// Task 583 — Seed Claude Code's two-stage permission classifier with a
// wildcard allow so claude.ai/code sessions never fall through to the
// Anthropic remote auto-classifier. The classifier routes `Agent`/`Task`
// to `ask`, which surfaces as a permission prompt that an unattended
// operator never clicks — observed as 4-minute dead-air hangs on
// realagent-code.
//
// This module is the single writer for the brand-scoped settings.json
// permissions block. Account-scoped settings.json is written by
// platform/scripts/setup-account.sh in lockstep with the same shape.
import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync } from "node:fs";
import { join, dirname } from "node:path";
export const BYPASS_PERMISSIONS_BLOCK = Object.freeze({
    defaultMode: "bypassPermissions",
    allow: ["*"],
    deny: [],
});
function isAlreadyCorrect(permissions) {
    if (!permissions || typeof permissions !== "object")
        return false;
    const p = permissions;
    if (p.defaultMode !== "bypassPermissions")
        return false;
    if (!Array.isArray(p.allow) || !p.allow.includes("*"))
        return false;
    if (!Array.isArray(p.deny) || p.deny.length !== 0)
        return false;
    return true;
}
export function seedBypassPermissionsSettings(configDir) {
    const settingsPath = join(configDir, "settings.json");
    let existing = {};
    if (existsSync(settingsPath)) {
        const text = readFileSync(settingsPath, "utf-8");
        if (text.trim().length > 0) {
            try {
                const parsed = JSON.parse(text);
                if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
                    existing = parsed;
                }
            }
            catch {
                // Malformed JSON: treat as empty and overwrite with a well-formed
                // file containing only the permissions block. Any keys the prior
                // file carried are unrecoverable from invalid JSON anyway.
            }
        }
    }
    if (isAlreadyCorrect(existing.permissions)) {
        return { action: "noop", path: settingsPath };
    }
    mkdirSync(dirname(settingsPath), { recursive: true });
    const merged = { ...existing, permissions: { ...BYPASS_PERMISSIONS_BLOCK, allow: [...BYPASS_PERMISSIONS_BLOCK.allow], deny: [] } };
    const tmpPath = `${settingsPath}.task583.tmp`;
    writeFileSync(tmpPath, JSON.stringify(merged, null, 2) + "\n");
    renameSync(tmpPath, settingsPath);
    return { action: "seeded", path: settingsPath };
}
export function assertBypassPermissionsSeed(configDir) {
    const settingsPath = join(configDir, "settings.json");
    if (!existsSync(settingsPath))
        return { status: "missing", path: settingsPath };
    let parsed;
    try {
        parsed = JSON.parse(readFileSync(settingsPath, "utf-8"));
    }
    catch {
        return { status: "missing", path: settingsPath };
    }
    if (!parsed || typeof parsed !== "object")
        return { status: "missing", path: settingsPath };
    const permissions = parsed.permissions;
    return isAlreadyCorrect(permissions)
        ? { status: "ok", path: settingsPath }
        : { status: "missing", path: settingsPath };
}
