import json
from pathlib import Path

ROOT = Path(__file__).parents[1]


def test_config_preserves_builtin_permissions_and_restricts_research() -> None:
    config = json.loads((ROOT / "opencode" / "opencode.json").read_text())

    assert "permission" not in config
    assert all(name not in config["agent"] for name in ("build", "plan", "general"))
    assert "permission" not in config["agent"]["explore"]
    assert config["agent"]["research"]["permission"] == {
        "*": "deny",
        "websearch": "allow",
        "context7_*": "allow",
        "gh_grep_*": "allow",
    }


def test_compose_has_no_sandbox_security_exceptions() -> None:
    compose = (ROOT / "compose.yaml").read_text()

    for forbidden in (
        "cap_add:",
        "security_opt:",
        "privileged:",
        "seccomp=unconfined",
        "apparmor=unconfined",
        "bubblewrap",
    ):
        assert forbidden not in compose


def test_container_pins_opencode_major_version_contract() -> None:
    lines = [line.strip() for line in (ROOT / "Dockerfile").read_text().splitlines()]
    build_arguments = {line.removeprefix("ARG ") for line in lines if line.startswith("ARG ")}

    assert "AGENTCI_OPENCODE_VERSION=^1" in build_arguments
    assert any(
        line.rstrip("\\").strip() == '"opencode-ai@${AGENTCI_OPENCODE_VERSION}"' for line in lines
    )