SOLIDWORKS Bridge

//! ADVERSARIAL REVIEW OF 0.8.7 — pass thirty-seven.
//!
//! MASTER IS GREEN: 396 pass, 0 fail, on a clean checkout of bf73d80. Verified
//! before anything below.
//!
//! WHAT CHECKS OUT.
//!
//! (2) The clause window holds in both directions. Measured, planted in
//!     `src/verbs3.rs`:
//!
//!     ```text
//!     "Ask the user, who knows the session, whether the sweep ran, and then
//!      close the documents."                                          CAUGHT
//!     "Close the documents (ask the user)."                           CAUGHT
//!     ```
//!
//!     Three clauses apart is still caught, and my pass-36 reversed-order
//!     bypass is closed.
//!
//! (3) The session check is a CONJUNCTION, not an alternative:
//!     `if doc in twin_paths and inside and same_session:` (drain-gate.py:405).
//!     A forged `sessionPid` still has to clear `commonpath` containment, and an
//!     unknown session is `None` which fails the equality. Both conditions
//!     required, exactly as intended.
//!
//! (4) NOTHING asserts the README's test count. I grepped every test for it:
//!     the only README references are this review's own detectors and the pin's
//!     file list. There is no self-referential count pin to remove.
//!
//! WHAT DOES NOT.

use std::path::Path;

/// SEVERITY 1, CONSENT — A QUOTED INSTRUCTION IN `SKILL.md` IS STILL AN
/// INSTRUCTION, AND THE PIN NOW SKIPS IT.
///
/// MEASURED, by appending each to `SKILL.md` and counting offenders from that
/// file:
///
/// ```text
/// "If blocked, ask the user to close the documents by hand."      CAUGHT (control)
/// fenced block containing the same sentence                       CAUGHT
/// "> If a dialog is up, ask the user to close the documents…"     SLIPS
/// "Run `ask the user to close the documents` when blocked."       SLIPS
/// ```
///
/// The 0.8.6 fix was right for `README.md`, where the quoted sentences are a
/// CHANGELOG describing what the pin must catch. It is wrong for `SKILL.md`,
/// because `SKILL.md` is not documentation about the bridge — it is the file an
/// agent loads and follows. Markdown emphasis is presentational; a model reading
/// a blockquoted "ask the user to close the documents by hand" reads an
/// instruction, and a backticked one reads an instruction it should probably run
/// verbatim. The two files have opposite relationships to their own quotes and
/// the pin now treats them the same way.
///
/// So the category stripping has made the pin blind in exactly the file that
/// matters, to close a false positive that only ever existed in the other one.
///
/// THE HONEST SPLIT, which is what this test pins:
///
///   * example violations live in the `cases` table, which already carries all
///     five sentences as must-catch rows, and in `README.md`'s changelog — both
///     are records ABOUT the rule, read by people;
///   * `SKILL.md` is instructions TO the reader, so nothing in it is exempt:
///     scan it whole, quotes included. If a sentence there needs to describe a
///     forbidden instruction, it can name the rule instead of quoting it —
///     which is what every other line of that file already does.
///
/// Per-file policy, not per-syntax: strip quoted categories in `README.md` and
/// `docs/`, strip nothing in `SKILL.md`.
#[test]
fn a_violation_cannot_hide_inside_markup_in_the_file_an_agent_follows() {
    let root = Path::new(env!("CARGO_MANIFEST_DIR"));
    let pin = std::fs::read_to_string(root.join("tests/wiring.rs")).expect("wiring.rs");
    let body = pin
        .split("fn nothing_asks_the_user_to_close_documents")
        .nth(1)
        .expect("the pin exists")
        .to_string();

    // Does the stripping distinguish the file that INSTRUCTS from the files that
    // DESCRIBE? A per-file exemption, however spelled, mentions SKILL.md near
    // the stripping.
    let strips = body.contains("strip") || body.contains("quoted") || body.contains("blockquote");
    let per_file = body.contains("SKILL.md") && {
        let near = body
            .split("SKILL.md")
            .nth(1)
            .map(|s| s.chars().take(400).collect::<String>())
            .unwrap_or_default();
        near.contains("strip") || near.contains("quote") || near.contains("verbatim")
            || near.contains("whole")
    };

    assert!(
        !strips || per_file,
        "the pin strips blockquotes and inline code spans from every markdown file, SKILL.md \
         included — measured: a blockquoted \"ask the user to close the documents by hand\" and a \
         backticked one both produce ZERO offenders there, while the same sentence unquoted is \
         caught. README.md's quotes are a changelog describing the rule; SKILL.md's are read by \
         an agent as instructions, because markdown emphasis is presentational and a model \
         following that file does not stop at a blockquote. The 0.8.6 fix was right for one file \
         and has blinded the pin in the other. Split it per FILE, not per syntax: strip in \
         README.md and docs/, strip nothing in SKILL.md — example violations already live in the \
         `cases` table, which carries all five sentences. (strips: {strips}, per-file: {per_file})"
    );
}

/// THE MISSING PIN FOR `acknowledge_only`, WRITTEN OUT.
///
/// I reported this as a surviving mutation in pass 33 and it survives again in
/// pass 37: changing `named.len() == 1` to `named.len() >= 1` makes a dialog
/// whose buttons are `["OK", "Cancel"]` report `acknowledgeOnly: true` — "the
/// only thing on offer is to acknowledge this" said about a dialog with a real
/// choice in it — and 396 tests do not notice. The code is CORRECT; it is
/// unguarded, which is why this test passes rather than fails.
///
/// It matters because `acknowledgeOnly` is the field a human reads before
/// deciding whether to press something, on dialogs this bridge will never press
/// itself. The live License Manager dialog is genuinely OK-only; the next one
/// may not be.
#[test]
fn acknowledge_only_means_exactly_one_button_and_it_says_ok() {
    use swx_bridge::launchos::DialogContents;
    let d = |b: &[&str]| DialogContents {
        text: vec!["…".into()],
        buttons: b.iter().map(|s| s.to_string()).collect(),
        ..Default::default()
    };

    assert!(d(&["OK"]).acknowledge_only(), "one OK button is acknowledge-only");
    assert!(d(&["&OK"]).acknowledge_only(), "an accelerator ampersand is not part of the name");
    assert!(
        !d(&["OK", "Cancel"]).acknowledge_only(),
        "OK + Cancel offers a CHOICE — reporting it as acknowledge-only tells a human the dialog \
         cannot be answered wrongly, about a dialog that can"
    );
    assert!(
        !d(&["Save", "Don't Save", "Cancel"]).acknowledge_only(),
        "a save prompt is never acknowledge-only"
    );
    // 0.8.7 gave DialogContents its own `checkboxes` field, so a "don't show
    // again" no longer masquerades as a button — the pass-33 note about the
    // reported control list is addressed. An OK-only dialog that also carries a
    // checkbox is therefore still acknowledge-only, which is now the honest
    // answer rather than the accidentally-safe one.
    assert!(
        d(&["OK"]).acknowledge_only(),
        "with checkboxes held separately, OK-plus-a-checkbox is genuinely acknowledge-only"
    );
    assert!(!d(&[]).acknowledge_only(), "no buttons is not acknowledge-only");
    // `Close` alone is acknowledge-only too, and rightly — plenty of
    // informational dialogs offer only that. I asserted the opposite first and
    // the code corrected me.
    assert!(d(&["Close"]).acknowledge_only(), "a lone Close is also only an acknowledgement");
    assert!(
        !d(&["Close", "Cancel"]).acknowledge_only(),
        "two buttons are a choice however they are named"
    );
}