//! Adopting a Claude Code session that already exists on a machine.
//!
//! Claude Code keeps every session as JSONL under
//! `~/.claude/projects/<encoded-cwd>/<session-id>.jsonl`, and the CLI can
//! be told to continue one with `--resume <id>`. This module is the two
//! halves of putting that behind the phone: asking a machine what it has,
//! and turning one of those files into the transcript a phone reads.
//!
//! **Continuing is not this module's job.** `claude.rs` already resumes
//! whenever a session directory holds a resume token, for crash recovery,
//! so an import is that same path with the token written up front. There
//! is deliberately no second way to start a session.
//!
//! **The phone never names a file.** It picks an id out of what this
//! module enumerated, and the path is looked up again on the server -- the
//! same rule the machines model follows for providers, and for the same
//! reason: an enrolled token must not be able to turn into "read me this
//! arbitrary path".

use std::collections::HashMap;

use anyhow::{Context, Result};
use serde::Serialize;
use serde_json::Value;

use super::driver::{self, Event};
use super::transport::{Launch, Transport};

/// How much of a transcript's tail is replayed into the phone's view.
///
/// The imported conversation is for reading; *continuing* it is the CLI's job
/// through `--resume`, and it reads the whole file itself. So this is a
/// display budget, and it needs to be one: these files reach tens of megabytes
/// and every line would otherwise cross a WireGuard link to a phone.
const REPLAY_LINES: usize = 2000;

/// Whether a session is open in a CLI somewhere. Three answers, because
/// "nobody could check" is not "nobody is using it" -- collapsing them puts
/// the dangerous case behind the safe word.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
#[serde(rename_all = "camelCase")]
pub enum InUse {
    /// Checked, and nothing is running it.
    No,
    /// Checked, and a live CLI has it open.
    Yes,
    /// The machine does not keep the record this is read from, so there is no
    /// answer to be had -- not an answer of "no".
    Unknown,
}

/// One Claude Code session found on a machine.
#[derive(Debug, Clone, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct Importable {
    /// The CLI's own session id, which is both the file name and the
    /// `--resume` token.
    pub id: String,
    /// Where that session was working, offered as the imported session's cwd
    /// so it resumes pointing at the same tree.
    pub cwd: String,
    /// The first thing a person said in it, for recognising it in a list.
    pub title: String,
    /// Epoch seconds, for ordering by "what I was last doing".
    pub modified: f64,
    pub lines: usize,
    /// How many tokens the model was holding at the last turn: the input side
    /// of the most recent assistant message's usage, which is the closest thing
    /// to "what continuing this costs" and is a number the CLI recorded rather
    /// than one inferred from the file.
    ///
    /// Size and this disagree in the direction that matters. Most of a big
    /// transcript is usually history from before a compaction, which the model
    /// is no longer given: of the 133 MB session behind the 2026-08-29
    /// incident, 99% of the bytes sat before its last compaction summary.
    ///
    /// `None` when no assistant turn has recorded usage yet -- which is not
    /// zero, and is why this is an option.
    pub context_tokens: Option<u64>,
    /// Size of the file, in bytes. Reported because it predicts what
    /// continuing the session will cost and lines do not: these transcripts
    /// embed screenshots as base64, so one line can be a megabyte. The session
    /// behind the 2026-08-29 incident was 65 MB across 13,000 lines.
    ///
    /// Shown rather than warned about: importing a large session is a choice
    /// somebody is entitled to make.
    pub bytes: u64,
    /// Whether [`title`](Self::title) is a name somebody chose rather than
    /// something read out of the conversation. Worth the reader knowing: a name
    /// is a claim about what a session *is*, and a last message is only the
    /// last thing that happened in it.
    pub named: bool,
    /// Whether a CLI is running this session right now.
    ///
    /// The load-bearing field on this struct. Importing a session already open
    /// puts a second `--resume` on one file: the conversation gets duplicated
    /// into it, both copies read each other's writes as work done elsewhere,
    /// and the adopted one is billed for re-reading everything -- measured on
    /// 2026-08-29 at 65 MB and 154 screenshots.
    pub in_use: InUse,
    /// Where it lives. Not serialized: the phone chooses by id and the server
    /// resolves the path, so a path never crosses the wire either direction.
    #[serde(skip)]
    pub path: String,
}

/// Asks `transport`'s machine which Claude Code sessions it has.
///
/// One command rather than one per file: over ssh each would be its own
/// connection and handshake. `stat -c` is GNU-specific, which is the thing to
/// change first if this ever meets a BSD.
pub async fn list(transport: &Transport) -> Result<Vec<Importable>> {
    // Which sessions are open right now, before the files themselves.
    //
    // Claude Code writes a descriptor per live session at
    // `~/.claude/sessions/<pid>.json`, and records `procStart` -- the kernel's
    // start time for that pid -- for the same reason `session::process` does: a
    // pid on its own is reused, so a descriptor left by a crashed CLI would
    // otherwise mark a session as open for as long as something else held its
    // number. Checking both is what makes this a measurement.
    //
    // The `LIVEKNOWN` line says the directory was there to be read at all.
    // Without it an old CLI that keeps no descriptors would look exactly like a
    // machine with nothing running.
    //
    // Then two questions per file, both answered from the end of it. A rename
    // if there was one, grepped over the whole file rather than its tail
    // because a session can be named early and talked in for hours after. Then
    // the last several things a person said -- the *last*, because the question
    // this answers is "which one was I just in", and several because the final
    // ones are often the CLI's own.
    //
    // Tool results are excluded rather than typed messages included, and the
    // difference matters: a tool result is *also* a user record, so grepping
    // the type alone gave a session that ended mid-tool a tail of empty records.
    // But matching only a string `content` was worse -- a message carrying an
    // attachment stores its text in a list, so that reading lost twenty rows
    // rather than two. Excluding `tool_use_id` keeps both shapes of a real
    // message and drops the one that is not.
    let script = listing_script(r#""$HOME"/.claude/projects/*/*.jsonl"#);
    let launch = Launch::new("sh", vec!["-c".to_string(), script], None);
    parse_listing(&transport.capture(&launch).await?)
}

/// The same listing, for one session named by id.
///
/// Importing needs everything a row holds, and used to get it by listing
/// *every* session and searching the result -- a full read of every transcript
/// on the machine, seconds of it, to answer a question about one file, paid
/// once per import in a batch. Same script, same parsing, one glob narrower.
pub async fn find(transport: &Transport, id: &str) -> Result<Option<Importable>> {
    if !is_session_id(id) {
        return Ok(None);
    }
    let script = listing_script(r#""$HOME"/.claude/projects/*/"$1".jsonl"#);
    let launch = Launch::new(
        "sh",
        vec!["-c".to_string(), script, "sh".to_string(), id.to_string()],
        None,
    );
    Ok(parse_listing(&transport.capture(&launch).await?)?
        .into_iter()
        .find(|candidate| candidate.id == id))
}

/// What the machine is asked, over whichever set of files `glob` names.
///
/// One script with the glob substituted rather than two that drift: a row has
/// to mean the same thing whether it came from a listing or a lookup. The glob
/// is this module's own text; the only thing that crosses from outside is the
/// id, which stays an argument and is checked by [`is_session_id`] first.
fn listing_script(glob: &str) -> String {
    // `replace` rather than `format!`: this is shell, so it is full of braces,
    // and every one would have to be doubled to survive a format string --
    // exactly the kind of edit that looks right and changes what the shell runs.
    SCRIPT.replace("{glob}", glob)
}

const SCRIPT: &str = r#"
if [ -d "$HOME/.claude/sessions" ]; then
  printf 'LIVEKNOWN\n'
  for s in "$HOME"/.claude/sessions/*.json; do
    [ -f "$s" ] || continue
    pid=${s##*/}; pid=${pid%.json}
    [ -d "/proc/$pid" ] || continue
    start=$(awk '{ n=index($0,") "); $0=substr($0,n+2); print $20 }' "/proc/$pid/stat" 2>/dev/null)
    [ -n "$start" ] || continue
    grep -q "\"procStart\":\"$start\"" "$s" || continue
    sid=$(grep -o '"sessionId":"[^"]*"' "$s" | head -1 | cut -d'"' -f4)
    [ -n "$sid" ] && printf 'LIVE\t%s\n' "$sid"
  done
fi
for f in {glob}; do
  [ -f "$f" ] || continue
  printf '%s\t%s\t%s\t%s\t%s\t' "$(stat -c %Y "$f" 2>/dev/null || echo 0)" \
    "$(wc -l < "$f")" "$(stat -c %s "$f" 2>/dev/null || echo 0)" \
    "$(grep -o '"usage":{[^}]*' "$f" 2>/dev/null | tail -1)" "$f"
  grep '"type":"custom-title"' "$f" 2>/dev/null | tail -1 | tr '\n' '\037'
  grep '"type":"user"' "$f" 2>/dev/null | grep -v '"tool_use_id"' | tail -12 | tr '\n' '\037'
  printf '\n'
done
"#;

/// Rows out of what [`listing_script`] printed, with `in_use` filled in.
fn parse_listing(found: &str) -> Result<Vec<Importable>> {
    let mut live = std::collections::HashSet::new();
    let mut checkable = false;
    for line in found.lines() {
        if line.trim() == "LIVEKNOWN" {
            checkable = true;
        } else if let Some(id) = line.strip_prefix("LIVE\t") {
            live.insert(id.trim().to_string());
        }
    }

    let mut sessions: Vec<Importable> = found.lines().filter_map(parse_row).collect();
    for session in &mut sessions {
        session.in_use = match (checkable, live.contains(&session.id)) {
            (_, true) => InUse::Yes,
            (true, false) => InUse::No,
            (false, false) => InUse::Unknown,
        };
    }
    // One row per session id, because the id is what everything downstream
    // addresses: `--resume` takes it, deleting globs for it, the in-flight
    // registry is keyed on it, and the phone keys its list on it -- which
    // turned two rows sharing an id into a crash rather than a confusion.
    //
    // It is a real state of the machine, not corruption: resuming from a
    // different working directory makes the CLI write a second file under that
    // directory's project folder with the same id. One is then usually a stub
    // of a few hundred bytes.
    //
    // So the copy with the most in it wins, and the row's `cwd` comes from that
    // same copy. Ties go to the more recent, and the *stub* is often the more
    // recent, so size has to be the first key rather than the tie-break.
    sessions.sort_by(|a, b| {
        b.lines
            .cmp(&a.lines)
            .then_with(|| b.modified.total_cmp(&a.modified))
    });
    let mut seen = std::collections::HashSet::new();
    sessions.retain(|session| seen.insert(session.id.clone()));

    // Most recent first, and only that. Naming was tried as the first key and
    // is a worse list: it buries what somebody was just doing under everything
    // they ever named. A name still shows, as the row's title and as a word
    // beside it.
    sessions.sort_by(|a, b| b.modified.total_cmp(&a.modified));
    Ok(sessions)
}

/// One line of [`list`]'s output, or nothing if it is not one.
fn parse_row(line: &str) -> Option<Importable> {
    let mut fields = line.splitn(6, '\t');
    let modified: f64 = fields.next()?.trim().parse().ok()?;
    let lines: usize = fields.next()?.trim().parse().ok()?;
    let bytes: u64 = fields.next()?.trim().parse().ok()?;
    let context_tokens = context_tokens(fields.next()?);
    let path = fields.next()?.to_string();
    let id = path.rsplit('/').next()?.strip_suffix(".jsonl")?.to_string();

    let mut named = None;
    let mut said = None;
    let mut cwd = None;
    for record in fields
        .next()
        .unwrap_or("")
        .split('\u{1f}')
        .filter_map(|record| serde_json::from_str::<Value>(record).ok())
    {
        if cwd.is_none() {
            cwd = record.get("cwd").and_then(Value::as_str).map(String::from);
        }
        if let Some(custom) = record.get("customTitle").and_then(Value::as_str) {
            named = Some(custom.to_string());
            continue;
        }
        if !is_hidden(&record)
            && let Some(text) = first_line_of(&record)
        {
            // Kept rather than broken out of: these arrive oldest first, so the
            // last to survive the filter is the most recent thing said.
            said = Some(text);
        }
    }

    Some(Importable {
        id,
        // Filled in by `list`, which is the only thing that knows: it takes one
        // command to ask a machine, and asking per row would be one ssh
        // connection each.
        in_use: InUse::Unknown,
        cwd: cwd.unwrap_or_default(),
        // A name somebody typed outranks anything read out of the conversation,
        // because they chose it to answer this exact question.
        named: named.is_some(),
        title: named
            .or(said)
            .unwrap_or_else(|| "(no messages)".to_string()),
        modified,
        lines,
        bytes,
        context_tokens,
        path,
    })
}

/// The input tokens named in one `usage` object, added up: prompt plus cache
/// creation plus cache read, all three being context the model was given. The
/// definition is [`driver::context_tokens`]; this is the same three figures dug
/// out of a raw line rather than a parsed one, because these files reach tens
/// of megabytes.
///
/// `None` for an empty blob, meaning no assistant turn has recorded usage.
/// Missing fields count as zero, which is what an absent category means.
fn context_tokens(usage: &str) -> Option<u64> {
    if usage.trim().is_empty() {
        return None;
    }
    // The leading quote matters: without it `"input_tokens"` also matches
    // inside `"cache_read_input_tokens"`, and the same number is counted three
    // times.
    let field = |name: &str| -> u64 {
        usage
            .split_once(&format!("\"{name}\":"))
            .map(|(_, rest)| rest.trim_start())
            .and_then(|rest| {
                let digits: String = rest.chars().take_while(char::is_ascii_digit).collect();
                digits.parse().ok()
            })
            .unwrap_or(0)
    };
    Some(driver::context_tokens(
        field("input_tokens"),
        field("cache_creation_input_tokens"),
        field("cache_read_input_tokens"),
    ))
}

/// The first line of what a person typed, short enough for a list row.
///
/// None for the CLI's own plumbing. A slash command, the caveat wrapped around
/// a local command's output, and an injected reminder are all stored as
/// ordinary user records without `isMeta` -- so titling by "first user record"
/// gave a list where most rows read `<command-name>/clear</command-name>`.
fn first_line_of(record: &Value) -> Option<String> {
    let text = text_of(record.get("message")?.get("content")?);
    let first = text.lines().find(|line| !line.trim().is_empty())?.trim();
    if first.starts_with('<') {
        return None;
    }
    let trimmed: String = first.chars().take(90).collect();
    (!trimmed.is_empty()).then_some(trimmed)
}

/// Records the transcript should not show: a subagent's private conversation,
/// and the CLI's own injected notes. The same rule the live translator applies
/// -- a sidechain is another agent talking to itself, and duplicating it would
/// show the reader two conversations interleaved as one.
fn is_hidden(record: &Value) -> bool {
    record.get("isSidechain").and_then(Value::as_bool) == Some(true)
        || record.get("isMeta").and_then(Value::as_bool) == Some(true)
}

fn text_of(content: &Value) -> String {
    match content {
        Value::String(text) => text.clone(),
        Value::Array(blocks) => blocks
            .iter()
            .filter(|block| block.get("type").and_then(Value::as_str) == Some("text"))
            .filter_map(|block| block.get("text").and_then(Value::as_str))
            .collect::<Vec<_>>()
            .join("\n"),
        _ => String::new(),
    }
}

/// Whether a directory the machine recorded is still there.
///
/// A session's recorded cwd can outlive the directory: these files go back
/// months, and a checkout that moved leaves every session from before it
/// pointing at a path that is gone. Resuming into one fails at `cd` before the
/// CLI starts.
pub async fn directory_exists(transport: &Transport, path: &str) -> bool {
    if path.is_empty() {
        return false;
    }
    // Asked by *entering* it rather than by `test -d <path>`, because the
    // question this stands in for is "can a session start here" and because a
    // path is only expanded where it is a working directory -- `~/repos/ai-app`
    // as an argument stays literal on both transports, so the old form answered
    // "no such directory" about every home-relative path somebody typed.
    let launch = Launch::new("true", Vec::new(), Some(std::path::Path::new(path)));
    transport.capture(&launch).await.is_ok()
}

/// Reads the tail of one session's file, as the raw JSONL.
///
/// `tail` rather than the whole file, and as [`Launch`] arguments rather than a
/// shell string, so the path is an argument and never syntax.
///
/// Returns text rather than events because turning records into events has a
/// side effect -- writing out the images they carry -- and that needs the
/// session directory, which does not exist until after this runs.
pub async fn read_tail(transport: &Transport, path: &str) -> Result<String> {
    let launch = Launch::new(
        "tail",
        vec!["-n".to_string(), REPLAY_LINES.to_string(), path.to_string()],
        None,
    );
    transport
        .capture(&launch)
        .await
        .with_context(|| format!("reading {path}"))
}

/// Claude Code's stored JSONL as this project's events.
///
/// A partial first line is expected and ignored: `tail -n` cuts at a line
/// boundary, but the *file* may have been appended to since.
///
/// `session_dir` is where images found along the way are written, the same
/// place and by the same function the live translator uses -- so a screenshot
/// looks identical whether it was watched happening or replayed afterwards.
/// Only the *reference* reaches the phone.
pub fn events_from(text: &str, session_dir: &std::path::Path) -> Vec<Event> {
    let mut events = Vec::new();
    // What the newest record that had an opinion says the session is doing.
    // Kept to the end rather than pushed as it is found, because the answer is
    // the last one and everything before it is history.
    let mut state = None;
    for line in text.lines() {
        let Ok(record) = serde_json::from_str::<Value>(line) else {
            continue;
        };
        if let Some(peer) = peer_message(&record) {
            // Before `is_hidden`, which these records are: the CLI marks them
            // meta because they are not the user's own words, and that is the
            // reason to draw them differently rather than to drop them. A
            // session working on something a phone never asked for is otherwise
            // unexplainable from the phone.
            state = turn_state(&record).or(state);
            events.push(peer);
            continue;
        }
        if is_hidden(&record) {
            continue;
        }
        state = turn_state(&record).or(state);
        let Some(message) = record.get("message") else {
            continue;
        };
        let Some(content) = message.get("content") else {
            continue;
        };
        match record.get("type").and_then(Value::as_str) {
            Some("user") => push_user(&mut events, content, session_dir),
            Some("assistant") => push_assistant(&mut events, content),
            _ => {}
        }
    }
    if let Some(state) = state {
        events.push(Event::Status { state });
    }
    events
}

/// A message from another agent, as the CLI reports one.
///
/// Measured from a real session file (2026-08-29): the record is a `user` one
/// marked `isMeta`, and its `origin` carries `kind: "peer"`, the sending
/// session's `name`, and the message as `body`. The message content beside it
/// is the same text wrapped in a preamble written for the model rather than for
/// a person, so the body is what a reader is shown.
///
/// Shared with the live driver, which finds the same `origin` object on a
/// different record -- so this reads the object and not the record around it.
/// One function because it is one wire format: two copies would drift the first
/// time the CLI renames a field, and the half that drifted would produce
/// nothing at all, which is indistinguishable from nobody having sent
/// anything.
pub(in crate::session) fn peer_message(record: &Value) -> Option<Event> {
    let origin = record.get("origin")?;
    if origin.get("kind").and_then(Value::as_str) != Some("peer") {
        return None;
    }
    Some(Event::PeerMessage {
        from: origin
            .get("name")
            .and_then(Value::as_str)
            .unwrap_or("another session")
            .to_string(),
        text: origin.get("body").and_then(Value::as_str)?.to_string(),
        // The session file has it in the right place already.
        turn_start: None,
    })
}

/// Whether this record means the session is working, as far as the file can
/// say.
///
/// The one thing a session file does not contain is the CLI saying "this turn
/// is over": there is no `result` record. What there is instead is why the last
/// assistant message stopped -- `tool_use` means a call is being made and more
/// is coming, anything else means the model has finished talking. Anything on
/// the user's side means the session has something to answer.
///
/// `None` is the third answer and it matters: a record that says nothing about
/// the turn leaves the status alone rather than voting for idle.
///
/// What this cannot see is a session that stopped existing mid-turn -- its
/// file's last record still says `tool_use`, so it reads as working forever.
/// Nothing in the file distinguishes that from a model thinking, and inventing
/// a timeout would replace a stale reading with a confident wrong one.
fn turn_state(record: &Value) -> Option<super::driver::SessionStatus> {
    use super::driver::SessionStatus;
    match record.get("type").and_then(Value::as_str)? {
        "user" => Some(SessionStatus::Running),
        "assistant" => match record["message"]
            .get("stop_reason")
            .and_then(Value::as_str)?
        {
            "tool_use" => Some(SessionStatus::Running),
            _ => Some(SessionStatus::Idle),
        },
        _ => None,
    }
}

fn push_user(events: &mut Vec<Event>, content: &Value, session_dir: &std::path::Path) {
    // A tool result arrives as a user record, because that is how the API
    // models it -- but it is the other half of a tool call, and showing it as a
    // message would put the reader's own words and a command's output in the
    // same voice.
    if let Value::Array(blocks) = content {
        for block in blocks {
            // A picture the person attached to their own message rather than
            // one a tool produced. Same block shape, one level up.
            push_images(events, std::slice::from_ref(block), session_dir, None);
            if block.get("type").and_then(Value::as_str) == Some("tool_result")
                && let Some(id) = block.get("tool_use_id").and_then(Value::as_str)
            {
                // Before the tool's own row, matching the live translator: a
                // screenshot belongs to the call that took it.
                if let Some(Value::Array(parts)) = block.get("content") {
                    push_images(events, parts, session_dir, Some(id));
                }
                events.push(Event::ToolEnd {
                    id: id.to_string(),
                    output: text_of(block.get("content").unwrap_or(&Value::Null)),
                });
            }
        }
    }
    let text = text_of(content);
    if !text.trim().is_empty() {
        // Replayed from the CLI's own file: it was read long ago, so there is
        // no waiting bubble for it to resolve. Its images are saved and
        // referenced separately just above, because they came out of somebody
        // else's file rather than this app's composer.
        events.push(Event::UserMessage {
            id: None,
            text,
            attachments: Vec::new(),
        });
    }
}

/// Saves every image block in `parts` and references each one. `about` is the
/// call the images came out of, or `None` for one a person attached to their
/// own message -- the same distinction the live translator makes, so replayed
/// history draws a screenshot under the call that took it.
fn push_images(
    events: &mut Vec<Event>,
    parts: &[Value],
    session_dir: &std::path::Path,
    about: Option<&str>,
) {
    for part in parts {
        if part.get("type").and_then(Value::as_str) == Some("image")
            && let Some(name) = super::claude::translate::save_image(session_dir, part)
        {
            events.push(Event::Image {
                image: name,
                about: about.map(String::from),
            });
        }
    }
}

fn push_assistant(events: &mut Vec<Event>, content: &Value) {
    let Value::Array(blocks) = content else {
        return;
    };
    for block in blocks {
        match block.get("type").and_then(Value::as_str) {
            Some("text") => {
                if let Some(text) = block.get("text").and_then(Value::as_str)
                    && !text.is_empty()
                {
                    events.push(Event::AssistantText {
                        delta: text.to_string(),
                    });
                }
            }
            Some("tool_use") => {
                if let (Some(id), Some(name)) = (
                    block.get("id").and_then(Value::as_str),
                    block.get("name").and_then(Value::as_str),
                ) {
                    events.push(Event::ToolStart {
                        id: id.to_string(),
                        tool: name.to_string(),
                        input: block.get("input").cloned().unwrap_or(Value::Null),
                    });
                }
            }
            _ => {}
        }
    }
}

/// Removes each id it is given and prints one `<id>\t<state>` line per id.
///
/// The three states are every way removing one id can end: `deleted` if at
/// least one file went, `missing` if the glob matched nothing, `failed` if an
/// `rm` refused. "Not there" is deliberately kept apart from "it broke" --
/// only one of them is worth retrying.
///
/// Every copy of each id, not the first. The same id can name a file under two
/// project directories, and stopping at the first left the other behind, so the
/// row came back on the next listing after a delete that reported success.
/// `failed` therefore sticks once set.
///
/// Ids arrive as arguments rather than in the script text; `is_session_id` is
/// what keeps one from globbing its way out of the projects directory.
const DELETE_SCRIPT: &str = r#"
for id do
  state=missing
  for f in "$HOME"/.claude/projects/*/"$id".jsonl; do
    [ -f "$f" ] || continue
    if rm -f "$f"; then
      [ "$state" = failed ] || state=deleted
    else
      state=failed
    fi
  done
  printf '%s\t%s\n' "$id" "$state"
done
"#;

/// Deletes sessions [`list`] reported, and says what happened to each.
///
/// By id, resolved on the machine against what it actually has, so the caller
/// never names a file -- the same rule importing follows, and it matters more
/// here: this one removes something.
///
/// Irreversible, and the caller is expected to have said so. Claude Code keeps
/// no copy: the JSONL *is* the session.
///
/// The whole batch in one invocation, which over ssh is the difference between
/// one connection and one per session. Six deletes started in the same tick
/// were six `ssh` processes racing to authenticate, and a batch past the remote
/// sshd's `MaxStartups` had rows come back as `Connection closed by …` -- a row
/// reporting a delete that never ran, for a reason nothing to do with the
/// session.
///
/// Still one outcome per id, because a batch is not a transaction. Every
/// requested id gets an entry, so an id the machine said nothing about is
/// reported as such rather than defaulting to either answer.
pub async fn delete(
    transport: &Transport,
    ids: &[String],
) -> Result<HashMap<String, Result<(), String>>> {
    // Refused here rather than on the machine: `is_session_id` is what keeps an
    // id from walking out of the projects directory. It fails only itself --
    // one malformed id is not a reason to leave the other five in place.
    let (safe, mut outcomes): (Vec<&String>, HashMap<String, Result<(), String>>) =
        ids.iter().fold(
            (Vec::new(), HashMap::new()),
            |(mut safe, mut outcomes), id| {
                if is_session_id(id) {
                    safe.push(id);
                } else {
                    outcomes.insert(
                        id.clone(),
                        Err(format!("not a Claude Code session id: {id}")),
                    );
                }
                (safe, outcomes)
            },
        );
    if safe.is_empty() {
        return Ok(outcomes);
    }

    // The file name *is* the id, so the machine can find it by name. This used
    // to call `list` and search its output, which is correct and costs a full
    // read of every transcript on the machine -- around four seconds against a
    // gigabyte of them, per delete.
    //
    // Every copy of each id, not the first: the same id can name a file under
    // two project directories, and stopping at the first left the other behind.
    //
    // Each id prints its own verdict rather than the loop exiting on the first
    // failure, which would leave every id after it unexplained.
    let mut args = vec![
        "-c".to_string(),
        DELETE_SCRIPT.to_string(),
        "sh".to_string(),
    ];
    args.extend(safe.iter().map(|id| (*id).clone()));
    let launch = Launch::new("sh", args, None);

    // A failure to run the script at all is the machine being unreachable,
    // which is true of every id in the batch rather than of any one of them.
    let reported = transport
        .capture(&launch)
        .await
        .with_context(|| format!("deleting {} Claude Code sessions", safe.len()))?;

    for line in reported.lines() {
        let Some((id, state)) = line.trim().split_once('\t') else {
            continue;
        };
        outcomes.insert(
            id.to_string(),
            match state {
                "deleted" => Ok(()),
                "missing" => Err(format!("no Claude Code session {id} on that machine")),
                _ => Err(format!("couldn't remove Claude Code session {id}")),
            },
        );
    }
    // Anything the machine did not mention. The connection can drop part-way
    // through the loop, and an id whose line never arrived is one nobody knows
    // the fate of -- which is its own answer, and must not read as either a
    // success or a clean "not there".
    for id in safe {
        outcomes.entry(id.clone()).or_insert_with(|| {
            Err(format!(
                "couldn't tell whether Claude Code session {id} was deleted -- the machine \
                 stopped answering part-way through the batch"
            ))
        });
    }
    Ok(outcomes)
}

/// Whether an id is one of ours to put in a shell glob.
///
/// Both places that resolve an id interpolate it into
/// `$HOME/.claude/projects/*/"$1".jsonl`. That is an argument rather than
/// script text, so a shell cannot be talked into running something -- but a `/`
/// or a `..` inside it still walks the glob out of the directory the id is
/// supposed to name, and [`delete`] removes whatever it lands on.
///
/// Claude Code names each transcript with a uuid, so hex and dashes is the
/// whole alphabet. Refused rather than escaped.
fn is_session_id(id: &str) -> bool {
    !id.is_empty() && id.len() <= 64 && id.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-')
}

/// How often an imported session checks whether its source file grew.
///
/// A poll rather than a watch, because the file may be on another machine and
/// there is no portable way to be told. Ten seconds is chosen against the cost
/// of an ssh round trip rather than against how fast a person types.
pub const SYNC_INTERVAL: std::time::Duration = std::time::Duration::from_secs(10);

/// Where an imported session came from, and how much of it has been shown.
/// Kept beside the session rather than in its config, because it is a position
/// in someone else's file rather than anything the person chose, and it changes
/// constantly.
#[derive(Debug, Clone, Serialize, serde::Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct Cursor {
    /// Server-side only, resolved once at import. Nothing accepts a path from
    /// the phone; this is the path *we* found.
    pub path: String,
    /// Lines of that file already accounted for -- whether replayed into
    /// the transcript or skipped because this session wrote them itself.
    pub lines: usize,
}

const CURSOR_FILE: &str = "import.json";

pub fn read_cursor(session_dir: &std::path::Path) -> Option<Cursor> {
    let text = std::fs::read_to_string(session_dir.join(CURSOR_FILE)).ok()?;
    serde_json::from_str(&text).ok()
}

pub fn write_cursor(session_dir: &std::path::Path, cursor: &Cursor) {
    let path = session_dir.join(CURSOR_FILE);
    match serde_json::to_string(cursor) {
        Ok(text) => {
            if let Err(err) = std::fs::write(&path, text) {
                tracing::error!(
                    "couldn't persist the import cursor to {}: {err}",
                    path.display()
                );
            }
        }
        Err(err) => tracing::error!("couldn't serialize the import cursor: {err}"),
    }
}

/// How many lines the source file has now.
pub async fn line_count(transport: &Transport, path: &str) -> Result<usize> {
    let launch = Launch::new("wc", vec!["-l".to_string(), path.to_string()], None);
    let out = transport.capture(&launch).await?;
    out.split_whitespace()
        .next()
        .and_then(|n| n.parse().ok())
        .with_context(|| format!("couldn't read a line count out of {out:?}"))
}

/// What the CLI's own file says a session is holding, for a session this
/// server has no measurement of.
///
/// A restarting server has been told nothing, and a session that has not
/// taken a turn since will not tell it -- so a conversation that is nearly
/// full reads as one nobody has counted until somebody sends a message to
/// it. The CLI records the figure on every assistant message, so it is
/// there to be read rather than waited for, and reading it is a
/// measurement rather than a guess: the same three fields, from the same
/// file, that the import list reports.
///
/// A clear needs no special case here even though it makes the last usage
/// in a file stale. Clearing gives the CLI a *new* session id, which the
/// reader persists as the resume token, so this looks in a file that has
/// no usage in it yet and answers `None` -- which is the true answer.
///
/// `None` for every way it cannot be read: no resume token, no file, a
/// machine that cannot be reached, or a file with no assistant turn in it.
/// Not knowing is a state the status row draws, so there is nothing to be
/// gained by inventing a number here.
pub async fn context_of(transport: &Transport, session_id: &str) -> Option<u64> {
    // The same guard `delete` explains, applied to the other member of the
    // set: this one only reads, but a glob that can leave the directory is
    // worth closing in both places rather than in the dangerous one only.
    if !is_session_id(session_id) {
        return None;
    }
    // The id crosses as an argument rather than as script text: it comes
    // from the CLI, but it reaches a shell on a machine that may not be
    // this one, and the rule there is that data never becomes syntax.
    let script = r#"
for f in "$HOME"/.claude/projects/*/"$1".jsonl; do
  [ -f "$f" ] || continue
  grep -o '"usage":{[^}]*' "$f" | tail -1
  exit 0
done
"#;
    let launch = Launch::new(
        "sh",
        vec![
            "-c".to_string(),
            script.to_string(),
            "sh".to_string(),
            session_id.to_string(),
        ],
        None,
    );
    context_tokens(&transport.capture(&launch).await.ok()?)
}

/// Events from the lines after `after`, which is a 0-based count of lines
/// already accounted for.
pub async fn replay_after(
    transport: &Transport,
    path: &str,
    after: usize,
    session_dir: &std::path::Path,
) -> Result<Vec<Event>> {
    let launch = Launch::new(
        "tail",
        vec![format!("-n+{}", after + 1), path.to_string()],
        None,
    );
    let text = transport
        .capture(&launch)
        .await
        .with_context(|| format!("reading {path} from line {}", after + 1))?;
    Ok(events_from(&text, session_dir))
}

#[cfg(test)]
mod tests {
    use super::*;

    /// One session id, two files, one row.
    ///
    /// Resuming a session from a different working directory makes the CLI
    /// write a second file with the same id under that directory's project
    /// folder, so this is an ordinary state of a machine rather than a
    /// corrupt one. Everything downstream addresses a session by id, and
    /// the phone keys its list on it, so two rows sharing one was a crash.
    ///
    /// The stub is deliberately the *newer* of the two here, because that
    /// is how the real case looked: ordering by recency alone picks the
    /// near-empty copy and describes the session by the wrong cwd.
    #[test]
    fn a_session_recorded_under_two_projects_is_offered_once() {
        let id = "3114dee1-2f95-4de0-9c04-3d6fcc594afe";
        let said = r#"{"cwd":"/home/bob/repos/survey","message":{"role":"user","content":"the real conversation"}}"#;
        let stub = r#"{"cwd":"/home/bob/repos/elsewhere","message":{"role":"user","content":"resumed here once"}}"#;
        let listing = format!(
            "LIVEKNOWN\n\
             1000.0\t412\t160638\t\t/home/bob/.claude/projects/-home-bob-repos-survey/{id}.jsonl\t{said}\n\
             2000.0\t4\t614\t\t/home/bob/.claude/projects/-home-bob-repos-elsewhere/{id}.jsonl\t{stub}\n"
        );

        let rows = parse_listing(&listing).expect("parse");

        assert_eq!(rows.len(), 1, "one id is one row: {rows:#?}");
        assert_eq!(rows[0].lines, 412, "the conversation, not the stub");
        // The cwd has to come from the copy that was kept, because that is
        // the directory `--resume` will find those 412 lines under.
        assert_eq!(rows[0].cwd, "/home/bob/repos/survey");
    }

    /// The guard on the only thing this module ever puts in a glob.
    ///
    /// Worth a test of its own because what it protects is a `rm`: `delete`
    /// resolves an id straight to `$HOME/.claude/projects/*/"$1".jsonl`, so
    /// an id that can contain a slash or a `..` is an id that can name a
    /// file outside the directory and have it removed.
    #[test]
    fn a_session_id_cannot_walk_out_of_the_projects_directory() {
        assert!(is_session_id("5ecf21da-d53f-4a11-9c0d-000000000100"));
        assert!(is_session_id("deadbeef"));

        assert!(!is_session_id("../../../etc/passwd"));
        assert!(!is_session_id("a/b"));
        assert!(!is_session_id(".."));
        assert!(!is_session_id("a.b"));
        assert!(!is_session_id("a*"));
        assert!(!is_session_id("a b"));
        // Empty would glob to the directory itself, and a long one is not a
        // uuid whatever else it is.
        assert!(!is_session_id(""));
        assert!(!is_session_id(&"a".repeat(65)));
    }

    /// One batch, one invocation, one verdict per id -- including for the
    /// two cases a single-id delete never had to keep apart from the rest:
    /// an id recorded under two project directories (both copies must go,
    /// and it still reports once) and an id that is not there at all.
    ///
    /// Runs the real script against a temporary `$HOME`, because what is
    /// being checked is the shell, not the Rust around it.
    #[test]
    fn a_batch_deletes_every_copy_and_reports_each_id_once() {
        let home = tempfile::tempdir().expect("tempdir");
        let projects = home.path().join(".claude/projects");
        let one = "5ecf21da-d53f-4a11-9c0d-000000000100";
        let twice = "5ecf21da-d53f-4a11-9c0d-000000000200";
        let absent = "5ecf21da-d53f-4a11-9c0d-000000000300";
        for (project, id) in [("a", one), ("a", twice), ("b", twice)] {
            let dir = projects.join(project);
            std::fs::create_dir_all(&dir).expect("project dir");
            std::fs::write(dir.join(format!("{id}.jsonl")), "{}\n").expect("transcript");
        }

        let output = std::process::Command::new("sh")
            .args(["-c", DELETE_SCRIPT, "sh", one, twice, absent])
            .env("HOME", home.path())
            .output()
            .expect("run the delete script");
        assert!(output.status.success());

        assert_eq!(
            String::from_utf8_lossy(&output.stdout),
            format!("{one}\tdeleted\n{twice}\tdeleted\n{absent}\tmissing\n"),
        );
        // The second copy is the one a per-id delete used to leave behind.
        assert!(!projects.join("b").join(format!("{twice}.jsonl")).exists());
        assert!(!projects.join("a").join(format!("{twice}.jsonl")).exists());
        assert!(!projects.join("a").join(format!("{one}.jsonl")).exists());
    }

    /// A 1x1 PNG, base64 -- the smallest thing with a real header.
    const PNG: &str = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk\
                       YPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";

    #[test]
    fn replayed_screenshots_are_saved_and_referenced() {
        let dir = tempfile::tempdir().expect("tempdir");
        // The shape a screenshot actually has in these files: an image
        // part inside a tool result, beside its text.
        let line = format!(
            r#"{{"type":"user","message":{{"role":"user","content":[{{"type":"tool_result","tool_use_id":"toolu_1","content":[{{"type":"text","text":"took a screenshot"}},{{"type":"image","source":{{"type":"base64","media_type":"image/png","data":"{PNG}"}}}}]}}]}}}}"#
        );

        let events = events_from(&line, dir.path());
        let Some(Event::Image { image, .. }) = events.first() else {
            panic!("a replayed screenshot must become an image event: {events:?}");
        };
        assert!(image.ends_with(".png"));
        // On disk, where the files route serves it from -- the phone
        // fetches it only when something draws it.
        assert!(dir.path().join("files").join(image).is_file());

        // And it comes before the tool row it belongs to, so it does not
        // read as belonging to whatever happened next.
        assert!(
            matches!(events.get(1), Some(Event::ToolEnd { .. })),
            "{events:?}"
        );
    }

    #[test]
    fn context_tokens_add_the_input_side_only() {
        // The shape the CLI records, as captured from a real transcript.
        let usage = r#""usage":{"input_tokens":2,"cache_creation_input_tokens":703,"cache_read_input_tokens":142228,"output_tokens":587,"output_tokens_details":{"thinking_tokens":0"#;
        // 2 + 703 + 142228. Output is not context to carry forward, so it
        // is not in the total; if it were, this would read 143520.
        assert_eq!(context_tokens(usage), Some(142_933));

        // The leading quote is load-bearing: without it "input_tokens"
        // matches inside both cache field names and the prompt figure gets
        // counted three times.
        let only_cache = r#""usage":{"cache_read_input_tokens":100,"output_tokens":9"#;
        assert_eq!(context_tokens(only_cache), Some(100));

        // No assistant turn yet is not a context of zero.
        assert_eq!(context_tokens(""), None);
        assert_eq!(context_tokens("   "), None);
    }

    #[test]
    fn a_record_with_no_image_writes_nothing() {
        let dir = tempfile::tempdir().expect("tempdir");
        let line = r#"{"type":"user","message":{"role":"user","content":[{"type":"tool_result","tool_use_id":"toolu_1","content":"plain output"}]}}"#;
        let events = events_from(line, dir.path());
        // The result, and the turn state it implies: a tool has answered,
        // so the model is about to be asked again.
        assert_eq!(events.len(), 2, "{events:?}");
        assert_eq!(
            events[1],
            Event::Status {
                state: super::super::driver::SessionStatus::Running
            }
        );
        // No stray directory for a session that never produced one.
        assert!(!dir.path().join("files").exists());
    }

    #[test]
    fn a_message_from_another_agent_is_kept_and_named() {
        // The real shape, from a session file: the CLI marks these meta,
        // and everything a reader needs is in `origin`.
        let dir = tempfile::tempdir().expect("tempdir");
        let line = r#"{"type":"user","isMeta":true,"origin":{"kind":"peer","from":"uds:/run/user/1000/cc-socks/605.sock","verifiedPeerPid":605,"name":"dev-updater-f5","fromMode":"prompting","body":"Pull before you touch AGENTS.md."},"message":{"role":"user","content":"Another Claude session sent a message:\n<cross-session-message from-name=\"dev-updater-f5\">\nPull before you touch AGENTS.md.\n</cross-session-message>"}}"#;
        let events = events_from(line, dir.path());
        assert_eq!(
            events[0],
            Event::PeerMessage {
                from: "dev-updater-f5".to_string(),
                // The body, not the wrapper the model is given.
                text: "Pull before you touch AGENTS.md.".to_string(),
                turn_start: None,
            },
            "{events:?}"
        );
        // And it counts as the session having been given something.
        assert_eq!(
            events[1],
            Event::Status {
                state: super::super::driver::SessionStatus::Running
            }
        );
    }

    #[test]
    fn the_last_record_says_whether_the_session_is_working() {
        use super::super::driver::SessionStatus;
        let dir = tempfile::tempdir().expect("tempdir");
        let asked = r#"{"type":"user","message":{"role":"user","content":"do the thing"}}"#;
        let calling = r#"{"type":"assistant","message":{"role":"assistant","stop_reason":"tool_use","content":[{"type":"tool_use","id":"t1","name":"Bash","input":{}}]}}"#;
        let done = r#"{"type":"assistant","message":{"role":"assistant","stop_reason":"end_turn","content":[{"type":"text","text":"done"}]}}"#;

        let state = |text: &str| {
            events_from(text, dir.path())
                .into_iter()
                .rev()
                .find_map(|event| match event {
                    Event::Status { state } => Some(state),
                    _ => None,
                })
        };
        assert_eq!(state(asked), Some(SessionStatus::Running));
        assert_eq!(
            state(&[asked, calling].join("\n")),
            Some(SessionStatus::Running)
        );
        assert_eq!(
            state(&[asked, calling, done].join("\n")),
            Some(SessionStatus::Idle),
            "a turn that has finished talking is over"
        );

        // A subagent's own messages are not the session's turn, and a
        // record with no stop reason is not an answer -- neither may
        // overrule what the conversation itself last said.
        let sidechain = r#"{"type":"assistant","isSidechain":true,"message":{"role":"assistant","stop_reason":"end_turn","content":[{"type":"text","text":"sub"}]}}"#;
        let unknown = r#"{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"?"}]}}"#;
        assert_eq!(
            state(&[asked, calling, sidechain, unknown].join("\n")),
            Some(SessionStatus::Running)
        );

        // And nothing at all to go on says nothing, rather than idle.
        assert_eq!(state(r#"{"type":"summary","summary":"x"}"#), None);
    }
}