"""c_skill_diff (named only in `sdd-mvcp-contract.json`, prose 03-C never
wrote it up) + list/get read helpers for `v_skill_library`/`v_skill_audit_log`
(02-V §2.9/§2.10). Skills live in graphlemon's own repo, not any target
project's (`src/skill_update.py`'s own docstring: "Skill 库是platform
asset,不是target-project"), so the diff runs against graphlemon's own
checkout by default -- reuses `agent_profile.py`'s own `_REPO_ROOT` pattern
rather than inventing a second way to locate it.
"""

import os
import subprocess

from src import skill_update

_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))


def list_skills(conn):
    rows = conn.execute(
        "SELECT skill_id, owner_org_node, file_path, current_git_commit_sha, source, "
        "migrated_from_profile, status FROM skill ORDER BY owner_org_node, skill_id"
    ).fetchall()
    return [
        {
            "skill_id": r[0], "owner_org_node": r[1], "file_path": r[2], "current_git_commit_sha": r[3],
            "source": r[4], "migrated_from_profile": r[5], "status": r[6],
        }
        for r in rows
    ]


class SkillNotFoundError(Exception):
    """NOT_FOUND -- c_skill_get's own skill_id doesn't exist."""


def get_skill_audit_log(conn, skill_id):
    """v_skill_audit_log (02-V §2.10): every skill_iteration row for this
    skill, oldest first."""
    if conn.execute("SELECT 1 FROM skill WHERE skill_id = ?", (skill_id,)).fetchone() is None:
        raise SkillNotFoundError(skill_id)
    rows = conn.execute(
        "SELECT iteration_id, triggered_by_bug_id, before_git_commit_sha, after_git_commit_sha, "
        "change_summary, applied_at, rollback_of_iteration_id FROM skill_iteration "
        "WHERE skill_id = ? ORDER BY applied_at",
        (skill_id,),
    ).fetchall()
    return [
        {
            "iteration_id": r[0], "triggered_by_bug_id": r[1], "before_git_commit_sha": r[2],
            "after_git_commit_sha": r[3], "change_summary": r[4], "applied_at": r[5],
            "rollback_of_iteration_id": r[6],
        }
        for r in rows
    ]


class SkillContentMissingError(Exception):
    """CONTENT_MISSING -- get_skill_content on a skill row whose real
    SKILL.md file isn't present on disk. Distinct from SkillNotFoundError
    (no such skill row at all): a skill row can legitimately exist with its
    real file not-yet-migrated, and callers (v_skill_audit_log's new "Skill
    内容" panel) need to tell the two apart to show the right message."""


def get_skill_content(conn, skill_id, repo_path=None):
    """v_skill_audit_log's new "Skill 内容" panel (bug fix: this page used to
    show only skill_iteration history -- correct on its own terms, but
    silent about the real SKILL.md content a skill migration already wrote
    to disk under skills/<skill_id>/). Independent of get_skill_audit_log:
    a skill can have real content with zero iterations, which is exactly
    the post-migration, pre-any-self-iteration state today.

    skill_id is user-controlled (comes straight off the URL), but it is
    never spliced into a filesystem path itself -- the lookup below is a
    parameterized query, and the actual on-disk path comes from the
    trusted `skill.file_path` DB column. Still applies two-layer
    path-traversal protection on that DB value: reuse
    skill_update._skill_file_path() for the same SKILL.md-suffix
    resolution c_skill_update/c_skill_rollback already rely on, then
    realpath+containment-check the result against the repo's skills/ root
    before ever opening it -- defense in depth against a future schema/data
    bug turning this read path into an arbitrary-file-read, not a fix for
    an exploit that's live today.
    """
    row = conn.execute("SELECT file_path FROM skill WHERE skill_id = ?", (skill_id,)).fetchone()
    if row is None:
        raise SkillNotFoundError(skill_id)

    repo_root = repo_path or _REPO_ROOT
    skills_root = os.path.realpath(os.path.join(repo_root, "skills"))
    rel_path = skill_update._skill_file_path(row[0])
    abs_path = os.path.realpath(os.path.join(repo_root, rel_path))
    if os.path.commonpath([abs_path, skills_root]) != skills_root:
        # Layer 1: DB-stored file_path resolves outside skills/ entirely.
        raise SkillContentMissingError(skill_id)

    try:
        with open(abs_path, "r", encoding="utf-8", errors="replace") as f:
            content = f.read()
    except OSError:
        # Layer 2: within skills/ but the file itself isn't there (not-yet-
        # migrated skill, or a stale DB row).
        raise SkillContentMissingError(skill_id)

    skill_dir = os.path.dirname(abs_path)
    support_files = []
    for dirpath, _dirnames, filenames in os.walk(skill_dir):
        for name in filenames:
            full_path = os.path.realpath(os.path.join(dirpath, name))
            if full_path == abs_path:
                continue
            support_files.append(os.path.relpath(full_path, skill_dir))
    support_files.sort()

    return {"skill_id": skill_id, "content": content, "support_files": support_files}


def get_diff(before, after, repo_path=None):
    """c_skill_diff: `git diff <before> <after>` -- skill_update.py's
    _write_and_commit makes every iteration an atomic single-file commit,
    so a plain repo-wide diff between the two commits naturally scopes
    itself to that one skill file without needing a path filter."""
    result = subprocess.run(
        ["git", "diff", before, after], cwd=repo_path or _REPO_ROOT,
        capture_output=True, text=True, check=True,
    )
    return result.stdout