/** Production expert/capability modules + real imported REA packages in an isolated YCode profile.
 * Electron's getPath is the only host replacement. The actual MCP SDK/registry uses an empty profile.
 * No original application access, expert script execution, model invocation or network operation.
 */
import fs from 'node:fs/promises'
import path from 'node:path'
import crypto from 'node:crypto'
import assert from 'node:assert/strict'
import {spawnSync} from 'node:child_process'
import {pathToFileURL} from 'node:url'
import {build} from 'esbuild'
import {parseDocument} from 'yaml'

const output=await fs.mkdtemp(path.resolve('.tmp/imported-expert-qa-'))
const userData=path.join(output,'YCode'),workspace=path.join(output,'workspace')
await fs.mkdir(userData);await fs.mkdir(workspace)
assert.equal(path.basename(userData),'YCode')
assert.ok(path.relative(path.resolve('.tmp'),output).startsWith('imported-expert-qa-'))
await fs.writeFile(path.join(userData,'mcp-servers.json'),JSON.stringify({version:1,servers:[]}))
const hash=bytes=>crypto.createHash('sha256').update(bytes).digest('hex')
const checks=[],imports=[],packages=[],resourceChecks=[],sourceShas=[]
let networkCalls=0
const originalFetch=globalThis.fetch
globalThis.fetch=async()=>{networkCalls++;throw Error('QA prohibits network calls')}
function check(label,actual,expected=true){
  const pass=JSON.stringify(actual)===JSON.stringify(expected)
  checks.push({label,pass,actual,expected});assert.ok(pass,label)
}
const sources=[
  {directory:'.tmp/rea-cpp-expert-recovered-20261016',id:'cpp-super-expert',pin:'b90023e9622bd74c55d583051bee3625eb491b552baeea17ae10ac792a352498'},
  {directory:'.tmp/rea-project-manager-recovered-20261016',id:'senior-project-manager',pin:'304805c85b87e8266294fb3aaf283d45fc71d7977af064fcb1eed1199e9389e6'},
  {directory:'.tmp/rea-ui-designer-recovered-20261016',id:'ui-designer',pin:'c9c83df190f0f0f871706d52b7e372f20b7ad63fde739f59cf9181ace1d08afa'},
  {directory:'.tmp/rea-algorithm-recovered-20261016',id:'senior-algorithm-expert',pin:'44ed0738d809fe492a36c697b0edd53b72ed75549f5b773291d05f9cf4a6c66f'}
]
const sourceFiles=['scripts/import-rea-expert.mjs','src/main/capabilities/experts.ts','src/main/capabilities/runtime.ts','src/main/capabilities/skills.ts','src/main/capabilities/mcp.ts','src/shared/capabilities.ts']
const textMember=name=>/\.(?:md|json|txt|yaml|yml|py|js|cjs|mjs|ts|csv|css|html|svg|cs|csproj|slnx|xml|xsd|sh|ps1|LICENSE)$/i.test(name)||['LICENSE','.gitignore'].includes(path.basename(name))
function promptBody(raw){const match=/^\uFEFF?---\r?\n[\s\S]*?\r?\n---(?:\r?\n|$)/.exec(raw);assert.ok(match);return raw.slice(match[0].length).trim()}
function metadata(raw){const match=/^\uFEFF?---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(raw);assert.ok(match);const parsed=parseDocument(match[1],{uniqueKeys:true,schema:'core'});assert.equal(parsed.errors.length,0);return parsed.toJS({maxAliasCount:30})}
try{
  for(const file of sourceFiles)sourceShas.push({file,sha256:hash(await fs.readFile(file))})
  for(const source of sources){
    const manifest=JSON.parse(await fs.readFile(path.join(source.directory,'evidence-manifest.json'),'utf8'))
    check(source.id+' fixed REA root identity',manifest.rootSha256,source.pin)
    const plugin=JSON.parse(await fs.readFile(path.join(source.directory,'.codebuddy-plugin/plugin.json'),'utf8'))
    check(source.id+' fixed package identity',plugin.name,source.id)
    const run=spawnSync(process.execPath,['scripts/import-rea-expert.mjs','--source',source.directory,'--user-data',userData],{encoding:'utf8',maxBuffer:4*1024*1024,timeout:60000,windowsHide:true})
    await fs.writeFile(path.join(output,source.id+'-import.log'),run.stdout+'\n'+run.stderr)
    check(source.id+' actual import helper exit',run.status,0)
    const summary=run.stdout.trim().split(/\r?\n/).map(line=>{try{return JSON.parse(line)}catch{return null}}).findLast(item=>item?.result)
    check(source.id+' actual import helper explicitly PASS',summary?.result,'PASS')
    const helperReport=JSON.parse(await fs.readFile(path.join(summary.directory,'report.json'),'utf8'))
    check(source.id+' helper report activated',helperReport.activated,true)
    imports.push({expertId:source.id,summary,helperReport:path.join(summary.directory,'report.json')})
    packages.push({...source,manifest,plugin,installedPath:path.join(userData,'plugins','marketplaces','my-experts','plugins',source.id)})
  }
  const bundle=path.join(output,'capabilities-under-test.mjs')
  const built=await build({stdin:{contents:`export * from './src/main/capabilities/experts';export {createCapabilitySnapshot} from './src/main/capabilities/runtime';export {listMcpServers} from './src/main/capabilities/mcp';`,resolveDir:process.cwd(),loader:'ts'},outfile:bundle,bundle:true,platform:'node',format:'esm',packages:'external',metafile:true,logLevel:'warning',plugins:[{name:'isolated-electron-path-only',setup(builder){
    builder.onResolve({filter:/^electron$/},()=>({path:'electron',namespace:'imported-expert-qa'}))
    builder.onLoad({filter:/.*/,namespace:'imported-expert-qa'},()=>({contents:`export const app={getPath(name){if(name!=='userData')throw Error('Unexpected host path '+name);return ${JSON.stringify(userData)}}};export const safeStorage={isEncryptionAvailable:()=>false};`}))
  }}]})
  await fs.writeFile(path.join(output,'bundle-metafile.json'),JSON.stringify(built.metafile,null,2))
  const api=await import(pathToFileURL(bundle).href)
  check('actual MCP SDK uses empty isolated registry',await api.listMcpServers(),[])
  const listed=await api.listExperts()
  check('production registry discovers all four genuine imports',listed.map(item=>item.id).sort(),sources.map(item=>item.id).sort())
  for(const pkg of packages){
    const {id,plugin,manifest,installedPath}=pkg,document=await api.readExpert(id),binding=await api.activateExpert(id)
    check(id+' actual expert is valid',document.expert.error??null,null)
    check(id+' raw localized display name',document.expert.displayName,plugin.displayName)
    check(id+' raw localized profession',document.expert.profession,plugin.profession)
    check(id+' activated localized display name',binding.name,plugin.displayName.zh)
    check(id+' activated localized profession',binding.profession,plugin.profession.zh)
    check(id+' activation returns same validated default prompt',binding.defaultInitPrompt,plugin.defaultInitPrompt)
    check(id+' activation identity mapping',JSON.parse(binding.runtimeIdentity.slice('expert-v2:'.length)),{v:2,kind:'expert',expertId:id,pluginRegisteredName:id,agentName:plugin.agentName,source:'custom'})
    const avatar=manifest.files.find(file=>file.path===plugin.avatar.replace(/^\.\//,''))
    check(id+' avatar data URL preserves complete PNG SHA',hash(Buffer.from(binding.avatarUrl.split(',')[1],'base64')),avatar.sha256)
    const agentPath='agents/'+plugin.agentName+'.md',agentRaw=await fs.readFile(path.join(pkg.directory,agentPath),'utf8')
    check(id+' role body preserved excluding YAML envelope',document.prompt,promptBody(agentRaw))
    const turn=await api.expertTurnContext(id)
    check(id+' actual turn includes real role prompt',turn.context.includes(document.prompt))
    check(id+' actual turn states isolated installed package root',turn.context.includes(JSON.stringify(installedPath)))
    const agentSkills=metadata(agentRaw).skills??[],expectedPreloads=[]
    for(const relative of plugin.skills){
      const key=relative.replace(/^\.\//,'')+'/SKILL.md',rawSkill=await fs.readFile(path.join(pkg.directory,key),'utf8'),skillName=metadata(rawSkill).name,preloaded=agentSkills.includes(skillName)
      check(id+' YAML-selected skill preload only: '+key,turn.context.includes(rawSkill),preloaded)
      check(id+' plugin skill remains in demand-load directory: '+key,turn.context.includes(JSON.stringify({name:skillName,path:key,description:metadata(rawSkill).description,preloaded})))
      if(preloaded)expectedPreloads.push(key)
    }
    check(id+' exact startup skill selection',Array.from(turn.context.matchAll(/<expert-skill path="([^"]+)">/g),match=>match[1]),expectedPreloads)
    const controller=new AbortController(),ctx={runId:'imported-expert-qa',toolCallId:'resource-check',workspaceRoot:workspace,permissionMode:'full-access',signal:controller.signal,emit(){}}
    const snapshot=await api.createCapabilitySnapshot([],workspace,{sessionId:'qa-'+id,expertId:id})
    const {defaultInitPrompt:_defaultInitPrompt,...displayBinding}=binding
    check(id+' runtime snapshot carries true expert identity',snapshot.assistantDisplay,displayBinding)
    check(id+' runtime exposes actual resource tool',snapshot.specs.some(spec=>spec.function.name==='ycode_expert_resource'))
    const resourceFiles=manifest.files.filter(file=>textMember(file.path))
    check(id+' exact complete resource index',Object.keys(document.files).sort(),resourceFiles.map(file=>file.path).sort())
    let installedBytes=0
    for(const file of manifest.files){
      const original=await fs.readFile(path.join(pkg.directory,file.path)),installed=await fs.readFile(path.join(installedPath,file.path))
      assert.equal(hash(original),file.sha256);assert.equal(hash(installed),file.sha256);assert.equal(installed.length,file.bytes);installedBytes+=installed.length
    }
    check(id+' every installed file preserves full source SHA/bytes',installedBytes,manifest.files.reduce((n,file)=>n+file.bytes,0))
    for(const file of resourceFiles){
      const result=await snapshot.execute('ycode_expert_resource',{path:file.path},ctx)
      const actualSha=typeof result?.content==='string'?hash(Buffer.from(result.content,'utf8')):null
      resourceChecks.push({expertId:id,path:file.path,sourceSha256:file.sha256,returnedSha256:actualSha,ok:result?.ok,pass:result?.ok===true&&actualSha===file.sha256})
      assert.equal(result?.ok,true,id+' resource success: '+file.path);assert.equal(actualSha,file.sha256,id+' resource full original SHA: '+file.path)
      check(id+' runtime advertises resource: '+file.path,snapshot.context.includes('- '+file.path))
    }
    check(id+' all real resource bytes preserved through production tool',resourceChecks.filter(item=>item.expertId===id).every(item=>item.pass))
    for(const bad of ['__proto__','constructor','toString','../README.md','..\\README.md','C:/outside-fixture.txt','/outside-fixture.txt','skills/../../README.md','%2e%2e/README.md','']){
      check(id+' rejects inherited/traversal/absolute resource '+JSON.stringify(bad),(await snapshot.execute('ycode_expert_resource',{path:bad},ctx))?.ok,false)
    }
    check(id+' legitimate ./ resource prefix works',hash((await snapshot.execute('ycode_expert_resource',{path:'./'+agentPath},ctx)).content),manifest.files.find(file=>file.path===agentPath).sha256)
    check(id+' binary avatar is not exposed as UTF8',(await snapshot.execute('ycode_expert_resource',{path:plugin.avatar},ctx))?.ok,false)
    for(const marker of ['.downloaded_at','.created-by-session'])check(id+' does not forge source host marker '+marker,await fs.stat(path.join(installedPath,marker)).then(()=>true,()=>false),false)
  }
  const ui=packages.find(pkg=>pkg.id==='ui-designer'),fonts=ui.manifest.files.filter(file=>file.path.endsWith('.ttf'))
  check('UI package exact full byte count',ui.manifest.files.reduce((n,file)=>n+file.bytes,0),6249920)
  check('UI package retains all 54 fonts',fonts.length,54)
  check('UI font SHA retention independently checked',await Promise.all(fonts.map(async file=>hash(await fs.readFile(path.join(ui.installedPath,file.path)))===file.sha256)),fonts.map(()=>true))
  check('PM C#/XML/XSD/csproj are genuinely readable',resourceChecks.filter(item=>item.expertId==='senior-project-manager'&&/\.(?:cs|csproj|xml|xsd)$/.test(item.path)).length,48)
  check('PM BOM csproj raw SHA preserved',resourceChecks.filter(item=>item.expertId==='senior-project-manager'&&item.path.endsWith('.csproj')).map(item=>item.pass),[true,true])
  check('UI HTML source exposed',resourceChecks.some(item=>item.expertId==='ui-designer'&&item.path.endsWith('/viewer.html')&&item.pass))
  check('UI licenses exposed',resourceChecks.some(item=>item.expertId==='ui-designer'&&/LICENSE$/i.test(item.path)&&item.pass))
  check('algorithm verifier Python source exposed',resourceChecks.some(item=>item.expertId==='senior-algorithm-expert'&&item.path.endsWith('/verify_shortest_paths.py')&&item.pass))
  check('no fetch/API call performed',networkCalls,0)
  for(const source of sourceShas)check('tested source unchanged '+source.file,hash(await fs.readFile(source.file)),source.sha256)
  await fs.writeFile(path.join(output,'report.json'),JSON.stringify({result:'PASS',checks,imports,packages:packages.map(({manifest,plugin,...rest})=>({...rest,files:manifest.files.length,bytes:manifest.files.reduce((n,file)=>n+file.bytes,0),sourceRootSha256:manifest.rootSha256,declaredSkills:plugin.skills})),resourceChecks,sourceShas,bundleSha256:hash(await fs.readFile(bundle)),networkCalls,limits:['Real imported files and production expert/capability/actual empty MCP SDK profile; Electron getPath only is a QA adapter.','No model API, original expert script, font/browser rendering, .NET build or business workflow was executed.','Original package evidence is inherited from SHA-verified REA recovered manifests; this test never accesses WorkBuddy.']},null,2))
  console.log(JSON.stringify({result:'PASS',checks:checks.length,packages:packages.length,textResources:resourceChecks.length,output}))
}catch(error){
  await fs.writeFile(path.join(output,'report.json'),JSON.stringify({result:'FAIL',error:error.stack,checks,imports,resourceChecks,sourceShas,networkCalls},null,2))
  console.error(JSON.stringify({result:'FAIL',error:error.message,output}));process.exitCode=1
}finally{globalThis.fetch=originalFetch}