) = paths.last()
            && let Some(dir) = last.parent()
        {
            ctx.insert("repo", &dir.to_string_lossy());
            ctx.insert(
                "repo_name",
                &dir.file_name().unwrap_or_default().to_string_lossy(),
            );
        }
        ctx
    }

    /// Load and deep-merge a stack of config files, later files winning.
    ///
    /// This is why the config is TOML-through-teravars rather than plain serde:
    /// the roster is a *machine* fact (which CLIs and plans you pay for) while
    /// the gate is a *repository* fact (`cargo make check` here, `pnpm test`
    /// there). Picking one file and ignoring the other would force every repo
    /// to restate the roster.
    pub fn load_layers(paths: &[PathBuf]) -> Result<Self> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        if paths.len() > 1 {
            Self::refuse_split_arrays(paths, &mut engine, &ctx)?;
        }
        let merged = teravars::load_merged(paths, &mut engine, &ctx).with_context(|| {
            format!(
                "rendering config via teravars: {}",
                paths
                    .iter()
                    .map(|p| p.display().to_string())
                    .collect::<Vec<_>>()
                    .join(", ")
            )
        })?;
        let mut table = merged.config;
        // `[vars]` is teravars' own input, already resolved into the render
        // context; `deny_unknown_fields` must not trip over it.
        table.remove("vars");
        // No layer says anything about `agents`: the roster is whatever is on
        // `PATH` now, exactly as when no layer exists at all. An explicit
        // `agents = []` is a statement and is kept.
        let detect_agents = !table.contains_key("agents");
        let mut cfg: Self = toml::Value::Table(table)
            .try_into()
            .context("deserializing magi config")?;
        if detect_agents {
            cfg.agents = Self::autodetected().agents;
        }
        Ok(cfg)
    }

    /// Refuse an array that two layers both declare, unless
    /// [`array_merge_policy`] says that key is meant to accumulate.
    ///
    /// teravars **appends** arrays when it merges layers, and that is wrong for
    /// most arrays magi has: `implementers` is an ordered list of seats,
    /// `notify.command` is an argv. Concatenating two of them yields something
    /// nobody wrote - three implementers out of a machine's two and a
    /// repository's one, or an argv of `["ntfy", "publish", "curl", "-X"]`.
    ///
    /// Replacing instead would be the right merge rule for those keys, but the
    /// rule lives in teravars, which several other projects depend on;
    /// changing it there is a decision for that crate, not something to fake
    /// here by re-reading the files with different semantics and hoping the
    /// two paths agree.
    ///
    /// So magi refuses the ambiguity rather than resolving it silently, for
    /// every array key except the short, deliberate list
    /// [`array_merge_policy`] marks [`ArrayMerge::Append`] - for those, the
    /// concatenation teravars already produces *is* what both files say, so
    /// there is nothing to refuse. The cost of guessing wrong on the refused
    /// keys is a roster the operator did not ask for and is paying for by the
    /// token; the append keys carry no such risk because every element runs
    /// (or every directory is scanned) regardless of order.
    fn refuse_split_arrays(
        paths: &[PathBuf],
        engine: &mut teravars::Engine,
        ctx: &teravars::Context,
    ) -> Result<()> {
        let mut seen: std::collections::BTreeMap<String, PathBuf> = Default::default();
        for path in paths {
            let one = teravars::load_merged([path], engine, ctx)
                .with_context(|| format!("rendering {}", path.display()))?;
            for key in array_keys(&one.config, "") {
                if array_merge_policy(&key) == ArrayMerge::Append {
                    continue;
                }
                if let Some(first) = seen.get(&key) {
                    bail!(
                        "`{key}` is an array declared in two config layers:\n  \
                         {}\n  {}\nteravars appends arrays when it merges, so \
                         magi would run the concatenation of both - which is \
                         not what either file says. Declare `{key}` in exactly \
                         one of them.",
                        first.display(),
                        path.display()
                    );
                }
                seen.insert(key, path.clone());
            }
        }
        Ok(())
    }

    /// Which layers contributed to a composed, appendable array key (e.g.
    /// `"verify.gate"`), in the same low-to-high-priority order
    /// [`Config::load_layers`] concatenates them in. Layers that do not
    /// declare `key` at all are omitted.
    ///
    /// This is a **display aid for `magi doctor` only.** The command list
    /// that actually runs always comes from the one joint
    /// [`teravars::load_merged`] call in `load_layers`, never from this
    /// function - the exact hazard [`Config::refuse_split_arrays`] warns
    /// about is two merge paths that might disagree, so this function must
    /// never become a second source of the *composed* value, only of which
    /// file wrote which line in it.
    ///
    /// Re-rendering each layer alone can, in principle, resolve a
    /// `{{ vars.x }}` differently than the joint render would, if `x` is
    /// defined in one layer and referenced in another - the same caveat
    /// `refuse_split_arrays`'s structural, key-only check already lives with.
    /// None of magi's own gate commands cross that line, and a doctor listing
    /// is read by a human who can compare it against the joint one printed
    /// alongside it, so this is judged worth the simplicity of not
    /// threading provenance through the real load path.
    pub fn array_provenance(paths: &[PathBuf], key: &str) -> Vec<(PathBuf, Vec<String>)> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        let mut out = Vec::new();
        for path in paths {
            let Ok(one) = teravars::load_merged([path], &mut engine, &ctx) else {
                continue;
            };
            let mut cur = &one.config;
            let mut found = None;
            let parts: Vec<&str> = key.split('.').collect();
            for (i, part) in parts.iter().enumerate() {
                match cur.get(*part) {
                    Some(toml::Value::Array(a)) if i == parts.len() - 1 => {
                        found = Some(a);
                        break;
                    }
                    Some(toml::Value::Table(t)) => cur = t,
                    _ => break,
                }
            }
            let Some(values) = found else { continue };
            let strings: Vec<String> = values
                .iter()
                .filter_map(|v| v.as_str().map(str::to_owned))
                .collect();
            if !strings.is_empty() {
                out.push((path.clone(), strings));
            }
        }
        out
    }

    /// Each layer rendered on its own, with the outcome per file: the
    /// settings screen's way of saying which layer a value came from and which
    /// layer is the one that does not parse. A **display aid only**, for the
    /// same reason as [`Config::array_provenance`]: the effective config
    /// always comes from the one joint [`Config::load_layers`].
    pub(crate) fn layer_tables(paths: &[PathBuf]) -> Vec<(PathBuf, Result<toml::Table>)> {
        let mut engine = teravars::Engine::default();
        let ctx = Self::render_ctx(paths);
        paths
            .iter()
            .map(|path| {
                let one = teravars::load_merged([path], &mut engine, &ctx)
                    .map(|m| m.config)
                    .with_context(|| format!("rendering {}", path.display()));
                (path.clone(), one)
            })
            .collect()
    }

    /// Render a composed command list for `magi doctor`: the joined command
    /// line the run actually uses, plus - only when more than one layer
    /// contributed - which layer wrote which line.
    ///
    /// A single contributing layer (the common case today) stays the plain
    /// one-line summary magi has always printed, `empty` included: that
    /// honest "(none — ...)" is what caught a real gate-composition gap
    /// before this array could compose at all, and composition should not
    /// make the common case noisier.
    pub fn describe_composed(
        paths: &[PathBuf],
        commands: &[String],
        key: &str,
        empty: &str,
    ) -> String {
        if commands.is_empty() {
            return empty.to_owned();
        }
        let joined = commands.join(" && ");
        let provenance = Self::array_provenance(paths, key);
        if provenance.len() <= 1 {
            return joined;
        }
        let mut out = joined;
        for (path, cmds) in &provenance {
            out.push_str(&format!("\n    [{}] {}", path.display(), cmds.join(" && ")));
        }
        out
    }

    /// Resolve the config for `repo`, honouring an explicit `--config` path.
    ///
    /// Returns the config and the layers it came from, empty for built-in
    /// defaults.
    pub fn discover(repo: &Path, explicit: Option<&Path>) -> Result<(Self, Vec<PathBuf>)> {
        if let Some(p) = explicit {
            let paths = vec![p.to_path_buf()];
            return Ok((Self::load_layers(&paths)?, paths));
        }
        let paths = Self::layers(repo);
        if paths.is_empty() {
            return Ok((Self::autodetected(), paths));
        }
        Ok((Self::load_layers(&paths)?, paths))
    }
    /// Environment variable that relocates the machine-wide config layer.
    ///
    /// Set it to a directory and magi reads `<dir>/magi/config.toml` instead
    /// of the one under [`dirs::config_dir`]; set it to the empty string and
    /// magi reads no machine layer at all.
    ///
    /// This exists because the machine layer is otherwise unavoidable, and a
    /// test that builds a config fixture is not asking for the operator's
    /// preferences to be merged into it. Adding `[repos] roots` to the real
    /// machine config on a development box turned two passing tests red -
    /// `repos_list_returns_name_and_path_for_every_configured_root` and
    /// `repos_list_only_rescans_within_the_ttl_when_asked_to`, whose fixtures
    /// declare `[repos] roots` of their own, which [`Config::layers`] then
    /// found in two layers and [`Config::refuse_split_arrays`] correctly
    /// refused. CI never saw it: a runner has no machine config, so the suite
    /// was green there and red only where somebody actually uses magi.
    ///
    /// An operator gets the same escape hatch for free: a second machine
    /// config, or none, without moving files about.
    pub const CONFIG_DIR_ENV: &str = "MAGI_CONFIG_DIR";

    /// Every config layer that applies to `repo`, in increasing precedence.
    ///
    /// The machine layer is whatever [`Config::machine_layer`] resolves to,
    /// which is nothing at all in a test build.
    pub fn layers(repo: &Path) -> Vec<PathBuf> {
        let mut paths = Vec::new();
        paths.extend(Self::machine_layer());
        paths.push(repo.join(".magi").join("config.toml"));
        paths.push(repo.join("magi.toml"));
        paths.retain(|p| p.is_file());
        paths
    }

    /// The machine-wide layer's path, when there is one.
    ///
    /// **A test build has none unless it names one.** A fixture is a complete
    /// statement of the config under test, and the operator's own preferences
    /// have no business being merged into it - least of all silently, on one
    /// machine, in a suite that is green everywhere else.
    #[cfg(test)]
    pub(crate) fn machine_layer() -> Option<PathBuf> {
        std::env::var(Self::CONFIG_DIR_ENV)
            .ok()
            .filter(|dir| !dir.trim().is_empty())
            .map(|dir| PathBuf::from(dir).join("magi").join("config.toml"))
    }

    /// The machine-wide layer's path, when there is one.
    #[cfg(not(test))]
    pub(crate) fn machine_layer() -> Option<PathBuf> {
        match std::env::var(Self::CONFIG_DIR_ENV) {
            // Named, and empty on purpose: no machine layer.
            Ok(dir) if dir.trim().is_empty() => None,
            Ok(dir) => Some(PathBuf::from(dir).join("magi").join("config.toml")),
            Err(_) => dirs::config_dir().map(|dir| dir.join("magi").join("config.toml")),
        }
    }

    /// Built-in config whose roster is the agent CLIs found on `PATH`.
    pub fn autodetected() -> Self {
        let mut cfg = Self::default();
        for (kind, id, model) in [
            (AgentKind::Claude, "opus", Some("opus")),
            (AgentKind::Claude, "sonnet", Some("sonnet")),
            (AgentKind::Antigravity, "antigravity", None),
            (AgentKind::Opencode, "opencode", None),
            (AgentKind::Codex, "codex", None),
            (AgentKind::Omp, "omp", None),
        ] {
            if kind.program().is_some_and(which) && !cfg.agents.iter().any(|a| a.id == id) {
                cfg.agents.push(AgentSpec {
                    id: id.to_owned(),
                    kind,
                    model: model.map(str::to_owned),
                    command: Vec::new(),
                    extra_args: Vec::new(),
                    env: BTreeMap::new(),
                    prompt_delivery: None,
                });
            }
        }
        cfg
    }

    /// The shared build cache the verify commands and the agents both build
    /// into, when the config declares one. See [`Verify::cache_dir`].
    pub fn cache_dir(&self) -> Option<PathBuf> {
        self.verify.cache_dir()
    }

    /// Look an agent up by id.
    pub fn agent(&self, id: &str) -> Result<&AgentSpec> {
        self.agents
            .iter()
            .find(|a| a.id == id)
            .with_context(|| format!("no agent with id `{id}` in the roster"))
    }

    /// Rotate `count` seats out of `ids`, or out of the whole roster at
    /// `offset` when `ids` is empty.
    ///
    /// The one rotation rule - explicit ids cycle, an empty list rotates the
    /// roster - shared by every seat count [`Config::resolve_roles`] fills in,
    /// rather than each seat reimplementing it and drifting apart.
    fn rotate(&self, ids: &[String], count: usize, offset: usize) -> Result<Vec<AgentSpec>> {
        let mut out = Vec::with_capacity(count);
        for i in 0..count {
            let spec = if ids.is_empty() {
                self.agents[(i + offset) % self.agents.len()].clone()
            } else {
                self.agent(&ids[i % ids.len()])?.clone()
            };
            out.push(spec);
        }
        Ok(out)
    }

    /// `ids`, resolved to specs in the order named, or the whole `[[agents]]`
    /// roster in file order when `ids` is empty — the same "explicit ids
    /// stand alone, an empty list means the whole roster" rule [`Self::rotate`]
    /// applies, but with no `count` to truncate to and no `offset` to wrap by.
    /// See [`ResolvedRoles::implementer_roster`] for why a truncated, rotated
    /// list cannot answer the question this exists for.
    fn full_roster(&self, ids: &[String]) -> Result<Vec<AgentSpec>> {
        if ids.is_empty() {
            Ok(self.agents.clone())
        } else {
            ids.iter().map(|id| self.agent(id).cloned()).collect()
        }
    }

    /// Fill the roles out to the configured widths.
    ///
    /// An empty role list rotates through the whole roster, so a three-agent
    /// roster with `candidates = 3` gives one implementation per agent, and
    /// `judges = 3` rotates the judge seats by one so that judge *i* is not the
    /// author of candidate *i* whenever the roster has more than one agent.
    pub fn resolve_roles(&self) -> Result<ResolvedRoles> {
        if self.agents.is_empty() {
            bail!(
                "agent roster is empty: no agent CLI found on PATH and no \
                 [[agents]] in the config. Run `magi init` to write a starter \
                 magi.toml."
            );
        }
        Ok(ResolvedRoles {
            implementers: self.rotate(&self.roles.implementers, self.graph.candidates, 0)?,
            judges: self.rotate(&self.roles.judges, self.graph.judges, 1)?,
            reviewers: self.rotate(&self.roles.reviewers, self.graph.reviewers, 0)?,
            fixer: self
                .roles
                .fixer
                .as_deref()
                .map(|f| self.agent(f).cloned())
                .transpose()?,
            // Role resolution validates roster shape, but deliberately does
            // not preflight a CLI. The other graph seats have always deferred
            // that failure to invocation; doing it only for the conductor
            // made otherwise usable graph commands and `doctor` fail as one.
            conductor: match self.roles.conductor.as_ref().map(AgentChoice::ids) {
                Some(ids) if ids.len() == 1 => self.agent(ids[0])?.clone(),
                // A fallback chain: the first id the roster knows. The rest
                // are `agent::pick_chain`'s business at invocation.
                Some(ids) if !ids.is_empty() => ids
                    .iter()
                    .find_map(|id| self.agent(id).ok())
                    .cloned()
                    .with_context(|| {
                        format!("[roles] conductor names no agent in the roster: {ids:?}")
                    })?,
                // Keep the normal standalone-seat preference when something
                // is installed, but retain a roster fallback when it is not.
                // Invocation then reports the unavailable CLI in the same
                // place it does for every other graph role.
                _ => crate::agent::pick(&self.agents, None, &crate::agent::installed)
                    .unwrap_or_else(|_| self.agents[0].clone()),
            },
            implementer_roster: self.full_roster(&self.roles.implementers)?,
            judge_roster: self.full_roster(&self.roles.judges)?,
            reviewer_roster: self.full_roster(&self.roles.reviewers)?,
        })
    }

    /// Advisor seats for the design-deliberation stage (see
    /// `graph::Runner::advise`): `[roles] advisors` when set, otherwise the
    /// judge roster - see [`Roles::advisors`] for why that fallback and not
    /// the whole roster.
    ///
    /// The fallback rotates with `offset = 1`, matching the judges line in
    /// [`Config::resolve_roles`] exactly, `ids` and offset both - not just
    /// `roles.judges`, which is empty whenever judges themselves are
    /// unconfigured and rotating the whole roster. Falling back with
    /// `offset = 0` there would silently hand the advisors a *different*
    /// agent set than the judges an unconfigured run would actually get,
    /// which is the one thing [`Roles::advisors`]'s doc promises will not
    /// happen.
    ///
    /// Called lazily from the graph node itself rather than folded into
    /// [`Config::resolve_roles`]: unlike the other roles, a failure here must
    /// not stop a run from starting at all - the deliberation stage is an
    /// enrichment `[graph] advise` can turn off, not a seat later nodes
    /// cannot proceed without - and at the point `resolve_roles` runs (before
    /// [`crate::run::RunState`] exists, on `Runner::start`) there would be no
    /// run yet for a resolution failure to be reported against.
    pub fn advisors(&self) -> Result<Vec<AgentSpec>> {
        if self.agents.is_empty() {
            bail!(
                "agent roster is empty: no agent CLI found on PATH and no \
                 [[agents]] in the config. Run `magi init` to write a starter \
                 magi.toml."
            );
        }
        if !self.roles.advisors.is_empty() {
            return self.rotate(&self.roles.advisors, self.graph.advisors, 0);
        }
        self.rotate(&self.roles.judges, self.graph.advisors, 1)
    }

    /// The untruncated roster advisor seats hand over along: `[roles]
    /// advisors` when set, otherwise the judges' roster, exactly as
    /// [`Self::advisors`] chooses its own list.
    pub fn advisor_roster(&self) -> Result<Vec<AgentSpec>> {
        if self.roles.advisors.is_empty() {
            self.full_roster(&self.roles.judges)
        } else {
            self.full_roster(&self.roles.advisors)
        }
    }

    /// Shell prefix for [`Verify`] commands.
    pub fn shell(&self) -> Vec<String> {
        if let Some(s) = &self.verify.shell {
            return s.clone();
        }
        if which("sh") {
            vec!["sh".to_owned(), "-c".to_owned()]
        } else {
            vec!["cmd".to_owned(), "/C".to_owned()]
        }
    }

    /// Starter config, as written by `magi init`.
    pub fn starter_toml() -> String {
        let detected = Self::autodetected();
        let mut s = String::from(
            "# magi — blind multi-agent implementation competition.\n\
             # `magi run \"<task>\"` walks: implement (N parallel worktrees)\n\
             #   -> blind judging -> deliberation -> private final vote\n\
             #   -> fold losers -> review + E2E loop -> gate -> merge.\n\
             #\n\
             # Rendered by teravars: a `[vars]` table, env\n\
             # and system lookups, and `include = [...]` all work. Tera\n\
             # braces are live everywhere in this file, but comments are\n\
             # stripped before rendering (teravars >= 0.2.2), so a comment\n\
             # may quote `{{ ... }}` freely.\n\
             #\n\
             # Layers deep-merge in increasing\n\
             # precedence, so the roster can live once per machine in\n\
             # <config_dir>/magi/config.toml and each repo only states its own\n\
             # gate:\n\
             #   <config_dir>/magi/config.toml  <  .magi/config.toml  <  magi.toml\n\n\
             [vars]\n\
             # Reference it as vars.cache inside Tera braces, anywhere below.\n\
             # Single quotes inside the braces: teravars renders the raw file\n\
             # text, so TOML's own \\\" escaping never reaches Tera.\n\
             cache = \"{{ env.MAGI_CACHE | default(value='/tmp') }}\"\n\n",
        );
        if detected.agents.is_empty() {
            s.push_str(
                "# No agent CLI was found on PATH. Fill this in by hand.\n\
                 # kind = claude | opencode | antigravity | codex | command\n\
                 [[agents]]\nid = \"opus\"\nkind = \"claude\"\nmodel = \"opus\"\n\n",
            );
        } else {
            for a in &detected.agents {
                s.push_str("[[agents]]\n");
                s.push_str(&format!("id = {:?}\n", a.id));
                s.push_str(&format!("kind = {:?}\n", a.kind.as_str()));
                if let Some(m) = &a.model {
                    s.push_str(&format!("model = {m:?}\n"));
                }
                s.push('\n');
            }
        }
        s.push_str(
            "# Leave a role list empty to rotate through the roster.\n\
             [roles]\n\
             implementers = []\n\
             judges = []\n\
             reviewers = []\n\
             # conductor = \"opus\"  # arranges the queue; unset picks a seat like chatter does\n\
             # synthesizer = \"opus\"  # blends the advisors into one brief; unset picks a seat like chatter does\n\
             # synthesizer = [\"opus\", \"codex\"]  # array form: fallback chain, each tried once on quota or failure\n\n\
             [graph]\n\
             candidates = 3\n\
             judges = 3\n\
             deliberate_rounds = 1\n\
             reviewers = 3\n\
             review_rounds = 6\n\
             # Fix rounds a failing verify.gate gets before the run is blocked (0 = none).\n\
             gate_fix_rounds = 1\n\
             max_parallel = 4\n\
             language = \"en\"\n\
             # One CLI conversation per seat: judges keep their own argument\n\
             # across deliberation, the fixer keeps its implementation context.\n\
             sessions = true\n\
             # Reviewer-seat timeout. When timeout_verify is omitted, E2E and\n\
             # the final gate inherit this value for compatibility.\n\
             timeout_review = 1200\n\
             # Optional independent E2E/final-gate timeout; uncomment to keep\n\
             # verification independent if timeout_review changes later.\n\
             # timeout_verify = 1200\n\n\
             [verify]\n\
             # Run once per review round in the winner's worktree; failures are\n\
             # fed back to the fixer.\n\
             e2e = []\n\
             # Final gate. Every command must exit 0 before a merge.\n\
             gate = []\n\
             # Mechanical fixers (formatters) run in the winner's worktree just\n\
             # before the gate; whatever they change becomes one commit. A failing\n\
             # command only warns - the gate stays the arbiter. Same timeout as the\n\
             # gate (timeout_verify). Keep it light and idempotent.\n\
             # pre_gate = []\n\n\
             [merge]\n\
             # none | local | pr\n\
             mode = \"none\"\n\
             # release_bump = true  # Rust (Cargo.toml) repositories only; a no-op elsewhere\n\n\
             [update]\n\
             # off | notify | install — checked in the background, throttled.\n\
             mode = \"notify\"\n\
             # interval = \"24h\"\n",
        );
        s
    }
}

/// Is `program` on `PATH`?
pub fn which(program: &str) -> bool {
    find_program(program).is_some()
}

/// The file a bare `program` name resolves to on `PATH`, the way the OS shell
/// would find it.
///
/// Spawn agents through this, not by bare name: on Windows Rust's std
/// only tries `name.exe`, so a CLI installed as an npm `.cmd` shim (codex
/// since its 2026-09-23 reinstall) is "not found" even though a shell runs it.
/// On Windows an extensionless file is never a match: npm writes an `sh`
/// script beside every `.cmd` shim, and spawning that fails with os error 193.
pub fn find_program(program: &str) -> Option<PathBuf> {
    find_program_on(program, &std::env::var_os("PATH")?)
}

/// [`find_program`] against an explicit `PATH`, for a child whose environment
/// overrides it.
pub fn find_program_on(program: &str, paths: &std::ffi::OsStr) -> Option<PathBuf> {
    let pathext = std::env::var("PATHEXT").unwrap_or_else(|_| ".EXE;.CMD;.BAT".into());
    find_program_in(program, paths, cfg!(windows).then_some(pathext.as_str()))
}

fn find_program_in(
    program: &str,
    paths: &std::ffi::OsStr,
    pathext: Option<&str>,
) -> Option<PathBuf> {
    let p = Path::new(program);
    if p.components().count() > 1 {
        return p.is_file().then(|| p.to_path_buf());
    }
    std::env::split_paths(paths).find_map(|dir| match pathext {
        Some(exts) => {
            let bare = dir.join(program);
            if p.extension().is_some() && bare.is_file() {
                return Some(bare);
            }
            exts.split(';')
                .filter(|e| !e.is_empty())
                .map(|e| dir.join(format!("{program}{}", e.to_lowercase())))
                .find(|c| c.is_file())
        }
        None => Some(dir.join(program)).filter(|c| c.is_file()),
    })
}

#[cfg(test)]
mod tests {
    #[test]
    fn context_window_prefers_exact_then_longest_prefix_and_user_over_builtin() {
        let mut cfg = Config::default();
        assert_eq!(
            cfg.context_window("claude-sonnet-4-5-20250929"),
            Some(200_000)
        );
        assert_eq!(cfg.context_window("gpt-4.1-mini"), Some(1_000_000));
        assert_eq!(cfg.context_window("mystery-model"), None);
        cfg.context_windows
            .insert("claude-sonnet-4-5".into(), 1_000_000);
        cfg.context_windows.insert("claude-sonnet-4".into(), 5);
        cfg.context_windows.insert("mystery".into(), 32_768);
        // Longest user prefix beats a shorter one and the built-in table.
        assert_eq!(
            cfg.context_window("claude-sonnet-4-5-20250929"),
            Some(1_000_000)
        );
        // An exact name beats any prefix.
        cfg.context_windows
            .insert("claude-sonnet-4-5-20250929".into(), 7);
        assert_eq!(cfg.context_window("claude-sonnet-4-5-20250929"), Some(7));
        assert_eq!(cfg.context_window("mystery-model"), Some(32_768));
    }

    use super::*;

    /// npm writes an extensionless `sh` script beside `codex.cmd`; on Windows
    /// the `.cmd` is the spawnable one (os error 193 otherwise, 2026-09-23).
    #[test]
    fn windows_lookup_picks_the_cmd_shim_over_the_extensionless_script() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(dir.path().join("codex"), "#!/bin/sh\n").unwrap();
        std::fs::write(dir.path().join("codex.cmd"), "@echo off\n").unwrap();
        let paths = dir.path().as_os_str();
        assert_eq!(
            find_program_in("codex", paths, Some(".EXE;.CMD")),
            Some(dir.path().join("codex.cmd"))
        );
        assert_eq!(
            find_program_in("codex", paths, None),
            Some(dir.path().join("codex"))
        );
        assert_eq!(find_program_in("claude", paths, Some(".EXE;.CMD")), None);
    }

    fn spec(id: &str) -> AgentSpec {
        AgentSpec {
            id: id.to_owned(),
            kind: AgentKind::Command,
            model: None,
            command: vec!["true".to_owned()],
            extra_args: Vec::new(),
            env: BTreeMap::new(),
            prompt_delivery: None,
        }
    }

    #[test]
    fn timeout_verify_omitted_from_old_toml_inherits_timeout_review() {
        // `timeout_verify` used to not exist: `verify.e2e`/`verify.gate` ran
        // under `timeout_review`. A config written before this field existed
        // must run exactly as before, which means its default has to be the
        // same 1200s `timeout_review` has always defaulted to.
        let g: Graph = toml::from_str("timeout_review = 3600").expect("parse");
        assert_eq!(g.timeout_verify, None);
        assert_eq!(g.verify_timeout(), 3600);
    }

    #[test]
    fn shrinking_timeout_review_does_not_shrink_timeout_verify() {
        // The bug this field exists to close: `[graph] timeout_review = 45`
        // used to shrink the real-machine `verify.e2e`/`verify.gate` budget
        // along with the reviewer seats' own timeout, because both read the
        // same field.
        let g: Graph = toml::from_str("timeout_review = 45").expect("parse");
        assert_eq!(g.timeout_review, 45);
        assert_eq!(
            g.verify_timeout(),
            45,
            "an omitted legacy value follows review"
        );
        let explicit: Graph = toml::from_str("timeout_review = 45\ntimeout_verify = 1200")
            .expect("parse explicit override");
        assert_eq!(explicit.verify_timeout(), 1200);
    }

    #[test]
    fn a_toml_layer_written_before_these_fields_existed_still_parses() {
        // `deny_unknown_fields` cuts both ways: a config from before
        // `timeout_verify`/`e2e_every_round` existed must still parse, with
        // both defaulted rather than refused as unknown-in-reverse.
        let g: Graph =
            toml::from_str("candidates = 1\nreviewers = 3\nreview_rounds = 6\nmax_parallel = 4\n")
                .expect("an old-shaped [graph] table must still parse");
        assert_eq!(g.verify_timeout(), Graph::default().timeout_review);
        assert!(
            !g.e2e_every_round,
            "off by default, same as before this field existed"
        );
    }

    #[test]
    fn empty_roles_rotate_judges_off_their_own_candidate() {
        // Three seats, said out loud: this is a test about *rotation*, and it
        // has nothing to say about how many candidates a task buys by default.
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                candidates: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        let impls: Vec<&str> = roles.implementers.iter().map(|a| a.id.as_str()).collect();
        let judges: Vec<&str> = roles.judges.iter().map(|a| a.id.as_str()).collect();
        assert_eq!(impls, ["a", "b", "c"]);
        assert_eq!(judges, ["b", "c", "a"]);
        for (i, j) in judges.iter().enumerate() {
            assert_ne!(*j, impls[i], "judge {i} must not sit on its own candidate");
        }
    }

    #[test]
    fn single_agent_roster_fills_every_seat() {
        let cfg = Config {
            agents: vec![spec("solo")],
            graph: Graph {
                candidates: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert_eq!(roles.implementers.len(), 3);
        assert!(roles.judges.iter().all(|a| a.id == "solo"));
    }

    #[test]
    fn implementer_roster_is_the_whole_agent_list_untruncated_when_unset() {
        // `candidates = 1` (a solo run) still resolves `implementers` down to
        // one slot, but `implementer_roster` must carry every agent in the
        // roster, in file order, for `graph::Runner`'s quota fallback to walk
        // forward through once that one slot's agent runs out of quota.
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                candidates: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert_eq!(roles.implementers.len(), 1);
        let roster: Vec<&str> = roles
            .implementer_roster
            .iter()
            .map(|a| a.id.as_str())
            .collect();
        assert_eq!(roster, ["a", "b", "c"]);
    }

    #[test]
    fn implementer_roster_follows_explicit_ids_in_the_order_named() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            roles: Roles {
                implementers: vec!["c".to_owned(), "a".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                candidates: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        // Unaffected by the new field: still just the first named id.
        assert_eq!(roles.implementers.len(), 1);
        assert_eq!(roles.implementers[0].id, "c");
        let roster: Vec<&str> = roles
            .implementer_roster
            .iter()
            .map(|a| a.id.as_str())
            .collect();
        assert_eq!(roster, ["c", "a"]);
    }

    #[test]
    fn explicit_roles_win() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                implementers: vec!["b".to_owned()],
                judges: vec!["a".to_owned()],
                reviewers: Vec::new(),
                fixer: Some("a".to_owned()),
                ..Roles::default()
            },
            ..Config::default()
        };
        let roles = cfg.resolve_roles().unwrap();
        assert!(roles.implementers.iter().all(|a| a.id == "b"));
        assert!(roles.judges.iter().all(|a| a.id == "a"));
        assert_eq!(roles.fixer.unwrap().id, "a");
        assert_eq!(roles.conductor.id, "a");
    }

    #[test]
    fn unknown_agent_id_is_an_error() {
        let cfg = Config {
            agents: vec![spec("a")],
            roles: Roles {
                judges: vec!["nope".to_owned()],
                ..Roles::default()
            },
            ..Config::default()
        };
        assert!(cfg.resolve_roles().is_err());
    }

    #[test]
    fn conductor_role_is_resolved_validated_and_has_a_fallback() {
        let mut cfg = Config {
            agents: vec![spec("a"), spec("b")],
            ..Config::default()
        };
        assert_eq!(cfg.resolve_roles().unwrap().conductor.id, "a");

        cfg.roles.conductor = Some("b".into());
        assert_eq!(cfg.resolve_roles().unwrap().conductor.id, "b");

        cfg.roles.conductor = Some("missing".into());
        assert!(cfg.resolve_roles().is_err());
    }

    #[test]
    fn a_standalone_role_takes_a_string_or_an_array_and_round_trips() {
        let one: Roles = toml::from_str("synthesizer = \"opus\"").unwrap();
        assert_eq!(one.synthesizer, Some(AgentChoice::One("opus".to_owned())));
        assert_eq!(primary(one.synthesizer.as_ref()), Some("opus"));

        let chain: Roles = toml::from_str("chatter = [\"opus\", \"codex\"]").unwrap();
        assert_eq!(chain.chatter.as_ref().unwrap().ids(), ["opus", "codex"]);
        assert_eq!(primary(chain.chatter.as_ref()), Some("opus"));

        for roles in [one, chain] {
            let text = toml::to_string(&roles).unwrap();
            let back: Roles = toml::from_str(&text).unwrap();
            assert_eq!(back.synthesizer, roles.synthesizer);
            assert_eq!(back.chatter, roles.chatter);
        }
        let text = toml::to_string(&Roles {
            conductor: Some("x".into()),
            ..Roles::default()
        })
        .unwrap();
        assert!(
            text.contains("conductor = \"x\""),
            "string stays a string: {text}"
        );
        assert!(toml::from_str::<Roles>("synthesizer = 3").is_err());
    }

    #[test]
    fn an_empty_choice_counts_as_unset() {
        assert!(AgentChoice::Chain(Vec::new()).ids().is_empty());
        assert!(AgentChoice::One("  ".to_owned()).ids().is_empty());
        assert_eq!(primary(Some(&AgentChoice::Chain(vec![]))), None);
    }

    #[test]
    fn synthesizer_role_is_a_lazy_lookup_with_the_same_fallback_as_chatter() {
        // Unlike `conductor`, `synthesizer` is never validated by
        // `resolve_roles` — it is looked up lazily by
        // `graph::Runner::synthesize_brief` the same way `[roles] chatter`
        // is looked up by `talk::begin`, so this exercises `agent::pick`
        // directly instead of going through `resolve_roles`.
        let mut cfg = Config {
            agents: vec![spec("a"), spec("b")],
            ..Config::default()
        };
        let want = primary(cfg.roles.synthesizer.as_ref());
        assert_eq!(
            crate::agent::pick(&cfg.agents, want, &crate::agent::installed)
                .unwrap()
                .id,
            "a",
            "unset falls back to agent::pick's own default order"
        );

        cfg.roles.synthesizer = Some("b".into());
        let want = primary(cfg.roles.synthesizer.as_ref());
        assert_eq!(
            crate::agent::pick(&cfg.agents, want, &crate::agent::installed)
                .unwrap()
                .id,
            "b",
            "the named agent wins over the default order"
        );
    }

    #[test]
    fn empty_roster_is_an_error() {
        assert!(Config::default().resolve_roles().is_err());
    }

    #[test]
    fn advise_defaults_to_on_with_three_proposals() {
        let g = Graph::default();
        assert!(g.advise);
        assert_eq!(g.advisors, 3);
    }

    #[test]
    fn unset_advisors_falls_back_to_the_judge_roster() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                judges: vec!["b".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 2,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        assert_eq!(advisors.len(), 2);
        assert!(
            advisors.iter().all(|a| a.id == "b"),
            "an unset [roles] advisors must fall back to [roles] judges: {advisors:?}"
        );
    }

    #[test]
    fn an_explicit_advisor_roster_wins_over_the_judge_fallback() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b")],
            roles: Roles {
                judges: vec!["b".to_owned()],
                advisors: vec!["a".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 2,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        assert!(advisors.iter().all(|a| a.id == "a"));
    }

    /// Neither `[roles] advisors` nor `[roles] judges` set: an unconfigured
    /// advisor roster must resolve to the exact same agents an unconfigured
    /// judge panel would get - same ids, same rotation offset - or the
    /// promise in [`Roles::advisors`]'s doc ("advisor diversity for free")
    /// does not actually hold.
    #[test]
    fn an_unconfigured_advisor_and_judge_roster_resolve_to_the_same_agents() {
        let cfg = Config {
            agents: vec![spec("a"), spec("b"), spec("c")],
            graph: Graph {
                advisors: 3,
                judges: 3,
                ..Graph::default()
            },
            ..Config::default()
        };
        let advisors = cfg.advisors().expect("advisors resolve");
        let judges = cfg.resolve_roles().expect("roles resolve").judges;
        let advisor_ids: Vec<&str> = advisors.iter().map(|a| a.id.as_str()).collect();
        let judge_ids: Vec<&str> = judges.iter().map(|a| a.id.as_str()).collect();
        assert_eq!(
            advisor_ids, judge_ids,
            "an unconfigured advisor roster must be the same seats an unconfigured judge panel gets"
        );
    }

    #[test]
    fn an_unresolvable_advisor_seat_is_an_error_naming_the_id() {
        let cfg = Config {
            agents: vec![spec("a")],
            roles: Roles {
                advisors: vec!["nope".to_owned()],
                ..Roles::default()
            },
            graph: Graph {
                advisors: 1,
                ..Graph::default()
            },
            ..Config::default()
        };
        let err = cfg.advisors().expect_err("`nope` is not in the roster");
        assert!(format!("{err:#}").contains("nope"));
    }

    #[test]
    fn repos_default_to_no_roots_and_a_day_of_trust() {
        assert_eq!(Config::default().repos.roots, Vec::<PathBuf>::new());
        assert_eq!(Config::default().repos.scan_ttl, 86_400);
    }

    #[test]
    fn a_config_file_with_no_repos_table_still_loads() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ncandidates = 2\n").unwrap();
        let cfg = Config::load(&path).expect("must load without [repos]");
        assert_eq!(cfg.repos.roots, Vec::<PathBuf>::new());
        assert_eq!(cfg.repos.scan_ttl, 86_400);
    }

    /// A fixture is the whole config under test.
    ///
    /// `layers` used to reach for `dirs::config_dir()` unconditionally, so on
    /// a machine where somebody had written `<config_dir>/magi/config.toml`
    /// the suite silently loaded it as the lowest layer. Adding `[repos]
    /// roots` there turned two web tests red - their fixtures declare
    /// `[repos] roots` too, and `refuse_split_arrays` rightly refuses one
    /// array key spread across two layers. CI stayed green throughout,
    /// because a runner has no such file: the suite failed only where magi is
    /// actually used.
    ///
    /// So a test build has no machine layer unless it asks for one, and this
    /// is that promise. Written against a real file at the real location so
    /// it fails if `machine_layer` starts reading it again.
    #[test]
    fn a_test_build_does_not_read_the_operators_machine_config() {
        let repo = tempfile::tempdir().unwrap();
        std::fs::write(repo.path().join("magi.toml"), "[graph]\ncandidates = 2\n").unwrap();

        let layers = Config::layers(repo.path());
        assert_eq!(
            layers,
            vec![repo.path().join("magi.toml")],
            "only the fixture's own file may be a layer"
        );
        if let Some(real) = dirs::config_dir() {
            let machine = real.join("magi").join("config.toml");
            assert!(
                !layers.contains(&machine),
                "the operator's {} must not be a layer in a test build",
                machine.display()
            );
        }
    }

    #[test]
    fn starter_toml_loads_through_teravars() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, Config::starter_toml()).unwrap();
        let parsed = Config::load(&path).expect("starter config must load");
        assert_eq!(parsed.graph.candidates, 3);
        assert_eq!(parsed.merge.mode, MergeMode::None);
        assert_eq!(parsed.merge.style, MergeStyle::Merge);
        assert!(parsed.graph.sessions);
        assert_eq!(parsed.graph.timeout_review, 1200);
        assert_eq!(parsed.graph.verify_timeout(), 1200);
        assert_eq!(parsed.update.mode, UpdateMode::Notify);
    }

    #[test]
    fn pre_gate_defaults_to_empty_and_the_starter_documents_it() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, Config::starter_toml()).unwrap();
        assert!(Config::load(&path).unwrap().verify.pre_gate.is_empty());
        assert!(Config::starter_toml().contains("# pre_gate = []"));
    }

    #[test]
    fn starter_toml_explains_inherited_and_explicit_verify_timeouts() {
        let starter = Config::starter_toml();
        assert!(starter.contains("When timeout_verify is omitted, E2E and"));
        assert!(starter.contains("verification independent if timeout_review changes later"));
        assert!(starter.contains("# timeout_verify = 1200"));
    }

    /// A repository whose ruleset forbids merge commits declares that once,
    /// here, rather than magi asking GitHub about it on every render (see
    /// [`MergeStyle`]'s own doc for why).
    #[test]
    fn a_repository_can_declare_a_linear_history_merge_style() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[merge]\nmode = \"none\"\nstyle = \"squash\"\n").unwrap();
        let parsed = Config::load(&path).expect("config must load");
        assert_eq!(parsed.merge.style, MergeStyle::Squash);
    }

    #[test]
    fn later_layers_win_and_vars_render() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let project = dir.path().join("magi.toml");
        // The machine layer owns the roster...
        std::fs::write(
            &machine,
            "[[agents]]\nid = \"opus\"\nkind = \"claude\"\nmodel = \"opus\"\n\n\
             [graph]\ncandidates = 3\nmax_parallel = 8\n",
        )
        .unwrap();
        // ...and the project layer only states what is repo-specific, plus a
        // `[vars]` value interpolated into a command.
        std::fs::write(
            &project,
            "[vars]\ncache = \"/shared\"\n\n\
             [graph]\ncandidates = 2\n\n\
             [verify]\ngate = [\"CARGO_TARGET_DIR={{ vars.cache }}/t cargo test\"]\n",
        )
        .unwrap();

        let cfg = Config::load_layers(&[machine, project]).expect("layered load");
        assert_eq!(cfg.agents.len(), 1, "roster comes from the machine layer");
        assert_eq!(cfg.graph.candidates, 2, "project layer wins");
        assert_eq!(cfg.graph.max_parallel, 8, "machine layer survives");
        assert_eq!(
            cfg.verify.gate,
            ["CARGO_TARGET_DIR=/shared/t cargo test".to_owned()]
        );
        // The rendered command is where the cache path is read back from.
        assert_eq!(cfg.cache_dir(), Some(PathBuf::from("/shared/t")));
    }

    #[test]
    fn talk_defaults_to_an_hour_and_an_unwritten_config_still_gets_it() {
        // An operator who writes no `[graph]` timeout keys at all must still
        // land on the hour, not on the five/fifteen minutes this turn used
        // to hardcode before it read from config.
        let g = Graph::default();
        assert_eq!(g.timeout_talk, 3600);

        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ncandidates = 2\n").unwrap();
        let cfg = Config::load(&path).expect("must load without timeout_talk set");
        assert_eq!(cfg.graph.timeout_talk, 3600);
    }

    #[test]
    fn an_overridden_talk_timeout_reaches_the_loaded_config() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\ntimeout_talk = 120\n").unwrap();
        let cfg = Config::load(&path).expect("must load");
        assert_eq!(cfg.graph.timeout_talk, 120);
    }

    #[test]
    fn the_disk_defaults_are_the_measurements_made_up_front() {
        let cfg = Config::default();
        assert_eq!(cfg.disk.min_free_bytes, 8 * 1024 * 1024 * 1024);
        assert!(cfg.disk.auto_fold);
        assert_eq!(cfg.disk.fold_grace_secs, 6 * 60 * 60);
        assert_eq!(cfg.disk.cache_limit_bytes, 10 * 1024 * 1024 * 1024);
    }

    #[test]
    fn an_unset_disk_section_is_the_safe_default() {
        let dir = tempfile::tempdir().unwrap();
        std::fs::write(dir.path().join("magi.toml"), "[graph]\ncandidates = 1\n").unwrap();
        let cfg = Config::load(&dir.path().join("magi.toml")).expect("load");
        assert_eq!(cfg.disk, Disk::default());
    }

    #[test]
    fn env_is_available_to_templates_with_a_default() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        // teravars ships no `env`; magi adds it, and the `default` filter has
        // to cover the unset case or every machine would need the variable.
        //
        // Deliberately no named variable: `env` is keyed by the exact spelling
        // the OS reports, and Windows says `Path` where POSIX says `PATH`, so a
        // test asserting `env.PATH` passes on one runner and fails on another.
        // The map's non-emptiness is the platform-neutral claim.
        std::fs::write(
            &path,
            "[verify]\n\
             gate = [\"cache={{ env.MAGI_TEST_UNSET_XYZ | default(value='fallback') }}\", \
             \"populated={{ env | length > 0 }}\"]\n",
        )
        .unwrap();
        let cfg = Config::load(&path).expect("env lookup must render");
        assert_eq!(cfg.verify.gate[0], "cache=fallback");
        assert_eq!(cfg.verify.gate[1], "populated=true");
    }

    #[test]
    fn a_broken_template_names_the_file() {
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[graph]\nlanguage = \"{{ nope.\"\n").unwrap();
        let err = Config::load(&path).expect_err("must not silently ignore");
        assert!(err.to_string().contains("teravars"), "{err}");
    }

    #[test]
    fn tera_syntax_in_comments_is_inert() {
        // teravars >= 0.2.2 strips `#` comments before Tera sees the file, so a
        // comment may quote template syntax without rendering. Before 0.2.2 this
        // load failed: the commented-out braces reached the template parser.
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(
            &path,
            "# a comment may quote templates: `{{ env.NOPE | default(value='x') }}` and `{% if %}`\n\
             [graph]\ncandidates = 2\n",
        )
        .unwrap();
        let cfg = Config::load(&path).expect("comments must be inert, not rendered");
        assert_eq!(cfg.graph.candidates, 2);
    }

    #[test]
    fn opencode_defaults_to_file_delivery() {
        let mut s = spec("oc");
        s.kind = AgentKind::Opencode;
        assert_eq!(s.delivery(), Delivery::File);
        s.prompt_delivery = Some(Delivery::Argv);
        assert_eq!(s.delivery(), Delivery::Argv);
    }
    #[test]
    fn the_land_loop_is_on_but_it_cannot_merge_without_being_asked() {
        // Both default on, and that pair is the safety property: `land` takes
        // over the watching an operator was doing by hand, `land_approval`
        // keeps the irreversible step a human decision. An unattended merge
        // needs BOTH flipped, which has to be chosen deliberately twice.
        let g = Graph::default();
        assert!(
            g.land,
            "stopping at an open PR left the watching to a human"
        );
        assert!(
            g.land_approval,
            "on-by-default land is only defensible while this is also on"
        );
        assert!(g.land_rounds > 0, "a loop with no budget never terminates");
        assert!(
            g.hold_contested_merge,
            "a contested hand-off must still reach a human when approvals are off"
        );
    }
    #[test]
    fn an_array_declared_in_two_layers_is_refused_instead_of_concatenated() {
        // teravars appends arrays. For an ordered list of seats, or an argv,
        // the concatenation is something neither file says - and the operator
        // pays for the extra seats by the token.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[roles]\nimplementers = [\"a\", \"b\"]\n").unwrap();
        std::fs::write(&repo, "[roles]\nimplementers = [\"oc\"]\n").unwrap();

        let err = Config::load_layers(&[machine.clone(), repo.clone()])
            .expect_err("two layers naming one array must not merge silently")
            .to_string();
        assert!(err.contains("roles.implementers"), "{err}");
        // Both files are named: the fix is to delete one of them, and the
        // operator has to know which two to choose between.
        assert!(err.contains("machine.toml"), "{err}");
        assert!(err.contains("magi.toml"), "{err}");
    }

    #[test]
    fn a_scalar_in_one_layer_and_an_array_in_another_still_merges() {
        // The split the layering exists for: state a preference machine-wide,
        // let the repository own its own lists.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[roles]\nchatter = \"opus\"\n").unwrap();
        std::fs::write(
            &repo,
            "[[agents]]\nid = \"oc\"\nkind = \"opencode\"\n\n\
             [roles]\nimplementers = [\"oc\"]\n",
        )
        .unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("layers merge");
        assert_eq!(primary(cfg.roles.chatter.as_ref()), Some("opus"));
        assert_eq!(cfg.roles.implementers, ["oc"]);
        assert_eq!(cfg.agents.len(), 1, "the roster is not doubled");
    }

    #[test]
    fn two_layers_declaring_verify_gate_run_both_in_priority_order() {
        // The `editorconfig-checker` distribution problem: a shared layer
        // wants to add a gate command without erasing the repository's own.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"editorconfig-checker\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.gate,
            [
                "editorconfig-checker".to_owned(),
                "cargo make check".to_owned()
            ],
            "low-priority (machine) command first, high-priority (repo) command after"
        );
    }

    #[test]
    fn two_layers_declaring_verify_e2e_run_both_in_priority_order() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ne2e = [\"shared-smoke-test\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ne2e = [\"cargo test\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.e2e,
            ["shared-smoke-test".to_owned(), "cargo test".to_owned()]
        );
    }

    #[test]
    fn two_layers_declaring_repos_roots_are_both_scanned() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[repos]\nroots = [\"/machine/root\"]\n").unwrap();
        std::fs::write(&repo, "[repos]\nroots = [\"/repo/root\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.repos.roots,
            [PathBuf::from("/machine/root"), PathBuf::from("/repo/root")]
        );
    }

    #[test]
    fn duplicate_gate_commands_across_layers_both_run() {
        // Dropping the duplicate would be a silent surprise; the operator
        // sees a slower gate, never a missing one.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"same-command\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"same-command\"]\n").unwrap();

        let cfg = Config::load_layers(&[machine, repo]).expect("appendable arrays must merge");
        assert_eq!(
            cfg.verify.gate,
            ["same-command".to_owned(), "same-command".to_owned()]
        );
    }

    #[test]
    fn notify_command_is_still_refused_across_two_layers() {
        // An argv, not a set: concatenating two of them is not a program.
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[notify]\ncommand = [\"ntfy\", \"publish\"]\n").unwrap();
        std::fs::write(&repo, "[notify]\ncommand = [\"curl\", \"-X\"]\n").unwrap();

        let err = Config::load_layers(&[machine.clone(), repo.clone()])
            .expect_err("an argv split across layers must not concatenate")
            .to_string();
        assert!(err.contains("notify.command"), "{err}");
        assert!(err.contains("machine.toml"), "{err}");
        assert!(err.contains("magi.toml"), "{err}");
    }

    #[test]
    fn one_layer_declaring_verify_gate_runs_unchanged() {
        // The classification must not change behaviour for the configuration
        // this very repository has today: exactly one layer names the gate.
        let dir = tempfile::tempdir().unwrap();
        let path = dir.path().join("magi.toml");
        std::fs::write(&path, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();

        let cfg = Config::load(&path).expect("single layer must still load");
        assert_eq!(cfg.verify.gate, ["cargo make check".to_owned()]);
    }

    #[test]
    fn describe_composed_names_the_contributing_layers_only_when_there_are_two() {
        let dir = tempfile::tempdir().unwrap();
        let machine = dir.path().join("machine.toml");
        let repo = dir.path().join("magi.toml");
        std::fs::write(&machine, "[verify]\ngate = [\"editorconfig-checker\"]\n").unwrap();
        std::fs::write(&repo, "[verify]\ngate = [\"cargo make check\"]\n").unwrap();
        let paths = vec![machine.clone(), repo.clone()];

        let cfg = Config::load_layers(&paths).expect("appendable arrays must merge");
        let described =
            Config::describe_composed(&paths, &cfg.verify.gate, "verify.gate", "(none)");
        assert!(described.contains("editorconfig-checker && cargo make check"));
        assert!(
            described.contains(&machine.display().to_string()),
            "{described}"
        );
        assert!(
            described.contains(&repo.display().to_string()),
            "{described}"
        );

        // A single contributing layer stays the plain one-line summary.
        let single = vec![repo.clone()];
        let solo_cfg = Config::load_layers(&single).expect("single layer loads");
        let solo_described =
            Config::describe_composed(&single, &solo_cfg.verify.gate, "verify.gate", "(none)");
        assert_eq!(solo_described, "cargo make check");
    }
}