IdeA/crates/backend/src/openai_tools.rs

//! ToolInvoker for the OpenAI-compatible adapter.
//!
//! C'est la porte locale qui donne aux modèles HTTP la même surface `idea_*` que
//! le serveur MCP : même catalogue, même mapping en `OrchestratorCommand`, même
//! `OrchestratorService::dispatch`.

use std::str::FromStr;
use std::sync::{Arc, Mutex};

use application::OrchestratorService;
use async_trait::async_trait;
use domain::ports::{
    AgentToolPolicyStore, McpToolPermissionStore, ProjectStore, ToolInvocationError, ToolInvoker,
    ToolSpec,
};
use domain::{AgentToolPolicy, IssueRef, McpToolPolicy, Project};
use infrastructure::{TemplateToolProvider, TicketToolProvider};
use serde_json::Value;

const PROJECT_ROOT_ARG: &str = "__ideaProjectRoot";
const REQUESTER_ARG: &str = "__ideaRequester";

/// Invoker d'outils OpenAI-compatible branché sur l'orchestrateur applicatif.
pub struct AppOpenAiToolInvoker {
    orchestrator: Arc<OrchestratorService>,
    projects: Arc<dyn ProjectStore>,
    policies: Arc<dyn AgentToolPolicyStore>,
    mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
    ticket_tools: Arc<dyn TicketToolProvider>,
    template_tools: Arc<dyn TemplateToolProvider>,
}

/// Proxy injecté avant que l'orchestrateur soit construit, puis lié dans la
/// composition root. Il casse uniquement le cycle de wiring, pas le contrat runtime.
#[derive(Default)]
pub struct LateBoundOpenAiToolInvoker {
    inner: Mutex<Option<Arc<dyn ToolInvoker>>>,
}

impl LateBoundOpenAiToolInvoker {
    /// Construit un proxy vide.
    #[must_use]
    pub fn new() -> Self {
        Self {
            inner: Mutex::new(None),
        }
    }

    /// Lie l'implémentation réelle. Appelé une fois par la composition root.
    pub fn bind(&self, inner: Arc<dyn ToolInvoker>) {
        *self.inner.lock().expect("mutex sain") = Some(inner);
    }
}

#[async_trait]
impl ToolInvoker for LateBoundOpenAiToolInvoker {
    fn tools(&self) -> Vec<ToolSpec> {
        self.inner
            .lock()
            .expect("mutex sain")
            .as_ref()
            .map_or_else(Vec::new, |inner| inner.tools())
    }

    async fn tools_for_context(
        &self,
        project_root: &str,
        requester: &str,
    ) -> Result<Vec<ToolSpec>, ToolInvocationError> {
        let inner = self
            .inner
            .lock()
            .expect("mutex sain")
            .clone()
            .ok_or_else(|| {
                ToolInvocationError::Execution("ToolInvoker OpenAI non initialisé".to_owned())
            })?;
        inner.tools_for_context(project_root, requester).await
    }

    async fn call(&self, name: &str, args_json: &str) -> Result<String, ToolInvocationError> {
        let inner = self
            .inner
            .lock()
            .expect("mutex sain")
            .clone()
            .ok_or_else(|| {
                ToolInvocationError::Execution("ToolInvoker OpenAI non initialisé".to_owned())
            })?;
        inner.call(name, args_json).await
    }
}

impl AppOpenAiToolInvoker {
    /// Construit l'invoker depuis le service orchestrateur et le store projet.
    #[must_use]
    pub fn new(
        orchestrator: Arc<OrchestratorService>,
        projects: Arc<dyn ProjectStore>,
        policies: Arc<dyn AgentToolPolicyStore>,
        mcp_tool_permissions: Arc<dyn McpToolPermissionStore>,
        ticket_tools: Arc<dyn TicketToolProvider>,
        template_tools: Arc<dyn TemplateToolProvider>,
    ) -> Self {
        Self {
            orchestrator,
            projects,
            policies,
            mcp_tool_permissions,
            ticket_tools,
            template_tools,
        }
    }
}

#[async_trait]
impl ToolInvoker for AppOpenAiToolInvoker {
    fn tools(&self) -> Vec<ToolSpec> {
        infrastructure::orchestrator::mcp::catalogue()
            .into_iter()
            .map(tool_def_to_spec)
            .collect()
    }

    async fn tools_for_context(
        &self,
        project_root: &str,
        requester: &str,
    ) -> Result<Vec<ToolSpec>, ToolInvocationError> {
        let ephemeral_policy = self.policies.get_policy(requester);
        let project = self.find_project(project_root).await?;
        let surface = infrastructure::orchestrator::mcp::policy::resolve_effective_tool_surface(
            Some(self.mcp_tool_permissions.as_ref()),
            &project,
            requester,
            ephemeral_policy.as_ref(),
        )
        .await
        .map_err(|e| {
            ToolInvocationError::Execution(format!("failed to resolve MCP tool permissions: {e}"))
        })?;
        Ok(
            infrastructure::orchestrator::mcp::policy::effective_tool_catalogue(
                ephemeral_policy.as_ref(),
                &surface,
            )
            .into_iter()
            .map(tool_def_to_spec)
            .collect(),
        )
    }

    async fn call(&self, name: &str, args_json: &str) -> Result<String, ToolInvocationError> {
        let value: Value = serde_json::from_str(args_json)
            .map_err(|e| ToolInvocationError::InvalidArguments(format!("JSON invalide: {e}")))?;
        let args = value.as_object().ok_or_else(|| {
            ToolInvocationError::InvalidArguments(
                "les arguments d'outil doivent être un objet JSON".to_owned(),
            )
        })?;
        let project_root = args
            .get(PROJECT_ROOT_ARG)
            .and_then(Value::as_str)
            .map(str::to_owned)
            .ok_or_else(|| {
                ToolInvocationError::InvalidArguments(
                    "contexte projet interne absent pour l'outil".to_owned(),
                )
            })?;
        let requester = args
            .get(REQUESTER_ARG)
            .and_then(Value::as_str)
            .map(str::to_owned)
            .ok_or_else(|| {
                ToolInvocationError::InvalidArguments(
                    "identité requester interne absente pour l'outil".to_owned(),
                )
            })?;
        let ephemeral_policy = self.policies.get_policy(&requester);
        if let Some(policy) = &ephemeral_policy {
            enforce_policy(policy, &requester, name, &value)?;
        }
        let project = self.find_project(&project_root).await?;
        enforce_durable_tool_policy(
            self.mcp_tool_permissions.as_ref(),
            &project,
            ephemeral_policy.as_ref(),
            &requester,
            name,
        )
        .await?;
        if infrastructure::orchestrator::mcp::tools::is_ticket_tool(name) {
            let value = self
                .ticket_tools
                .handle_ticket_tool(&project, &requester, name, value)
                .await
                .map_err(|e| {
                    let detail =
                        serde_json::to_string(&e.to_value()).unwrap_or_else(|_| e.to_string());
                    ToolInvocationError::Execution(detail)
                })?;
            return serde_json::to_string(&value)
                .map_err(|e| ToolInvocationError::Execution(format!("JSON ticket tool: {e}")));
        }
        if infrastructure::orchestrator::mcp::tools::is_template_tool(name) {
            let value = self
                .template_tools
                .handle_template_tool(&project, &requester, name, value)
                .await
                .map_err(|e| {
                    let detail =
                        serde_json::to_string(&e.to_value()).unwrap_or_else(|_| e.to_string());
                    ToolInvocationError::Execution(detail)
                })?;
            return serde_json::to_string(&value)
                .map_err(|e| ToolInvocationError::Execution(format!("JSON template tool: {e}")));
        }
        let command = infrastructure::orchestrator::mcp::map_tool_call(name, &value, &requester)
            .map_err(|e| match e {
                infrastructure::orchestrator::mcp::ToolMapError::UnknownTool(tool) => {
                    ToolInvocationError::NotFound(tool)
                }
                infrastructure::orchestrator::mcp::ToolMapError::BadArguments(tool) => {
                    ToolInvocationError::InvalidArguments(format!(
                        "arguments invalides pour `{tool}`"
                    ))
                }
                infrastructure::orchestrator::mcp::ToolMapError::Invalid(err) => {
                    ToolInvocationError::InvalidArguments(err.to_string())
                }
            })?;
        let outcome = self
            .orchestrator
            .dispatch(&project, command)
            .await
            .map_err(|e| ToolInvocationError::Execution(e.to_string()))?;
        Ok(outcome.reply.unwrap_or(outcome.detail))
    }
}

impl AppOpenAiToolInvoker {
    async fn find_project(&self, project_root: &str) -> Result<Project, ToolInvocationError> {
        self.projects
            .list_projects()
            .await
            .map_err(|e| ToolInvocationError::Execution(e.to_string()))?
            .into_iter()
            .find(|project| project.root.as_str() == project_root)
            .ok_or_else(|| {
                ToolInvocationError::Execution(format!(
                    "projet introuvable pour root `{project_root}`"
                ))
            })
    }
}

fn tool_def_to_spec(tool: infrastructure::orchestrator::mcp::ToolDef) -> ToolSpec {
    ToolSpec {
        name: tool.name.to_owned(),
        description: tool.description.to_owned(),
        input_schema: tool.input_schema,
    }
}

async fn enforce_durable_tool_policy(
    store: &dyn McpToolPermissionStore,
    project: &Project,
    ephemeral_policy: Option<&AgentToolPolicy>,
    requester: &str,
    name: &str,
) -> Result<(), ToolInvocationError> {
    let Some(policy) = durable_tool_policy(store, project, ephemeral_policy, requester).await?
    else {
        return Ok(());
    };
    if policy.permits(name) {
        return Ok(());
    }
    let requester = if requester.is_empty() {
        "mcp"
    } else {
        requester
    };
    Err(ToolInvocationError::Rejected(format!(
        "MCP tool `{name}` is not permitted for requester {requester}"
    )))
}

async fn durable_tool_policy(
    store: &dyn McpToolPermissionStore,
    project: &Project,
    ephemeral_policy: Option<&AgentToolPolicy>,
    requester: &str,
) -> Result<Option<McpToolPolicy>, ToolInvocationError> {
    infrastructure::orchestrator::mcp::policy::resolve_effective_tool_surface(
        Some(store),
        project,
        requester,
        ephemeral_policy,
    )
    .await
    .map(|surface| surface.durable_policy)
    .map_err(|e| {
        ToolInvocationError::Execution(format!("failed to resolve MCP tool permissions: {e}"))
    })
}

#[cfg(test)]
fn enforce_tool_policy(
    policies: &dyn AgentToolPolicyStore,
    requester: &str,
    name: &str,
    arguments: &Value,
) -> Result<(), ToolInvocationError> {
    let Some(policy) = policies.get_policy(requester) else {
        return Ok(());
    };
    enforce_policy(&policy, requester, name, arguments)
}

fn enforce_policy(
    policy: &AgentToolPolicy,
    requester: &str,
    name: &str,
    arguments: &Value,
) -> Result<(), ToolInvocationError> {
    if !policy.permits(name) {
        return Err(ToolInvocationError::Rejected(format!(
            "tool `{name}` is not permitted for requester {requester}"
        )));
    }
    if is_ticket_policy_bulk_mutation_tool(name) {
        let refs = arguments
            .get("refs")
            .and_then(Value::as_array)
            .ok_or_else(|| {
                ToolInvocationError::InvalidArguments(format!(
                    "tool `{name}` requires ticket refs under the active policy"
                ))
            })?;
        for raw_ref in refs {
            let raw_ref = raw_ref.as_str().ok_or_else(|| {
                ToolInvocationError::InvalidArguments(format!(
                    "tool `{name}` requires string ticket refs under the active policy"
                ))
            })?;
            let issue_ref = IssueRef::from_str(raw_ref).map_err(|e| {
                ToolInvocationError::InvalidArguments(format!("invalid ticket ref: {e}"))
            })?;
            if !policy.permits_ticket_mutation(name, issue_ref) {
                return Err(ToolInvocationError::Rejected(format!(
                    "tool `{name}` is not permitted for ticket {issue_ref}"
                )));
            }
        }
    } else if is_ticket_policy_mutation_tool(name) {
        let raw_ref = arguments
            .get("ref")
            .and_then(Value::as_str)
            .ok_or_else(|| {
                ToolInvocationError::InvalidArguments(format!(
                    "tool `{name}` requires a ticket ref under the active policy"
                ))
            })?;
        let issue_ref = IssueRef::from_str(raw_ref).map_err(|e| {
            ToolInvocationError::InvalidArguments(format!("invalid ticket ref: {e}"))
        })?;
        if !policy.permits_ticket_mutation(name, issue_ref) {
            return Err(ToolInvocationError::Rejected(format!(
                "tool `{name}` is not permitted for ticket {issue_ref}"
            )));
        }
    }
    Ok(())
}

fn is_ticket_policy_mutation_tool(name: &str) -> bool {
    matches!(
        name,
        "idea_ticket_update"
            | "idea_ticket_update_status"
            | "idea_ticket_update_priority"
            | "idea_ticket_update_carnet"
            | "idea_ticket_attachment_add"
            | "idea_ticket_attachment_mark_summarized"
            | "idea_ticket_link"
            | "idea_ticket_unlink"
    )
}

fn is_ticket_policy_bulk_mutation_tool(name: &str) -> bool {
    matches!(
        name,
        "idea_ticket_bulk_update_status"
            | "idea_ticket_bulk_update_priority"
            | "idea_ticket_bulk_delete"
    )
}

#[cfg(test)]
mod tests {
    use std::collections::HashMap;
    use std::sync::Mutex;

    use domain::ports::{AgentToolPolicyStore, McpToolPermissionStore, ProjectStore};
    use domain::{
        AgentId, AgentMcpToolPolicyOverride, McpToolPolicy, Project, ProjectId,
        ProjectMcpToolPermissions, ProjectPath, RemoteRef, StoreError, Workspace,
    };
    use infrastructure::{TemplateToolError, TicketToolError};
    use serde_json::json;
    use uuid::Uuid;

    use super::*;

    #[derive(Default)]
    struct FakePolicies(Mutex<HashMap<String, AgentToolPolicy>>);

    impl AgentToolPolicyStore for FakePolicies {
        fn set_policy(&self, requester: String, policy: AgentToolPolicy) {
            self.0.lock().unwrap().insert(requester, policy);
        }

        fn get_policy(&self, requester: &str) -> Option<AgentToolPolicy> {
            self.0.lock().unwrap().get(requester).cloned()
        }

        fn clear_policy(&self, requester: &str) {
            self.0.lock().unwrap().remove(requester);
        }
    }

    #[derive(Default)]
    struct FakeProjects {
        projects: Mutex<Vec<Project>>,
    }

    impl FakeProjects {
        fn with(project: Project) -> Self {
            Self {
                projects: Mutex::new(vec![project]),
            }
        }
    }

    struct FakeMcpToolPermissions {
        doc: Mutex<ProjectMcpToolPermissions>,
    }

    impl FakeMcpToolPermissions {
        fn new(doc: ProjectMcpToolPermissions) -> Self {
            Self {
                doc: Mutex::new(doc),
            }
        }
    }

    #[async_trait]
    impl McpToolPermissionStore for FakeMcpToolPermissions {
        async fn load_mcp_tool_permissions(
            &self,
            _project: &Project,
        ) -> Result<ProjectMcpToolPermissions, StoreError> {
            Ok(self.doc.lock().unwrap().clone())
        }

        async fn save_mcp_tool_permissions(
            &self,
            _project: &Project,
            permissions: &ProjectMcpToolPermissions,
        ) -> Result<(), StoreError> {
            *self.doc.lock().unwrap() = permissions.clone();
            Ok(())
        }
    }

    #[async_trait]
    impl ProjectStore for FakeProjects {
        async fn list_projects(&self) -> Result<Vec<Project>, StoreError> {
            Ok(self.projects.lock().unwrap().clone())
        }

        async fn load_project(&self, id: ProjectId) -> Result<Project, StoreError> {
            self.projects
                .lock()
                .unwrap()
                .iter()
                .find(|project| project.id == id)
                .cloned()
                .ok_or(StoreError::NotFound)
        }

        async fn save_project(&self, project: &Project) -> Result<(), StoreError> {
            self.projects.lock().unwrap().push(project.clone());
            Ok(())
        }

        async fn save_workspace(&self, _workspace: &Workspace) -> Result<(), StoreError> {
            Ok(())
        }

        async fn load_workspace(&self) -> Result<Workspace, StoreError> {
            Ok(Workspace::default())
        }
    }

    #[derive(Default)]
    struct FakeTicketTools {
        calls: Mutex<Vec<(String, String, Value)>>,
    }

    #[async_trait]
    impl TicketToolProvider for FakeTicketTools {
        async fn handle_ticket_tool(
            &self,
            _project: &Project,
            requester: &str,
            name: &str,
            arguments: Value,
        ) -> Result<Value, TicketToolError> {
            self.calls.lock().unwrap().push((
                requester.to_owned(),
                name.to_owned(),
                arguments.clone(),
            ));
            Ok(json!({
                "ok": true,
                "requester": requester,
                "ref": arguments.get("ref").and_then(Value::as_str).unwrap_or_default(),
            }))
        }
    }

    #[derive(Default)]
    struct FakeTemplateTools {
        calls: Mutex<Vec<(String, String, Value)>>,
    }

    #[async_trait]
    impl TemplateToolProvider for FakeTemplateTools {
        async fn handle_template_tool(
            &self,
            _project: &Project,
            requester: &str,
            name: &str,
            arguments: Value,
        ) -> Result<Value, TemplateToolError> {
            self.calls.lock().unwrap().push((
                requester.to_owned(),
                name.to_owned(),
                arguments.clone(),
            ));
            Ok(json!({
                "ok": true,
                "requester": requester,
                "templateId": arguments.get("templateId").and_then(Value::as_str).unwrap_or_default(),
            }))
        }
    }

    fn issue_ref(raw: &str) -> IssueRef {
        IssueRef::from_str(raw).unwrap()
    }

    fn project() -> Project {
        Project::new(
            ProjectId::from_uuid(Uuid::from_u128(1)),
            "demo",
            ProjectPath::new("/tmp/project").unwrap(),
            RemoteRef::local(),
            1_000,
        )
        .unwrap()
    }

    fn mcp_permissions(doc: ProjectMcpToolPermissions) -> Arc<dyn McpToolPermissionStore> {
        Arc::new(FakeMcpToolPermissions::new(doc))
    }

    fn allow_doc(agent: AgentId, allowed_tools: &[&str]) -> ProjectMcpToolPermissions {
        let known_tools = infrastructure::orchestrator::mcp::tools::classified_tool_names();
        ProjectMcpToolPermissions::new(
            None,
            vec![AgentMcpToolPolicyOverride::new(
                agent,
                McpToolPolicy::new(
                    allowed_tools
                        .iter()
                        .map(|tool| (*tool).to_owned())
                        .collect(),
                    &known_tools,
                )
                .unwrap(),
            )],
            &known_tools,
        )
        .unwrap()
    }

    #[test]
    fn openai_tool_policy_rejects_tool_outside_allowlist() {
        let policies = FakePolicies::default();
        policies.set_policy(
            "ticket-assistant:p:#7".to_owned(),
            AgentToolPolicy::new(
                vec!["idea_ticket_read".to_owned()],
                Some(issue_ref("#7")),
                true,
            ),
        );

        let err = enforce_tool_policy(
            &policies,
            "ticket-assistant:p:#7",
            "idea_ask_agent",
            &json!({}),
        )
        .expect_err("tool must be rejected");

        assert!(
            matches!(err, ToolInvocationError::Rejected(message) if message.contains("idea_ask_agent"))
        );
    }

    #[test]
    fn openai_tool_policy_rejects_ticket_mutation_outside_bound_issue() {
        let policies = FakePolicies::default();
        policies.set_policy(
            "ticket-assistant:p:#7".to_owned(),
            AgentToolPolicy::new(
                vec!["idea_ticket_update".to_owned()],
                Some(issue_ref("#7")),
                true,
            ),
        );

        let err = enforce_tool_policy(
            &policies,
            "ticket-assistant:p:#7",
            "idea_ticket_update",
            &json!({ "ref": "#8", "patch": { "title": "nope" } }),
        )
        .expect_err("ticket mutation must be rejected");

        assert!(matches!(err, ToolInvocationError::Rejected(message) if message.contains("#8")));
    }

    #[test]
    fn openai_tool_policy_allows_bound_ticket_mutation() {
        let policies = FakePolicies::default();
        policies.set_policy(
            "ticket-assistant:p:#7".to_owned(),
            AgentToolPolicy::new(
                vec!["idea_ticket_update".to_owned()],
                Some(issue_ref("#7")),
                true,
            ),
        );

        enforce_tool_policy(
            &policies,
            "ticket-assistant:p:#7",
            "idea_ticket_update",
            &json!({ "ref": "#7", "patch": { "title": "ok" } }),
        )
        .expect("bound ticket mutation allowed");
    }

    #[tokio::test]
    async fn openai_ticket_tool_uses_injected_requester_and_ticket_policy_provider() {
        let temp =
            std::env::temp_dir().join(format!("idea-openai-ticket-tool-test-{}", Uuid::new_v4()));
        let core = crate::BackendCore::build(temp.clone());
        let requester = "ticket-assistant:00000000000000000000000000000001:7";
        let policies = Arc::new(FakePolicies::default());
        policies.set_policy(
            requester.to_owned(),
            AgentToolPolicy::new(
                vec!["idea_ticket_update".to_owned()],
                Some(issue_ref("#7")),
                true,
            ),
        );
        let ticket_tools = Arc::new(FakeTicketTools::default());
        let template_tools = Arc::new(FakeTemplateTools::default());
        let invoker = AppOpenAiToolInvoker::new(
            Arc::clone(&core.orchestrator_service),
            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
            policies,
            mcp_permissions(ProjectMcpToolPermissions::default()),
            ticket_tools.clone(),
            template_tools,
        );

        let denied = invoker
            .call(
                "idea_ticket_update",
                &json!({
                    PROJECT_ROOT_ARG: "/tmp/project",
                    REQUESTER_ARG: requester,
                    "ref": "#8",
                    "patch": { "title": "denied" },
                })
                .to_string(),
            )
            .await
            .expect_err("out-of-scope ticket must be rejected");
        assert!(matches!(denied, ToolInvocationError::Rejected(message) if message.contains("#8")));
        assert!(
            ticket_tools.calls.lock().unwrap().is_empty(),
            "policy rejection happens before TicketToolProvider dispatch"
        );

        let allowed = invoker
            .call(
                "idea_ticket_update",
                &json!({
                    PROJECT_ROOT_ARG: "/tmp/project",
                    REQUESTER_ARG: requester,
                    "ref": "#7",
                    "patch": { "title": "allowed" },
                })
                .to_string(),
            )
            .await
            .expect("bound ticket update allowed");
        let allowed: Value = serde_json::from_str(&allowed).unwrap();
        assert_eq!(allowed["requester"], requester);
        assert_eq!(allowed["ref"], "#7");

        let calls = ticket_tools.calls.lock().unwrap();
        assert_eq!(calls.len(), 1);
        assert_eq!(calls[0].0, requester);
        assert_eq!(calls[0].1, "idea_ticket_update");
        assert_eq!(calls[0].2[REQUESTER_ARG], requester);
        assert_eq!(calls[0].2[PROJECT_ROOT_ARG], "/tmp/project");

        let _ = std::fs::remove_dir_all(temp);
    }

    #[tokio::test]
    async fn openai_general_agent_without_durable_override_is_read_only() {
        let temp = std::env::temp_dir().join(format!(
            "idea-openai-mcp-permissions-readonly-{}",
            Uuid::new_v4()
        ));
        let core = crate::BackendCore::build(temp.clone());
        let requester = AgentId::from_uuid(Uuid::from_u128(82)).to_string();
        let ticket_tools = Arc::new(FakeTicketTools::default());
        let template_tools = Arc::new(FakeTemplateTools::default());
        let invoker = AppOpenAiToolInvoker::new(
            Arc::clone(&core.orchestrator_service),
            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
            Arc::new(FakePolicies::default()),
            mcp_permissions(ProjectMcpToolPermissions::default()),
            ticket_tools.clone(),
            template_tools.clone(),
        );

        for tool in ["idea_ticket_list", "idea_template_list"] {
            invoker
                .call(
                    tool,
                    &json!({
                        PROJECT_ROOT_ARG: "/tmp/project",
                        REQUESTER_ARG: requester,
                    })
                    .to_string(),
                )
                .await
                .expect("read tool must pass the durable read-only policy");
        }

        for (tool, arguments) in [
            (
                "idea_memory_write",
                json!({ "slug": "note-a", "content": "body" }),
            ),
            (
                "idea_ask_agent",
                json!({ "target": "architect", "task": "do it" }),
            ),
            (
                "idea_ticket_update_carnet",
                json!({ "ref": "#7", "expectedVersion": 1, "carnet": "body" }),
            ),
            (
                "idea_run_in_background",
                json!({ "label": "task", "command": "echo" }),
            ),
            (
                "idea_template_create",
                json!({ "name": "Base", "content": "body", "defaultProfileId": Uuid::new_v4() }),
            ),
            (
                "idea_template_update",
                json!({ "templateId": Uuid::new_v4(), "content": "body" }),
            ),
            (
                "idea_template_delete",
                json!({ "templateId": Uuid::new_v4() }),
            ),
        ] {
            let mut payload = arguments.as_object().unwrap().clone();
            payload.insert(PROJECT_ROOT_ARG.to_owned(), json!("/tmp/project"));
            payload.insert(REQUESTER_ARG.to_owned(), json!(requester.clone()));
            let err = invoker
                .call(tool, &Value::Object(payload).to_string())
                .await
                .expect_err("write tool must be rejected without durable override");
            assert!(
                matches!(err, ToolInvocationError::Rejected(ref message) if message.contains(tool)),
                "expected readable rejection for {tool}, got {err:?}"
            );
        }

        let calls = ticket_tools.calls.lock().unwrap();
        assert_eq!(calls.len(), 1, "only the read ticket tool should run");
        assert_eq!(calls[0].1, "idea_ticket_list");
        let template_calls = template_tools.calls.lock().unwrap();
        assert_eq!(
            template_calls.len(),
            1,
            "only the read template tool should run"
        );
        assert_eq!(template_calls[0].1, "idea_template_list");

        let _ = std::fs::remove_dir_all(temp);
    }

    #[tokio::test]
    async fn openai_tools_list_matches_durable_agent_policy() {
        let temp =
            std::env::temp_dir().join(format!("idea-openai-mcp-tools-list-{}", Uuid::new_v4()));
        let core = crate::BackendCore::build(temp.clone());
        let agent = AgentId::from_uuid(Uuid::from_u128(182));
        let invoker = AppOpenAiToolInvoker::new(
            Arc::clone(&core.orchestrator_service),
            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
            Arc::new(FakePolicies::default()),
            mcp_permissions(allow_doc(
                agent,
                &["idea_ticket_list", "idea_ticket_update_carnet"],
            )),
            Arc::new(FakeTicketTools::default()),
            Arc::new(FakeTemplateTools::default()),
        );

        let tools = invoker
            .tools_for_context("/tmp/project", &agent.to_string())
            .await
            .expect("tools list should resolve durable policy");
        let names = tools
            .iter()
            .map(|tool| tool.name.as_str())
            .collect::<Vec<_>>();

        assert!(names.contains(&"idea_ticket_list"));
        assert!(names.contains(&"idea_ticket_update_carnet"));
        assert!(!names.contains(&"idea_ask_agent"));
        assert!(!names.contains(&"idea_ticket_update"));
        assert!(!names.contains(&"idea_run_in_background"));

        let _ = std::fs::remove_dir_all(temp);
    }

    #[tokio::test]
    async fn openai_durable_agent_override_allows_explicit_write_tool() {
        let temp =
            std::env::temp_dir().join(format!("idea-openai-mcp-permissions-{}", Uuid::new_v4()));
        let core = crate::BackendCore::build(temp.clone());
        let agent = AgentId::from_uuid(Uuid::from_u128(83));
        let requester = agent.to_string();
        let ticket_tools = Arc::new(FakeTicketTools::default());
        let template_tools = Arc::new(FakeTemplateTools::default());
        let invoker = AppOpenAiToolInvoker::new(
            Arc::clone(&core.orchestrator_service),
            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
            Arc::new(FakePolicies::default()),
            mcp_permissions(allow_doc(agent, &["idea_ticket_update_carnet"])),
            ticket_tools.clone(),
            template_tools,
        );

        let result = invoker
            .call(
                "idea_ticket_update_carnet",
                &json!({
                    PROJECT_ROOT_ARG: "/tmp/project",
                    REQUESTER_ARG: requester,
                    "ref": "#7",
                    "expectedVersion": 1,
                    "carnet": "body",
                })
                .to_string(),
            )
            .await
            .expect("durable override should let the write tool reach the provider");
        let result: Value = serde_json::from_str(&result).unwrap();
        assert_eq!(result["requester"], requester);
        assert_eq!(result["ref"], "#7");

        let calls = ticket_tools.calls.lock().unwrap();
        assert_eq!(calls.len(), 1);
        assert_eq!(calls[0].1, "idea_ticket_update_carnet");

        let _ = std::fs::remove_dir_all(temp);
    }

    #[tokio::test]
    async fn openai_durable_agent_override_allows_only_explicit_template_write_tool() {
        let temp = std::env::temp_dir().join(format!(
            "idea-openai-template-permissions-{}",
            Uuid::new_v4()
        ));
        let core = crate::BackendCore::build(temp.clone());
        let agent = AgentId::from_uuid(Uuid::from_u128(84));
        let requester = agent.to_string();
        let ticket_tools = Arc::new(FakeTicketTools::default());
        let template_tools = Arc::new(FakeTemplateTools::default());
        let template_id = Uuid::from_u128(7).to_string();
        let invoker = AppOpenAiToolInvoker::new(
            Arc::clone(&core.orchestrator_service),
            Arc::new(FakeProjects::with(project())) as Arc<dyn ProjectStore>,
            Arc::new(FakePolicies::default()),
            mcp_permissions(allow_doc(agent, &["idea_template_update"])),
            ticket_tools,
            template_tools.clone(),
        );

        let result = invoker
            .call(
                "idea_template_update",
                &json!({
                    PROJECT_ROOT_ARG: "/tmp/project",
                    REQUESTER_ARG: requester,
                    "templateId": template_id,
                    "content": "body",
                })
                .to_string(),
            )
            .await
            .expect("explicit durable override should reach template provider");
        let result: Value = serde_json::from_str(&result).unwrap();
        assert_eq!(result["requester"], requester);
        assert_eq!(result["templateId"], template_id);

        for tool in ["idea_template_create", "idea_template_delete"] {
            let err = invoker
                .call(
                    tool,
                    &json!({
                        PROJECT_ROOT_ARG: "/tmp/project",
                        REQUESTER_ARG: requester,
                        "templateId": template_id,
                        "name": "Base",
                        "content": "body",
                        "defaultProfileId": Uuid::from_u128(9),
                    })
                    .to_string(),
                )
                .await
                .expect_err("non-allowlisted template write must be rejected");
            assert!(
                matches!(err, ToolInvocationError::Rejected(ref message) if message.contains(tool)),
                "expected readable rejection for {tool}, got {err:?}"
            );
        }

        let calls = template_tools.calls.lock().unwrap();
        assert_eq!(calls.len(), 1);
        assert_eq!(calls[0].1, "idea_template_update");

        let _ = std::fs::remove_dir_all(temp);
    }
}