#!/usr/bin/env bash
# cpu-guard.sh remote-offload routing: heavy commands exec local-gate unless a
# loop guard (LOCAL_GATE_ACTIVE / BUILD_SLOT_HELD) or disabled config applies.
set -uo pipefail
TMP=$(mktemp -d "$HOME/.cache/cgroute-test-XXXXXX")
trap 'rm -rf "$TMP"' EXIT
FAKE="$TMP/home"
mkdir -p "$FAKE/.claude/bin" "$FAKE/.claude/lib" "$FAKE/bin"
cp "$HOME/.claude/lib/cpu-guard.sh" "$FAKE/.claude/lib/cpu-guard.sh"
cat > "$FAKE/.claude/bin/local-gate" <<'EOF'
#!/usr/bin/env bash
echo "GATE $*"
EOF
cat > "$FAKE/.claude/lib/buildslot.sh" <<'EOF'
#!/usr/bin/env bash
echo "SLOT $*"
EOF
chmod +x "$FAKE/.claude/bin/local-gate" "$FAKE/.claude/lib/buildslot.sh"
cat > "$FAKE/bin/npm" <<'EOF'
#!/usr/bin/env bash
echo "NPM $*"
EOF
chmod +x "$FAKE/bin/npm"
echo '{"enabled": true}' > "$FAKE/.claude/build-remote.json"

run() { env -i HOME="$FAKE" PATH="/usr/bin:/bin" XDG_RUNTIME_DIR="" "$@" bash "$FAKE/.claude/lib/cpu-guard.sh" vitest run; }

PASS=0; FAIL=0
t() { local name="$1" want="$2" got="$3"; if [[ "$got" == $want ]]; then echo "PASS $name"; PASS=$((PASS+1)); else echo "FAIL $name want=$want got=$got"; FAIL=$((FAIL+1)); fi; }

t "heavy-routes-to-gate" "GATE --key shim-vitest-* -- vitest run" "$(run)"
t "install-routes-to-gate" "GATE --key shim-pnpm-* -- pnpm install" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" pnpm install 2>/dev/null)"
t "global-install-skips-gate" "NPM install --global @openai/codex@latest" "$(env -i HOME="$FAKE" PATH="$FAKE/bin:/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" npm install --global @openai/codex@latest 2>/dev/null)"
t "gate-child-skips-routing" "SLOT*vitest run" "$(run LOCAL_GATE_ACTIVE=1 AGENT_BUILD_SCOPE_ACTIVE=1)"
t "slot-held-stays-local" "" "$(BUILD_SLOT_HELD=1 env -i HOME="$FAKE" PATH="/usr/bin:/bin" BUILD_SLOT_HELD=1 bash "$FAKE/.claude/lib/cpu-guard.sh" true)"
echo '{"enabled": false}' > "$FAKE/.claude/build-remote.json"
t "disabled-config-no-routing" "SLOT*vitest run" "$(run AGENT_BUILD_SCOPE_ACTIVE=1)"
t "non-heavy-passes-through" "hello" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" echo hello)"
echo '{"enabled": true}' > "$FAKE/.claude/build-remote.json"
t "gate-invocation-never-routed" "GATE --key k -- vitest run" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" "$FAKE/.claude/bin/local-gate" --key k -- vitest run)"
t "gate-token-in-argv-not-heavy" "" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node /nonexistent/bin/local-gate --key k -- vitest run 2>/dev/null | grep "key shim-")"
t "node-test-file-routes-to-gate" "GATE --key shim-node-* -- node tests/remote-build.test.mjs" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node tests/remote-build.test.mjs 2>/dev/null)"
t "node-builtin-runner-routes-to-gate" "GATE --key shim-node-* -- node --test src" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node --test src 2>/dev/null)"
t "node-plain-script-not-routed" "" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node scripts/deploy.mjs 2>/dev/null | grep "key shim-")"

echo "passed=$PASS failed=$FAIL"
[ "$FAIL" -eq 0 ]