use std::fs;
use std::path::Path;

#[test]
fn mcp_tools_route_through_ops_or_common_contracts() {
    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src/tools");
    let allowlist = ["mod.rs", "common.rs"];

    for entry in fs::read_dir(&dir).expect("tools directory must exist") {
        let entry = entry.expect("valid directory entry");
        let path = entry.path();
        if path.extension().and_then(|e| e.to_str()) != Some("rs") {
            continue;
        }

        let file = path
            .file_name()
            .and_then(|s| s.to_str())
            .unwrap_or_default();
        if allowlist.contains(&file) {
            continue;
        }

        let content = fs::read_to_string(&path).expect("must read tool file");
        for line in content.lines() {
            let trimmed = line.trim();
            if trimmed.starts_with("use envseal::")
                && !trimmed.contains("envseal::ops")
                && !trimmed.contains("envseal::error::Error")
            {
                panic!("tool file {file} bypasses ops boundary: {trimmed}");
            }
        }
    }
}
