forge_workspace/workspace/

testing.rs

//! Test-only constructors, seed helpers and dispatch interception for
//! `Workspace`, so tests here and cross-crate tests can drive a workspace
//! without a real subprocess.

use std::collections::{HashMap, HashSet};
use std::path::PathBuf;
use std::sync::Arc;

use parking_lot::Mutex;
use tokio::sync::mpsc;

use crate::config::LoadedConfig;
use crate::domain_session::PendingInteractions;
use crate::protocol::SessionUpdate;
use crate::target::{ProjectKey, SessionSlot};
use crate::update_fanout::{SeatUpdate, SubscriberRole, UpdateFanout};
use crate::workspace::{KickRequest, PendingInteractionKind, PooledAgent, Workspace};
use forge_gateway::AccountKey;
use forge_primitives::SessionId;

/// Drive a seat's frame window down, so a fixture reaches the transcript
/// fallback without emitting a window's worth of frames. The window is
/// otherwise the constant it ships as, and the module this sits in is the
/// gate that keeps it out of production.
pub fn set_seat_ring_cap(workspace: &Workspace, cap: usize) {
    workspace.update_tx.set_ring_cap(cap);
}

/// The tool id a parked test prompt answers to, so a test addresses the one
/// it seeded rather than a key it has to know how the fixture built.
#[cfg(any(test, feature = "testing"))]
pub const TEST_TOOL_ID: &str = "test-tool";

/// The path a seeded document hand-off parks at. The registration IS the
/// state a seeder produces - nothing reads the file - so the fixture names
/// one rather than touching disk.
#[cfg(any(test, feature = "testing"))]
const TEST_DOCUMENT_PATH: &str = "/proj/docs/test.md";

/// A permission prompt for a fixture to park on a seat: the smallest one a
/// dock can draw, carrying the id [`TEST_TOOL_ID`] answers to. A fixture is
/// the only place a prompt is invented, so it says what it invents.
#[cfg(any(test, feature = "testing"))]
pub(crate) fn test_permission(
    tx: tokio::sync::oneshot::Sender<forge_primitives::PermissionOutcome>,
) -> crate::protocol::PendingInteractionSlot {
    use forge_primitives::permission_interaction::{
        PermissionAction, PermissionOption, PermissionOptionKind,
    };

    let request = forge_primitives::PermissionRequest {
        tool_call: test_tool_call("Bash", forge_primitives::ToolKind::Execute, Some("ls")),
        options: vec![PermissionOption {
            option_id: "allow_once".to_owned(),
            name: "Allow once".to_owned(),
            kind: PermissionOptionKind::Allow,
            action: PermissionAction::Allow,
        }],
        display: None,
    };
    crate::protocol::PendingInteractionSlot::Permission { tx, request: Box::new(request) }
}

/// The tool call a fixture's prompt is about.
#[cfg(any(test, feature = "testing"))]
fn test_tool_call(
    title: &str,
    kind: forge_primitives::ToolKind,
    command: Option<&str>,
) -> forge_primitives::ToolCall {
    forge_primitives::ToolCall {
        tool_call_id: TEST_TOOL_ID.to_owned(),
        title: title.to_owned(),
        kind,
        status: forge_primitives::ToolCallStatus::Pending,
        content: Vec::new(),
        raw_input: command.map(|command| serde_json::json!({ "command": command })),
        raw_output: None,
        output_metadata: None,
        task_metadata: None,
        locations: Vec::new(),
        meta: None,
    }
}

/// The same, for a question.
#[cfg(any(test, feature = "testing"))]
pub(crate) fn test_question(
    tx: tokio::sync::oneshot::Sender<forge_primitives::QuestionOutcome>,
) -> crate::protocol::PendingInteractionSlot {
    use forge_primitives::question::{QuestionOption, QuestionPrompt};

    let request = forge_primitives::QuestionRequest {
        tool_call: test_tool_call("AskUserQuestion", forge_primitives::ToolKind::Think, None),
        prompt: QuestionPrompt {
            question: "Which environment?".to_owned(),
            header: "Environments".to_owned(),
            multi_select: false,
            options: vec![QuestionOption {
                option_id: "staging".to_owned(),
                label: "Staging".to_owned(),
                description: None,
                preview: None,
            }],
        },
        question_index: 0,
        total_questions: 1,
    };
    crate::protocol::PendingInteractionSlot::Question { tx, request: Box::new(request) }
}

/// [`test_permission`] or [`test_question`] with a receiver nobody keeps.
///
/// `None` for every other kind: each parks in a registry of the workspace's
/// own rather than in the session's pending set, and the seeders below
/// register it there instead - so a test that wants the HELD state gets the
/// real one.
#[cfg(any(test, feature = "testing"))]
fn test_prompt(kind: PendingInteractionKind) -> Option<crate::protocol::PendingInteractionSlot> {
    match kind {
        PendingInteractionKind::Permission => {
            let (tx, _rx) = tokio::sync::oneshot::channel();
            Some(test_permission(tx))
        }
        PendingInteractionKind::Question => {
            let (tx, _rx) = tokio::sync::oneshot::channel();
            Some(test_question(tx))
        }
        PendingInteractionKind::SlackDraft
        | PendingInteractionKind::BrowserHandOff
        | PendingInteractionKind::TerminalHandOff
        | PendingInteractionKind::DocumentHandOff
        | PendingInteractionKind::SettingsWrite
        | PendingInteractionKind::Vault => None,
    }
}

#[cfg(any(test, feature = "testing"))]
impl Workspace {
    /// Mark a session as having completed its Connected handshake by
    /// stamping `session_id` on its `DomainSession` (registering one if
    /// absent). Delivery paths gate dispatch-vs-buffer on this, so tests
    /// that assert a live worker/lead receives a prompt need it set -
    /// in production every Running session has it stamped by `Connected`.
    #[cfg(test)]
    pub(crate) fn mark_session_connected_for_test(&self, key: &SessionSlot, session_id: &str) {
        let domain = self
            .domain_session_for(key)
            .unwrap_or_else(|| self.register_domain_session(key.clone(), None));
        domain.lock().session_id = Some(forge_primitives::SessionId::new(session_id));
    }

    /// Construct a stub `AgentHandle` plus the matching
    /// `Receiver<forge_primitives::AgentCommand>` that drains every command
    /// dispatched to it. Tests use this to wire a stub connection
    /// without spinning up a real subprocess; the bridge underneath is
    /// `forge_agent::Agent::testing_stub` - same shape as before, now
    /// reachable from a view via `forge_workspace::Workspace::*`
    /// so a view crate needs no direct `forge-agent` dep.
    ///
    /// The returned `Receiver` carries `forge_primitives::AgentCommand`
    /// because that's what the bridge's dispatcher accepts; this is
    /// distinct from [`crate::protocol::Command`] (the workspace's
    /// outer envelope) that wraps these primitives under a
    /// `SessionSlot`.
    pub fn testing_stub_handle()
    -> (forge_agent::AgentHandle, mpsc::UnboundedReceiver<forge_primitives::AgentCommand>) {
        forge_agent::Agent::testing_stub()
    }

    /// Record a slot's failed spawn, as the connection-failure path does
    /// before it releases the session. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn record_spawn_failure_for_test(&self, slot: &SessionSlot, message: &str) {
        self.record_spawn_failure(slot, message);
    }

    /// Stamp a slot's failed-turn record the way an errored `Result`
    /// does, so a cross-crate test can read the row the surface builds.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn record_failed_turn_for_test(&self, slot: &SessionSlot, at: std::time::SystemTime) {
        if let Some(domain) = self.domain_session_for(slot) {
            domain.lock().failed_turn_at = Some(at);
        }
    }

    /// Record a slot's death alone - the state a recovering connect leaves:
    /// the failure cleared, the death riding with the reason it left. Add
    /// [`Self::record_spawn_failure_for_test`] for the crashed-and-still-
    /// down shape, where no connect has cleared anything. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn record_death_for_test(&self, slot: &SessionSlot, occupant: &str, message: &str) {
        self.record_death(slot, SessionId::new(occupant), message);
    }

    /// Push one update onto the fan-out, so a test can watch a view react
    /// to the core without driving a session. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn emit_for_test(&self, update: SessionUpdate) {
        let _ = self.update_tx.send(update);
    }

    /// Park a Slack draft on `key` as a blocked Slack tool call would. The
    /// receiver is dropped on purpose: the tool call is the test's to
    /// simulate, and the note's own path is covered where a handler awaits
    /// it. Test-only.
    pub fn park_slack_draft_for_test(
        &self,
        key: &SessionSlot,
        draft: forge_primitives::slack::SlackDraft,
    ) {
        let _ = self.register_slack_draft(key, draft);
    }

    /// [`Self::emit_for_test`], reporting whether a subscriber was there to
    /// take it.
    ///
    /// A dead subscriber is dropped from the registry on the next send, so
    /// the answer is `false` once nothing is listening - which is how a test
    /// tells a subscription still attached from one that went with its
    /// socket.
    pub fn emit_for_test_reported(&self, update: SessionUpdate) -> bool {
        self.update_tx.send(update)
    }

    /// How many subscribers are attached right now. Test-only: a test that
    /// watches a subscription arrive and leave reads this rather than asking
    /// whether an emit landed, which a permanently attached listener answers
    /// for everything.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_subscriber_count(&self) -> usize {
        self.update_tx.count()
    }

    /// How many subscribers could answer a prompt right now. Test-only: the
    /// role decides whether the core parks a turn on a reply, and a test that
    /// watches a client declare it has nothing else to read.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_answering_count(&self) -> usize {
        self.update_tx.answering_count()
    }

    /// Whether the usage poller is registered and running. Test-only: the
    /// poller's first tick is a minute out and its pass reaches the network,
    /// so a cross-crate boot test reads the registry rather than watching it
    /// poll.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_usage_poller_started(&self) -> bool {
        self.supervisor.snapshot().iter().any(|member| {
            member.name == "usage_poller"
                && matches!(&member.state, forge_supervise::MemberState::Running { .. })
        })
    }

    /// Whether the dictate prewarm's start has run. Test-only: the start
    /// reaches the network for models this fixture has none of, so a
    /// cross-crate boot test reads the guard rather than watching it fetch.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_dictate_preflight_started(&self) -> bool {
        self.dictate_preflight_started.load(std::sync::atomic::Ordering::Acquire)
    }

    /// Whether the voice prewarm's start has run. Test-only: the start
    /// loads multi-gigabyte weights this fixture has none of, so a
    /// cross-crate boot test reads the guard rather than watching it load.
    #[cfg(any(test, feature = "testing"))]
    pub fn test_voice_prewarm_started(&self) -> bool {
        self.voice_prewarm_started.load(std::sync::atomic::Ordering::Acquire)
    }

    /// Hold a claude version snapshot, so a cross-crate test can render the
    /// version line without a real `claude --version` and npm probe.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_cli_version(&self, installed: Option<&str>, latest: Option<&str>) {
        *self.cli_version.lock() = Some(forge_agent::env::cli_version::CliVersionInfo {
            installed: installed.map(str::to_owned),
            latest: latest.map(str::to_owned),
        });
    }

    /// Hold the last fatal, as the boot spawn's failure records it, so a
    /// cross-crate test can read the home's encoding without a dying spawn.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_fatal_error(&self, error: forge_primitives::error::AppError) {
        self.record_fatal_error(error);
    }

    /// Register a fresh testing-stub agent against `key`'s
    /// `DomainSession`. Returns the matching
    /// `forge_primitives::AgentCommand` receiver so tests can assert on
    /// the commands the workspace routes through it (the same shape
    /// as `testing_stub_handle()`, but with the handle installed in
    /// one step so a view's test code doesn't have to touch
    /// `AgentHandle` directly).
    ///
    /// Auto-creates a `DomainSession` for `key` when none is
    /// registered yet; otherwise overwrites the existing
    /// `DomainSession.conn` slot.
    pub fn install_testing_stub(
        &self,
        key: &SessionSlot,
    ) -> mpsc::UnboundedReceiver<forge_primitives::AgentCommand> {
        let (handle, rx) = forge_agent::Agent::testing_stub();
        let arc = Arc::new(handle);
        let domain = self
            .domain_session_for(key)
            .unwrap_or_else(|| self.register_domain_session(key.clone(), None));
        domain.lock().conn = Some(arc);
        rx
    }

    /// Put a prompt in a seat's queue exactly as a dispatch leaves it: the row
    /// a client attaching mid-queue reads, with no dispatch to drive.
    pub fn seed_queued_prompt(
        &self,
        key: &SessionSlot,
        uuid: &str,
        source: crate::protocol::PromptSource,
        text: &str,
    ) {
        let domain = self
            .domain_session_for(key)
            .unwrap_or_else(|| self.register_domain_session(key.clone(), None));
        domain.lock().record_queued_prompt(uuid, source, text, Vec::new());
    }

    /// Construct an empty `Workspace` for use in unit tests. Skips
    /// the on-disk `forge.toml` load + catalog scan that
    /// [`Workspace::new`] performs; the returned workspace carries an
    /// empty project list and an empty pool. Tests register a domain
    /// session via [`Self::register_domain_session`] before
    /// exercising any code path that needs one.
    ///
    /// Returns the workspace alongside the `SeatUpdate` receiver
    /// this constructor subscribed. The workspace's `subscribe()` slot
    /// is `None`, so a later `subscribe()` mints a stream of its own
    /// rather than handing back this one.
    pub fn testing_stub() -> (Arc<Self>, mpsc::UnboundedReceiver<SeatUpdate>) {
        Self::testing_stub_with_config_dir(PathBuf::from("/tmp/forge-testing-stub"))
    }

    /// Like `testing_stub` but with a caller-supplied `config_dir` so
    /// tests that probe disk-side APIs (catalog scan, JSONL reads)
    /// can point the stub at a tempdir of their own.
    pub fn testing_stub_with_config_dir(
        config_dir: PathBuf,
    ) -> (Arc<Self>, mpsc::UnboundedReceiver<SeatUpdate>) {
        // `empty_for_test` carries no `[[slack]]` entries, so there is
        // nothing here for `from_config` to check.
        Self::testing_stub_with_slack(
            config_dir,
            LoadedConfig::empty_for_test(),
            Arc::new(crate::slack::SlackWorkspaces::default()),
            None,
        )
    }

    /// Like `testing_stub_with_config_dir` but injects a caller-built
    /// `LoadedConfig` so tests can drive the project-resolution paths
    /// (`project_for_target` / `default_project`) that read the live
    /// config's `projects`, which the `test_extra_projects` overlay
    /// does not populate. Build the config via
    /// `crate::config::load_from_dir` on a tempdir `forge.toml` fixture;
    /// `db` stays `None`, so nothing touches the real machine store.
    ///
    /// Clients come from the injected config through
    /// `SlackWorkspaces::from_config`, the only thing that checks a
    /// `[[slack]]` entry; `load_from_dir` parses the section straight
    /// through. An entry `from_config` refuses is returned as its bare
    /// error rather than degrading to a workspace with no clients, the
    /// way `new` refuses to boot on the same error. A malformed fixture
    /// has to fail where the test that built it can see it.
    ///
    /// `#[cfg(test)]` because `LoadedConfig` is crate-private and only
    /// this crate's own test modules call it; the feature build, which
    /// exists for the cross-crate constructors above, has no use for it.
    #[cfg(test)]
    pub(crate) fn testing_stub_with_config(
        config_dir: PathBuf,
        config: LoadedConfig,
    ) -> Result<(Arc<Self>, mpsc::UnboundedReceiver<SeatUpdate>), String> {
        let slack =
            crate::slack::SlackWorkspaces::from_config(&config.slack, &reqwest::Client::new())?;
        let systemone = crate::systemone::client_for(
            config.systemone.as_ref(),
            &crate::config::forge_data_dir(&config_dir).join("forge.toml"),
        )
        .map_err(|error| error.to_string())?
        .map(Arc::new);
        Ok(Self::testing_stub_with_slack(config_dir, config, Arc::new(slack), systemone))
    }

    /// `Self::testing_stub_with_config` with the Slack clients supplied
    /// by the caller, so a test can drive a real facade against a double
    /// rather than a live workspace.
    #[cfg(any(test, feature = "testing"))]
    pub(crate) fn testing_stub_with_slack(
        config_dir: PathBuf,
        config: LoadedConfig,
        slack: Arc<crate::slack::SlackWorkspaces>,
        systemone: Option<Arc<forge_system_one::SystemOneClient>>,
    ) -> (Arc<Self>, mpsc::UnboundedReceiver<SeatUpdate>) {
        // Mirror the boot-time `ensure_forge_data_dir`: stub-based tests
        // that exercise the cron / state stores expect `forge/` present.
        let _ = crate::config::ensure_forge_data_dir(&config_dir);
        let update_tx = UpdateFanout::default();
        // A stub's caller stands in for the frontend, so it answers.
        let update_rx = update_tx.subscribe(SubscriberRole::Answering);
        let (kick_dispatcher_tx, kick_dispatcher_rx) = mpsc::unbounded_channel::<KickRequest>();
        let config_dictate = config.dictate.clone();
        let accounts = std::sync::Arc::new(forge_gateway::AccountPool::empty_for_test());
        // A stub workspace never binds the listener, so nothing forwards
        // through this client; the leg's own construction is covered by the
        // gateway's tests.
        let gateway = std::sync::Arc::new(forge_gateway::forward::Gateway::new(
            std::sync::Arc::clone(&accounts),
            reqwest::Client::new(),
        ));
        // `new_for_test`'s convention: the stub's whole app-support base
        // sits under the test's own config dir.
        let app_support = Some(config_dir.join("app-support"));
        let (settings, _settings_rx) = tokio::sync::watch::channel(None);
        let workspace = Self {
            config_dir,
            config: parking_lot::RwLock::new(Arc::new(config)),
            settings,
            settings_version: std::sync::OnceLock::new(),
            settings_write: parking_lot::Mutex::new(()),
            reload_generation: std::sync::atomic::AtomicU64::new(0),
            reload_gate: std::sync::Mutex::new(()),
            systemone: parking_lot::RwLock::new(systemone),
            vault: parking_lot::RwLock::new(None),
            voice: std::sync::OnceLock::new(),
            voice_preview_error: std::sync::Mutex::new(None),
            catalog: Arc::new(Mutex::new(HashMap::new())),
            app_support,
            pool: Mutex::new(HashMap::new()),
            // A stub reaches no network either: the refill has nothing to
            // fetch.
            pricing_fetcher: crate::workspace::default_pricing_fetcher(),
            #[cfg(any(test, feature = "testing"))]
            test_spawn_handle: Mutex::new(None),
            test_spawn_server: Mutex::new(None),
            accounts,
            gateway,
            // A stub workspace pretends the listener is bound: the
            // tests driving it never open a socket, and the boot gate
            // must read open for spawns to proceed.
            gateway_ready: std::sync::atomic::AtomicBool::new(true),
            gateway_port: crate::config::DEFAULT_GATEWAY_PORT,
            gateway_url: Mutex::new(Some(format!(
                "http://127.0.0.1:{}",
                crate::config::DEFAULT_GATEWAY_PORT
            ))),
            gateway_bind_error: Mutex::new(None),
            dictate: Arc::new(crate::dictate::DictateState::new(&config_dictate)),
            dictate_runtime: Mutex::new(crate::dictate::DictateRuntime::default()),
            browser_host: std::sync::OnceLock::new(),
            live_seats_lock: std::sync::Mutex::new(()),
            live_seats_generation: std::sync::atomic::AtomicU64::new(0),
            live_seats_gate: Mutex::new(None),
            attached_clients: std::sync::atomic::AtomicUsize::new(0),
            document_handoffs: parking_lot::Mutex::new(HashMap::new()),
            dictate_catalogue: Mutex::new(crate::catalogue::CatalogueState::default()),
            dictate_install: Mutex::new(crate::install::InstallState::default()),
            plugin_cli: Mutex::new(crate::plugins::PluginCli::real()),
            plugin_run: Mutex::new(None),
            plugin_action_running: std::sync::atomic::AtomicBool::new(false),
            dictate_activate: Mutex::new(crate::install::ActivateState::default()),
            dictate_bench: Mutex::new(crate::bench::BenchState::default()),
            dictate_bench_cancel: std::sync::atomic::AtomicBool::new(false),
            speaking_bench: Mutex::new(crate::bench::SpeakingBenchState::default()),
            speaking_bench_cancel: std::sync::atomic::AtomicBool::new(false),
            bench_claim: std::sync::atomic::AtomicBool::new(false),
            read_aloud_error: Mutex::new(None),
            #[cfg(any(test, feature = "testing"))]
            test_catalogue_source: Mutex::new(None),
            #[cfg(any(test, feature = "testing"))]
            test_cleanup_source: Mutex::new(None),
            #[cfg(any(test, feature = "testing"))]
            test_catalogue_dir: Mutex::new(None),
            #[cfg(any(test, feature = "testing"))]
            test_read_aloud_dir: Mutex::new(None),
            update_tx,
            command_senders: Mutex::new(HashMap::new()),
            session_teardowns: Mutex::new(HashMap::new()),
            shutting_down: std::sync::atomic::AtomicBool::new(false),
            live_workers: Mutex::new(HashMap::new()),
            idle_sweeps: Mutex::new(HashMap::new()),
            worktree_claims: std::sync::Arc::new(parking_lot::Mutex::new(HashMap::new())),
            despawn_cleanups: Mutex::new(HashSet::new()),
            spawn_failures: Mutex::new(HashMap::new()),
            deaths: Mutex::new(HashMap::new()),
            heal_progress: Mutex::new(HashMap::new()),
            healing: std::sync::OnceLock::new(),
            held_work_seats: crate::work::HeldSeats::default(),
            domain_handles: Mutex::new(HashMap::new()),
            review_origin: Mutex::new(HashMap::new()),
            review_activity: Mutex::new(HashMap::new()),
            supervisor: Arc::new(forge_supervise::Supervisor::new()),
            dictate_preflight_started: std::sync::atomic::AtomicBool::new(false),
            voice_prewarm_started: std::sync::atomic::AtomicBool::new(false),
            voice_prewarm_dispatched: std::sync::atomic::AtomicBool::new(false),
            kick_dispatcher_tx,
            kick_dispatcher_rx_slot: Mutex::new(Some(kick_dispatcher_rx)),
            _single_instance_lock: None,
            crons: Mutex::new(Vec::new()),
            crons_load_failed: std::sync::atomic::AtomicBool::new(false),
            tasks: Mutex::new(Vec::new()),
            parked_by_slot: Mutex::new(HashMap::new()),
            pending_handoffs: Mutex::new(HashMap::new()),
            swapping: Mutex::new(HashMap::new()),
            swap_epochs: std::sync::atomic::AtomicU64::new(0),
            held_prompts: Mutex::new(HashMap::new()),
            gotify_subs: Mutex::new(Vec::new()),
            db: Arc::new(Mutex::new(None)),
            catalog_loaded: Arc::new(std::sync::atomic::AtomicBool::new(false)),
            catalog_scan_started: std::sync::atomic::AtomicBool::new(false),
            cli_version: Arc::new(Mutex::new(None)),
            last_fatal_error: Mutex::new(None),
            service_status: Arc::new(Mutex::new(None)),
            service_status_probe_started: std::sync::atomic::AtomicBool::new(false),
            gotify_connected: Mutex::new(false),
            gotify_app_index: Mutex::new(HashMap::new()),
            gotify_subsystem: Mutex::new(None),
            slack,
            slack_subs: Mutex::new(Vec::new()),
            slack_subsystem: Mutex::new(std::collections::BTreeMap::new()),
            slack_connected: Mutex::new(std::collections::BTreeMap::new()),
            slack_inflight: Mutex::new(std::collections::HashMap::new()),
            slack_user_ids: Mutex::new(std::collections::BTreeMap::new()),
            slack_user_names: Mutex::new(std::collections::BTreeMap::new()),
            slack_author_failures: Mutex::new(std::collections::HashSet::new()),
            slack_draft_user_failures: Mutex::new(std::collections::HashSet::new()),
            slack_thread_failures: Mutex::new(std::collections::HashSet::new()),
            slack_thread_full_reads: Mutex::new(std::collections::HashMap::new()),
            slack_thread_first_walks: Mutex::new(std::collections::HashSet::new()),
            slack_thread_edit_watermarks: Mutex::new(std::collections::HashMap::new()),
            slack_ledger_failures: Mutex::new(std::collections::HashSet::new()),
            slack_drafts: Mutex::new(HashMap::new()),
            browser_handoffs: Mutex::new(HashMap::new()),
            terminals: Mutex::new(HashMap::new()),
            terminal_handoffs: Mutex::new(HashMap::new()),
            next_terminal_id: std::sync::atomic::AtomicU16::new(1),
            settings_writes: Mutex::new(HashMap::new()),
            parked_vault_asks: Mutex::new(HashMap::new()),
            pending_seq: Mutex::new(HashMap::new()),
            slack_recently_delivered: Mutex::new(HashMap::new()),
            slack_load_failed: std::sync::atomic::AtomicBool::new(false),
            slack_user_id_retries: Mutex::new(std::collections::BTreeMap::new()),
            slack_verification_started: std::sync::atomic::AtomicBool::new(false),
            respawn_in_flight: Mutex::new(std::collections::HashSet::new()),
            unwakeable_crons: Mutex::new(std::collections::HashSet::new()),
            cooling_crons: Mutex::new(std::collections::HashMap::new()),
            command_intercept: Mutex::new(None),
            test_extra_projects: Mutex::new(Vec::new()),
            test_user_preferences: Mutex::new(None),
            test_claude_pid: Mutex::new(HashMap::new()),
            test_scan_gate: Mutex::new(None),
        };
        (Arc::new(workspace), update_rx)
    }

    /// Hold the CLI's per-user preferences document, so a cross-crate test
    /// reads an ignore preference without the machine's own
    /// `$HOME/.claude.json`. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_user_preferences(&self, preferences: serde_json::Value) {
        *self.test_user_preferences.lock() = Some(preferences);
    }

    /// Give a fixture seat a live `claude` pid, so its held loop walks a real
    /// process tree with no CLI behind it. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_claude_pid(&self, key: &SessionSlot, pid: u32) {
        self.test_claude_pid.lock().insert(key.clone(), pid);
    }

    /// Hold every stale read at `gate` until the fixture adds permits, so a
    /// test can say what a hold answers while its scans are still in flight.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_scan_gate(&self, gate: Arc<tokio::sync::Semaphore>) {
        *self.test_scan_gate.lock() = Some(gate);
    }

    /// Report the seat's tree moved, as the file watch's own mark does, so a
    /// cross-crate test drives the watch's pass instead of waiting on the OS
    /// daemon's delivery, which has no budget to derive a wait from.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn note_tree_moved_for_test(&self, key: &SessionSlot) {
        self.held_work_seats.mark_tree_moved(key);
    }

    /// The mark a held seat's watch raises at the end of every pass, so a test
    /// waits for a pass rather than for a clock. `None` for a seat held by
    /// nobody. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn watch_pass_done_for_test(&self, key: &SessionSlot) -> Option<Arc<tokio::sync::Notify>> {
        self.held_work_seats.pass_done(key)
    }

    /// Hold the next [`Self::live_seats`] capture between its mint and its
    /// reads: the returned receiver fires once it is held, and a message on
    /// the returned sender releases it. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn pause_next_live_seats_capture(
        &self,
    ) -> (std::sync::mpsc::Receiver<()>, std::sync::mpsc::Sender<()>) {
        let (reached_tx, reached_rx) = std::sync::mpsc::channel();
        let (resume_tx, resume_rx) = std::sync::mpsc::channel();
        *self.live_seats_gate.lock() = Some((reached_tx, resume_rx));
        (reached_rx, resume_tx)
    }

    /// Hold this capture where a test armed [`Self::pause_next_live_seats_capture`].
    /// Test-only: a production capture never meets a gate.
    #[cfg(any(test, feature = "testing"))]
    pub(crate) fn pass_live_seats_gate(&self) {
        let gate = self.live_seats_gate.lock().take();
        if let Some((reached, resume)) = gate {
            let _ = reached.send(());
            let _ = resume.recv();
        }
    }
}

/// Test-mode command interception. Feature-gated and `pub` for the same
/// reason the seeds below are: a view's tests reach for these to
/// assert what boot WOULD have spawned, without starting a subprocess.
#[cfg(any(test, feature = "testing"))]
impl Workspace {
    /// Enable test-mode app-level command interception. After this
    /// call, every `Command` routed through the app-level branch of
    /// `dispatch` is buffered in lieu of running the spawn handler;
    /// drain via `drain_test_dispatch_buffer`. No-op if already
    /// enabled. Test-only - tests use this to assert what would
    /// have been dispatched without spinning up real subprocesses.
    pub fn enable_test_dispatch_intercept(&self) {
        let mut intercept = self.command_intercept.lock();
        if intercept.is_none() {
            *intercept = Some(Vec::new());
        }
    }

    /// Whether the rotation announcer is registered and running, so a test
    /// pins that the boot call actually reaches the one watcher.
    pub fn test_rotation_announcer_started(&self) -> bool {
        self.supervisor.snapshot().iter().any(|member| {
            member.name == "rotation_announcer"
                && matches!(&member.state, forge_supervise::MemberState::Running { .. })
        })
    }

    /// Drain every app-level `Command` captured since the last call.
    /// Returns empty when no intercept was enabled or no commands
    /// were dispatched. Test-only.
    pub fn drain_test_dispatch_buffer(&self) -> Vec<crate::protocol::Command> {
        let mut intercept = self.command_intercept.lock();
        match intercept.as_mut() {
            Some(buffer) => std::mem::take(buffer),
            None => Vec::new(),
        }
    }
}

#[cfg(any(test, feature = "testing"))]
impl Workspace {
    /// Plant a session row in the seat state a boot test derives from, so
    /// the wave can be driven without running a real spawn first. Test-only.
    pub fn seed_seat_state_for_test(
        &self,
        org: &str,
        project: &str,
        label: &str,
        state: crate::store::sessions::SeatState,
    ) -> anyhow::Result<()> {
        let store = self.db.lock();
        let db = store.as_ref().ok_or_else(|| anyhow::anyhow!("the fixture has no store"))?;
        let record = crate::store::sessions::SessionRecord {
            org: org.to_owned(),
            project: project.to_owned(),
            label: label.to_owned(),
            session_id: Some(format!("{label}-id")),
            charter: None,
            kick: None,
            resume_kick: None,
            interactive: None,
            seat_state: Some(state),
            is_git_repo: None,
            mcp_families: None,
            cwd: None,
        };
        crate::store::sessions::put(db, &record)
    }

    /// Park a terminal hand-off on `slot` as a blocked `terminal__hand_off`
    /// call would, so a transport test can type through the hand-off's door.
    /// Test-only.
    pub fn park_terminal_hand_off(
        &self,
        slot: &SessionSlot,
        terminal: u16,
    ) -> Result<String, String> {
        self.register_terminal_hand_off(slot, terminal, "a transport test parks this")
            .map(|(id, _answer)| id.to_string())
    }

    /// Answer a parked terminal hand-off with Done, as the dock's button
    /// would. Test-only.
    pub fn answer_terminal_hand_off(&self, id: &str, slot: &SessionSlot) {
        let Ok(id) = uuid::Uuid::parse_str(id) else { return };
        let _ = self.resolve_terminal_hand_off(
            id,
            slot,
            forge_primitives::terminal::TerminalHandOffAnswer {
                ending: forge_primitives::browser::HandOffEnding::Done,
                source: forge_primitives::browser::HandOffSource::Unstated,
                client: None,
            },
        );
    }

    /// Append a synthetic project to the test overlay searched first
    /// by `find_project_view_by_name`. Used by respawn tests
    /// to drive the Connected-hook worker-spawn trigger without
    /// writing a real `forge.toml`. Test-only.
    pub fn seed_test_project(&self, name: &str, path: &str) {
        self.seed_test_project_inner(name, path, None, None);
    }

    /// Drop a project seeded by [`Self::seed_test_project`], so a test can
    /// exercise the paths that react to a project leaving the config.
    pub fn remove_test_project(&self, name: &str) {
        self.test_extra_projects.lock().retain(|project| project.name != name);
    }

    /// [`Workspace::seed_test_project`] with a Slack binding, so a facade
    /// test can drive the slot-to-workspace resolution. Test-only.
    pub fn seed_test_project_with_slack_workspace(&self, name: &str, path: &str, workspace: &str) {
        self.seed_test_project_inner(name, path, None, Some(workspace));
    }

    /// [`Workspace::seed_test_project`] with the project's
    /// `max_workers` override, so facade tests can
    /// exercise the override arm of the capacity read. Test-only.
    pub fn seed_test_project_with_max_workers(&self, name: &str, path: &str, max_workers: usize) {
        self.seed_test_project_inner(name, path, Some(max_workers), None);
    }

    fn seed_test_project_inner(
        &self,
        name: &str,
        path: &str,
        max_workers: Option<usize>,
        slack_workspace: Option<&str>,
    ) {
        self.test_extra_projects.lock().push(crate::config::LoadedProject {
            name: name.to_owned(),
            path: std::path::PathBuf::from(path),
            display_path: path.to_owned(),
            org: "TestOrg".to_owned(),
            accounts: vec!["acct-a".to_owned()],
            fallback_accounts: Vec::new(),
            model: None,
            env: std::collections::HashMap::new(),
            env_file: None,
            max_workers,
            permission_mode: forge_primitives::permission::PermissionMode::Auto,
            document_roots: Vec::new(),
            handoff: None,
            browser_profile: forge_primitives::browser::ProfileKey::from_parts_for_test(
                "TestOrg", "default",
            ),
            slack_workspace: slack_workspace.map(str::to_owned),
        });
    }

    /// Set the gateway bind error, so a cross-crate test can render
    /// the failed state of the preflight gateway row. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_gateway_bind_error(&self, error: Option<String>) {
        *self.gateway_bind_error.lock() = error;
    }

    /// Set the gateway listener's ready flag, so a cross-crate test
    /// can render each of the preflight gateway row's states. Test-only.
    #[cfg(any(test, feature = "testing"))]
    /// Stand in a stub handle for the next cold spawn, so a test can read
    /// the launch settings the spawn hands its child. Consumed by that
    /// spawn: a test that asserts on one installs one.
    pub fn install_test_spawn_handle(&self, handle: forge_agent::AgentHandle) {
        *self.test_spawn_handle.lock() = Some(handle);
    }

    /// The installed stand-in, taken so one spawn cannot use it twice.
    pub(crate) fn take_test_spawn_handle(&self) -> Option<forge_agent::AgentHandle> {
        self.test_spawn_handle.lock().take()
    }

    /// The `forge` MCP server the last spawn composed, so a test can drive a
    /// tool through the spawn's OWN wiring rather than a copy of it.
    pub fn test_spawn_server(&self) -> Option<forge_sdk::mcp::server::McpServer> {
        self.test_spawn_server.lock().clone()
    }

    pub fn seed_test_gateway_ready(&self, ready: bool) {
        self.gateway_ready.store(ready, std::sync::atomic::Ordering::Release);
    }

    /// Set the Gotify stream's connection flag, so a cross-crate test can
    /// give the two connectors' liveness flags different values. Two
    /// false-valued bools read as agreement, which lets a read wired to
    /// the wrong connector pass unnoticed. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_gotify_connected(&self, connected: bool) {
        *self.gotify_connected.lock() = connected;
    }

    /// Mark `account` Ready, so a cross-crate test can render chip-bearing
    /// rows without driving the real account loader. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_ready_account(&self, account: &str) {
        self.accounts
            .set_loading(&AccountKey(account.to_owned()), forge_gateway::LoadingState::Ready);
    }

    /// Drive `account` to `state` directly, so a cross-crate test can
    /// render a mid-flight or bailed preflight screen without the real
    /// loader. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_account_state(&self, account: &str, state: forge_gateway::LoadingState) {
        self.accounts.set_loading(&AccountKey(account.to_owned()), state);
    }

    /// Record a probe failure on `account`, so a cross-crate test can
    /// render bailed-row copy keyed on why the account bailed. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_account_failure(
        &self,
        account: &str,
        status: forge_gateway::UsageFetchStatus,
    ) {
        self.accounts.set_last_error(&AccountKey(account.to_owned()), status, None);
    }

    /// Replace the dictation preflight snapshot, so a cross-crate test
    /// can render any of its states without fetching 3 GB. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_dictate_snapshot(&self, snapshot: crate::dictate::DictateSnapshot) {
        *self.dictate.snapshot.lock() = snapshot;
    }

    /// Arm dictation with an engine over `models_dir`: its weights are
    /// absent, so a take registers, meters and resolves without a model.
    /// The caller holds the directory for as long as the engine is
    /// wanted. Test-only.
    ///
    /// **The read-aloud set moves here too**, because its own resolution
    /// falls back to the machine's app-support dir whatever config dir a
    /// fixture gave the workspace: a test that kept a recording would write
    /// into the real one and the next run would read it back.
    #[cfg(any(test, feature = "testing"))]
    pub fn install_test_dictate_engine(
        &self,
        models_dir: &std::path::Path,
    ) -> Result<(), forge_dictate::Error> {
        let engine = forge_dictate::Engine::new(
            forge_dictate::ConfigBuilder::new().models_dir(models_dir).normalizer(None).build(),
        )?;
        *self.dictate.engine.lock() = Some(engine);
        *self.test_read_aloud_dir.lock() = Some(models_dir.join("dictate-read-aloud"));
        Ok(())
    }

    /// Mark `key` live the way a started session is - a command sender
    /// with nothing behind it - so a liveness gate reads true without a
    /// CLI. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn mark_test_session_live(&self, key: &SessionSlot) {
        let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
        // Held for the process's length: a dropped receiver reads as a
        // session that has gone, which is the very state this marks the
        // absence of.
        Box::leak(Box::new(receiver));
        self.command_senders.lock().insert(key.clone(), sender);
    }

    /// A `testing_stub` whose `[dictate] enabled` is true, so a
    /// cross-crate test exercises the key handler's enabled path
    /// without a model download. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn testing_stub_with_dictate_enabled() -> (Arc<Self>, mpsc::UnboundedReceiver<SeatUpdate>) {
        let mut config = LoadedConfig::empty_for_test();
        config.dictate.enabled = true;
        Self::testing_stub_with_slack(
            PathBuf::from("/tmp/forge-testing-stub-dictate"),
            config,
            Arc::new(crate::slack::SlackWorkspaces::default()),
            None,
        )
    }

    /// Pool `key` as a live session and bind `account` to it, so a
    /// cross-crate test can render the account panel against a real
    /// binding without spawning a CLI. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_bound_session(&self, key: &SessionSlot, account: &str) {
        let (handle, _rx) = forge_agent::Agent::testing_stub();
        let account = AccountKey(account.to_owned());
        let session_id = "test-bound-session".to_owned();
        self.pool.lock().insert(
            key.clone(),
            PooledAgent {
                handle: Arc::new(handle),
                account: account.clone(),
                permission_mode: None,
                registration: Some(forge_gateway::binding::Registration {
                    org: key.org().to_owned(),
                    project: key.project().to_owned(),
                    session: session_id.clone(),
                    account: account.clone(),
                    provider: forge_primitives::account::Provider::Anthropic,
                }),
                session_id: session_id.clone(),
            },
        );
        self.gateway.bindings.bind(key.org(), key.project(), &session_id, account);
    }

    /// Pool `key` under `session_id`, so a cross-crate test can read the
    /// transcript that id names. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_running_session_id(&self, key: &SessionSlot, session_id: &str) {
        let (handle, _rx) = forge_agent::Agent::testing_stub();
        self.pool.lock().insert(
            key.clone(),
            PooledAgent {
                handle: Arc::new(handle),
                account: AccountKey("TestAccount".to_owned()),
                permission_mode: None,
                registration: None,
                session_id: session_id.to_owned(),
            },
        );
    }

    /// Record `session_id` as the store's row for `key` with nothing live
    /// behind it: the seat a wake resumes, whose transcript is the last
    /// session it ran. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_stored_session_id(&self, key: &SessionSlot, session_id: &str) {
        self.record_session_id(key.org(), key.project(), key.label(), session_id);
    }

    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_usage(&self, account: &str, snapshot: forge_primitives::usage::UsageSnapshot) {
        self.accounts.set_usage(&AccountKey(account.to_owned()), snapshot);
    }

    /// Advertise `commands` and `agents` for `slot`, registering its
    /// domain if it has none, so a cross-crate test can read what the
    /// CLI's init frame would have left behind without driving the wire.
    /// Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_advertised_catalogues(
        &self,
        slot: &SessionSlot,
        commands: Vec<forge_primitives::AvailableCommand>,
        agents: Vec<forge_primitives::AvailableAgent>,
    ) {
        let domain = self
            .domain_session_for(slot)
            .unwrap_or_else(|| self.register_domain_session(slot.clone(), None));
        let mut domain = domain.lock();
        domain.available_commands = commands;
        domain.available_agents = agents;
    }

    /// Park one ask of `kind` on `slot`, so a test can read the state a held
    /// turn produces without driving the wire. A prompt's domain is
    /// registered when it has none; a registry ask parks in its own registry
    /// and needs no domain. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_pending_interaction(&self, slot: &SessionSlot, kind: PendingInteractionKind) {
        self.seed_test_asks(slot, kind, 1);
    }

    /// Let go of everything parked on `slot`, which is half of what
    /// answering does: the other half is the update that says so. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn clear_test_pending(&self, slot: &SessionSlot) {
        if let Some(domain) = self.domain_session_for(slot) {
            domain.lock().pending_interactions = PendingInteractions::default();
        }
    }

    /// Hold `slot` waiting to be let in, the state a session that cannot
    /// authenticate reads as. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_awaiting_login(&self, slot: &SessionSlot) {
        let domain = self
            .domain_session_for(slot)
            .unwrap_or_else(|| self.register_domain_session(slot.clone(), None));
        domain.lock().awaiting_login = true;
    }

    /// Park `count` unanswered asks of `kind` on `slot` under distinct ids,
    /// the way a session holding a queue of them reads. Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_prompt_queue(
        &self,
        slot: &SessionSlot,
        kind: PendingInteractionKind,
        count: usize,
    ) {
        self.seed_test_asks(slot, kind, count);
    }

    /// Park `count` asks of `kind` in the place that kind really lives - the
    /// session's pending set for a prompt, its own registry for everything
    /// else - so the fixture is the state, not a stand-in. A registry ask is
    /// inserted directly: the hand-offs and the draft carry a sender whose
    /// receiver nobody kept, and the settings and vault asks, whose sender is
    /// optional, carry `None`. Each parked ask then takes its number, the way
    /// every production registration does, so a seeded ask reads the identity
    /// the app would give it. It is the parking that makes the seat need a
    /// person, and no test answers a seeded ask through its own oneshot.
    #[cfg(any(test, feature = "testing"))]
    fn seed_test_asks(&self, slot: &SessionSlot, kind: PendingInteractionKind, count: usize) {
        use forge_primitives::browser::HandOffEnding;
        match kind {
            PendingInteractionKind::Question | PendingInteractionKind::Permission => {
                let domain = self
                    .domain_session_for(slot)
                    .unwrap_or_else(|| self.register_domain_session(slot.clone(), None));
                {
                    let mut domain = domain.lock();
                    for index in 0..count {
                        if let Some(prompt) = test_prompt(kind) {
                            domain
                                .pending_interactions
                                .insert(format!("test-tool-{index}"), prompt);
                        }
                    }
                }
                for _ in 0..count {
                    self.note_ask(slot);
                }
            }
            PendingInteractionKind::DocumentHandOff => {
                // The registration parks the ask and takes its number.
                self.note_client_attached();
                for _ in 0..count {
                    let _ = self.register_document_hand_off(slot, TEST_DOCUMENT_PATH, true);
                }
            }
            PendingInteractionKind::SlackDraft => {
                for _ in 0..count {
                    let (sender, _receiver) = tokio::sync::oneshot::channel();
                    let draft = forge_primitives::slack::SlackDraft {
                        id: uuid::Uuid::new_v4(),
                        workspace: "test".to_owned(),
                        conversation: "C-test".to_owned(),
                        conversation_label: "test".to_owned(),
                        thread_ts: None,
                        text: "test".to_owned(),
                        operation: forge_primitives::slack::SlackDraftOperation::Post,
                        thread: None,
                        tagged: Vec::new(),
                    };
                    self.slack_drafts.lock().insert(draft.id, (slot.clone(), draft, sender));
                    self.note_ask(slot);
                }
            }
            PendingInteractionKind::BrowserHandOff => {
                for _ in 0..count {
                    let (sender, _receiver) = tokio::sync::oneshot::channel::<HandOffEnding>();
                    let handoff = forge_primitives::browser::HandOff {
                        id: uuid::Uuid::new_v4(),
                        reason: "test".to_owned(),
                        tab: 1,
                        target: "test-target".to_owned(),
                    };
                    self.browser_handoffs
                        .lock()
                        .insert(handoff.id, (slot.clone(), handoff, sender));
                    self.note_ask(slot);
                }
            }
            PendingInteractionKind::TerminalHandOff => {
                for _ in 0..count {
                    let (sender, _receiver) = tokio::sync::oneshot::channel::<HandOffEnding>();
                    let handoff = forge_primitives::terminal::TerminalHandOff {
                        id: uuid::Uuid::new_v4(),
                        reason: "test".to_owned(),
                        terminal: 1,
                        secret: false,
                    };
                    self.terminal_handoffs
                        .lock()
                        .insert(handoff.id, (slot.clone(), handoff, sender));
                    self.note_ask(slot);
                }
            }
            PendingInteractionKind::SettingsWrite => {
                for _ in 0..count {
                    let ask = forge_primitives::settings::SettingsWriteAsk {
                        id: uuid::Uuid::new_v4(),
                        edits: vec![forge_primitives::settings::SettingsWriteChange {
                            key: "sessions.heal_attempts".to_owned(),
                            current: serde_json::json!(2),
                            proposed: serde_json::json!(4),
                            unset: false,
                        }],
                    };
                    self.settings_writes.lock().insert(ask.id, (slot.clone(), ask, None));
                    self.note_ask(slot);
                }
            }
            PendingInteractionKind::Vault => {
                for _ in 0..count {
                    let draft = forge_primitives::vault::VaultDraft::new(
                        forge_primitives::vault::VaultTool::Search,
                        "test",
                    );
                    self.parked_vault_asks.lock().insert(draft.id, (slot.clone(), draft, None));
                    self.note_ask(slot);
                }
            }
        }
    }

    /// Persist a dynamic-worker row directly, bypassing `agents__spawn`.
    /// Cross-crate test access to the otherwise `pub(crate)` store write
    /// so a view can render launchpad worker rows against a seeded row.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_worker_row(&self, project_key: &ProjectKey, label: &str) {
        let _ = self.record_worker_row(
            project_key,
            label,
            &format!("{label}-test-id"),
            &format!("charter for {label}"),
            None,
            None,
            false,
            // Non-git: the seeded row nests under its project in the
            // launchpad without needing a worktree on disk.
            crate::mcp::workers::types::WorkerTree { is_git_repo: false, cwd: None },
            None,
        );
    }

    /// [`Self::seed_test_worker_row`] with the worker pointed at its own
    /// tree, the way a spawn with `cwd` records it.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_worker_row_at(
        &self,
        project_key: &ProjectKey,
        label: &str,
        cwd: &str,
        is_git_repo: bool,
    ) {
        let _ = self.record_worker_row(
            project_key,
            label,
            &format!("{label}-test-id"),
            &format!("charter for {label}"),
            None,
            None,
            false,
            crate::mcp::workers::types::WorkerTree { is_git_repo, cwd: Some(cwd.to_owned()) },
            None,
        );
    }

    /// [`Self::seed_test_worker_row`] for a worker that was spawned in a
    /// git repo, so its tree is the worktree under the project rather than
    /// the project root. The flag is what [`crate::Workspace::cwd_for_session`]
    /// composes the directory from, so a fixture that seeds the row without
    /// it hands the test the project's own tree.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_git_worker_row(&self, project_key: &ProjectKey, label: &str) {
        let _ = self.record_worker_row(
            project_key,
            label,
            &format!("{label}-test-id"),
            &format!("charter for {label}"),
            None,
            None,
            false,
            crate::mcp::workers::types::WorkerTree { is_git_repo: true, cwd: None },
            None,
        );
    }

    /// Attach a store to the stub. Every other testing constructor leaves
    /// `db` as `None` so nothing touches the real machine store; this one
    /// opens the caller's own redb, for the tests that read persisted rows
    /// (the worker-seat set, the launchpad's labels). Test-only.
    #[cfg(any(test, feature = "testing"))]
    pub fn attach_store_for_test(&self, db: crate::store::Db) {
        *self.db.lock() = Some(db);
    }

    /// Write a session row for `slot` carrying `charter`, bypassing a
    /// spawn. A test that drives `/new` needs the store to already hold
    /// the worker's mission, which is what the re-delivery reads; the
    /// `interactive` flag is what its respawn reads to decide whether the
    /// worker may put a question to its user.
    #[cfg(any(test, feature = "testing"))]
    pub fn seed_test_session_charter(&self, slot: &SessionSlot, charter: &str, interactive: bool) {
        let guard = self.db.lock();
        let Some(db) = guard.as_ref() else { return };
        let _ = crate::store::sessions::put(
            db,
            &crate::store::sessions::SessionRecord {
                org: slot.org().to_owned(),
                project: slot.project().to_owned(),
                label: slot.label().to_owned(),
                session_id: None,
                charter: Some(charter.to_owned()),
                kick: None,
                resume_kick: None,
                interactive: Some(interactive),
                seat_state: None,
                is_git_repo: None,
                mcp_families: None,
                cwd: None,
            },
        );
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use forge_primitives::slack::SlackConfig;

    /// A `[[slack]]` fixture `from_config` refuses: the entry names a
    /// workspace but carries no token.
    fn config_with_a_tokenless_slack_entry() -> LoadedConfig {
        let mut config = LoadedConfig::empty_for_test();
        config.slack = vec![SlackConfig {
            workspace: "acme".to_owned(),
            token: String::new(),
            poll_seconds: 30,
            dm_poll_seconds: 150,
            thread_idle_days: 14,
            stale_after_hours: 24,
        }];
        config
    }

    /// A fixture `from_config` refuses must not come back as a workspace
    /// whose Slack surface is quietly empty: a test written against it
    /// would pass while exercising nothing.
    #[test]
    fn a_tokenless_slack_fixture_does_not_build_a_stub() {
        let dir = tempfile::tempdir().expect("tempdir");
        let error = Workspace::testing_stub_with_config(
            dir.path().to_path_buf(),
            config_with_a_tokenless_slack_entry(),
        )
        .err()
        .expect("a tokenless [[slack]] fixture must fail rather than yield an empty client set");
        assert!(
            error.contains("has an empty token"),
            "the error names the malformed fixture, got: {error}",
        );
    }

    /// The boot leg: a configured `[systemone]` section must reach the
    /// workspace as a client, and an absent one must leave the tools
    /// unregistered.
    #[test]
    fn a_configured_systemone_section_builds_a_client() {
        let dir = tempfile::tempdir().expect("tempdir");
        let mut config = LoadedConfig::empty_for_test();
        config.systemone = Some(forge_system_one::SystemOneConfig {
            base_url: "https://api.typesafe.ai".to_owned(),
            api_key: None,
            model: "jev-latest".to_owned(),
            timeout_ms: 30_000,
        });
        let (workspace, _rx) =
            Workspace::testing_stub_with_config(dir.path().to_path_buf(), config)
                .expect("a valid systemone section builds");
        assert!(
            workspace.systemone.read().is_some(),
            "a configured section must reach the workspace"
        );
    }

    #[test]
    fn an_absent_systemone_section_leaves_no_client() {
        let dir = tempfile::tempdir().expect("tempdir");
        let (workspace, _rx) = Workspace::testing_stub_with_config(
            dir.path().to_path_buf(),
            LoadedConfig::empty_for_test(),
        )
        .expect("an empty config builds");
        assert!(workspace.systemone.read().is_none(), "an absent section must not build a client");
    }
}