import { mkdirSync, renameSync, writeFileSync } from "node:fs";
import { dirname, join, resolve } from "node:path";

// Only a public loopback endpoint, outside model-writable workspaces. The
// trusted OpenCode process already owns its separate internal-channel token.
export function writeQueryMcpConnection(metadataRoot: string, url: string, executionTimeoutMs = 300_000) {
  const path = resolve(join(dirname(metadataRoot), "mcp-query", "connection.json"));
  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
  const temporary = `${path}.${process.pid}.tmp`;
  writeFileSync(temporary, JSON.stringify({ url, executionTimeoutMs }), { mode: 0o600 });
  renameSync(temporary, path);
  process.env.TJWATER_AGENT_MCP_CONNECTION_PATH = path;
  return path;
}