"""Coverage push — test_cov_100e: target 15 modules still below 90%.

Covers uncovered branches in: advanced_security, agent_orchestration,
auth_compliance, browser_audit, compliance_medium, config_migration,
delivery_export, gateway_fleet, hebbian _runtime/_validation,
platform_audit, reliability_probe, skill_loader, spec_compliance, vs_bridge.
"""
from __future__ import annotations

import asyncio
import json
import os
from pathlib import Path
from unittest.mock import AsyncMock, MagicMock, patch

import pytest

# ---- helpers ----------------------------------------------------------------

def _run(coro):
    loop = asyncio.new_event_loop()
    try:
        return loop.run_until_complete(coro)
    finally:
        loop.close()

def _write(tmp_path: Path, data: dict) -> str:
    p = tmp_path / "cfg.json"
    p.write_text(json.dumps(data))
    return str(p)

def _parse(result):
    if isinstance(result, list) and result:
        return result[0] if isinstance(result[0], dict) else json.loads(result[0].text)
    if isinstance(result, dict):
        return result
    return json.loads(result)

def _fc(r):
    return r.get("finding_count", len(r.get("findings", [])))


# ============================================================================
# advanced_security — empty config early returns + branches
# ============================================================================
class TestAdvancedSecurityE:

    def test_secrets_lifecycle_empty_config(self, tmp_path):
        from src.advanced_security import firm_secrets_lifecycle_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_secrets_lifecycle_check(config_path=cfg)))
        assert r.get("ok") is False or "config_not_found" in str(r) or _fc(r) >= 0

    def test_secrets_lifecycle_inline_cred(self, tmp_path):
        """Config with auth.profiles containing a plain string apiKey."""
        from src.advanced_security import firm_secrets_lifecycle_check
        cfg = _write(tmp_path, {
            "auth": {"profiles": {"prod": {"apiKey": "sk-plaintext-secret-value"}}}
        })
        r = _parse(_run(firm_secrets_lifecycle_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_channel_auth_canon_empty(self, tmp_path):
        from src.advanced_security import firm_channel_auth_canon_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_channel_auth_canon_check(config_path=cfg)))
        assert r.get("ok") is False or "config_not_found" in str(r) or _fc(r) >= 0

    def test_channel_auth_canon_none_remote(self, tmp_path):
        """auth.mode=none with non-loopback bind."""
        from src.advanced_security import firm_channel_auth_canon_check
        cfg = _write(tmp_path, {
            "gateway": {"auth": {"mode": "none"}, "bind": "0.0.0.0:8080"}
        })
        r = _parse(_run(firm_channel_auth_canon_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_channel_auth_canon_plugin_traversal(self, tmp_path):
        """Plugin with encoded path traversal in httpPath."""
        from src.advanced_security import firm_channel_auth_canon_check
        cfg = _write(tmp_path, {
            "gateway": {"auth": {"mode": "password"}, "bind": "127.0.0.1"},
            "plugins": {"entries": {"evil": {"httpPath": "/webhook/%2e%2e/admin"}}}
        })
        r = _parse(_run(firm_channel_auth_canon_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_exec_approval_freeze_empty(self, tmp_path):
        from src.advanced_security import firm_exec_approval_freeze_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_exec_approval_freeze_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_exec_approval_shell_wrapper(self, tmp_path):
        """Exec-approvals file with a shell wrapper executable."""
        from src.advanced_security import firm_exec_approval_freeze_check
        # Create mock exec-approvals.json
        approvals_dir = tmp_path / ".firm"
        approvals_dir.mkdir()
        approvals_file = approvals_dir / "exec-approvals.json"
        approvals_file.write_text(json.dumps([
            {"executable": "/bin/bash", "args": ["script.sh"], "approved_at": "2026-01-01"}
        ]))
        cfg = _write(tmp_path, {"tools": {"exec": {"enabled": True}}})
        with patch("src.advanced_security._FIRM_DIR", approvals_dir):
            _parse(_run(firm_exec_approval_freeze_check(config_path=cfg)))
        # May or may not find the shell wrapper depending on exact implementation

    def test_hook_session_routing_empty(self, tmp_path):
        from src.advanced_security import firm_hook_session_routing_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_hook_session_routing_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_hook_session_routing_no_prefixes(self, tmp_path):
        """allowRequestSessionKey=true but no allowedSessionKeyPrefixes."""
        from src.advanced_security import firm_hook_session_routing_check
        cfg = _write(tmp_path, {
            "hooks": {"allowRequestSessionKey": True}
        })
        r = _parse(_run(firm_hook_session_routing_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_config_include_empty(self, tmp_path):
        from src.advanced_security import firm_config_include_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_config_include_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_config_prototype_empty(self, tmp_path):
        from src.advanced_security import firm_config_prototype_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_config_prototype_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_safe_bins_empty(self, tmp_path):
        from src.advanced_security import firm_safe_bins_profile_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_safe_bins_profile_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_safe_bins_exec_not_dict(self, tmp_path):
        """tools.exec is a non-dict."""
        from src.advanced_security import firm_safe_bins_profile_check
        cfg = _write(tmp_path, {"tools": {"exec": "string-value"}})
        _parse(_run(firm_safe_bins_profile_check(config_path=cfg)))
        # Should return early

    def test_safe_bins_no_safebins(self, tmp_path):
        """tools.exec is a dict but no safeBins key."""
        from src.advanced_security import firm_safe_bins_profile_check
        cfg = _write(tmp_path, {"tools": {"exec": {"enabled": True}}})
        r = _parse(_run(firm_safe_bins_profile_check(config_path=cfg)))
        findings_text = str(r)
        assert "no_safe_bins" in findings_text or _fc(r) >= 0

    def test_group_policy_empty(self, tmp_path):
        from src.advanced_security import firm_group_policy_default_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_group_policy_default_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_group_policy_channels_not_dict(self, tmp_path):
        """channels is a non-dict."""
        from src.advanced_security import firm_group_policy_default_check
        cfg = _write(tmp_path, {"channels": "not-a-dict"})
        _parse(_run(firm_group_policy_default_check(config_path=cfg)))

    def test_group_policy_chan_no_policy(self, tmp_path):
        """Channel exists but has no groupPolicy."""
        from src.advanced_security import firm_group_policy_default_check
        cfg = _write(tmp_path, {
            "channels": {"defaults": {"groupPolicy": "admin-only"},
                         "telegram": {"enabled": True}}
        })
        r = _parse(_run(firm_group_policy_default_check(config_path=cfg)))
        assert _fc(r) >= 1


# ============================================================================
# agent_orchestration — vote, first_success, status not found
# ============================================================================
class TestAgentOrchestrationE:

    def test_aggregate_vote(self):
        from src.agent_orchestration import _aggregate_results
        results = {
            "t1": {"output": {"decision": "yes"}, "status": "completed"},
            "t2": {"output": {"decision": "yes"}, "status": "completed"},
            "t3": {"output": {"decision": "no"}, "status": "completed"},
        }
        r = _run(_aggregate_results(results, strategy="vote"))
        assert r["strategy"] == "vote"
        assert r["winner"] == "yes"

    def test_aggregate_first_success(self):
        from src.agent_orchestration import _aggregate_results
        results = {
            "t1": {"status": "failed", "output": {}},
            "t2": {"status": "completed", "output": {"data": 42}},
        }
        r = _run(_aggregate_results(results, strategy="first_success"))
        assert r["strategy"] == "first_success"
        assert r["selected"] == "t2"

    def test_aggregate_first_success_none(self):
        from src.agent_orchestration import _aggregate_results
        results = {"t1": {"status": "failed"}}
        r = _run(_aggregate_results(results, strategy="first_success"))
        assert r["selected"] is None

    def test_status_not_found(self):
        from src.agent_orchestration import firm_agent_team_status
        r = _parse(_run(firm_agent_team_status(orchestration_id="nonexistent-xxx")))
        assert r.get("ok") is False

    def test_orchestrate_timeout(self):
        """Very short timeout triggers the timeout path."""
        from src.agent_orchestration import firm_agent_team_orchestrate
        tasks = [{"id": "slow", "agent": "test", "action": "sleep", "params": {}}]
        with patch("src.agent_orchestration._execute_task", new_callable=AsyncMock) as mock_exec:
            # Make it take a long time
            async def slow_task(*a, **kw):
                await asyncio.sleep(10)
                return {"status": "completed"}
            mock_exec.side_effect = slow_task
            _parse(_run(firm_agent_team_orchestrate(
                tasks=tasks, timeout_s=0.01
            )))
            # Should have timeout error or partial results


# ============================================================================
# auth_compliance — uncovered branches
# ============================================================================
class TestAuthComplianceE:

    def test_oauth_no_resource_field(self, tmp_path):
        """protectedResourceMetadata exists but empty."""
        from src.auth_compliance import oauth_oidc_audit
        cfg = _write(tmp_path, {
            "mcp": {"auth": {"protectedResourceMetadata": {}}}
        })
        r = _parse(_run(oauth_oidc_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_oauth_no_auth_servers(self, tmp_path):
        from src.auth_compliance import oauth_oidc_audit
        cfg = _write(tmp_path, {
            "mcp": {"auth": {"protectedResourceMetadata": {"resource": "x"}}}
        })
        r = _parse(_run(oauth_oidc_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_oauth_no_resource_indicators(self, tmp_path):
        from src.auth_compliance import oauth_oidc_audit
        cfg = _write(tmp_path, {
            "mcp": {"auth": {
                "protectedResourceMetadata": {
                    "resource": "https://api.example.com",
                    "authorization_servers": ["https://auth.example.com"]
                },
                "resourceIndicators": {"enabled": False},
            }}
        })
        r = _parse(_run(oauth_oidc_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_oauth_no_refresh_rotation(self, tmp_path):
        from src.auth_compliance import oauth_oidc_audit
        cfg = _write(tmp_path, {
            "mcp": {"auth": {
                "protectedResourceMetadata": {
                    "resource": "https://api.example.com",
                    "authorization_servers": ["https://auth.example.com"]
                },
                "resourceIndicators": {"enabled": True},
            }}
        })
        r = _parse(_run(oauth_oidc_audit(config_path=cfg)))
        # Should find missing refreshTokenRotation
        assert _fc(r) >= 1

    def test_token_scope_tools_not_list(self, tmp_path):
        from src.auth_compliance import token_scope_check
        cfg = _write(tmp_path, {
            "mcp": {"tools": "not-a-list", "auth": {"toolScopes": {}}}
        })
        _parse(_run(token_scope_check(config_path=cfg)))

    def test_token_scope_wildcard(self, tmp_path):
        from src.auth_compliance import token_scope_check
        cfg = _write(tmp_path, {
            "mcp": {
                "tools": [{"name": "tool1"}, {"name": "tool2"}],
                "auth": {"toolScopes": {"tool1": ["*"]}}
            }
        })
        r = _parse(_run(token_scope_check(config_path=cfg)))
        assert _fc(r) >= 1


# ============================================================================
# browser_audit — config not found, headless false, deep_get, js scan
# ============================================================================
class TestBrowserAuditE:

    def test_no_config_no_override(self, tmp_path):
        from src.browser_audit import firm_browser_context_check
        r = _parse(_run(firm_browser_context_check(
            workspace_path=str(tmp_path), config_override=None, check_deps=False
        )))
        # No config files found
        assert isinstance(r, dict)

    def test_bad_package_json(self, tmp_path):
        (tmp_path / "package.json").write_text("{invalid json!!!")
        from src.browser_audit import firm_browser_context_check
        _parse(_run(firm_browser_context_check(
            workspace_path=str(tmp_path), check_deps=True
        )))

    def test_validate_headless_false(self):
        from src.browser_audit import _validate_browser_config
        findings, recs = [], []
        _validate_browser_config({"headless": False}, findings, recs)
        assert any(f["check"] == "headless_disabled" for f in findings)

    def test_validate_timeout_high(self):
        from src.browser_audit import _validate_browser_config
        findings, recs = [], []
        _validate_browser_config({"headless": True, "timeout": 200000}, findings, recs)
        assert any("timeout" in f.get("check", "") for f in findings)

    def test_validate_no_userDataDir(self):
        from src.browser_audit import _validate_browser_config
        findings, recs = [], []
        _validate_browser_config({"headless": True}, findings, recs)
        # May or may not produce a finding about userDataDir

    def test_deep_get_depth_limit(self):
        from src.browser_audit import _deep_get
        # Build deeply nested dict (>10 levels)
        d: dict = {"key": "found"}
        for _ in range(15):
            d = {"nested": d}
        result = _deep_get(d, "key")
        assert result is None  # depth > 10 returns None

    def test_extract_launch_args_with_args(self):
        from src.browser_audit import _extract_launch_args
        args = _extract_launch_args({"launch": {"args": ["--no-sandbox", "--headless"]}})
        assert "--no-sandbox" in args

    def test_scan_js_config_remote_debug(self):
        from src.browser_audit import _scan_js_config
        findings, recs = [], []
        _scan_js_config("use: { launchOptions: { args: ['--remote-debugging-port=9222'] } }", "test.config.ts", findings, recs)
        assert any("remote_debugging" in f.get("check", "") for f in findings)

    def test_json_config_file(self, tmp_path):
        """Test parsing a .json browser config file."""
        from src.browser_audit import firm_browser_context_check
        config_file = tmp_path / "playwright.config.json"
        config_file.write_text(json.dumps({
            "headless": False,
            "launch": {"args": ["--no-sandbox"]}
        }))
        _parse(_run(firm_browser_context_check(
            workspace_path=str(tmp_path), check_deps=False
        )))

    def test_js_config_file(self, tmp_path):
        """Test scanning a .js/.ts config file with dangerous patterns."""
        from src.browser_audit import firm_browser_context_check
        config_file = tmp_path / "playwright.config.ts"
        config_file.write_text("export default { headless: false, launch: { args: ['--no-sandbox'] } }")
        _parse(_run(firm_browser_context_check(
            workspace_path=str(tmp_path), check_deps=False
        )))


# ============================================================================
# compliance_medium — many branches
# ============================================================================
class TestComplianceMediumE:

    def test_deprecation_sunset_not_deprecated(self, tmp_path):
        """Tool has sunset but deprecated=false."""
        from src.compliance_medium import tool_deprecation_audit
        cfg = _write(tmp_path, {"mcp": {"tools": [
            {"name": "old_tool", "annotations": {"deprecated": False, "sunset": "2026-12-01"}}
        ]}})
        _parse(_run(tool_deprecation_audit(config_path=cfg)))

    def test_deprecation_no_sunset(self, tmp_path):
        """Tool deprecated=true but no sunset."""
        from src.compliance_medium import tool_deprecation_audit
        cfg = _write(tmp_path, {"mcp": {"tools": [
            {"name": "old_tool", "annotations": {"deprecated": True}}
        ]}})
        r = _parse(_run(tool_deprecation_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_circuit_no_cb_config(self, tmp_path):
        from src.compliance_medium import circuit_breaker_audit
        cfg = _write(tmp_path, {"mcp": {"resilience": {}}})
        r = _parse(_run(circuit_breaker_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_circuit_invalid_threshold(self, tmp_path):
        from src.compliance_medium import circuit_breaker_audit
        cfg = _write(tmp_path, {"mcp": {"resilience": {
            "circuitBreaker": {"failureThreshold": 0, "resetTimeoutMs": 30000}
        }}})
        r = _parse(_run(circuit_breaker_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_circuit_low_reset_timeout(self, tmp_path):
        from src.compliance_medium import circuit_breaker_audit
        cfg = _write(tmp_path, {"mcp": {"resilience": {
            "circuitBreaker": {"failureThreshold": 5, "resetTimeoutMs": 500}
        }}})
        r = _parse(_run(circuit_breaker_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_circuit_external_tool_no_resilience(self, tmp_path):
        from src.compliance_medium import circuit_breaker_audit
        cfg = _write(tmp_path, {"mcp": {
            "resilience": {"circuitBreaker": {"failureThreshold": 5, "resetTimeoutMs": 30000}},
            "tools": [{"name": "fetch_data", "description": "HTTP fetch from external API"}]
        }})
        _parse(_run(circuit_breaker_audit(config_path=cfg)))

    def test_gdpr_privacy_not_dict(self, tmp_path):
        from src.compliance_medium import gdpr_residency_audit
        cfg = _write(tmp_path, {"mcp": {"privacy": "string", "gdpr": {}}})
        _parse(_run(gdpr_residency_audit(config_path=cfg)))

    def test_gdpr_not_dict(self, tmp_path):
        from src.compliance_medium import gdpr_residency_audit
        cfg = _write(tmp_path, {"mcp": {"gdpr": []}})
        _parse(_run(gdpr_residency_audit(config_path=cfg)))

    def test_gdpr_erasure_empty(self, tmp_path):
        from src.compliance_medium import gdpr_residency_audit
        cfg = _write(tmp_path, {"mcp": {"gdpr": {"rightToErasure": {}}}})
        r = _parse(_run(gdpr_residency_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_gdpr_no_residency(self, tmp_path):
        from src.compliance_medium import gdpr_residency_audit
        cfg = _write(tmp_path, {"mcp": {"gdpr": {"rightToErasure": {"endpoint": "/erase"}}}})
        r = _parse(_run(gdpr_residency_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_gdpr_residency_cross_border(self, tmp_path):
        from src.compliance_medium import gdpr_residency_audit
        cfg = _write(tmp_path, {"mcp": {
            "gdpr": {"rightToErasure": {"endpoint": "/erase"}},
            "dataResidency": {"allowCrossBorder": True}
        }})
        r = _parse(_run(gdpr_residency_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_identity_agents_dict(self, tmp_path):
        """agents as dict instead of list."""
        from src.compliance_medium import agent_identity_audit
        cfg = _write(tmp_path, {"mcp": {
            "identity": {"did": "did:web:example.com", "signing": {"algorithm": "EdDSA"}},
            "agents": {"bot1": {"did": "did:web:bot1.example.com"}}
        }})
        _parse(_run(agent_identity_audit(config_path=cfg)))

    def test_identity_invalid_did(self, tmp_path):
        from src.compliance_medium import agent_identity_audit
        cfg = _write(tmp_path, {"mcp": {
            "identity": {"did": "invalid-did-format", "signing": {"algorithm": "none"}}
        }})
        r = _parse(_run(agent_identity_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_identity_agent_bad_did(self, tmp_path):
        from src.compliance_medium import agent_identity_audit
        cfg = _write(tmp_path, {"mcp": {
            "identity": {"did": "did:web:example.com", "signing": {"algorithm": "EdDSA"}},
            "agents": [{"name": "bot1", "did": "not-a-did"}]
        }})
        r = _parse(_run(agent_identity_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_routing_no_strategy(self, tmp_path):
        from src.compliance_medium import model_routing_audit
        cfg = _write(tmp_path, {"mcp": {"routing": {"models": [
            {"name": "gpt-4", "provider": "openai"}
        ]}}})
        r = _parse(_run(model_routing_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_routing_dangerous_strategy(self, tmp_path):
        from src.compliance_medium import model_routing_audit
        cfg = _write(tmp_path, {"mcp": {"routing": {
            "strategy": "random",
            "models": [{"name": "gpt-4", "provider": "openai"}]
        }}})
        r = _parse(_run(model_routing_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_routing_no_budget_caps(self, tmp_path):
        from src.compliance_medium import model_routing_audit
        cfg = _write(tmp_path, {"mcp": {"routing": {
            "strategy": "cost_optimized",
            "budget": {"limit": 100},
            "models": [
                {"name": "gpt-4", "provider": "openai"},
                {"name": "claude", "provider": "anthropic"}
            ]
        }}})
        _parse(_run(model_routing_audit(config_path=cfg)))

    def test_routing_single_provider(self, tmp_path):
        from src.compliance_medium import model_routing_audit
        cfg = _write(tmp_path, {"mcp": {"routing": {
            "strategy": "cost_optimized",
            "budget": {"maxDailyCostUsd": 50},
            "models": [
                {"name": "gpt-4", "provider": "openai"},
                {"name": "gpt-3.5", "provider": "openai"}
            ]
        }}})
        r = _parse(_run(model_routing_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_resource_links_templates_not_list(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {"templates": "not-a-list"}}})
        _parse(_run(resource_links_audit(config_path=cfg)))

    def test_resource_links_static_not_list(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {"static": 42}}})
        _parse(_run(resource_links_audit(config_path=cfg)))

    def test_resource_links_no_uri(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {
            "static": [{"name": "test"}]
        }}})
        r = _parse(_run(resource_links_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_resource_links_template_no_uri(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {"templates": [{}]}}})
        r = _parse(_run(resource_links_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_resource_links_template_bad_scheme(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {"templates": [
            {"uriTemplate": "not-a-scheme", "name": "bad"}
        ]}}})
        r = _parse(_run(resource_links_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_resource_links_template_no_name(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {"resources": {"templates": [
            {"uriTemplate": "config://test/{id}"}
        ]}}})
        _parse(_run(resource_links_audit(config_path=cfg)))

    def test_resource_links_tool_output_resource_link(self, tmp_path):
        from src.compliance_medium import resource_links_audit
        cfg = _write(tmp_path, {"mcp": {
            "resources": {"static": [{"name": "t", "uri": "config://test"}]},
            "tools": [{"name": "get_config", "outputSchema": {"type": "object", "properties": {"resource_link": {"type": "string"}}}}]
        }})
        _parse(_run(resource_links_audit(config_path=cfg)))


# ============================================================================
# config_migration — empty configs + specific branches
# ============================================================================
class TestConfigMigrationE:

    def test_shell_env_empty(self, tmp_path):
        from src.config_migration import firm_shell_env_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_shell_env_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_shell_env_ld_preload(self, tmp_path):
        from src.config_migration import firm_shell_env_check
        cfg = _write(tmp_path, {
            "agents": {"defaults": {"env": {"LD_PRELOAD": "/lib/evil.so"}}}
        })
        r = _parse(_run(firm_shell_env_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_shell_env_fork_shell_var(self, tmp_path):
        from src.config_migration import firm_shell_env_check
        cfg = _write(tmp_path, {
            "agents": {"defaults": {"fork": {"env": {"SHELL": "/bin/zsh"}}}}
        })
        _parse(_run(firm_shell_env_check(config_path=cfg)))

    def test_plugin_integrity_empty(self, tmp_path):
        from src.config_migration import firm_plugin_integrity_check
        cfg = _write(tmp_path, {})
        r = _parse(_run(firm_plugin_integrity_check(config_path=cfg)))
        assert r.get("ok") is False or _fc(r) >= 0

    def test_plugin_integrity_manifest_corrupt(self, tmp_path):
        from src.config_migration import firm_plugin_integrity_check
        cfg = _write(tmp_path, {"plugins": {"entries": [{"id": "test-plugin"}]}})
        manifest = tmp_path / "plugin-manifest.json"
        manifest.write_text("{invalid json!!")
        with patch("src.config_migration._PLUGIN_MANIFEST", manifest):
            _parse(_run(firm_plugin_integrity_check(config_path=cfg)))

    def test_plugin_integrity_drift(self, tmp_path):
        """Manifest hash doesn't match actual file."""
        from src.config_migration import firm_plugin_integrity_check
        plugin_dir = tmp_path / "plugins" / "myplugin"
        plugin_dir.mkdir(parents=True)
        main_file = plugin_dir / "index.js"
        main_file.write_text("console.log('hello');")
        manifest = tmp_path / "plugin-manifest.json"
        manifest.write_text(json.dumps({
            "myplugin": {"sha256": "wrong-hash-value", "main": str(main_file)}
        }))
        cfg = _write(tmp_path, {"plugins": {"entries": [{"id": "myplugin"}]}})
        with patch("src.config_migration._PLUGIN_MANIFEST", manifest):
            _parse(_run(firm_plugin_integrity_check(config_path=cfg)))

    def test_token_separation_empty(self, tmp_path):
        from src.config_migration import firm_token_separation_check
        cfg = _write(tmp_path, {})
        _parse(_run(firm_token_separation_check(config_path=cfg)))

    def test_token_separation_reuse(self, tmp_path):
        from src.config_migration import firm_token_separation_check
        cfg = _write(tmp_path, {
            "hooks": {"token": "shared-secret"},
            "gateway": {"auth": {"password": "shared-secret"}}
        })
        r = _parse(_run(firm_token_separation_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_otel_redaction_empty(self, tmp_path):
        from src.config_migration import firm_otel_redaction_check
        cfg = _write(tmp_path, {})
        _parse(_run(firm_otel_redaction_check(config_path=cfg)))

    def test_otel_redaction_not_dict(self, tmp_path):
        from src.config_migration import firm_otel_redaction_check
        cfg = _write(tmp_path, {"otel": "string"})
        _parse(_run(firm_otel_redaction_check(config_path=cfg)))

    def test_rpc_rate_limit_empty(self, tmp_path):
        from src.config_migration import firm_rpc_rate_limit_check
        cfg = _write(tmp_path, {})
        _parse(_run(firm_rpc_rate_limit_check(config_path=cfg)))

    def test_rpc_rate_limit_remote_no_limit(self, tmp_path):
        from src.config_migration import firm_rpc_rate_limit_check
        cfg = _write(tmp_path, {
            "gateway": {"bind": "0.0.0.0:8080"}
        })
        r = _parse(_run(firm_rpc_rate_limit_check(config_path=cfg)))
        assert _fc(r) >= 1


# ============================================================================
# delivery_export — HTTP error paths + optional params
# ============================================================================
class TestDeliveryExportE:

    def test_github_pr_branch_error(self, tmp_path):
        """GitHub API returns error on getting default branch ref."""
        from src.delivery_export import firm_export_github_pr
        import httpx

        mock_resp = MagicMock()
        mock_resp.status_code = 404
        mock_resp.raise_for_status.side_effect = httpx.HTTPStatusError(
            "Not Found", request=MagicMock(), response=mock_resp
        )

        with patch.dict(os.environ, {"GITHUB_TOKEN": "ghp_test123"}), \
             patch("src.delivery_export.GITHUB_TOKEN", "ghp_test123"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.get = AsyncMock(side_effect=httpx.HTTPStatusError(
                "Not Found", request=MagicMock(), response=mock_resp
            ))
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_github_pr(
                    repo="owner/repo", content="test", objective="test PR"
                )))
                assert r.get("ok") is False

    def test_jira_with_components_and_assignee(self):
        """Jira export with optional components and assignee."""
        from src.delivery_export import firm_export_jira_ticket

        mock_resp = MagicMock()
        mock_resp.status_code = 201
        mock_resp.json.return_value = {"key": "ENG-42", "self": "https://jira.example.com/rest/api/3/issue/ENG-42"}

        with patch("src.delivery_export.JIRA_API_TOKEN", "token"), \
             patch("src.delivery_export.JIRA_BASE_URL", "https://jira.example.com"), \
             patch("src.delivery_export.JIRA_USER_EMAIL", "user@example.com"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_jira_ticket(
                    project_key="ENG", content="body", objective="Test ticket",
                    components=["Backend"], assignee_account_id="acc-123"
                )))
                assert r.get("ok") is True

    def test_jira_api_error(self):
        from src.delivery_export import firm_export_jira_ticket

        mock_resp = MagicMock()
        mock_resp.status_code = 400
        mock_resp.text = "Bad Request"

        with patch("src.delivery_export.JIRA_API_TOKEN", "t"), \
             patch("src.delivery_export.JIRA_BASE_URL", "https://j.example.com"), \
             patch("src.delivery_export.JIRA_USER_EMAIL", "u@e.com"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_jira_ticket(
                    project_key="ENG", content="body", objective="Test"
                )))
                assert r.get("ok") is False

    def test_linear_with_assignee(self):
        from src.delivery_export import firm_export_linear_issue

        mock_resp = MagicMock()
        mock_resp.status_code = 200
        mock_resp.json.return_value = {"data": {"issueCreate": {
            "success": True,
            "issue": {"id": "lin-1", "identifier": "ENG-42", "url": "https://linear.app/x"}
        }}}

        with patch("src.delivery_export.LINEAR_API_KEY", "lin_test"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_linear_issue(
                    team_id="team-1", content="body", objective="Test",
                    assignee_id="user-123"
                )))
                assert r.get("ok") is True

    def test_linear_graphql_error(self):
        from src.delivery_export import firm_export_linear_issue

        mock_resp = MagicMock()
        mock_resp.status_code = 200
        mock_resp.json.return_value = {"errors": [{"message": "Invalid field"}]}

        with patch("src.delivery_export.LINEAR_API_KEY", "lin_test"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_linear_issue(
                    team_id="team-1", content="body", objective="Test"
                )))
                assert r.get("ok") is False

    def test_slack_with_mentions(self):
        from src.delivery_export import firm_export_slack_digest

        mock_resp = MagicMock()
        mock_resp.status_code = 200

        with patch("src.delivery_export.SLACK_WEBHOOK_URL", "https://hooks.slack.com/xxx"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_slack_digest(
                    content="body", objective="Test",
                    mention_users=["@alice", "@bob"]
                )))
                assert r.get("ok") is True

    def test_slack_api_error(self):
        from src.delivery_export import firm_export_slack_digest

        mock_resp = MagicMock()
        mock_resp.status_code = 500
        mock_resp.text = "Internal Server Error"

        with patch("src.delivery_export.SLACK_WEBHOOK_URL", "https://hooks.slack.com/xxx"):
            mock_client = AsyncMock()
            mock_client.__aenter__ = AsyncMock(return_value=mock_client)
            mock_client.__aexit__ = AsyncMock(return_value=False)
            mock_client.post = AsyncMock(return_value=mock_resp)
            with patch("httpx.AsyncClient", return_value=mock_client):
                r = _parse(_run(firm_export_slack_digest(
                    content="body", objective="Test"
                )))
                assert r.get("ok") is False

    def test_auto_jira(self):
        from src.delivery_export import firm_export_auto
        with patch("src.delivery_export.firm_export_jira_ticket", new_callable=AsyncMock) as m:
            m.return_value = {"ok": True, "issue_key": "X-1"}
            r = _parse(_run(firm_export_auto(
                delivery_format="jira_ticket", content="body", objective="test",
                jira_project_key="ENG"
            )))
            assert r.get("ok") is True
            m.assert_called_once()

    def test_auto_linear(self):
        from src.delivery_export import firm_export_auto
        with patch("src.delivery_export.firm_export_linear_issue", new_callable=AsyncMock) as m:
            m.return_value = {"ok": True, "identifier": "X-1"}
            r = _parse(_run(firm_export_auto(
                delivery_format="linear_issue", content="body", objective="test",
                linear_team_id="team-1"
            )))
            assert r.get("ok") is True
            m.assert_called_once()


# ============================================================================
# gateway_fleet — empty fleet, save error, ws_rpc, filters
# ============================================================================
class TestGatewayFleetE:

    def test_fleet_status_empty(self, tmp_path):
        from src.gateway_fleet import firm_gateway_fleet_status
        cfg = tmp_path / "fleet.json"
        cfg.write_text(json.dumps([]))
        with patch("src.gateway_fleet.FLEET_CONFIG_PATH", str(cfg)):
            _parse(_run(firm_gateway_fleet_status()))
            # Empty fleet → early return

    def test_save_fleet_write_error(self, tmp_path):
        from src.gateway_fleet import _save_fleet
        with patch("src.gateway_fleet.FLEET_CONFIG_PATH", "/nonexistent/dir/fleet.json"):
            # Should handle the error gracefully
            try:
                _save_fleet([{"id": "test", "url": "ws://localhost:1234"}])
            except Exception:
                pass  # Expected — write to non-existent dir

    def test_sync_with_filters(self, tmp_path):
        from src.gateway_fleet import firm_gateway_fleet_sync
        fleet = [
            {"id": "i1", "url": "ws://localhost:1111", "department": "engineering", "tags": ["prod"]},
            {"id": "i2", "url": "ws://localhost:2222", "department": "sales", "tags": ["staging"]},
        ]
        cfg = tmp_path / "fleet.json"
        cfg.write_text(json.dumps(fleet))
        with patch("src.gateway_fleet.FLEET_CONFIG_PATH", str(cfg)), \
             patch("src.gateway_fleet._ws_rpc_instance", new_callable=AsyncMock) as mock_rpc:
            mock_rpc.return_value = {"ok": True}
            _parse(_run(firm_gateway_fleet_sync(
                filter_department="engineering"
            )))

    def test_sync_with_tag_filter(self, tmp_path):
        from src.gateway_fleet import firm_gateway_fleet_sync
        fleet = [
            {"id": "i1", "url": "ws://localhost:1111", "tags": ["prod"]},
            {"id": "i2", "url": "ws://localhost:2222", "tags": ["staging"]},
        ]
        cfg = tmp_path / "fleet.json"
        cfg.write_text(json.dumps(fleet))
        with patch("src.gateway_fleet.FLEET_CONFIG_PATH", str(cfg)), \
             patch("src.gateway_fleet._ws_rpc_instance", new_callable=AsyncMock) as mock_rpc:
            mock_rpc.return_value = {"ok": True}
            _parse(_run(firm_gateway_fleet_sync(
                filter_tag="prod"
            )))


# ============================================================================
# hebbian_memory/_runtime — invalid extension, bad JSON, no summary, DB
# ============================================================================
class TestHebbianRuntimeE:

    def test_harvest_bad_extension(self, tmp_path):
        from src.hebbian_memory._runtime import firm_hebbian_harvest
        bad_file = tmp_path / "data.txt"
        bad_file.write_text("not jsonl")
        r = _parse(_run(firm_hebbian_harvest(
            session_jsonl_path=str(bad_file),
            claude_md_path=str(tmp_path / "CLAUDE.md")
        )))
        assert r.get("ok") is False or "extension" in str(r).lower() or "suffix" in str(r).lower()

    def test_harvest_bad_json_line(self, tmp_path):
        from src.hebbian_memory._runtime import firm_hebbian_harvest
        jsonl = tmp_path / "data.jsonl"
        jsonl.write_text('{"summary": "good"}\n{invalid json}\n{"summary": "also good"}\n')
        claude = tmp_path / "CLAUDE.md"
        claude.write_text("# CLAUDE\nLAYER 2 — CONSOLIDATED\n- [0.80] Rule one\n")
        _parse(_run(firm_hebbian_harvest(
            session_jsonl_path=str(jsonl),
            claude_md_path=str(claude)
        )))
        # Should skip bad line and process the rest

    def test_harvest_no_summary(self, tmp_path):
        from src.hebbian_memory._runtime import firm_hebbian_harvest
        jsonl = tmp_path / "data.jsonl"
        jsonl.write_text('{"tags": ["test"]}\n')
        claude = tmp_path / "CLAUDE.md"
        claude.write_text("# CLAUDE\nLAYER 2 — CONSOLIDATED\n- [0.80] Rule one\n")
        _parse(_run(firm_hebbian_harvest(
            session_jsonl_path=str(jsonl),
            claude_md_path=str(claude)
        )))

    def test_weight_update_with_db(self, tmp_path):
        """Pre-populated DB with hebbian_sessions row to trigger DB read path."""
        from src.hebbian_memory._runtime import firm_hebbian_weight_update
        from src.hebbian_memory._helpers import _init_db
        db = tmp_path / "hebbian.db"
        conn = _init_db(str(db))
        conn.execute(
            "INSERT INTO hebbian_sessions (session_id, summary, tags, rules_activated) VALUES (?, ?, ?, ?)",
            ("sess1", "test session", "[]", json.dumps(["overweight-rule"]))
        )
        conn.commit()
        conn.close()

        claude = tmp_path / "CLAUDE.md"
        claude.write_text("# CLAUDE\nLAYER 2 — CONSOLIDATED\n- [0.80] Overweight rule\n- [0.50] Normal rule two\n")
        _parse(_run(firm_hebbian_weight_update(
            claude_md_path=str(claude),
            db_path=str(db),
            dry_run=True
        )))

    def test_apply_weight_unformatted(self, tmp_path):
        """Rule with unformatted weight like [0.5] instead of [0.50]."""
        from src.hebbian_memory._runtime import _apply_weight_changes
        content = "# CLAUDE\n## Layer 2\n[0.5] Rule one\n"
        changes = [{"old_weight": 0.5, "text": "Rule one", "new_weight": 0.70}]
        result = _apply_weight_changes(content, changes)
        assert "0.70" in result


# ============================================================================
# hebbian_memory/_validation — Layer 2 weights, PII, decay config
# ============================================================================
class TestHebbianValidationE:

    def test_layer_validate_overweight(self, tmp_path):
        from src.hebbian_memory._validation import firm_hebbian_layer_validate
        claude = tmp_path / "CLAUDE.md"
        claude.write_text(
            "# ════════════════\n# LAYER 1\nCore content\n"
            "LAYER 2 — CONSOLIDATED\n- [1.50] Overweight rule\n- [0.80] Normal rule\n"
            "LAYER 3 — EPISODIC\nEpisodic index\n"
            "LAYER 4 — META\nMeta instructions\n"
        )
        r = _parse(_run(firm_hebbian_layer_validate(claude_md_path=str(claude))))
        assert _fc(r) >= 1

    def test_layer_validate_pii(self, tmp_path):
        from src.hebbian_memory._validation import firm_hebbian_layer_validate
        claude = tmp_path / "CLAUDE.md"
        claude.write_text(
            "# ════════════════\n# LAYER 1\nCore content\n"
            "LAYER 2 — CONSOLIDATED\n- [0.80] Contact john@example.com for details\n"
            "LAYER 3 — EPISODIC\nEpisodic index\n"
            "LAYER 4 — META\nMeta instructions\n"
        )
        r = _parse(_run(firm_hebbian_layer_validate(claude_md_path=str(claude))))
        assert _fc(r) >= 1

    def test_pii_check_no_ner_model(self, tmp_path):
        from src.hebbian_memory._validation import firm_hebbian_pii_check
        cfg = _write(tmp_path, {"hebbian": {"pii": {"enabled": True}}})
        _parse(_run(firm_hebbian_pii_check(config_path=cfg)))

    def test_decay_negative_poids_min(self, tmp_path):
        from src.hebbian_memory._validation import firm_hebbian_decay_config_check
        cfg = _write(tmp_path, {"hebbian": {
            "parameters": {"poids_min": -0.1, "poids_max": 1.0, "decay_rate": 0.01},
            "thresholds": {"episodic_to_emergent": 5}
        }})
        r = _parse(_run(firm_hebbian_decay_config_check(config_path=cfg)))
        assert _fc(r) >= 1

    def test_decay_low_episodic_threshold(self, tmp_path):
        from src.hebbian_memory._validation import firm_hebbian_decay_config_check
        cfg = _write(tmp_path, {"hebbian": {
            "parameters": {"poids_min": 0.0, "poids_max": 1.0, "decay_rate": 0.01},
            "thresholds": {"episodic_to_emergent": 1}
        }})
        r = _parse(_run(firm_hebbian_decay_config_check(config_path=cfg)))
        assert _fc(r) >= 1


# ============================================================================
# platform_audit — severity branches, early returns
# ============================================================================
class TestPlatformAuditE:

    def test_agent_routing_medium_only(self, tmp_path):
        from src.platform_audit import firm_agent_routing_check
        cfg = _write(tmp_path, {
            "agents": {"routing": {"strategy": "round_robin"}},
            "gateway": {"bind": "127.0.0.1"}
        })
        _parse(firm_agent_routing_check(config_path=cfg))

    def test_voice_no_config(self, tmp_path):
        from src.platform_audit import firm_voice_security_check
        cfg = _write(tmp_path, {})
        _parse(firm_voice_security_check(config_path=cfg))

    def test_voice_dangerous_provider(self, tmp_path):
        from src.platform_audit import firm_voice_security_check
        cfg = _write(tmp_path, {"talk": {"provider": "test-unsafe", "enabled": True}})
        _parse(firm_voice_security_check(config_path=cfg))

    def test_trust_model_empty(self, tmp_path):
        from src.platform_audit import firm_trust_model_check
        cfg = _write(tmp_path, {})
        _parse(firm_trust_model_check(config_path=cfg))

    def test_trust_model_timeout_zero(self, tmp_path):
        from src.platform_audit import firm_trust_model_check
        cfg = _write(tmp_path, {"session": {"timeoutMinutes": 0}})
        r = _parse(firm_trust_model_check(config_path=cfg))
        assert _fc(r) >= 1

    def test_trust_model_timeout_high(self, tmp_path):
        from src.platform_audit import firm_trust_model_check
        cfg = _write(tmp_path, {"session": {"timeoutMinutes": 600}})
        r = _parse(firm_trust_model_check(config_path=cfg))
        assert _fc(r) >= 1

    def test_autoupdate_no_config(self, tmp_path):
        from src.platform_audit import firm_autoupdate_check
        cfg = _write(tmp_path, {})
        _parse(firm_autoupdate_check(config_path=cfg))

    def test_plugin_sdk_no_config(self, tmp_path):
        from src.platform_audit import firm_plugin_sdk_check
        cfg = _write(tmp_path, {})
        _parse(firm_plugin_sdk_check(config_path=cfg))

    def test_plugin_sdk_dangerous_hook(self, tmp_path):
        from src.platform_audit import firm_plugin_sdk_check
        cfg = _write(tmp_path, {"plugins": {"registered": [
            {"name": "evil-plugin", "hooks": [{"name": "onMessage"}]}
        ]}})
        _parse(firm_plugin_sdk_check(config_path=cfg))

    def test_content_boundary_severity(self, tmp_path):
        from src.platform_audit import firm_content_boundary_check
        cfg = _write(tmp_path, {"content": {"boundaries": {"maxTokens": 999999}}})
        _parse(firm_content_boundary_check(config_path=cfg))

    def test_sqlite_vec_empty(self, tmp_path):
        from src.platform_audit import firm_sqlite_vec_check
        cfg = _write(tmp_path, {})
        _parse(firm_sqlite_vec_check(config_path=cfg))


# ============================================================================
# reliability_probe — WS mock paths
# ============================================================================
class TestReliabilityProbeE:

    def test_gateway_probe_success(self):
        """Mock successful WS connection."""
        from src.reliability_probe import firm_gateway_probe

        mock_ws = AsyncMock()
        mock_ws.recv = AsyncMock(return_value=json.dumps({"jsonrpc": "2.0", "id": 1, "result": "pong"}))
        mock_ws.__aenter__ = AsyncMock(return_value=mock_ws)
        mock_ws.__aexit__ = AsyncMock(return_value=False)

        with patch("websockets.connect", return_value=mock_ws):
            r = _parse(_run(firm_gateway_probe(
                gateway_url="ws://localhost:18789", max_retries=1
            )))
            assert r.get("ok") is True

    def test_gateway_probe_1006(self):
        """Mock WS 1006 abnormal closure."""
        from src.reliability_probe import firm_gateway_probe

        with patch("websockets.connect", side_effect=Exception("Connection closed abnormally (1006)")):
            r = _parse(_run(firm_gateway_probe(
                gateway_url="ws://localhost:18789", max_retries=1, backoff_factor=0.001
            )))
            assert r.get("ok") is False
            assert r.get("close_code") == 1006

    def test_gateway_probe_all_fail(self):
        """All retries fail with generic error."""
        from src.reliability_probe import firm_gateway_probe

        with patch("websockets.connect", side_effect=OSError("Connection refused")):
            r = _parse(_run(firm_gateway_probe(
                gateway_url="ws://localhost:18789", max_retries=2, backoff_factor=0.001
            )))
            assert r.get("ok") is False
            assert len(r.get("attempts", [])) == 2

    def test_doc_sync_unreadable_file(self, tmp_path):
        """Markdown file that raises OSError on read."""
        from src.reliability_probe import firm_doc_sync_check
        pkg = tmp_path / "package.json"
        pkg.write_text(json.dumps({"dependencies": {"lodash": "4.17.21"}}))
        md = tmp_path / "README.md"
        md.write_text("# README\nUses lodash 4.17.21")
        # Make one md file unreadable
        bad_md = tmp_path / "BROKEN.md"
        bad_md.write_text("content")
        bad_md.chmod(0o000)
        try:
            _parse(_run(firm_doc_sync_check(
                package_json_path=str(pkg), docs_glob="*.md"
            )))
        finally:
            bad_md.chmod(0o644)


# ============================================================================
# skill_loader — name lookup, search failures, tag filter, metadata
# ============================================================================
class TestSkillLoaderE:

    def test_lazy_loader_not_found(self, tmp_path):
        from src.skill_loader import firm_skill_lazy_loader
        skills_dir = tmp_path / "skills"
        skills_dir.mkdir()
        r = _parse(_run(firm_skill_lazy_loader(
            skill_name="nonexistent-skill", skills_dir=str(skills_dir)
        )))
        assert r.get("ok") is False

    def test_search_invalid_dir(self, tmp_path):
        from src.skill_loader import firm_skill_search
        _parse(_run(firm_skill_search(
            query="test", skills_dir=str(tmp_path / "nonexistent")
        )))

    def test_search_tag_filter(self, tmp_path):
        from src.skill_loader import firm_skill_search
        skills_dir = tmp_path / "skills"
        skill1 = skills_dir / "skill-one"
        skill1.mkdir(parents=True)
        (skill1 / "SKILL.md").write_text("---\ntags: [security, audit]\n---\n# Skill One\nSecurity audit skill")
        skill2 = skills_dir / "skill-two"
        skill2.mkdir()
        (skill2 / "SKILL.md").write_text("---\ntags: [delivery]\n---\n# Skill Two\nDelivery skill")
        _parse(_run(firm_skill_search(
            query="skill", skills_dir=str(skills_dir), tags=["security"]
        )))

    def test_metadata_unreadable(self, tmp_path):
        from src.skill_loader import _extract_metadata
        skill_dir = tmp_path / "test-skill"
        skill_dir.mkdir()
        skill_file = skill_dir / "SKILL.md"
        skill_file.write_text("content")
        skill_file.chmod(0o000)
        try:
            meta = _extract_metadata(skill_file, "test-skill")
            assert "error" in meta or "name" in meta
        finally:
            skill_file.chmod(0o644)

    def test_metadata_yaml_list_tags(self, tmp_path):
        from src.skill_loader import _extract_metadata
        skill_dir = tmp_path / "test-skill"
        skill_dir.mkdir()
        skill_file = skill_dir / "SKILL.md"
        skill_file.write_text("---\ntags: [security, audit]\nversion: 1.0.0\n---\n# Test Skill\nDescription")
        meta = _extract_metadata(skill_file, "test-skill")
        assert "security" in str(meta.get("tags", []))

    def test_metadata_bad_yaml(self, tmp_path):
        from src.skill_loader import _extract_metadata
        skill_dir = tmp_path / "test-skill"
        skill_dir.mkdir()
        skill_file = skill_dir / "SKILL.md"
        skill_file.write_text("---\n{{{invalid yaml\n---\n# Test Skill")
        _extract_metadata(skill_file, "test-skill")
        # Should not crash — graceful fallback


# ============================================================================
# spec_compliance — various branches
# ============================================================================
class TestSpecComplianceE:

    def test_elicitation_schema_not_dict(self, tmp_path):
        from src.spec_compliance import elicitation_audit
        cfg = _write(tmp_path, {"mcp": {"elicitation": {
            "enabled": True,
            "schemas": ["not-a-dict", {"type": "object"}]
        }}})
        _parse(_run(elicitation_audit(config_path=cfg)))

    def test_elicitation_no_url_mode(self, tmp_path):
        from src.spec_compliance import elicitation_audit
        cfg = _write(tmp_path, {"mcp": {"elicitation": {"enabled": True}}})
        _parse(_run(elicitation_audit(config_path=cfg)))

    def test_tasks_no_max_concurrent(self, tmp_path):
        from src.spec_compliance import tasks_audit
        cfg = _write(tmp_path, {"mcp": {
            "capabilities": {"tasks": {}},
            "tasks": {}
        }})
        _parse(_run(tasks_audit(config_path=cfg)))

    def test_resources_no_list_changed(self, tmp_path):
        from src.spec_compliance import resources_prompts_audit
        cfg = _write(tmp_path, {"mcp": {
            "capabilities": {"resources": {"subscribe": True}}
        }})
        _parse(_run(resources_prompts_audit(config_path=cfg)))

    def test_resources_no_uri(self, tmp_path):
        from src.spec_compliance import resources_prompts_audit
        cfg = _write(tmp_path, {"mcp": {
            "capabilities": {"resources": {"listChanged": True}},
            "resources": [{"name": "test"}]
        }})
        r = _parse(_run(resources_prompts_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_audio_no_max_duration(self, tmp_path):
        from src.spec_compliance import audio_content_audit
        cfg = _write(tmp_path, {"mcp": {"audio": {"enabled": True}}})
        _parse(_run(audio_content_audit(config_path=cfg)))

    def test_json_schema_definitions_keyword(self, tmp_path):
        from src.spec_compliance import json_schema_dialect_check
        cfg = _write(tmp_path, {"mcp": {
            "tools": [{"name": "t", "inputSchema": {"definitions": {"X": {}}}}]
        }})
        _parse(_run(json_schema_dialect_check(config_path=cfg)))

    def test_json_schema_additional_items(self, tmp_path):
        from src.spec_compliance import json_schema_dialect_check
        cfg = _write(tmp_path, {"mcp": {
            "tools": [{"name": "t", "inputSchema": {"additionalItems": True}}]
        }})
        _parse(_run(json_schema_dialect_check(config_path=cfg)))

    def test_sse_no_protocol_version_header(self, tmp_path):
        from src.spec_compliance import sse_transport_audit
        cfg = _write(tmp_path, {"mcp": {
            "transport": {"type": "sse", "requireProtocolVersionHeader": False}
        }})
        r = _parse(_run(sse_transport_audit(config_path=cfg)))
        assert _fc(r) >= 1

    def test_icon_non_https(self, tmp_path):
        from src.spec_compliance import icon_metadata_audit
        cfg = _write(tmp_path, {"mcp": {
            "tools": [{"name": "t", "icon": "http://example.com/icon.png"}],
            "server": {"icon": "https://example.com/icon.png"}
        }})
        r = _parse(_run(icon_metadata_audit(config_path=cfg)))
        assert _fc(r) >= 1


# ============================================================================
# vs_bridge — WS RPC mock, HTTP mock, token header
# ============================================================================
class TestVsBridgeE:

    def test_ws_rpc_success(self):
        from src.vs_bridge import _ws_rpc
        mock_ws = AsyncMock()
        mock_ws.recv = AsyncMock(return_value=json.dumps({
            "jsonrpc": "2.0", "id": 1, "result": {"status": "ok"}
        }))
        mock_ws.__aenter__ = AsyncMock(return_value=mock_ws)
        mock_ws.__aexit__ = AsyncMock(return_value=False)
        with patch("src.vs_bridge.websockets") as mock_websockets:
            mock_websockets.connect = MagicMock(return_value=mock_ws)
            r = _run(_ws_rpc("test.method", {"key": "value"}))
            assert r == {"status": "ok"}

    def test_ws_rpc_error(self):
        from src.vs_bridge import _ws_rpc
        mock_ws = AsyncMock()
        mock_ws.recv = AsyncMock(return_value=json.dumps({
            "jsonrpc": "2.0", "id": 1, "error": {"code": -32600, "message": "Invalid request"}
        }))
        mock_ws.__aenter__ = AsyncMock(return_value=mock_ws)
        mock_ws.__aexit__ = AsyncMock(return_value=False)
        with patch("src.vs_bridge.websockets") as mock_websockets:
            mock_websockets.connect = MagicMock(return_value=mock_ws)
            with pytest.raises(RuntimeError, match="Gateway error"):
                _run(_ws_rpc("test.method", {}))

    def test_http_get_with_token(self):
        from src.vs_bridge import _http_get

        mock_resp = MagicMock()
        mock_resp.json.return_value = {"result": "ok"}
        mock_resp.raise_for_status = MagicMock()

        mock_client = AsyncMock()
        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
        mock_client.__aexit__ = AsyncMock(return_value=False)
        mock_client.get = AsyncMock(return_value=mock_resp)

        with patch("src.vs_bridge.GATEWAY_TOKEN", "my-secret-token"), \
             patch("httpx.AsyncClient", return_value=mock_client):
            r = _run(_http_get("/api/status"))
            assert r == {"result": "ok"}
            # Verify Authorization header was set
            call_args = mock_client.get.call_args
            headers = call_args.kwargs.get("headers", {})
            assert "Authorization" in headers

    def test_http_get_no_token(self):
        from src.vs_bridge import _http_get

        mock_resp = MagicMock()
        mock_resp.json.return_value = {"data": 42}
        mock_resp.raise_for_status = MagicMock()

        mock_client = AsyncMock()
        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
        mock_client.__aexit__ = AsyncMock(return_value=False)
        mock_client.get = AsyncMock(return_value=mock_resp)

        with patch("src.vs_bridge.GATEWAY_TOKEN", None), \
             patch("httpx.AsyncClient", return_value=mock_client):
            r = _run(_http_get("/api/data"))
            assert r == {"data": 42}


# ============================================================================
# Additional deep coverage — remaining gaps
# ============================================================================

class TestHebbianRuntimeDeepE:
    """Extra tests for hebbian _runtime lines 223-236, 266-267."""

    def test_weight_update_apply_and_record(self, tmp_path):
        """dry_run=False → apply changes + record to DB (lines 251-267)."""
        from src.hebbian_memory._runtime import firm_hebbian_weight_update
        from src.hebbian_memory._helpers import _init_db
        db = tmp_path / "hebbian.db"
        conn = _init_db(str(db))
        conn.execute(
            "INSERT INTO hebbian_sessions (session_id, summary, tags, rules_activated) VALUES (?, ?, ?, ?)",
            ("sess1", "test session", "[]", json.dumps(["overweight-rule"]))
        )
        conn.commit()
        conn.close()

        claude = tmp_path / "CLAUDE.md"
        claude.write_text("# CLAUDE\nLAYER 2 — CONSOLIDATED\n- [0.80] Overweight rule\n- [0.50] Normal rule two\n")
        _parse(_run(firm_hebbian_weight_update(
            claude_md_path=str(claude),
            db_path=str(db),
            dry_run=False
        )))
        # Should apply changes and record to DB

    def test_weight_update_history_db_error(self, tmp_path):
        """Exception when recording weight history (lines 266-267)."""
        from src.hebbian_memory._runtime import firm_hebbian_weight_update
        from src.hebbian_memory._helpers import _init_db
        db = tmp_path / "hebbian.db"
        conn = _init_db(str(db))
        conn.execute(
            "INSERT INTO hebbian_sessions (session_id, summary, tags, rules_activated) VALUES (?, ?, ?, ?)",
            ("sess1", "test session", "[]", json.dumps(["overweight-rule"]))
        )
        conn.commit()
        conn.close()

        claude = tmp_path / "CLAUDE.md"
        claude.write_text("# CLAUDE\nLAYER 2 — CONSOLIDATED\n- [0.80] Overweight rule\n- [0.50] Normal rule two\n")

        # Make the DB read-only after initial setup to trigger history write error
        import stat
        db.chmod(stat.S_IRUSR)
        try:
            _parse(_run(firm_hebbian_weight_update(
                claude_md_path=str(claude),
                db_path=str(db),
                dry_run=False
            )))
        finally:
            db.chmod(stat.S_IRUSR | stat.S_IWUSR)


class TestGatewayFleetDeepE:
    """Extra tests for gateway_fleet lines 149-167 (WS RPC), 197 (empty fleet)."""

    def test_ws_rpc_instance_success(self):
        """Mock WS RPC call to an instance."""
        from src.gateway_fleet import _ws_rpc_instance, GatewayInstance

        inst = GatewayInstance(name="test", ws_url="ws://localhost:1234", http_url="http://localhost:1234", token="tok")
        mock_ws = AsyncMock()
        mock_ws.recv = AsyncMock(return_value=json.dumps({
            "jsonrpc": "2.0", "id": 1, "result": {"status": "ok"}
        }))
        mock_ws.__aenter__ = AsyncMock(return_value=mock_ws)
        mock_ws.__aexit__ = AsyncMock(return_value=False)

        with patch("websockets.connect", return_value=mock_ws):
            r = _run(_ws_rpc_instance(inst, "ping", {}))
            assert isinstance(r, dict)

    def test_ws_rpc_instance_error(self):
        """WS RPC returns error."""
        from src.gateway_fleet import _ws_rpc_instance, GatewayInstance

        inst = GatewayInstance(name="test", ws_url="ws://localhost:1234", http_url="http://localhost:1234")
        mock_ws = AsyncMock()
        mock_ws.recv = AsyncMock(return_value=json.dumps({
            "jsonrpc": "2.0", "id": 1, "error": {"code": -1, "message": "fail"}
        }))
        mock_ws.__aenter__ = AsyncMock(return_value=mock_ws)
        mock_ws.__aexit__ = AsyncMock(return_value=False)

        with patch("websockets.connect", return_value=mock_ws):
            with pytest.raises(RuntimeError):
                _run(_ws_rpc_instance(inst, "bad_method", {}))

    def test_save_fleet_oserror(self, tmp_path):
        """_save_fleet handles OSError on write."""
        from src.gateway_fleet import _save_fleet
        # Point to a read-only directory
        ro_dir = tmp_path / "readonly"
        ro_dir.mkdir()
        ro_dir.chmod(0o444)
        cfg = str(ro_dir / "fleet.json")
        try:
            with patch("src.gateway_fleet.FLEET_CONFIG_PATH", cfg):
                _save_fleet([{"id": "x", "url": "ws://localhost:1234"}])
        except Exception:
            pass
        finally:
            ro_dir.chmod(0o755)


class TestConfigMigrationDeepE:
    """Extra tests for config_migration remaining gaps."""

    def test_plugin_integrity_manifest_exists(self, tmp_path):
        """Plugin manifest exists with matching hash."""
        from src.config_migration import firm_plugin_integrity_check
        import hashlib
        plugin_dir = tmp_path / "plugins" / "myplugin"
        plugin_dir.mkdir(parents=True)
        main_file = plugin_dir / "index.js"
        main_file.write_text("console.log('hello');")
        expected_hash = hashlib.sha256(main_file.read_bytes()).hexdigest()
        manifest = tmp_path / "plugin-manifest.json"
        manifest.write_text(json.dumps({
            "myplugin": {"sha256": expected_hash, "main": str(main_file)}
        }))
        cfg = _write(tmp_path, {"plugins": {"entries": [{"id": "myplugin"}]}})
        with patch("src.config_migration._PLUGIN_MANIFEST", manifest):
            _parse(_run(firm_plugin_integrity_check(config_path=cfg)))

    def test_token_separation_hooks_token(self, tmp_path):
        """hooks.token set but different from gateway password."""
        from src.config_migration import firm_token_separation_check
        cfg = _write(tmp_path, {
            "hooks": {"token": "hook-secret-123"},
            "gateway": {"auth": {"password": "different-password"}}
        })
        _parse(_run(firm_token_separation_check(config_path=cfg)))


class TestSpecComplianceDeepE:
    """Extra tests for spec_compliance remaining gaps."""

    def test_resources_high_finding(self, tmp_path):
        """Trigger HIGH severity in resources_prompts_audit."""
        from src.spec_compliance import resources_prompts_audit
        cfg = _write(tmp_path, {"mcp": {
            "capabilities": {"resources": {"subscribe": True}},
            "resources": [{"name": "test"}]
        }})
        _parse(_run(resources_prompts_audit(config_path=cfg)))

    def test_tasks_high_finding(self, tmp_path):
        """Trigger HIGH severity in tasks_audit."""
        from src.spec_compliance import tasks_audit
        cfg = _write(tmp_path, {"mcp": {
            "capabilities": {"tasks": True},
            "tasks": {"durableRequests": False}
        }})
        _parse(_run(tasks_audit(config_path=cfg)))

    def test_elicitation_high_severity(self, tmp_path):
        """Trigger HIGH severity in elicitation_audit."""
        from src.spec_compliance import elicitation_audit
        cfg = _write(tmp_path, {"mcp": {
            "elicitation": {
                "enabled": True,
                "urlMode": "unsafe"
            }
        }})
        _parse(_run(elicitation_audit(config_path=cfg)))


class TestSkillLoaderDeepE:
    """Extra tests for skill_loader remaining gaps."""

    def test_lazy_loader_found(self, tmp_path):
        """Skill found by name."""
        from src.skill_loader import firm_skill_lazy_loader
        import src.skill_loader as sl_mod
        sl_mod._SKILL_CACHE.clear()
        sl_mod._CACHE_TS = 0.0
        skills_dir = tmp_path / "skills"
        skill1 = skills_dir / "test-skill"
        skill1.mkdir(parents=True)
        (skill1 / "SKILL.md").write_text("---\ntags: [test]\n---\n# Test Skill\nA test skill.")
        r = _parse(_run(firm_skill_lazy_loader(
            skill_name="test-skill", skills_dir=str(skills_dir)
        )))
        assert r.get("ok") is True

    def test_search_with_tag_filter_no_match(self, tmp_path):
        """Tag filter excludes all skills."""
        from src.skill_loader import firm_skill_search
        skills_dir = tmp_path / "skills"
        skill1 = skills_dir / "skill-one"
        skill1.mkdir(parents=True)
        (skill1 / "SKILL.md").write_text("---\ntags: [security]\n---\n# Skill One\nSecurity skill")
        r = _parse(_run(firm_skill_search(
            query="skill", skills_dir=str(skills_dir), tags=["nonexistent-tag"]
        )))
        # Should return 0 matches
        assert r.get("total_matches", 0) == 0
