"""From either installed checkout, start T3CODE_DEV_SEED=0 vp run dev first.
Run python3 reproduce.py, or python3 reproduce.py --deny-helper.
Set T3_PROOF_MODEL to an available Claude model. Keep graph-fixture.py beside this file. Open the returned thread in the web
app, click Load / reload graph, and Confirm if prompted. Synthetic data only.
"""
import json,os,pathlib,subprocess,sys,tempfile
root=pathlib.Path(__file__).resolve().parent
run=pathlib.Path(tempfile.mkdtemp(prefix='graph-run-',dir=root))
workspace=run/'graph-demo';(workspace/'.claude').mkdir(parents=True)
(workspace/'README.md').write_text('Synthetic graph permission reproduction.\n')
(workspace/'.mcp.json').write_text(json.dumps({'mcpServers':{'graph':{'command':'python3','args':[str(root/'graph-fixture.py')]}}}))
deny=['mcp__buildkite__create_build']
if '--deny-helper' in sys.argv:deny.append('mcp__graph__get_graph_data')
(workspace/'.claude/settings.json').write_text(json.dumps({'permissions':{'deny':deny},'enableAllProjectMcpServers':True}))
subprocess.run(['git','init','-q',str(workspace)],check=True)
cli=['node','apps/server/src/bin.ts']
subprocess.run(cli+['project','add',str(workspace),'--title','MCP graph permissions','--base-dir','.t3'],check=True)
subprocess.run(cli+['thread','start',str(workspace),'Call mcp__graph__show_graph once to display the native graph app. Do not call any other tools. Reply only: Graph ready.','--title','Graph helper denied' if '--deny-helper' in sys.argv else 'Graph permission proof','--provider','claudeAgent','--model',os.environ['T3_PROOF_MODEL'],'--base-dir','.t3','--json'],check=True)