/**
 * Git clone and update operations
 *
 * WHY clone/fetch via spawn with stdio inherit: simple-git's clone()/fetch() often don't
 * surface progress (e.g. "Receiving objects: 45%"); the same outputHandler was applied to
 * every subsequent git call (diff, status, etc.) so users saw diffs instead of clone progress.
 * We run only clone and the main fetch via spawn so the user sees those; the returned git
 * instance has no outputHandler so the rest of the run (diffs, status, commit) stays quiet.
 */
import { simpleGit, type SimpleGit } from 'simple-git';
import { spawn } from 'child_process';
import { existsSync, readdirSync, readFileSync, statSync } from 'fs';
import { join, dirname } from 'path';
import { debug } from '../logger.js';
import { DEFAULT_CLONE_TIMEOUT_MS } from '../constants.js';
import { cleanupGitState } from './git-merge.js';

/** Normalize clone URL for comparison: strip credentials and trailing .git so same repo matches. */
function normalizeCloneUrl(url: string): string {
  let u = url.trim();
  // Strip token: https://token@host/path -> https://host/path
  u = u.replace(/^(https?:\/\/)[^@]+@/, '$1');
  if (u.endsWith('.git')) u = u.slice(0, -4);
  return u.toLowerCase();
}

/** Read origin URL from workdir's .git/config (no spawn). Returns null if unreadable or no origin. */
function getOriginFromWorkdir(workdirPath: string): string | null {
  const configPath = join(workdirPath, '.git', 'config');
  if (!existsSync(configPath)) return null;
  try {
    const content = readFileSync(configPath, 'utf8');
    const match = content.match(/\[remote\s+"origin"\][\s\S]*?url\s*=\s*(.+?)(?:\r?\n|$)/im);
    if (!match) return null;
    return match[1].trim();
  } catch {
    return null;
  }
}

/** Mtime of .git/FETCH_HEAD or .git for "most recently fetched" ordering. */
function getFetchHeadMtime(workdirPath: string): number {
  const fetchHead = join(workdirPath, '.git', 'FETCH_HEAD');
  if (existsSync(fetchHead)) return statSync(fetchHead).mtimeMs;
  const gitDir = join(workdirPath, '.git');
  return existsSync(gitDir) ? statSync(gitDir).mtimeMs : 0;
}

/**
 * Find another workdir for the same repo to use as git clone --reference (bootstrap from local copy).
 * WHY: Git is distributed; reusing an existing clone only fetches missing objects and is much faster.
 * Scans sibling dirs of workdir (e.g. ~/.prr/work/*), picks one with same origin and latest fetch.
 */
function findReferenceWorkdir(workdir: string, cloneUrl: string): string | null {
  const baseDir = dirname(workdir);
  const wantNorm = normalizeCloneUrl(cloneUrl);
  const candidates: { path: string; mtime: number }[] = [];
  try {
    const names = readdirSync(baseDir, { withFileTypes: true });
    for (const ent of names) {
      if (!ent.isDirectory()) continue;
      const candidatePath = join(baseDir, ent.name);
      if (candidatePath === workdir) continue;
      const gitDir = join(candidatePath, '.git');
      if (!existsSync(gitDir)) continue;
      const origin = getOriginFromWorkdir(candidatePath);
      if (origin == null) continue;
      if (normalizeCloneUrl(origin) !== wantNorm) continue;
      const mtime = getFetchHeadMtime(candidatePath);
      candidates.push({ path: candidatePath, mtime });
    }
  } catch {
    return null;
  }
  if (candidates.length === 0) return null;
  candidates.sort((a, b) => b.mtime - a.mtime);
  return candidates[0].path;
}

/**
 * Ensure refs/remotes/origin/<b> exist for each additional branch after fetch.
 * WHY: --single-branch clones omit base from default fetch; a missing origin/base makes
 * merge-base checks lie ("already up-to-date") while the PR is dirty (AGENTS.md).
 */
async function assertAdditionalBranchTrackingRefs(
  git: SimpleGit,
  primaryBranch: string,
  additionalBranches: string[] | undefined
): Promise<void> {
  if (!additionalBranches?.length) return;
  const missing: string[] = [];
  for (const b of additionalBranches) {
    if (!b || b === primaryBranch) continue;
    try {
      await git.raw(['rev-parse', '--verify', `refs/remotes/origin/${b}`]);
    } catch {
      missing.push(b);
    }
  }
  if (missing.length === 0) return;
  const list = missing.map((b) => `origin/${b}`).join(', ');
  throw new Error(
    `Missing remote tracking ref(s) after fetch: ${list}. ` +
      `Those branches may not exist on the remote, or fetching them failed. ` +
      `PRR needs these refs for base-branch merge checks. Fix the branch name or ensure it exists on origin, then re-run.`,
  );
}

/**
 * Replace all `remote.origin.fetch` entries with clean refspecs for the requested branches.
 * WHY direct config edit: `git remote set-branches` validates existing entries before replacing;
 * if any stale refspec is invalid (e.g. branch name with `:` from old split-exec runs), the command
 * itself fails. We remove all entries first via `--unset-all`, then add only the ones we need.
 */
async function syncOriginFetchBranches(
  git: SimpleGit,
  primaryBranch: string,
  additionalBranches: string[] | undefined
): Promise<void> {
  // Remove all existing fetch refspecs (tolerate "key does not exist" on fresh clones).
  try {
    await git.raw(['config', '--unset-all', 'remote.origin.fetch']);
  } catch {
    // Key may not exist — that's fine.
  }

  // Build the set of branches we actually need.
  const names = new Set<string>();
  const p = primaryBranch?.trim();
  if (p) names.add(p);
  for (const b of additionalBranches ?? []) {
    const t = typeof b === 'string' ? b.trim() : '';
    if (t) names.add(t);
  }

  // Add one refspec per branch.
  for (const name of names) {
    await git.raw(['config', '--add', 'remote.origin.fetch', `+refs/heads/${name}:refs/remotes/origin/${name}`]);
  }
  debug('syncOriginFetchBranches', { branches: [...names] });
}

/** Fetch extra branches (explicit refspec) so origin/<b> exists under --single-branch. */
async function fetchAdditionalBranches(git: SimpleGit, primaryBranch: string, additionalBranches: string[] | undefined): Promise<void> {
  await syncOriginFetchBranches(git, primaryBranch, additionalBranches);
  if (!additionalBranches?.length) return;
  for (const b of additionalBranches) {
    if (b && b !== primaryBranch) {
      try {
        debug('Fetching additional branch', { branch: b });
        await git.fetch(['origin', `+refs/heads/${b}:refs/remotes/origin/${b}`]);
      } catch (err) {
        const msg = err instanceof Error ? err.message : String(err);
        debug(`Failed to fetch origin/${b}`, { err: msg });
        const isBranchMissing = /couldn't find|does not exist|not found|invalid refspec/i.test(msg);
        if (isBranchMissing) {
          console.warn(`  ⚠ Branch ${b} does not exist on remote; ref origin/${b} will be missing.`);
        } else {
          console.warn(`  ⚠ Failed to fetch origin/${b}: ${msg.slice(0, 80)}${msg.length > 80 ? '…' : ''}`);
        }
      }
    }
  }
}

/** Clone timeout in ms. Override with PRR_CLONE_TIMEOUT_MS (default 900s). */
function getCloneTimeoutMs(): number {
  const raw = process.env.PRR_CLONE_TIMEOUT_MS;
  if (raw === undefined || raw === '') return DEFAULT_CLONE_TIMEOUT_MS;
  const n = parseInt(raw, 10);
  return Number.isFinite(n) && n >= 5000 ? n : DEFAULT_CLONE_TIMEOUT_MS;
}

/** Optional shallow clone: set PRR_CLONE_DEPTH to a positive integer (e.g. 1) for faster large-repo clones; full history otherwise. */
function getCloneDepthArg(): string[] {
  const raw = process.env.PRR_CLONE_DEPTH?.trim();
  if (raw === undefined || raw === '') return [];
  const n = parseInt(raw, 10);
  if (!Number.isFinite(n) || n < 1) return [];
  return ['--depth', String(n)];
}

export interface GitOperations {
  git: SimpleGit;
  workdir: string;
}


export interface CloneOptions {
  preserveChanges?: boolean;  // If true, don't reset - keep existing uncommitted changes
  /** Fetch these branches after clone/update so refs exist (e.g. split-exec needs origin/targetBranch). */
  additionalBranches?: string[];
  /**
   * When true (default), require every `additionalBranches` entry (except the primary clone branch)
   * to exist as `refs/remotes/origin/<name>` after fetch — fail fast if missing.
   * WHY: PRR base-branch merge needs real refs. split-exec lists new split branches that may not
   * exist on the remote yet; pass `verifyAdditionalRemoteRefs: false` there.
   */
  verifyAdditionalRemoteRefs?: boolean;
}

export async function cloneOrUpdate(
  cloneUrl: string,
  branch: string,
  workdir: string,
  githubToken?: string,
  options?: CloneOptions
): Promise<GitOperations> {
  // Inject token into clone URL for authentication
  let authUrl = cloneUrl;
  if (githubToken && cloneUrl.startsWith('https://')) {
    authUrl = cloneUrl.replace('https://', `https://${githubToken}@`);
  }

  const gitDir = join(workdir, '.git');
  let isExistingRepo = existsSync(gitDir);

  let git: SimpleGit | undefined;

  if (isExistingRepo) {
    git = simpleGit(workdir);
    let repoUsable = false;
    try {
      await git.raw(['rev-parse', 'HEAD']);
      repoUsable = true;
    } catch {
      debug('Workdir has .git but no valid HEAD (broken or incomplete clone), will clone fresh');
    }
    if (!repoUsable) {
      const { rm } = await import('fs/promises');
      await rm(workdir, { recursive: true, force: true });
      isExistingRepo = false;
      console.log('  Workdir incomplete or broken, cloning fresh...');
    }
  }

  if (isExistingRepo) {
    // Sanitize remote.origin.fetch FIRST — stale invalid refspecs (e.g. branch names with `:` from old
    // split-exec `set-branches --add` runs) make ANY `git remote` subcommand fail, including `set-url`.
    await syncOriginFetchBranches(git!, branch, options?.additionalBranches);

    // Set remote to auth URL when we have a token so fetch/pull/push do not prompt
    if (githubToken && cloneUrl.startsWith('https://')) {
      await git!.raw(['remote', 'set-url', 'origin', authUrl]);
      debug('Set origin remote URL with token so fetch/pull/push do not prompt', {
        tokenLength: githubToken.length,
      });
    } else if (!githubToken) {
      debug('No GitHub token provided - fetch/push may prompt for credentials');
    }

    if (options?.preserveChanges) {
      // Preserve existing changes - just make sure we're on the right branch
      console.log(`Existing workdir found at ${workdir}, preserving local changes...`);
      
      // Abort any stuck rebase/merge/cherry-pick from a previous failed run.
      // Without this, a prior crash mid-rebase leaves the workdir in an
      // unusable state and every subsequent run fails at the same point.
      const rebaseMerge = join(workdir, '.git', 'rebase-merge');
      const rebaseApply = join(workdir, '.git', 'rebase-apply');
      const mergeHead = join(workdir, '.git', 'MERGE_HEAD');
      const cherryPickHead = join(workdir, '.git', 'CHERRY_PICK_HEAD');
      if (existsSync(rebaseMerge) || existsSync(rebaseApply) || existsSync(mergeHead) || existsSync(cherryPickHead)) {
        console.log('  ⚠ Detected stuck rebase/merge from previous run, aborting...');
        try { await git!.rebase(['--abort']); } catch { /* no rebase */ }
        try { await git!.merge(['--abort']); } catch { /* no merge */ }
        try { await git!.raw(['cherry-pick', '--abort']); } catch { /* no cherry-pick */ }
        debug('Aborted stuck git operation in preserveChanges path');
      }
      
      const status = await git!.status();
      const hasChanges = status.modified.length > 0 || status.created.length > 0 || status.staged.length > 0;
      if (hasChanges) {
        console.log(`  Keeping ${status.modified.length + status.created.length} modified files`);
      }
      // Just ensure we're on the right branch, don't reset
      try {
        await git!.checkout(branch);
      } catch {
        // Already on branch or changes prevent checkout - that's fine
      }
      // WHY: Base-branch ref must exist for merge-base even when we preserve dirty workdir;
      // the non-preserve path always fetched these — align behavior (fetch-only, no reset).
      await fetchAdditionalBranches(git!, branch, options?.additionalBranches);
    } else {
      // Clean start - reset everything
      console.log(`Existing workdir found at ${workdir}, cleaning up and fetching latest...`);

      // Clean up any leftover merge/rebase state from previous runs (includes git clean -fd)
      await cleanupGitState(git!);
      // Ensure we're on a branch before reset (e.g. previous run left detached HEAD mid-rebase).
      await git!.checkout(branch).catch(() => {});

      await syncOriginFetchBranches(git!, branch, options?.additionalBranches);

      // Run fetch via spawn with stdio inherit so user sees "Receiving objects" progress (not diffs).
      console.log('  Fetching latest from origin (git output will appear below)...');
      await new Promise<void>((resolve, reject) => {
        const proc = spawn('git', ['fetch', 'origin', `+refs/heads/${branch}:refs/remotes/origin/${branch}`], {
          cwd: workdir,
          stdio: 'inherit',
        });
        proc.on('close', (code) => {
          if (code === 0) resolve();
          else reject(new Error(`git fetch exited ${code ?? 'unknown'}`));
        });
        proc.on('error', (err) => reject(err));
      });
      try {
        await git!.checkout(branch);
      } catch {
        // Local branch may not exist (e.g. --single-branch clone for a different branch); create from remote.
        await git!.raw(['checkout', '-b', branch, `origin/${branch}`]);
      }
      await git!.reset(['--hard', `origin/${branch}`]);
      await fetchAdditionalBranches(git!, branch, options?.additionalBranches);
      console.log(`Updated to latest ${branch}`);
    }
  }

  if (!isExistingRepo) {
    // Fresh clone. Bootstrap from another workdir for same repo when possible (git is distributed).
    const referencePath = findReferenceWorkdir(workdir, cloneUrl);
    const cloneArgs = ['clone', '--branch', branch, '--single-branch', ...getCloneDepthArg()];
    if (referencePath) {
      cloneArgs.push('--reference', referencePath);
      debug('Using reference workdir for clone', { referencePath, workdir });
      console.log(`  Bootstrapping from existing clone (${referencePath})...`);
    }
    const cloneTimeoutMs = getCloneTimeoutMs();
    const depthNote = process.env.PRR_CLONE_DEPTH?.trim() ? ` shallow depth=${process.env.PRR_CLONE_DEPTH.trim()};` : '';
    console.log(`Cloning repository to ${workdir}...`);
    console.log(
      `  (Git output and any prompts will appear below. Timeout: ${Math.round(cloneTimeoutMs / 1000)}s; PRR_CLONE_TIMEOUT_MS for slow connections.${depthNote} PRR_CLONE_DEPTH for shallow clone.)`,
    );
    await new Promise<void>((resolve, reject) => {
      const proc = spawn('git', [...cloneArgs, authUrl, workdir], {
        stdio: 'inherit',
      });
      let settled = false;
      const settle = (fn: () => void) => {
        if (settled) return;
        settled = true;
        clearTimeout(timeoutId);
        clearInterval(progressTimer);
        fn();
      };
      let timeoutId: ReturnType<typeof setTimeout>;
      timeoutId = setTimeout(() => {
        proc.kill('SIGKILL');
        settle(() =>
          reject(
            new Error(
              `Clone timed out after ${Math.round(cloneTimeoutMs / 1000)}s. Set PRR_CLONE_TIMEOUT_MS to increase (e.g. 600000 for 10min).`,
            ),
          ),
        );
      }, cloneTimeoutMs);
      const progressIntervalMs = 30_000;
      let progressElapsed = 0;
      const progressTimer = setInterval(() => {
        progressElapsed += progressIntervalMs / 1000;
        console.log(`  Still cloning... (${Math.floor(progressElapsed)}s)`);
      }, progressIntervalMs);
      proc.on('close', (code) => {
        settle(() => {
          if (code === 0) resolve();
          else reject(new Error(`git clone exited ${code ?? 'unknown'}`));
        });
      });
      proc.on('error', (err) => {
        settle(() => reject(err));
      });
    });

    git = simpleGit(workdir);
    await fetchAdditionalBranches(git, branch, options?.additionalBranches);
    console.log(`Cloned ${branch} successfully`);
  }

  if (git === undefined) {
    throw new Error('cloneOrUpdate: internal error — git instance was not initialized');
  }
  const verifyRefs = options?.verifyAdditionalRemoteRefs !== false;
  if (verifyRefs) {
    await assertAdditionalBranchTrackingRefs(git, branch, options?.additionalBranches);
  }
  return { git, workdir };
}