#!/usr/bin/env bash
# cpu-guard.sh remote-offload routing: heavy commands exec local-gate unless a
# loop guard (LOCAL_GATE_ACTIVE / BUILD_SLOT_HELD) or disabled config applies.
set -uo pipefail
TMP=$(mktemp -d "$HOME/.cache/cgroute-test-XXXXXX")
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
trap 'rm -rf "$TMP"' EXIT
FAKE="$TMP/home"
mkdir -p "$FAKE/.claude/bin" "$FAKE/.claude/lib" "$FAKE/bin"
cp "$SCRIPT_DIR/../lib/cpu-guard.sh" "$FAKE/.claude/lib/cpu-guard.sh"
cat > "$FAKE/.claude/bin/local-gate" <<'EOF'
#!/usr/bin/env bash
echo "GATE $*"
EOF
cat > "$FAKE/.claude/lib/buildslot.sh" <<'EOF'
#!/usr/bin/env bash
echo "SLOT $*"
EOF
chmod +x "$FAKE/.claude/bin/local-gate" "$FAKE/.claude/lib/buildslot.sh"
cat > "$FAKE/bin/npm" <<'EOF'
#!/usr/bin/env bash
echo "NPM $*"
EOF
cat > "$FAKE/bin/vitest" <<'EOF'
#!/usr/bin/env bash
echo "VITEST $*"
EOF
chmod +x "$FAKE/bin/npm" "$FAKE/bin/vitest"
echo '{"enabled": true}' > "$FAKE/.claude/build-remote.json"

run() { env -i HOME="$FAKE" PATH="/usr/bin:/bin" XDG_RUNTIME_DIR="" "$@" bash "$FAKE/.claude/lib/cpu-guard.sh" vitest run; }

PASS=0; FAIL=0
t() { local name="$1" want="$2" got="$3"; if [[ "$got" == $want ]]; then echo "PASS $name"; PASS=$((PASS+1)); else echo "FAIL $name want=$want got=$got"; FAIL=$((FAIL+1)); fi; }

t "strict-heavy-routes-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run)"
t "strict-build-no-cap-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run BUILD_NO_CAP=1)"
t "supervisor-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run COMMAND_SUPERVISOR_ACTIVE=1)"
t "cpu-active-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run CPU_GUARD_ACTIVE=1)"
t "slot-held-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run BUILD_SLOT_HELD=1)"
printf '0::/build.slice\n' > "$FAKE/cgroup"
t "cgroup-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run CPU_GUARD_CGROUP_FILE="$FAKE/cgroup")"
t "install-routes-with-local-fallback" "GATE --key shim-pnpm-* -- pnpm install" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" pnpm install 2>/dev/null)"
t "global-install-skips-gate" "NPM install --global @openai/codex@latest" "$(env -i HOME="$FAKE" PATH="$FAKE/bin:/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" npm install --global @openai/codex@latest 2>/dev/null)"
t "gate-child-skips-routing" "SLOT*vitest run" "$(run LOCAL_GATE_ACTIVE=1 AGENT_BUILD_SCOPE_ACTIVE=1)"
t "slot-held-stays-local" "" "$(BUILD_SLOT_HELD=1 env -i HOME="$FAKE" PATH="/usr/bin:/bin" BUILD_SLOT_HELD=1 bash "$FAKE/.claude/lib/cpu-guard.sh" true)"
echo '{"enabled": false}' > "$FAKE/.claude/build-remote.json"
t "disabled-config-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run AGENT_BUILD_SCOPE_ACTIVE=1)"
t "disabled-supervisor-strict-still-remote-only" "GATE --remote-only --key shim-vitest-* -- vitest run" "$(run COMMAND_SUPERVISOR_ACTIVE=1)"
t "non-heavy-passes-through" "hello" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" echo hello)"
echo '{"enabled": true}' > "$FAKE/.claude/build-remote.json"
t "gate-invocation-never-routed" "GATE --key k -- vitest run" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" "$FAKE/.claude/bin/local-gate" --key k -- vitest run)"
t "gate-token-in-argv-not-heavy" "" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node /nonexistent/bin/local-gate --key k -- vitest run 2>/dev/null | grep "key shim-")"
t "node-test-file-routes-remote-only" "GATE --remote-only --key shim-node-* -- node tests/remote-build.test.mjs" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node tests/remote-build.test.mjs 2>/dev/null)"
t "node-builtin-runner-routes-remote-only" "GATE --remote-only --key shim-node-* -- node --test src" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node --test src 2>/dev/null)"
t "node-plain-script-not-routed" "" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" node scripts/deploy.mjs 2>/dev/null | grep "key shim-")"
t "pnpm-deploy-routes-with-local-fallback" "GATE --key shim-pnpm-* -- pnpm --filter web deploy --prod /target" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" pnpm --filter web deploy --prod /target 2>/dev/null)"
t "php-phpstan-routes-with-local-fallback" "GATE --key shim-php-* -- php vendor/bin/phpstan analyse" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" php vendor/bin/phpstan analyse 2>/dev/null)"
t "composer-install-routes-with-local-fallback" "GATE --key shim-composer-* -- composer install" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" composer install 2>/dev/null)"
t "php-plain-script-not-routed" "" "$(env -i HOME="$FAKE" PATH="/usr/bin:/bin" bash "$FAKE/.claude/lib/cpu-guard.sh" php foo.php 2>/dev/null | grep "key shim-")"

echo "passed=$PASS failed=$FAIL"
[ "$FAIL" -eq 0 ]