import fs from 'node:fs/promises';
import path from 'node:path';
import os from 'node:os';
import { nowIso, writeJsonAtomic, writeTextAtomic, ensureDir } from '../fsx.js';
import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
import { agentRolePayloadFor, probeCodexAgentTypeSupport } from './codex-agent-type-probe.js';
const DIRECTIVE_ROLES = [
    'sks-explorer',
    'sks-planner',
    'sks-implementer',
    'sks-checker',
    'sks-release-verifier',
    'sks-zellij-ui-verifier',
    'sks-codex-probe-verifier'
];
export async function syncCodexAgentRoles(input) {
    const root = path.resolve(input.root);
    const env = input.env || process.env;
    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
    const targetDir = path.join(codexHome, 'agents');
    const baseRepair = await repairAgentRoleConfigs({
        root,
        apply: input.apply === true,
        codexHome,
        reportPath: path.join(root, '.sneakoscope', 'reports', 'agent-role-config-repair.json')
    }).catch((err) => ({ ok: false, blockers: [messageOf(err)] }));
    const agentTypeProbe = input.agentTypeSupported === undefined
        ? await probeCodexAgentTypeSupport(root, { env }).catch((err) => ({
            schema: 'sks.codex-agent-type-probe.v1',
            generated_at: nowIso(),
            ok: false,
            supported: false,
            source: 'unknown',
            spawn_tool_name: 'unknown',
            schema_path: null,
            evidence: [],
            blockers: [messageOf(err)],
            warnings: ['agent_type_probe_failed_message_role_fallback']
        }))
        : {
            schema: 'sks.codex-agent-type-probe.v1',
            generated_at: nowIso(),
            ok: true,
            supported: input.agentTypeSupported,
            source: 'fixture',
            spawn_tool_name: input.agentTypeSupported ? 'spawn_agent' : 'unknown',
            schema_path: input.agentTypeSupported ? 'input.agentTypeSupported' : null,
            evidence: [`input.agentTypeSupported=${input.agentTypeSupported}`],
            blockers: [],
            warnings: []
        };
    const rolePayloads = Object.fromEntries(DIRECTIVE_ROLES.map((role) => [role, agentRolePayloadFor(role, agentTypeProbe)]));
    const created = [];
    if (input.apply === true) {
        await ensureDir(targetDir);
        for (const role of DIRECTIVE_ROLES) {
            const file = path.join(targetDir, `${role}.toml`);
            const current = await fs.readFile(file, 'utf8').catch(() => '');
            if (current && !current.includes('SKS managed 3.1.4 directive role') && !current.includes('SKS managed 3.1.5 directive role') && !current.includes('SKS managed 3.1.6 directive role') && !current.includes('SKS managed 3.1.6 bounded role'))
                continue;
            await writeTextAtomic(file, roleToml(role, rolePayloads[role]));
            created.push(file);
        }
    }
    const report = {
        schema: 'sks.codex-agent-role-sync.v1',
        generated_at: nowIso(),
        ok: recordOk(baseRepair) !== false && agentTypeProbe.ok !== false,
        apply: input.apply === true,
        agent_type_supported: agentTypeProbe.supported,
        fallback: agentTypeProbe.supported ? 'agent_type' : 'message-role',
        codex_home: codexHome,
        directive_roles: DIRECTIVE_ROLES,
        role_payloads: rolePayloads,
        agent_type_probe: agentTypeProbe,
        created,
        base_repair: baseRepair,
        blockers: blockersOf(baseRepair)
    };
    await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'codex-agent-role-sync.json'), report).catch(() => undefined);
    return report;
}
function roleToml(role, payload) {
    const strategyLine = payload?.strategy === 'agent_type'
        ? `agent_type = "${payload.agent_type || role}"`
        : `message_role_prefix = "${escapeToml(payload?.message_role_prefix || `Role: ${role}.`)}"`;
    return [
        `name = "${role}"`,
        `description = "SKS managed 3.1.6 directive role: ${role}"`,
        strategyLine,
        'model_reasoning_effort = "medium"',
        role.includes('implementer') ? 'sandbox_mode = "workspace-write"' : 'sandbox_mode = "read-only"',
        'approval_policy = "never"',
        'developer_instructions = """',
        `You are ${role}. SKS managed 3.1.6 directive role with bounded ownership.`,
        'Bounded ownership: use only the assigned owner files/directories and treat memory as guidance, not permission.',
        role.includes('implementer') ? 'Maker/checker separation: implementer may patch only owner scope and cannot self-approve.' : 'Maker/checker separation: checker is read-only and must reject missing gates or missing proof artifacts.',
        role.includes('release') ? 'Release verifier: verify version truth, release DAG coverage, package scripts, packlist, and changelog evidence.' : '',
        role.includes('zellij') ? 'UI/Zellij verifier: inspect readiness status, headless fallback, repair_required, pane proof, and slot telemetry without mutating unrelated UI state.' : '',
        role.includes('codex') ? 'Codex native verifier: inspect hook approval, agent_type, skill sync, plugin inventory, MCP candidates, and invocation plan artifacts.' : '',
        'Side effects: no destructive shell, package publish, global config mutation, database mutation, or external service write unless the sealed route contract explicitly allows it.',
        'Required proof artifacts: cite concrete repo paths, command outputs, and route-local JSON proof before claiming completion.',
        'Final arbiter: parent integration owns final acceptance; this role supplies evidence and cannot override missing gates.',
        `Execution role strategy: ${payload?.strategy || 'message-role'}. Probe: ${payload?.probe_artifact_path || '.sneakoscope/reports/codex-agent-type-probe.json'}.`,
        '"""',
        ''
    ].join('\n');
}
function blockersOf(value) {
    return Boolean(value) && typeof value === 'object' && Array.isArray(value.blockers)
        ? (value.blockers).map((item) => String(item)).filter(Boolean)
        : [];
}
function recordOk(value) {
    return Boolean(value) && typeof value === 'object' && typeof value.ok === 'boolean'
        ? value.ok
        : undefined;
}
function escapeToml(value) {
    return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
}
function messageOf(err) {
    return err instanceof Error ? err.message : String(err);
}
//# sourceMappingURL=codex-agent-role-sync.js.map