配置系统

// utils/settings/settings.ts — 简化版
export function getInitialSettings(cliFlags?: Partial<SettingsJson>): SettingsJson {
  // 第 7 层：全局默认值
  const globalDefaults = loadJsonSafe<SettingsJson>(
    path.join(os.homedir(), '.claude.json'),
    SettingsJsonSchema
  )

  // 第 6 层：用户级配置
  const userSettings = loadJsonSafe<SettingsJson>(
    path.join(os.homedir(), '.claude', 'settings.json'),
    SettingsJsonSchema
  )

  // 第 5 层：项目级配置
  const projectSettings = loadJsonSafe<SettingsJson>(
    path.join(findProjectRoot(), '.claude', 'settings.json'),
    SettingsJsonSchema
  )

  // 第 4 层：Flag file
  const flagFileSettings = loadFlagFileSettings()

  // 第 3 层：远程托管配置
  const remoteSettings = getRemoteManagedSettings()

  // 第 2 层：MDM 企业策略
  const mdmPolicy = getMdmSettings()

  // 深度合并，高优先级覆盖低优先级
  let merged = deepMerge(
    globalDefaults,
    userSettings,
    projectSettings,
    flagFileSettings,
    remoteSettings
  )

  // MDM 策略的强制字段不可覆盖
  merged = applyMdmEnforcement(merged, mdmPolicy)

  // 第 1 层：CLI 标志（最高优先级）
  if (cliFlags) {
    merged = deepMerge(merged, cliFlags)
  }

  return merged
}

// mdm.ts — macOS 通过 plutil 读取托管首选项
let mdmRawReadPromise: Promise<string> | null = null

export function startMdmRawRead(): void {
  if (process.platform === 'darwin') {
    // 异步启动 plutil 子进程（与模块导入并行）
    mdmRawReadPromise = execAsync(
      'plutil -extract . json -o - ' +
      '/Library/Managed\ Preferences/com.anthropic.claude-code.plist'
    ).then(({ stdout }) => stdout)
     .catch(() => '{}')  // 无 MDM 策略时返回空对象
  } else if (process.platform === 'win32') {
    // Windows 通过注册表读取
    mdmRawReadPromise = execAsync(
      'reg query "HKLM\\SOFTWARE\\Policies\\Anthropic\\ClaudeCode" /s'
    ).then(({ stdout }) => parseRegistryOutput(stdout))
     .catch(() => '{}')
  }
}

export async function getMdmSettings(): Promise<Partial<SettingsJson>> {
  if (!mdmRawReadPromise) return {}
  const raw = await mdmRawReadPromise
  const parsed = JSON.parse(raw)
  // 通过 Zod 验证 MDM 策略格式
  return MdmPolicySchema.safeParse(parsed).data ?? {}
}

// schemas/settingsSchema.ts
import { z } from 'zod/v4'

const McpServerSchema = z.object({
  command: z.string(),
  args: z.array(z.string()).optional(),
  env: z.record(z.string()).optional(),
  type: z.enum(['stdio', 'sse']).default('stdio'),
})

export const SettingsJsonSchema = z.object({
  // 权限控制
  permissions: z.object({
    allow: z.array(z.string()).default([]),
    deny: z.array(z.string()).default([]),
  }).optional(),

  // 工具白名单 / 黑名单
  allowedTools: z.array(z.string()).optional(),
  denyTools: z.array(z.string()).optional(),

  // MCP 服务器配置
  mcpServers: z.record(McpServerSchema).optional(),

  // 生命周期钩子
  hooks: z.record(z.object({
    command: z.string(),
    timeout: z.number().default(30000),
  })).optional(),

  // 模型设置
  model: z.string().optional(),
  maxThinkingTokens: z.number().optional(),

  // 自定义 API 密钥
  customApiKeyResponses: z.record(z.string()).optional(),
}).passthrough()  // 允许未知字段，向前兼容

export type SettingsJson = z.infer<typeof SettingsJsonSchema>

// 安全加载配置文件
function loadJsonSafe<T>(filePath: string, schema: z.ZodType<T>): T {
  try {
    const raw = fs.readFileSync(filePath, 'utf-8')
    const parsed = JSON.parse(raw)
    const result = schema.safeParse(parsed)
    if (result.success) return result.data
    // 验证失败：记录警告并返回默认值
    logWarning('Config validation failed:', result.error.issues)
    return schema.parse({})  // 返回默认值
  } catch {
    return schema.parse({})  // 文件不存在或格式错误
  }
}