package cli

import (

"context"

"encoding/json"

"errors"

"fmt"

"net/http"

"slices"

"strings"

"time"

"github.com/google/uuid"

"golang.org/x/xerrors"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/websocket"

)

const localChatDiffWatchTimeout = 5 * time.Second

// localChatDiffReadLimit bounds the size of the Changes message the

// client is willing to receive from the chat git watcher. agentgit

// caps each repository's UnifiedDiff at ~3 MiB (maxTotalDiffSize),

// and a Changes payload can aggregate many repos plus metadata, so

// 4 MiB is too tight for realistic multi-repo worktrees. 32 MiB

// covers ~10 maxed-out repos; pathological payloads beyond that still

// fall back to the remote empty diff via errLocalDiffWatchClosed /

// shouldIgnoreLocalDiffFallbackError.

const localChatDiffReadLimit = 32 << 20 // 32 MiB

// errLocalDiffWatchClosed is returned when the chat git watcher

// websocket closes during the Changes read loop with one of the

// known-safe close statuses:

//

// - StatusMessageTooBig: the Changes payload exceeded our local

// 32 MiB client read limit (localChatDiffReadLimit).

// - StatusGoingAway: the coderd watchChatGit proxy tore the

// client stream down. This is the status the proxy always uses

// in coderd/exp_chats.go, so it also covers the upstream 4 MiB

// read limit on agent->coderd messages (see

// workspacesdk/agentconn.go): when that limit is exceeded the

// agent closes with StatusMessageTooBig, but the proxy does not

// propagate that status and the client only ever observes

// StatusGoingAway.

//

// Both cases degrade to the remote empty diff returned by /diff:

// the local watcher is a supplementary enrichment source that

// cannot improve on the remote when its stream is cut short. Other

// close statuses (StatusInternalError, StatusProtocolError, ...)

// and non-close read errors still surface as hard errors so real

// protocol regressions are not hidden behind the fallback.

var errLocalDiffWatchClosed = xerrors.New("chat git watcher connection closed before delivering a Changes message")

func fetchChatDiffContents(

ctx context.Context,

client *codersdk.ExperimentalClient,

chatID uuid.UUID,

) (codersdk.ChatDiffContents, error) {

remoteDiff, err := client.GetChatDiffContents(ctx, chatID)

if err != nil {

return codersdk.ChatDiffContents{}, err

}

if strings.TrimSpace(remoteDiff.Diff) != "" {

return remoteDiff, nil

}

localDiff, localSingleRepo, err := fetchLocalChatDiffContents(ctx, client, chatID)

if err != nil {

if shouldIgnoreLocalDiffFallbackError(err) {

return remoteDiff, nil

}

return codersdk.ChatDiffContents{}, err

}

if strings.TrimSpace(localDiff.Diff) == "" {

return remoteDiff, nil

}

// Backfill metadata from the remote diff only when the local

// watcher produced a single contributing repository. Gate this on

// the explicit single-repo signal from buildLocalChatDiffContents

// rather than on Branch/RemoteOrigin being non-nil, because a

// single contributing repo can legitimately have an empty branch

// (detached HEAD) or no origin remote and we still want remote

// fields like Provider/PullRequestURL to flow through. Multi-repo

// aggregates cannot be described by a single remote's metadata, so

// we leave them alone.

if localSingleRepo {

if localDiff.Provider == nil {

localDiff.Provider = remoteDiff.Provider

}

if localDiff.RemoteOrigin == nil {

localDiff.RemoteOrigin = remoteDiff.RemoteOrigin

}

if localDiff.Branch == nil {

localDiff.Branch = remoteDiff.Branch

}

if localDiff.PullRequestURL == nil {

localDiff.PullRequestURL = remoteDiff.PullRequestURL

}

}

return localDiff, nil

}

// fetchLocalChatDiffContents returns the aggregated local-watcher diff

// and a singleRepo flag that indicates whether that aggregate came from

// exactly one contributing repository. The caller uses singleRepo to

// decide whether it is safe to backfill remote-only metadata onto the

// local diff. All error paths return singleRepo=false.

//

// This intentionally bypasses wsjson.NewStream and reads the websocket

// directly so we can inspect the close status: an oversized Changes

// payload must degrade to the remote empty diff via

// errLocalDiffWatchClosed + shouldIgnoreLocalDiffFallbackError,

// but wsjson.Decoder swallows the read error (logs at debug) and

// closes the channel, which would collapse that specific case into

// the same generic "connection closed" bucket as server crashes or

// decode failures. Reading directly lets us narrowly fall back only

// for read-limit violations while still surfacing real protocol

// regressions.

func fetchLocalChatDiffContents(

parentCtx context.Context,

client *codersdk.ExperimentalClient,

chatID uuid.UUID,

) (codersdk.ChatDiffContents, bool, error) {

ctx, cancel := context.WithTimeout(parentCtx, localChatDiffWatchTimeout)

defer cancel()

conn, err := dialChatGit(ctx, client, chatID)

if err != nil {

return codersdk.ChatDiffContents{}, false, err

}

defer func() {

_ = conn.Close(websocket.StatusNormalClosure, "")

}()

conn.SetReadLimit(localChatDiffReadLimit)

refreshPayload, err := json.Marshal(codersdk.WorkspaceAgentGitClientMessage{

Type: codersdk.WorkspaceAgentGitClientMessageTypeRefresh,

})

if err != nil {

return codersdk.ChatDiffContents{}, false, xerrors.Errorf("marshal git refresh: %w", err)

}

if err := conn.Write(ctx, websocket.MessageText, refreshPayload); err != nil {

return codersdk.ChatDiffContents{}, false, xerrors.Errorf("request git refresh: %w", err)

}

for {

msgType, payload, err := conn.Read(ctx)

if err != nil {

// Context expiration gets its own wrapping so it threads

// cleanly through shouldIgnoreLocalDiffFallbackError's

// context.DeadlineExceeded case.

if ctxErr := ctx.Err(); ctxErr != nil {

return codersdk.ChatDiffContents{}, false, xerrors.Errorf("watch chat git: %w", ctxErr)

}

// A Changes payload that exceeds localChatDiffReadLimit

// causes coder/websocket to close the connection with

// StatusMessageTooBig. The coderd watchChatGit proxy

// also always closes the client with StatusGoingAway

// (see coderd/exp_chats.go), which is how we observe

// the upstream 4 MiB agent->coderd read-limit breach:

// the agent closes its own hop with StatusMessageTooBig,

// but the proxy does not propagate that status, so the

// client only ever sees StatusGoingAway. Map both onto

// the narrow sentinel so shouldIgnoreLocalDiffFallbackError

// can degrade to the remote empty diff instead of

// surfacing a hard error. Every other close status

// (StatusInternalError, StatusProtocolError, ...) and

// every non-close read error still propagates so real

// protocol regressions reach the user.

switch websocket.CloseStatus(err) {

case websocket.StatusMessageTooBig, websocket.StatusGoingAway:

return codersdk.ChatDiffContents{}, false, errLocalDiffWatchClosed

}

return codersdk.ChatDiffContents{}, false, xerrors.Errorf("read git watch: %w", err)

}

// Ignore unexpected frame types instead of erroring; the

// watcher only emits text frames today and a future binary

// heartbeat should not break the overlay.

if msgType != websocket.MessageText {

continue

}

var msg codersdk.WorkspaceAgentGitServerMessage

if err := json.Unmarshal(payload, &msg); err != nil {

return codersdk.ChatDiffContents{}, false, xerrors.Errorf("decode git watch message: %w", err)

}

switch msg.Type {

case codersdk.WorkspaceAgentGitServerMessageTypeError:

message := strings.TrimSpace(msg.Message)

if message == "" {

message = "git watch returned an unknown error"

}

return codersdk.ChatDiffContents{}, false, xerrors.New(message)

case codersdk.WorkspaceAgentGitServerMessageTypeChanges:

diff, singleRepo := buildLocalChatDiffContents(chatID, msg.Repositories)

return diff, singleRepo, nil

}

}

}

// dialChatGit opens the chat git-watcher WebSocket. We dial the socket

// manually instead of using codersdk.Client.Dial because that helper

// closes the HTTP response body before surfacing the error, which

// prevents codersdk.ReadBodyAsError from extracting the status code and

// message that shouldIgnoreLocalDiffFallbackError needs to decide

// whether to degrade to the empty remote diff. Keep this handrolled

// path as long as the shared helper has that limitation.

func dialChatGit(

ctx context.Context,

client *codersdk.ExperimentalClient,

chatID uuid.UUID,

) (*websocket.Conn, error) {

requestURL, err := client.URL.Parse(

fmt.Sprintf("/api/experimental/chats/%s/stream/git", chatID),

)

if err != nil {

return nil, err

}

dialOptions := &websocket.DialOptions{

HTTPClient: client.HTTPClient,

CompressionMode: websocket.CompressionDisabled,

}

client.SessionTokenProvider.SetDialOption(dialOptions)

conn, resp, err := websocket.Dial(ctx, requestURL.String(), dialOptions)

if resp != nil && resp.Body != nil {

defer resp.Body.Close()

}

if err != nil {

if resp != nil {

return nil, codersdk.ReadBodyAsError(resp)

}

return nil, err

}

return conn, nil

}

// buildLocalChatDiffContents aggregates the local watcher's

// per-repository changes into a single ChatDiffContents. The returned

// singleRepo flag is true iff the aggregated diff came from exactly

// one contributing repository (one repo with a non-empty UnifiedDiff

// that has not been removed). Callers use this flag to decide whether

// it is safe to backfill remote-only metadata onto the local diff:

// multi-repo aggregates cannot be described by a single remote's

// branch/origin/PR URL, but a single-repo aggregate can even when the

// contributing repo has an empty branch (detached HEAD) or no origin

// remote configured.

func buildLocalChatDiffContents(

chatID uuid.UUID,

repositories []codersdk.WorkspaceAgentRepoChanges,

) (codersdk.ChatDiffContents, bool) {

result := codersdk.ChatDiffContents{ChatID: chatID}

if len(repositories) == 0 {

return result, false

}

repositories = slices.Clone(repositories)

slices.SortFunc(repositories, func(a, b codersdk.WorkspaceAgentRepoChanges) int {

return strings.Compare(a.RepoRoot, b.RepoRoot)

})

diffSegments := make([]string, 0, len(repositories))

diffRepositories := make([]codersdk.WorkspaceAgentRepoChanges, 0, len(repositories))

for _, repo := range repositories {

if repo.Removed || strings.TrimSpace(repo.UnifiedDiff) == "" {

continue

}

diffRepositories = append(diffRepositories, repo)

diffSegments = append(diffSegments, strings.TrimRight(repo.UnifiedDiff, "\n"))

}

if len(diffSegments) == 0 {

return result, false

}

result.Diff = strings.Join(diffSegments, "\n")

singleRepo := len(diffRepositories) == 1

if singleRepo {

if branch := strings.TrimSpace(diffRepositories[0].Branch); branch != "" {

result.Branch = &branch

}

if origin := strings.TrimSpace(diffRepositories[0].RemoteOrigin); origin != "" {

result.RemoteOrigin = &origin

}

}

return result, singleRepo

}

func shouldIgnoreLocalDiffFallbackError(err error) bool {

if errors.Is(err, context.DeadlineExceeded) {

return true

}

// A watcher stream closed with StatusMessageTooBig or

// StatusGoingAway is a best-effort degradation point: the

// remote /diff endpoint already returns the empty placeholder

// in this case, so fall back to it instead of surfacing a hard

// error. See errLocalDiffWatchClosed for the rationale on why

// those two close statuses are safe while others still surface.

if errors.Is(err, errLocalDiffWatchClosed) {

return true

}

sdkErr, ok := codersdk.AsError(err)

if !ok {

return false

}

switch sdkErr.StatusCode() {

case http.StatusNotFound:

return true

case http.StatusForbidden:

// authorizeChatWorkspaceExec returns 403 when the chat owner's

// workspace permissions have been revoked. The remote diff

// endpoint (getChatDiffContents) does not re-check workspace

// permissions, so degrade to its empty response the same way

// we do for the 400 variants below.

return true

case http.StatusBadRequest:

// These correspond to the 400 responses from watchChatGit in

// coderd/exp_chats.go when the chat cannot be observed through

// a workspace agent (no workspace bound, workspace deleted, no

// agents, or an agent that is not yet connected). Each should

// fall back to the empty remote diff the same way a missing

// chat (404) does instead of surfacing a hard error.

// codersdk.IsChatGitWatchFallbackMessage keeps this list

// mechanically linked to the server-side messages.

return codersdk.IsChatGitWatchFallbackMessage(sdkErr.Message)

default:

return false

}

}