# BRYNQ SWARM - ZERO-TRUST FILE SYSTEM MCP
# [AUTOGENERATED BY TOOL_SMITH_01 & SECURITY_OFFICER_02]
# Description: Provides Vanguard agents with bounded read/write access to the local repo.

import os
from pathlib import Path

class FileSystemMCP:
    def __init__(self, root_dir: str):
        self.root_dir = Path(root_dir).resolve()

    def _is_safe_path(self, target_path: str) -> bool:
        """Prevents directory traversal attacks (e.g., ../../../Windows)."""
        try:
            target = Path(target_path).resolve()
            # The target MUST be a child of the root_dir or the root_dir itself
            return self.root_dir in target.parents or target == self.root_dir
        except Exception:
            return False

    def read_file(self, file_path: str) -> str:
        """Tool: Read a file safely within the workspace."""
        if not self._is_safe_path(file_path):
            return "[SECURITY_VIOLATION] Agent attempted to read outside the isolated workspace."
        try:
            with open(file_path, 'r', encoding='utf-8') as f:
                return f.read()
        except Exception as e:
            return f"[ERROR] Could not read file: {e}"

    def write_file(self, file_path: str, content: str) -> str:
        """Tool: Write a file safely within the workspace."""
        if not self._is_safe_path(file_path):
            return "[SECURITY_VIOLATION] Agent attempted to write outside the isolated workspace."
        try:
            # Ensure the target directory exists
            os.makedirs(os.path.dirname(file_path), exist_ok=True)
            with open(file_path, 'w', encoding='utf-8') as f:
                f.write(content)
            return "[SUCCESS] File securely written to NVMe."
        except Exception as e:
            return f"[ERROR] Could not write file: {e}"

def get_mcp_manifest():
    return {
        "name": "fs_zerotrust_mcp",
        "version": "1.0.0",
        "tools": ["read_file", "write_file"],
        "clearance_required": "LEVEL_3"
    }