import { Agent, AgentContext, ConnectionContext, getAgentByName } from "agents";
import { AgentInitArgs, AgentSummary, DeployOptions, DeployResult, ExportOptions, ExportResult, DeploymentTarget, BehaviorType } from "./types";
import { AgenticState, AgentState, BaseProjectState, CurrentDevState, MAX_PHASES, ThinkState, PhasicState } from "./state";
import { Blueprint } from "../schemas";
import { BaseCodingBehavior } from "./behaviors/base";
import { ThinkCodingBehavior } from './behaviors/think';
import { getBehaviorTypeForProject } from './features';
import { createObjectLogger, StructuredLogger } from '../../logger';
import { InferenceMetadata } from "../inferutils/config.types";
import { getMimeType } from 'hono/utils/mime';
import { normalizePath, isPathSafe } from '../../utils/pathUtils';
import { FileManager } from '../services/implementations/FileManager';
import { DeploymentManager } from '../services/implementations/DeploymentManager';
import { GitVersionControl } from '../git';
import { StateManager } from '../services/implementations/StateManager';
import { PhasicCodingBehavior } from './behaviors/phasic';
import { AgenticCodingBehavior } from './behaviors/agentic';
import { SqlExecutor } from '../git';
import { AgentInfrastructure } from "./AgentCore";
import { ProjectType } from './types';
import { Connection } from 'agents';
import { handleWebSocketMessage, handleWebSocketClose, broadcastToConnections, sendToConnection } from './websocket';
import { WebSocketMessageData, WebSocketMessageType } from "worker/api/websocketTypes";
import { PreviewType, TemplateDetails } from "worker/services/sandbox/sandboxTypes";
import { WebSocketMessageResponses } from "../constants";
import { AppService, ModelConfigService } from "worker/database";
import { ConversationMessage, ConversationState } from "../inferutils/common";
import { ImageAttachment } from "worker/types/image-attachment";
import { RateLimitExceededError } from "shared/types/errors";
import { ProjectObjective } from "./objectives/base";
import { FileOutputType } from "../schemas";
import { SecretsClient, type UserSecretsStoreStub } from '../../services/secrets/SecretsClient';
import { StateMigration } from './stateMigration';
import {
    ConversationMessageLoader,
    LocalConversationMessageLoader,
    ThinkMessageLoader,
} from './conversation/MessageLoader';
import { PendingWsTicket, TicketConsumptionResult } from '../../types/auth-types';
import { WsTicketManager } from '../../utils/wsTicketManager';
import { readTokenCookie } from '../../utils/oauthCookie';

const DEFAULT_CONVERSATION_SESSION_ID = 'default';

interface AgentBootstrapProps {
    behaviorType?: BehaviorType;
    projectType?: ProjectType;
}

export class CodeGeneratorAgent extends Agent<Env, AgentState> implements AgentInfrastructure<AgentState> {
    public _logger: StructuredLogger | undefined;
    private behavior!: BaseCodingBehavior<AgentState>;
    private objective!: ProjectObjective<BaseProjectState>;
    private secretsClient: SecretsClient | null = null;
    protected static readonly PROJECT_NAME_PREFIX_MAX_LENGTH = 20;
    
    /** Ticket manager for WebSocket authentication */
    private ticketManager = new WsTicketManager();
    
    // Services
    readonly fileManager: FileManager;
    readonly deploymentManager: DeploymentManager;
    readonly git: GitVersionControl;
    
    // Redeclare as public to satisfy AgentInfrastructure interface
    declare public readonly env: Env;
    declare public readonly sql: SqlExecutor;
    
    // ==========================================
    // Initialization
    // ==========================================
    
    initialState = {
        behaviorType: 'unknown' as BehaviorType,
        projectType: 'unknown' as ProjectType,
        projectName: "",
        query: "",
        sessionId: '',
        hostname: '',
        blueprint: {} as unknown as Blueprint,
        templateName: '',
        generatedFilesMap: {},
        conversationMessages: [],
        metadata: {} as InferenceMetadata,
        shouldBeGenerating: false,
        sandboxInstanceId: undefined,
        commandsHistory: [],
        lastPackageJson: '',
        pendingUserInputs: [],
        projectUpdatesAccumulator: [],
        lastDeepDebugTranscript: null,
        mvpGenerated: false,
        reviewingInitiated: false,
        generatedPhases: [],
        currentDevState: CurrentDevState.IDLE,
        phasesCounter: MAX_PHASES,
    } as AgentState;

    constructor(ctx: AgentContext, env: Env) {
        super(ctx, env);
                
        void this.sql`CREATE TABLE IF NOT EXISTS full_conversations (id TEXT PRIMARY KEY, messages TEXT)`;
        void this.sql`CREATE TABLE IF NOT EXISTS compact_conversations (id TEXT PRIMARY KEY, messages TEXT)`;

        // Create StateManager
        const stateManager = new StateManager(
            () => this.state,
            (s) => this.setState(s)
        );
        
        this.git = new GitVersionControl(this.sql.bind(this));
        this.fileManager = new FileManager(
            stateManager,
            () => this.behavior?.getTemplateDetails?.() || null,
            this.git
        );
        this.deploymentManager = new DeploymentManager(
            {
                stateManager,
                fileManager: this.fileManager,
                getLogger: () => this.logger(),
                env: this.env
            },
            10, // MAX_COMMANDS_HISTORY
        );
    }
    private createObjective(projectType: ProjectType): ProjectObjective<BaseProjectState> {
        return new ProjectObjective(this as AgentInfrastructure<BaseProjectState>, projectType);
    }

    /**
     * Initialize the agent with project blueprint and template
     * Only called once in an app's lifecycle
     */
    async initialize(
        initArgs: AgentInitArgs<AgentState>,
        ..._args: unknown[]
    ): Promise<AgentState> {
        const { inferenceContext } = initArgs;
        const sandboxSessionId = DeploymentManager.generateNewSessionId();
        this.initLogger(inferenceContext.metadata.agentId, inferenceContext.metadata.userId, sandboxSessionId);

        // Infrastructure setup
        await this.gitInit();
        
        // Let behavior handle all state initialization (blueprint, projectName, etc.)
        await this.behavior.initialize({
            ...initArgs,
            sandboxSessionId // Pass generated session ID to behavior
        });
        
        await this.saveToDatabase();
        
        return this.state;
    }
    
    async isInitialized() {
        return this.getAgentId() ? true : false
    }

    /**
     * Called evertime when agent is started or re-started
     * @param props - Optional props
     */
    async onStart(props?: Record<string, unknown> | undefined): Promise<void> {
        // Run common migration FIRST, before any state access
        const migratedState = StateMigration.migrateCommon(this.state);
        if (migratedState) {
            this.setState(migratedState);
        }

        this.logger().info(`Agent ${this.getAgentId()} session: ${this.state.sessionId} onStart`, { props });

        this.logger().info('Bootstrapping CodeGeneratorAgent', { props });
        const agentProps = props as AgentBootstrapProps;
        // ProjectType: prefer props → existing state → 'app'. Treat 'unknown'
        // sentinel from initialState as missing.
        const projectType =
            agentProps?.projectType ??
            (this.state.projectType && this.state.projectType !== ('unknown' as unknown as typeof this.state.projectType)
                ? this.state.projectType
                : 'app');

        // BehaviorType resolution order:
        //   1. explicit props.behaviorType (controller-supplied)
        //   2. previously persisted state.behaviorType (only if valid)
        //   3. feature-registry default for projectType
        // The 'unknown' sentinel and any invalid value falls through to (3).
        const persistedBehavior = this.state.behaviorType;
        const isValidPersisted =
            persistedBehavior === 'phasic' ||
            persistedBehavior === 'agentic' ||
            persistedBehavior === 'think';
        const behaviorType: BehaviorType =
            agentProps?.behaviorType ??
            (isValidPersisted ? persistedBehavior : getBehaviorTypeForProject(projectType));

        if (behaviorType === 'phasic') {
            this.behavior = new PhasicCodingBehavior(this as AgentInfrastructure<PhasicState>, projectType);
        } else if (behaviorType === 'think') {
            this.behavior = new ThinkCodingBehavior(
                this as AgentInfrastructure<ThinkState>,
                projectType,
            ) as unknown as BaseCodingBehavior<AgentState>;
        } else {
            this.behavior = new AgenticCodingBehavior(this as AgentInfrastructure<AgenticState>, projectType);
        }
        
        // Create objective based on project type
        this.objective = this.createObjective(projectType);

        this.behavior.onStart(props);

        // Ignore if agent not initialized
        if (!this.state.query) {
            this.logger().warn(`Agent ${this.getAgentId()} session: ${this.state.sessionId} onStart ignored, agent not initialized`);
            return;
        }

        // Ensure state is migrated for any previous versions
        this.behavior.migrateStateIfNeeded();
        
        // Check if this is a read-only operation
        const readOnlyMode = props?.readOnlyMode === true;
        
        if (readOnlyMode) {
            this.logger().info(`Agent ${this.getAgentId()} starting in READ-ONLY mode - skipping expensive initialization`);
            return;
        }
        
        // Just in case
        await this.gitInit();
        
        await this.behavior.ensureTemplateDetails();
        this.logger().info(`Agent ${this.getAgentId()} session: ${this.state.sessionId} onStart processed successfully`);

        // Load the latest user configs
        const modelConfigService = new ModelConfigService(this.env);
        const userConfigsRecord = await modelConfigService.getUserModelConfigs(this.state.metadata.userId);
        this.behavior.setUserModelConfigs(userConfigsRecord);
        this.logger().info(`Agent ${this.getAgentId()} session: ${this.state.sessionId} onStart: User configs loaded successfully`, {userConfigsRecord});
    }
    
    onConnect(connection: Connection, ctx: ConnectionContext) {
        this.logger().info(`Agent connected for agent ${this.getAgentId()}`, { connection, ctx });
        // Capture the encrypted Cloudflare OAuth blob from the WS upgrade request's
        // HttpOnly cookie and stash it on the DO state. The browser cannot read this
        // cookie, and messages over the WS do not carry cookies per-frame, so this
        // is the one chance we get to pick it up per connection.
        try {
            const blob = readTokenCookie(ctx.request, this.env);
            const origin = new URL(ctx.request.url).origin;
            const needsUpdate =
                (blob && blob !== this.state.cloudflareToken) ||
                (origin && origin !== this.state.wsOrigin);
            if (needsUpdate) {
                this.setState({
                    ...this.state,
                    cloudflareToken: blob || this.state.cloudflareToken,
                    wsOrigin: origin || this.state.wsOrigin,
                });
            }
        } catch (error) {
            this.logger().warn('Failed to capture CF token cookie on WS connect', { error });
        }
        void (async () => {
            let previewUrl = '';
            try {
                // The think behavior exposes its preview via the
                // `/space/.../preview/<branch>/` worker route. Only surface it
                // once a real deploy has happened (`lastDeployedCommit` is set
                // by `deployCurrentBranch`); the URL is derived purely from the
                // space name/branch, so without this gate the iframe would
                // point at an empty, undeployed space before the first deploy.
                const renderMode = this.behavior.getTemplateDetails().renderMode;
                const isThink = this.state.behaviorType === 'think';
                const thinkHasDeployed = isThink && Boolean(this.state.lastDeployedCommit);
                if (renderMode === 'browser' || thinkHasDeployed) {
                    previewUrl = await this.behavior.getBrowserPreviewURL();
                }
            } catch (error) {
                this.logger().error('Error getting preview URL:', error);
            }
            sendToConnection(connection, WebSocketMessageResponses.AGENT_CONNECTED, {
                state: this.state,
                templateDetails: this.behavior.getTemplateDetails(),
                previewUrl: previewUrl
            });
        })();
    }

    private initLogger(agentId: string, userId: string, sessionId?: string) {
        this._logger = createObjectLogger(this, 'CodeGeneratorAgent');
        this._logger.setObjectId(agentId);
        this._logger.setFields({
            agentId,
            userId,
            projectType: this.state.projectType,
            behaviorType: this.state.behaviorType
        });
        if (sessionId) {
            this._logger.setField('sessionId', sessionId);
        }
        return this._logger;
    }
    
    // ==========================================
    // Utilities
    // ==========================================

    logger(): StructuredLogger {
        if (!this._logger) {
            this._logger = this.initLogger(this.getAgentId(), this.state.metadata.userId, this.state.sessionId);
        }
        return this._logger;
    }

    getAgentId() {
        return this.state.metadata.agentId;
    }
    
    getWebSockets(): WebSocket[] {
        return this.ctx.getWebSockets();
    }

    handleVaultUnlocked(): void {
        this.secretsClient?.notifyUnlocked();
        this.logger().info('Vault unlocked notification received', {});
    }

    handleVaultLocked(): void {
        this.secretsClient?.notifyUnlockFailed('Vault locked');
        this.secretsClient = null;
        this.logger().info('Vault locked', {});
    }

    private getSecretsClient(): SecretsClient {
        if (!this.secretsClient) {
            const userId = this.state.metadata.userId;
            const stub = this.env.UserSecretsStore.get(
                this.env.UserSecretsStore.idFromName(userId)
            ) as unknown as UserSecretsStoreStub;

            this.secretsClient = new SecretsClient(stub, (type, data) => {
                if (type === 'vault_required') {
                    const vaultData = data as { reason: string; provider?: string; envVarName?: string; secretId?: string };
                    broadcastToConnections(this, 'vault_required', vaultData);
                }
            });
        }

        return this.secretsClient;
    }

    async getDecryptedSecret(query: { provider?: string; envVarName?: string; secretId?: string }): Promise<string | null> {
        try {
            return await this.getSecretsClient().get(query);
        } catch (error) {
            this.logger().info('Secret request failed', { query, error: String(error) });
            return null;
        }
    }

    /**
     * Get the project objective (defines what is being built)
     */
    getObjective(): ProjectObjective<BaseProjectState> {
        return this.objective;
    }
    
    /**
     * Get the behavior (defines how code is generated)
     */
    getBehavior(): BaseCodingBehavior<AgentState> {
        return this.behavior;
    }

    async getFullState(): Promise<AgentState> {
        return await this.behavior.getFullState();
    }

    async getSummary(): Promise<AgentSummary> {
        return this.behavior.getSummary();
    }

    getBehaviorType(): BehaviorType {
        return this.state.behaviorType;
    }

    /**
     * Public RPC entrypoint for the think agent's tools (and any other caller
     * holding a `CodeGenObject` stub) to capture browser console
     * output from the current preview app. Delegates straight to the
     * active behavior, which routes between the BROWSER binding (prod)
     * and the local dev sidecar.
     */
    async captureBrowserConsoleLogs(opts?: {
        url?: string;
        waitSeconds?: number;
        viewport?: { width: number; height: number };
        interactScript?: string;
    }) {
        return this.behavior.captureBrowserConsoleLogs(opts ?? {});
    }

    getPreviewUrlCache(): string {
        return ''; // Unimplemented
    }

    deployToSandbox(
        files: FileOutputType[] = [],
        redeploy: boolean = false,
        commitMessage?: string,
        clearLogs: boolean = false
    ): Promise<PreviewType | null> {
        return this.behavior.deployToSandbox(files, redeploy, commitMessage, clearLogs);
    }

    deployToCloudflare(target?: DeploymentTarget): Promise<{ deploymentUrl?: string; workersUrl?: string } | null> {
        return this.behavior.deployToCloudflare(target);
    }

    deployProject(options?: DeployOptions): Promise<DeployResult> {
        return this.objective.deploy(options);
    }

    exportProject(options: ExportOptions): Promise<ExportResult> {
        return this.objective.export(options);
    }

    importTemplate(templateName: string): Promise<{ templateName: string; filesImported: number }> {
        return this.behavior.importTemplate(templateName);
    }
    
    protected async saveToDatabase() {
        this.logger().info(`Saving agent ${this.getAgentId()} to database`);
        // Save the app to database (authenticated users only)
        const appService = new AppService(this.env);
        await appService.createApp({
            id: this.state.metadata.agentId,
            userId: this.state.metadata.userId,
            sessionToken: null,
            title: this.state.blueprint.title || this.state.query.substring(0, 100),
            description: this.state.blueprint.description,
            originalPrompt: this.state.query,
            finalPrompt: this.state.query,
            framework: this.state.blueprint.frameworks.join(','),
            visibility: 'private',
            status: 'generating',
                createdAt: new Date(),
            updatedAt: new Date()
            });
        this.logger().info(`App saved successfully to database for agent ${this.state.metadata.agentId}`, { 
            agentId: this.state.metadata.agentId, 
            userId: this.state.metadata.userId,
            visibility: 'private'
        });
        this.logger().info(`Agent initialized successfully for agent ${this.state.metadata.agentId}`);
    }

    // ==========================================
    // Conversation Management
    // ==========================================

    /*
    * Each DO has 10 gb of sqlite storage. However, the way agents sdk works, it stores the 'state' object of the agent as a single row
    * in the cf_agents_state table. And row size has a much smaller limit in sqlite. Thus, we only keep current compactified conversation
    * in the agent's core state and store the full conversation in a separate DO table.
    */
    getConversationState(id: string = DEFAULT_CONVERSATION_SESSION_ID): ConversationState {
        const rows = this.sql<{ messages: string, id: string }>`SELECT * FROM full_conversations WHERE id = ${id}`;
        let fullHistory: ConversationMessage[] = [];
        if (rows.length > 0 && rows[0].messages) {
            try {
                const parsed = JSON.parse(rows[0].messages);
                if (Array.isArray(parsed)) {
                    fullHistory = parsed as ConversationMessage[];
                }
            } catch (_e) {
                this.logger().warn('Failed to parse full conversation history', _e);
            }
        }
        
        // Load compact (running) history from sqlite with fallback to in-memory state for migration
        const compactRows = this.sql<{ messages: string, id: string }>`SELECT * FROM compact_conversations WHERE id = ${id}`;
        let runningHistory: ConversationMessage[] = [];
        if (compactRows.length > 0 && compactRows[0].messages) {
            try {
                const parsed = JSON.parse(compactRows[0].messages);
                if (Array.isArray(parsed)) {
                    runningHistory = parsed as ConversationMessage[];
                }
            } catch (_e) {
                this.logger().warn('Failed to parse compact conversation history', _e);
            }
        }
        if (runningHistory.length === 0) {
            runningHistory = fullHistory;
        }

        // Remove duplicates
        const deduplicateMessages = (messages: ConversationMessage[]): ConversationMessage[] => {
            const seen = new Set<string>();
            return messages.filter(msg => {
                const key = `${msg.conversationId}-${msg.role}-${msg.tool_call_id || ''}`;
                if (seen.has(key)) {
                    return false;
                }
                seen.add(key);
                return true;
            });
        };

        runningHistory = deduplicateMessages(runningHistory);
        fullHistory = deduplicateMessages(fullHistory);

        this.logger().info(`Loaded conversation state ${id}, full_length: ${fullHistory.length}, compact_length: ${runningHistory.length}`, fullHistory);
        
        return {
            id: id,
            runningHistory,
            fullHistory,
        };
    }

    setConversationState(conversations: ConversationState) {
        const serializedFull = JSON.stringify(conversations.fullHistory);
        const serializedCompact = JSON.stringify(conversations.runningHistory);
        try {
            this.logger().info(`Saving conversation state ${conversations.id}, full_length: ${serializedFull.length}, compact_length: ${serializedCompact.length}`, serializedFull);
            void this.sql`INSERT OR REPLACE INTO compact_conversations (id, messages) VALUES (${conversations.id}, ${serializedCompact})`;
            void this.sql`INSERT OR REPLACE INTO full_conversations (id, messages) VALUES (${conversations.id}, ${serializedFull})`;
        } catch (error) {
            this.logger().error(`Failed to save conversation state ${conversations.id}`, error);
        }
    }

    addConversationMessage(message: ConversationMessage) {
        const conversationState = this.getConversationState();
        if (!conversationState.runningHistory.find(msg => msg.conversationId === message.conversationId)) {
            this.logger().info('Adding conversation message', {
                message,
                conversationId: message.conversationId,
                runningHistoryLength: conversationState.runningHistory.length,
                fullHistoryLength: conversationState.fullHistory.length
            });
            conversationState.runningHistory.push(message);
        } else  {
            conversationState.runningHistory = conversationState.runningHistory.map(msg => {
                if (msg.conversationId === message.conversationId) {
                    return message;
                }
                return msg;
            });
        }
        if (!conversationState.fullHistory.find(msg => msg.conversationId === message.conversationId)) {
            conversationState.fullHistory.push(message);
        } else {
            conversationState.fullHistory = conversationState.fullHistory.map(msg => {
                if (msg.conversationId === message.conversationId) {
                    return message;
                }
                return msg;
            });
        }
        this.setConversationState(conversationState);
    }
    
    /**
     * Pick a conversation message loader based on the active behavior.
     *
     *   - `think` → reads from the companion `ThinkAgent` DO (the source of
     *     truth for think runs; populated by the Think runtime itself).
     *   - everything else → reads from this agent's local SQLite tables.
     *
     * Used by the WebSocket boundary (`GET_CONVERSATION_STATE`) so the
     * frontend sees the same history the backend actually persists.
     */
    public getConversationMessageLoader(): ConversationMessageLoader {
        const behavior = this.state.behaviorType;
        if (behavior === 'think') {
            const thinkState = this.state as ThinkState;
            const ns = (this.env as unknown as {
                THINK_DO?: DurableObjectNamespace;
            }).THINK_DO;
            const name = thinkState.thinkAgentName || thinkState.metadata?.agentId;
            if (ns && name) {
                // Resolve the ThinkAgent via the agents framework helper so its
                // `_init` runs before we read messages (a raw stub would throw).
                return new ThinkMessageLoader(async () => {
                    const stub = await getAgentByName(ns as never, name);
                    return stub as unknown as Awaited<ReturnType<ConstructorParameters<typeof ThinkMessageLoader>[0]>>;
                });
            }
        }
        return new LocalConversationMessageLoader(this);
    }

    /**
     * Clear conversation history
     */
    public clearConversation(): void {
        try {
            this.logger().info('Clearing conversation history');
            
            // Clear SQL tables for default conversation session
            void this.sql`DELETE FROM full_conversations WHERE id = ${DEFAULT_CONVERSATION_SESSION_ID}`;
            void this.sql`DELETE FROM compact_conversations WHERE id = ${DEFAULT_CONVERSATION_SESSION_ID}`;
            
            this.logger().info('Conversation history cleared successfully');
            
            this.broadcast(WebSocketMessageResponses.CONVERSATION_CLEARED, {
                message: 'Conversation history cleared',
            });
        } catch (error) {
            this.logger().error('Error clearing conversation history:', error);
            this.broadcastError('Failed to clear conversation history', error);
        }
    }

    /**
     * Handle user input during conversational code generation
     * Processes user messages and updates pendingUserInputs state
     */
    async handleUserInput(userMessage: string, images?: ImageAttachment[]): Promise<void> {
        try {
            this.logger().info('Processing user input message', { 
                messageLength: userMessage.length,
                pendingInputsCount: this.state.pendingUserInputs.length,
                hasImages: !!images && images.length > 0,
                imageCount: images?.length || 0
            });

            await this.behavior.handleUserInput(userMessage, images);
            if (!this.behavior.isCodeGenerating()) {
                // If idle, start generation process
                this.logger().info('User input during IDLE state, starting generation');
                this.behavior.generateAllFiles().catch(error => {
                    this.logger().error('Error starting generation from user input:', error);
                });
            }

        } catch (error) {
            if (error instanceof RateLimitExceededError) {
                this.logger().error('Rate limit exceeded:', error);
                this.broadcast(WebSocketMessageResponses.RATE_LIMIT_ERROR, {
                    error
                });
                return;
            }
            this.broadcastError('Error processing user input', error);
        }
    }
    // ==========================================
    // WebSocket Management
    // ==========================================
    
    /**
     * Handle WebSocket message - Agent owns WebSocket lifecycle
     * Delegates to centralized handler which can access both behavior and objective
     */
    async onMessage(connection: Connection, message: string): Promise<void> {
        await handleWebSocketMessage(this, connection, message);
    }
    
    /**
     * Handle WebSocket close - Agent owns WebSocket lifecycle
     */
    async onClose(connection: Connection): Promise<void> {
        handleWebSocketClose(this, connection);
    }
    
    /**
     * Broadcast message to all connected WebSocket clients
     * Type-safe version using proper WebSocket message types
     */
    public broadcast<T extends WebSocketMessageType>(
        type: T, 
        data?: WebSocketMessageData<T>
    ): void {
        broadcastToConnections(this, type, data || {} as WebSocketMessageData<T>);
    }

    protected broadcastError(context: string, error: unknown): void {
        const errorMessage = error instanceof Error ? error.message : String(error);
        this.logger().error(`${context}:`, error);
        this.broadcast(WebSocketMessageResponses.ERROR, {
            error: `${context}: ${errorMessage}`
        });
    }
    // ==========================================
    // Git Management
    // ==========================================

    protected async gitInit() {
        try {
            await this.git.init();
            this.logger().info("Git initialized successfully");
            // Check if there is any commit
            const head = await this.git.getHead();
            
            if (!head) {
                this.logger().info("No commits found, creating initial commit");
                // get all generated files and commit them
                const generatedFiles = this.fileManager.getGeneratedFiles();
                if (generatedFiles.length === 0) {
                    this.logger().info("No generated files found, skipping initial commit");
                    return;
                }
                await this.git.commit(generatedFiles, "Initial commit");
                this.logger().info("Initial commit created successfully");
            }
        } catch (error) {
            this.logger().error("Error during git init:", error);
        }
    }

    /**
     * Export git objects
     * The route handler will build the repo with template rebasing
     */
    async exportGitObjects(): Promise<{
        gitObjects: Array<{ path: string; data: Uint8Array }>;
        query: string;
        hasCommits: boolean;
        templateDetails: TemplateDetails | null;
    }> {
        try {
            // Export git objects efficiently (minimal DO memory usage)
            const gitObjects = this.git.fs.exportGitObjects();

            await this.gitInit();
            
            // Ensure template details are available
            await this.behavior.ensureTemplateDetails();

            const templateDetails = this.behavior.getTemplateDetails();
            
            return {
                gitObjects,
                query: this.state.query || 'N/A',
                hasCommits: gitObjects.length > 0,
                templateDetails
            };
        } catch (error) {
            this.logger().error('exportGitObjects failed', error);
            throw error;
        }
    }

    /**
     * Handle browser file serving requests
     */
    async handleBrowserFileServing(request: Request): Promise<Response> {
        const url = new URL(request.url);

        this.logger().info('[BROWSER SERVING] Request received', {
            hostname: url.hostname,
            pathname: url.pathname,
            method: request.method
        });

        // Handle CORS preflight
        if (request.method === 'OPTIONS') {
            return new Response(null, {
                status: 204,
                headers: {
                    'Access-Control-Allow-Origin': '*',
                    'Access-Control-Allow-Methods': 'GET, OPTIONS',
                    'Access-Control-Allow-Headers': '*',
                    'Access-Control-Max-Age': '86400'
                }
            });
        }

        // Extract token from hostname
        // Pattern: b-{agentid}-{token}.{previewDomain}/{filepath}
        // Token is always 16 characters after the LAST hyphen (after removing 'b-' prefix)
        const subdomain = url.hostname.split('.')[0];

        if (!subdomain.startsWith('b-')) {
            this.logger().warn('[BROWSER SERVING] Invalid hostname pattern - missing b- prefix', { hostname: url.hostname });
            return new Response('Invalid request', {
                status: 400,
                headers: { 'Content-Type': 'text/plain' }
            });
        }

        const withoutPrefix = subdomain.substring(2); // Remove 'b-'
        const lastHyphenIndex = withoutPrefix.lastIndexOf('-');

        if (lastHyphenIndex === -1) {
            this.logger().warn('[BROWSER SERVING] Invalid hostname pattern - no hyphen after prefix', { hostname: url.hostname });
            return new Response('Invalid request', {
                status: 400,
                headers: { 'Content-Type': 'text/plain' }
            });
        }

        const providedToken = withoutPrefix.substring(lastHyphenIndex + 1);

        // Extract file path from pathname
        const filePath = url.pathname === '/' || url.pathname === ''
            ? 'public/index.html'
            : url.pathname.replace(/^\//, ''); // Remove leading slash

        this.logger().info('[BROWSER SERVING] Extracted', { providedToken, filePath });

        // Validate token
        const storedToken = this.state.fileServingToken?.token;
        if (!storedToken || providedToken !== storedToken.toLowerCase()) {
            this.logger().warn('[BROWSER SERVING] Token mismatch', { providedToken, storedToken });
            return new Response('Unauthorized', {
                status: 403,
                headers: { 'Content-Type': 'text/plain' }
            });
        }

        if (!isPathSafe(filePath)) {
            return new Response('Invalid path', {
                status: 400,
                headers: { 'Content-Type': 'text/plain' }
            });
        }
        const normalized = normalizePath(filePath);
        let file = this.fileManager.getFile(normalized);

        // Try with public/ prefix if not found
        if (!file && !normalized.startsWith('public/')) {
            file = this.fileManager.getFile(`public/${normalized}`);
        }

        if (!file) {
            this.logger().warn('[BROWSER SERVING] File not found', { normalized });
            return new Response('File not found', {
                status: 404,
                headers: { 'Content-Type': 'text/plain' }
            });
        }

        // Serve file with correct Content-Type
        const contentType = getMimeType(normalized) || 'application/octet-stream';

        this.logger().info('[BROWSER SERVING] Serving file', {
            path: normalized,
            contentType
        });

        let content = file.fileContents;

        // For HTML files, inject base tag
        if (normalized.endsWith('.html') || contentType.includes('text/html')) {
            const baseTag = `<base href="/">`;

            // Inject base tag after <head> tag if present
            if (content.includes('<head>')) {
                content = content.replace(/<head>/i, `<head>\n  ${baseTag}`);
            } else {
                // Fallback: inject at the beginning
                content = baseTag + '\n' + content;
            }

            this.logger().info('[BROWSER SERVING] Injected base tag');
        }

        return new Response(content, {
            status: 200,
            headers: {
                'Content-Type': contentType,
                'Cache-Control': 'no-cache, no-store, must-revalidate',
                'Access-Control-Allow-Origin': '*',
                'Access-Control-Allow-Methods': 'GET, OPTIONS',
                'Access-Control-Allow-Headers': '*',
                'X-Sandbox-Type': 'browser-native'
            }
        });
    }

    /**
     * Cache GitHub OAuth token in memory for subsequent exports
     * Token is ephemeral - lost on DO eviction
     */
    setGitHubToken(token: string, username: string, ttl: number = 3600000): void {
        this.objective.setGitHubToken(token, username, ttl);
    }

    /**
     * Get cached GitHub token if available and not expired
     */
    getGitHubToken(): { token: string; username: string } | null {
        return this.objective.getGitHubToken();
    }

    /**
     * Clear cached GitHub token
     */
    clearGitHubToken(): void {
        this.objective.clearGitHubToken();
    }

    // ==========================================
    // WebSocket Ticket Management
    // ==========================================

    /**
     * Store a WebSocket ticket for later consumption
     * Called by controller after ownership is verified via JWT
     */
    storeWsTicket(ticket: PendingWsTicket): void {
        this.ticketManager.store(ticket);
        this.logger().info('WebSocket ticket stored', {
            userId: ticket.user.id,
            expiresIn: Math.floor((ticket.expiresAt - Date.now()) / 1000),
        });
    }

    /**
     * Consume a WebSocket ticket (one-time use)
     * Returns user session if valid, null otherwise
     */
    consumeWsTicket(token: string): TicketConsumptionResult | null {
        const result = this.ticketManager.consume(token);
        if (result) {
            this.logger().info('Ticket consumed successfully', { userId: result.user.id });
        } else {
            this.logger().warn('Ticket consumption failed', { tokenPrefix: token.slice(0, 10) });
        }
        return result;
    }
}