import json
from pathlib import Path


def test_config_preserves_builtin_permissions_and_restricts_research() -> None:
    root = Path(__file__).parents[1]
    config = json.loads((root / "opencode" / "opencode.json").read_text())

    assert "permission" not in config
    assert all(name not in config["agent"] for name in ("build", "plan", "general"))
    assert "permission" not in config["agent"]["explore"]
    assert config["agent"]["research"]["permission"] == {
        "*": "deny",
        "websearch": "allow",
        "context7_*": "allow",
        "gh_grep_*": "allow",
    }
    assert config["mcp"]["codegraph"]["command"] == ["codegraph", "serve", "--mcp"]
    assert config["mcp"]["context7"]["url"] == "https://mcp.context7.com/mcp"
    assert config["agent"]["explore"]["model"] == "{env:AGENTCI_EXPLORE_MODEL}"
    assert config["agent"]["explore"]["variant"] == "{env:AGENTCI_EXPLORE_VARIANT}"
    assert config["agent"]["research"]["variant"] == "{env:AGENTCI_RESEARCH_VARIANT}"


def test_compose_removes_codex_sandbox_exceptions() -> None:
    root = Path(__file__).parents[1]
    compose = (root / "compose.yaml").read_text()
    dockerfile = (root / "Dockerfile").read_text()

    for forbidden in ("cap_add", "seccomp=unconfined", "apparmor=unconfined", "bubblewrap"):
        assert forbidden not in compose
    assert "no_cache: true" in compose
    assert "opencode_home:/var/lib/opencode" in compose
    assert "HOME: /etc/opencode/home" in compose
    assert "OPENCODE_DISABLE_EXTERNAL_SKILLS" in compose
    assert "OPENCODE_DISABLE_DEFAULT_PLUGINS" not in compose
    assert 'OPENCODE_ENABLE_EXA: "1"' in compose
    assert "AGENTCI_EXPLORE_VARIANT: ${AGENTCI_EXPLORE_VARIANT:-low}" in compose
    assert "AGENTCI_RESEARCH_VARIANT: ${AGENTCI_RESEARCH_VARIANT:-high}" in compose
    assert compose.count("/run/agentci:mode=1777") == 2
    assert "AGENTCI_OPENCODE_VERSION: ${AGENTCI_OPENCODE_VERSION:-^1}" in compose
    assert "ARG AGENTCI_OPENCODE_VERSION=^1" in dockerfile
    assert '"opencode-ai@${AGENTCI_OPENCODE_VERSION}"' in dockerfile