refactor: remove legacy live-read and injected-history chat context paths (#26585)

This PR makes the agent-pushed pinned snapshot
(`chat_context_resources`) the sole source of workspace context for
chats, completing the "Release 5" cleanup. It removes legacy mechanisms
now superseded by the snapshot that agents push over dRPC
(`PushContextState`) and refresh via `chat-context/refresh`.

Removed:

- **Live-read at turn time.** MCP tool discovery, skill live-body reads,
and the instruction/skill history fallback that dialed the workspace on
every turn.
- **Context injected as message history.** The
`persist_workspace_context` generation action and its decision-loop
guard.
- **The legacy write path.** `POST`/`DELETE
/api/v2/workspaceagents/me/experimental/chat-context`, the agentsdk
`AddChatContext`/`ClearChatContext` methods, and the CLI one-shot
writer.
- **The `chats.last_injected_context` column** and all of its plumbing
(migration `000529`, queries, `db2sdk`, `dbauthz`, audit table, and the
frontend `ContextUsageIndicator` fallback).

Subagent context inheritance no longer copies parent context messages;
children now hydrate the parent's pinned `chat_context_resources` on
create, which yields an identical pin for the same workspace and agent.

What stays (still served by the live agent connection, not the
snapshot): `read_skill_file` supporting-file reads, `read_skill`
supporting-file listing, and MCP tool execution.

> [!NOTE]
> Migration `000529` drops `chats.last_injected_context` and recreates
the `chats_expanded` view without it. The down migration restores both.

<details>
<summary>Decision log (D1-D5)</summary>

- **D1 (subagent inheritance):** Re-point inheritance from the legacy
message copy to a pinned hydrate. Children call
`hydrateChatContextOnCreate` instead of copying parent context messages.
- **D2 (`persist_workspace_context`):** Remove the generation action
entirely along with the decision-loop guard it existed to satisfy, since
context is never injected into history anymore.
- **D3 (legacy HTTP + CLI):** Remove the experimental `chat-context`
POST/DELETE endpoints, the agentsdk methods, and the CLI one-shot. The
dRPC push + `chat-context/refresh` replace them.
- **D4 (frontend fallback):** Remove the `last_injected_context`
fallback in `ContextUsageIndicator`; pinned `resources` are the sole
source.
- **D5 (sequencing):** Ship as a single PR rather than a stacked pair.

</details>

---
Coder Agents generated on behalf of @kylecarbs.

coderd/workspaceagents.go

@@ -42,9 +42,6 @@ import (
 	"github.com/coder/coder/v2/coderd/telemetry"
 	maputil "github.com/coder/coder/v2/coderd/util/maps"
 	"github.com/coder/coder/v2/coderd/wspubsub"
-	"github.com/coder/coder/v2/coderd/x/chatd"
-	"github.com/coder/coder/v2/coderd/x/chatd/chatprompt"
-	"github.com/coder/coder/v2/coderd/x/chatd/chatstate"
 	"github.com/coder/coder/v2/coderd/x/gitsync"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
@@ -2387,315 +2384,11 @@ func convertWorkspaceAgentLogs(logs []database.WorkspaceAgentLog) []codersdk.Wor
 	return sdk
 }
 
-// maxChatContextParts caps the number of parts per request to
-// prevent unbounded message payloads.
-const maxChatContextParts = 100
-
-// maxChatContextFileBytes caps each context-file part to the same
-// 64KiB budget used when the agent reads instruction files from disk.
-const maxChatContextFileBytes = 64 * 1024
-
-// maxChatContextRequestBodyBytes caps the JSON request body size for
-// agent-added context to roughly the same per-part budget used when
-// reading instruction files from disk.
-const maxChatContextRequestBodyBytes int64 = maxChatContextParts * maxChatContextFileBytes
-
-// sanitizeWorkspaceAgentContextFileContent applies prompt
-// sanitization, then enforces the 64KiB per-file budget. The
-// truncated flag is preserved when the caller already capped the
-// file before sending it.
-func sanitizeWorkspaceAgentContextFileContent(
-	content string,
-	truncated bool,
-) (string, bool) {
-	content = chatd.SanitizePromptText(content)
-	if len(content) > maxChatContextFileBytes {
-		content = content[:maxChatContextFileBytes]
-		truncated = true
-	}
-	return content, truncated
-}
-
-// readChatContextBody reads and validates the request body for chat
-// context endpoints. It handles MaxBytesReader wrapping, error
-// responses, and body rewind. If the body is empty or whitespace-only
-// and allowEmpty is true, it returns false without writing an error.
-//
-//nolint:revive // Add and clear endpoints only differ by empty-body handling.
-func readChatContextBody(ctx context.Context, rw http.ResponseWriter, r *http.Request, dst any, allowEmpty bool) bool {
-	r.Body = http.MaxBytesReader(rw, r.Body, maxChatContextRequestBodyBytes)
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		var maxBytesErr *http.MaxBytesError
-		if errors.As(err, &maxBytesErr) {
-			httpapi.Write(ctx, rw, http.StatusRequestEntityTooLarge, codersdk.Response{
-				Message: "Request body too large.",
-				Detail:  fmt.Sprintf("Maximum request body size is %d bytes.", maxChatContextRequestBodyBytes),
-			})
-			return false
-		}
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Failed to read request body.",
-			Detail:  err.Error(),
-		})
-		return false
-	}
-	if allowEmpty && len(bytes.TrimSpace(body)) == 0 {
-		r.Body = http.NoBody
-		return false
-	}
-
-	r.Body = io.NopCloser(bytes.NewReader(body))
-	return httpapi.Read(ctx, rw, r, dst)
-}
-
-// @x-apidocgen {"skip": true}
-func (api *API) workspaceAgentAddChatContext(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	workspaceAgent := httpmw.WorkspaceAgent(r)
-
-	var req agentsdk.AddChatContextRequest
-	if !readChatContextBody(ctx, rw, r, &req, false) {
-		return
-	}
-
-	if len(req.Parts) == 0 {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "No context parts provided.",
-		})
-		return
-	}
-
-	if len(req.Parts) > maxChatContextParts {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Too many context parts (%d). Maximum is %d.", len(req.Parts), maxChatContextParts),
-		})
-		return
-	}
-
-	// Filter to only non-empty context-file and skill parts.
-	filtered := chatd.FilterContextParts(req.Parts, false)
-	if len(filtered) == 0 {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "No context-file or skill parts provided.",
-		})
-		return
-	}
-	req.Parts = filtered
-	responsePartCount := 0
-
-	// Use system context for chat operations since the
-	// workspace agent scope does not include chat resources.
-	// We verify agent-to-chat ownership explicitly below.
-	//nolint:gocritic // Agent needs system access to read/write chat resources.
-	sysCtx := dbauthz.AsSystemRestricted(ctx)
-	workspace, err := api.Database.GetWorkspaceByAgentID(sysCtx, workspaceAgent.ID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to determine workspace from agent token.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	chat, err := resolveAgentChat(sysCtx, api.Database, workspaceAgent.ID, workspace.OwnerID, req.ChatID)
-	if err != nil {
-		writeAgentChatError(ctx, rw, err)
-		return
-	}
-
-	// Stamp each persisted part with the agent identity. Context-file
-	// parts also get server-authoritative workspace metadata.
-	directory := workspaceAgent.ExpandedDirectory
-	if directory == "" {
-		directory = workspaceAgent.Directory
-	}
-	for i := range req.Parts {
-		req.Parts[i].ContextFileAgentID = uuid.NullUUID{
-			UUID:  workspaceAgent.ID,
-			Valid: true,
-		}
-		if req.Parts[i].Type != codersdk.ChatMessagePartTypeContextFile {
-			continue
-		}
-		req.Parts[i].ContextFileContent, req.Parts[i].ContextFileTruncated = sanitizeWorkspaceAgentContextFileContent(
-			req.Parts[i].ContextFileContent,
-			req.Parts[i].ContextFileTruncated,
-		)
-		req.Parts[i].ContextFileOS = workspaceAgent.OperatingSystem
-		req.Parts[i].ContextFileDirectory = directory
-	}
-	req.Parts = chatd.FilterContextParts(req.Parts, false)
-	if len(req.Parts) == 0 {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "No context-file or skill parts provided.",
-		})
-		return
-	}
-	responsePartCount = len(req.Parts)
-
-	// Skill-only messages need a sentinel context-file part so the turn
-	// pipeline trusts the associated skill metadata.
-	req.Parts = prependAgentChatContextSentinelIfNeeded(
-		req.Parts,
-		workspaceAgent.ID,
-		workspaceAgent.OperatingSystem,
-		directory,
-	)
-
-	content, err := chatprompt.MarshalParts(req.Parts)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to marshal context parts.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	machine := chatstate.NewChatMachine(api.Database, api.Pubsub, chat.ID)
-	err = machine.Update(sysCtx, func(tx *chatstate.Tx, store database.Store) error {
-		locked, err := store.GetChatByID(sysCtx, chat.ID)
-		if err != nil {
-			return xerrors.Errorf("load chat: %w", err)
-		}
-		if !isActiveAgentChat(locked) {
-			return errChatNotActive
-		}
-		if !locked.AgentID.Valid || locked.AgentID.UUID != workspaceAgent.ID {
-			return errChatDoesNotBelongToAgent
-		}
-		if locked.OwnerID != workspace.OwnerID {
-			return errChatDoesNotBelongToWorkspaceOwner
-		}
-		apiKeyID, err := resolveAgentChatContextAPIKeyID(sysCtx, store, locked)
-		if err != nil {
-			return err
-		}
-		sendResult, err := tx.SendMessage(chatstate.SendMessageInput{
-			Message: chatstate.Message{
-				Role:           database.ChatMessageRoleUser,
-				Content:        content,
-				Visibility:     database.ChatMessageVisibilityBoth,
-				ModelConfigID:  uuid.NullUUID{UUID: locked.LastModelConfigID, Valid: locked.LastModelConfigID != uuid.Nil},
-				CreatedBy:      uuid.NullUUID{UUID: locked.OwnerID, Valid: locked.OwnerID != uuid.Nil},
-				ContentVersion: chatprompt.CurrentContentVersion,
-				APIKeyID:       sql.NullString{String: apiKeyID, Valid: apiKeyID != ""},
-			},
-			BusyBehavior: chatstate.BusyBehaviorInterrupt,
-		})
-		if err != nil {
-			return err
-		}
-		if len(sendResult.InsertedMessages) == 0 {
-			return nil
-		}
-		if err := updateAgentChatLastInjectedContextFromMessages(sysCtx, api.Logger, store, chat.ID); err != nil {
-			return xerrors.Errorf("rebuild injected context cache: %w", err)
-		}
-		return nil
-	})
-	if err != nil {
-		switch {
-		case errors.Is(err, errChatNotActive), errors.Is(err, errChatDoesNotBelongToAgent), errors.Is(err, errChatDoesNotBelongToWorkspaceOwner):
-			writeAgentChatError(ctx, rw, err)
-		case errors.Is(err, errChatAPIKeyAttributionUnavailable):
-			httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
-				Message: "Cannot modify context: chat has no API key attribution.",
-			})
-		case errors.Is(err, chatstate.ErrMessageQueueFull):
-			var queueFull *chatstate.MessageQueueFullError
-			detail := ""
-			if errors.As(err, &queueFull) {
-				detail = fmt.Sprintf("Maximum %d messages can be queued.", queueFull.Max)
-			}
-			httpapi.Write(ctx, rw, http.StatusTooManyRequests, codersdk.Response{
-				Message: "Message queue is full.",
-				Detail:  detail,
-			})
-		case errors.Is(err, chatstate.ErrInvalidState):
-			httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
-				Message: "Chat is in an invalid state.",
-			})
-		case errors.Is(err, chatstate.ErrTransitionNotAllowed):
-			httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
-				Message: "Chat is not in a state that accepts new context.",
-				Detail:  err.Error(),
-			})
-		case errors.Is(err, chatstate.ErrChatNotFound):
-			writeAgentChatError(ctx, rw, errChatNotFound)
-		default:
-			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-				Message: "Failed to persist context message.",
-				Detail:  err.Error(),
-			})
-		}
-		return
-	}
-
-	httpapi.Write(ctx, rw, http.StatusOK, agentsdk.AddChatContextResponse{
-		ChatID: chat.ID,
-		Count:  responsePartCount,
-	})
-}
-
-// @x-apidocgen {"skip": true}
-func (api *API) workspaceAgentClearChatContext(rw http.ResponseWriter, r *http.Request) {
-	ctx := r.Context()
-	workspaceAgent := httpmw.WorkspaceAgent(r)
-
-	var req agentsdk.ClearChatContextRequest
-	populated := readChatContextBody(ctx, rw, r, &req, true)
-	if !populated && r.Body != http.NoBody {
-		return
-	}
-
-	// Use system context for chat operations since the
-	// workspace agent scope does not include chat resources.
-	//nolint:gocritic // Agent needs system access to read/write chat resources.
-	sysCtx := dbauthz.AsSystemRestricted(ctx)
-	workspace, err := api.Database.GetWorkspaceByAgentID(sysCtx, workspaceAgent.ID)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to determine workspace from agent token.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	chat, err := resolveAgentChat(sysCtx, api.Database, workspaceAgent.ID, workspace.OwnerID, req.ChatID)
-	if err != nil {
-		// Zero active chats is not an error for clear.
-		if errors.Is(err, errNoActiveChats) {
-			httpapi.Write(ctx, rw, http.StatusOK, agentsdk.ClearChatContextResponse{})
-			return
-		}
-		writeAgentChatError(ctx, rw, err)
-		return
-	}
-
-	err = clearAgentChatContext(sysCtx, api.Database, chat.ID, workspaceAgent.ID, workspace.OwnerID)
-	if err != nil {
-		if errors.Is(err, errChatNotActive) || errors.Is(err, errChatDoesNotBelongToAgent) || errors.Is(err, errChatDoesNotBelongToWorkspaceOwner) {
-			writeAgentChatError(ctx, rw, err)
-			return
-		}
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Failed to clear context from chat.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	httpapi.Write(ctx, rw, http.StatusOK, agentsdk.ClearChatContextResponse{
-		ChatID: chat.ID,
-	})
-}
-
 // workspaceAgentRefreshChatContext re-pins every drifted chat bound to the
 // calling agent to the agent's latest context snapshot, clearing their
 // drift markers. It backs the in-workspace `coder exp chat context refresh`
 // (no chat argument), which uses the agent token rather than a user
-// session, mirroring workspaceAgentClearChatContext's auth model.
+// session.
 //
 // @x-apidocgen {"skip": true}
 func (api *API) workspaceAgentRefreshChatContext(rw http.ResponseWriter, r *http.Request) {
@@ -2753,383 +2446,3 @@ func (api *API) workspaceAgentRefreshChatContext(rw http.ResponseWriter, r *http
 		Refreshed: refreshed,
 	})
 }
-
-var (
-	errNoActiveChats                     = xerrors.New("no active chats found")
-	errChatNotFound                      = xerrors.New("chat not found")
-	errChatNotActive                     = xerrors.New("chat is not active")
-	errChatDoesNotBelongToAgent          = xerrors.New("chat does not belong to this agent")
-	errChatDoesNotBelongToWorkspaceOwner = xerrors.New("chat does not belong to this workspace owner")
-	errChatAPIKeyAttributionUnavailable  = xerrors.New("chat has no API key attribution")
-)
-
-type multipleActiveChatsError struct {
-	count int
-}
-
-func (e *multipleActiveChatsError) Error() string {
-	return fmt.Sprintf(
-		"multiple active chats (%d) found for this agent, specify a chat ID",
-		e.count,
-	)
-}
-
-func resolveDefaultAgentChat(chats []database.Chat) (database.Chat, error) {
-	switch len(chats) {
-	case 0:
-		return database.Chat{}, errNoActiveChats
-	case 1:
-		return chats[0], nil
-	}
-
-	var rootChat *database.Chat
-	for i := range chats {
-		chat := &chats[i]
-		if chat.ParentChatID.Valid {
-			continue
-		}
-		if rootChat != nil {
-			return database.Chat{}, &multipleActiveChatsError{count: len(chats)}
-		}
-		rootChat = chat
-	}
-	if rootChat != nil {
-		return *rootChat, nil
-	}
-	return database.Chat{}, &multipleActiveChatsError{count: len(chats)}
-}
-
-// resolveAgentChat finds the target chat from either an explicit ID
-// or auto-detection via the agent's active chats.
-func resolveAgentChat(
-	ctx context.Context,
-	db database.Store,
-	agentID uuid.UUID,
-	workspaceOwnerID uuid.UUID,
-	explicitChatID uuid.UUID,
-) (database.Chat, error) {
-	if explicitChatID == uuid.Nil {
-		chats, err := db.GetActiveChatsByAgentID(ctx, agentID)
-		if err != nil {
-			return database.Chat{}, xerrors.Errorf("list active chats: %w", err)
-		}
-		ownerChats := make([]database.Chat, 0, len(chats))
-		for _, chat := range chats {
-			if chat.OwnerID != workspaceOwnerID {
-				continue
-			}
-			ownerChats = append(ownerChats, chat)
-		}
-		return resolveDefaultAgentChat(ownerChats)
-	}
-
-	chat, err := db.GetChatByID(ctx, explicitChatID)
-	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) {
-			return database.Chat{}, errChatNotFound
-		}
-		return database.Chat{}, xerrors.Errorf("get chat by id: %w", err)
-	}
-	if !chat.AgentID.Valid || chat.AgentID.UUID != agentID {
-		return database.Chat{}, errChatDoesNotBelongToAgent
-	}
-	if chat.OwnerID != workspaceOwnerID {
-		return database.Chat{}, errChatDoesNotBelongToWorkspaceOwner
-	}
-	if !isActiveAgentChat(chat) {
-		return database.Chat{}, errChatNotActive
-	}
-	return chat, nil
-}
-
-func isActiveAgentChat(chat database.Chat) bool {
-	if chat.Archived {
-		return false
-	}
-
-	switch chat.Status {
-	case database.ChatStatusWaiting,
-		database.ChatStatusPending,
-		database.ChatStatusRunning,
-		database.ChatStatusPaused,
-		database.ChatStatusRequiresAction:
-		return true
-	default:
-		return false
-	}
-}
-
-func resolveAgentChatContextAPIKeyID(ctx context.Context, db database.Store, chat database.Chat) (string, error) {
-	messages, err := db.GetChatMessagesByChatID(ctx, database.GetChatMessagesByChatIDParams{
-		ChatID:  chat.ID,
-		AfterID: 0,
-	})
-	if err != nil {
-		return "", xerrors.Errorf("load chat messages for API key attribution: %w", err)
-	}
-	for i := len(messages) - 1; i >= 0; i-- {
-		message := messages[i]
-		if message.Role != database.ChatMessageRoleUser {
-			continue
-		}
-		if !message.APIKeyID.Valid || message.APIKeyID.String == "" {
-			continue
-		}
-		return message.APIKeyID.String, nil
-	}
-
-	loginTypes := []database.LoginType{
-		database.LoginTypePassword,
-		database.LoginTypeOIDC,
-		database.LoginTypeGithub,
-		database.LoginTypeToken,
-		database.LoginTypeNone,
-	}
-	var newest database.APIKey
-	hasNewest := false
-	for _, loginType := range loginTypes {
-		keys, err := db.GetAPIKeysByUserID(ctx, database.GetAPIKeysByUserIDParams{
-			LoginType:      loginType,
-			UserID:         chat.OwnerID,
-			IncludeExpired: false,
-		})
-		if err != nil {
-			return "", xerrors.Errorf("load owner API keys for attribution: %w", err)
-		}
-		for _, key := range keys {
-			if !hasNewest || key.CreatedAt.After(newest.CreatedAt) {
-				newest = key
-				hasNewest = true
-			}
-		}
-	}
-	if !hasNewest {
-		return "", errChatAPIKeyAttributionUnavailable
-	}
-	return newest.ID, nil
-}
-
-func clearAgentChatContext(
-	ctx context.Context,
-	db database.Store,
-	chatID uuid.UUID,
-	agentID uuid.UUID,
-	workspaceOwnerID uuid.UUID,
-) error {
-	return db.InTx(func(tx database.Store) error {
-		locked, err := tx.GetChatByIDForUpdate(ctx, chatID)
-		if err != nil {
-			return xerrors.Errorf("lock chat: %w", err)
-		}
-		if !isActiveAgentChat(locked) {
-			return errChatNotActive
-		}
-		if !locked.AgentID.Valid || locked.AgentID.UUID != agentID {
-			return errChatDoesNotBelongToAgent
-		}
-		if locked.OwnerID != workspaceOwnerID {
-			return errChatDoesNotBelongToWorkspaceOwner
-		}
-		messages, err := tx.GetChatMessagesByChatID(ctx, database.GetChatMessagesByChatIDParams{
-			ChatID:  chatID,
-			AfterID: 0,
-		})
-		if err != nil {
-			return xerrors.Errorf("get chat messages: %w", err)
-		}
-		hadInjectedContext := locked.LastInjectedContext.Valid
-		var skillOnlyMessageIDs []int64
-		for _, msg := range messages {
-			if !msg.Content.Valid {
-				continue
-			}
-			hasContextFile := messageHasPartTypes(msg.Content.RawMessage, codersdk.ChatMessagePartTypeContextFile)
-			hasSkill := messageHasPartTypes(msg.Content.RawMessage, codersdk.ChatMessagePartTypeSkill)
-			if hasContextFile || hasSkill {
-				hadInjectedContext = true
-			}
-			if hasSkill && !hasContextFile {
-				skillOnlyMessageIDs = append(skillOnlyMessageIDs, msg.ID)
-			}
-		}
-		if !hadInjectedContext {
-			return nil
-		}
-		if err := tx.SoftDeleteContextFileMessages(ctx, chatID); err != nil {
-			return xerrors.Errorf("soft delete context-file messages: %w", err)
-		}
-		for _, messageID := range skillOnlyMessageIDs {
-			if err := tx.SoftDeleteChatMessageByID(ctx, messageID); err != nil {
-				return xerrors.Errorf("soft delete context message %d: %w", messageID, err)
-			}
-		}
-		// Reset provider-side Responses chaining so the next turn replays
-		// the post-clear history instead of inheriting cleared context.
-		if err := tx.ClearChatMessageProviderResponseIDsByChatID(ctx, chatID); err != nil {
-			return xerrors.Errorf("clear provider response chain: %w", err)
-		}
-		// Clear the injected-context cache inside the transaction so it is
-		// atomic with the soft-deletes.
-		param, err := chatd.BuildLastInjectedContext(nil)
-		if err != nil {
-			return xerrors.Errorf("clear injected context cache: %w", err)
-		}
-		if _, err := tx.UpdateChatLastInjectedContext(ctx, database.UpdateChatLastInjectedContextParams{
-			ID:                  chatID,
-			LastInjectedContext: param,
-		}); err != nil {
-			return xerrors.Errorf("clear injected context cache: %w", err)
-		}
-		return nil
-	}, nil)
-}
-
-// prependAgentChatContextSentinelIfNeeded adds an empty context-file
-// part when the request only carries skills. The turn pipeline uses
-// the sentinel's agent metadata to trust the skill parts.
-func prependAgentChatContextSentinelIfNeeded(
-	parts []codersdk.ChatMessagePart,
-	agentID uuid.UUID,
-	operatingSystem string,
-	directory string,
-) []codersdk.ChatMessagePart {
-	hasContextFile := false
-	hasSkill := false
-	for _, part := range parts {
-		switch part.Type {
-		case codersdk.ChatMessagePartTypeContextFile:
-			hasContextFile = true
-		case codersdk.ChatMessagePartTypeSkill:
-			hasSkill = true
-		}
-		if hasContextFile && hasSkill {
-			return parts
-		}
-	}
-	if !hasSkill || hasContextFile {
-		return parts
-	}
-	return append([]codersdk.ChatMessagePart{{
-		Type:            codersdk.ChatMessagePartTypeContextFile,
-		ContextFilePath: chatd.AgentChatContextSentinelPath,
-		ContextFileAgentID: uuid.NullUUID{
-			UUID:  agentID,
-			Valid: true,
-		},
-		ContextFileOS:        operatingSystem,
-		ContextFileDirectory: directory,
-	}}, parts...)
-}
-
-func sortChatMessagesByCreatedAtAndID(messages []database.ChatMessage) {
-	sort.SliceStable(messages, func(i, j int) bool {
-		if messages[i].CreatedAt.Equal(messages[j].CreatedAt) {
-			return messages[i].ID < messages[j].ID
-		}
-		return messages[i].CreatedAt.Before(messages[j].CreatedAt)
-	})
-}
-
-// updateAgentChatLastInjectedContextFromMessages rebuilds the
-// injected-context cache from all persisted context-file and skill parts.
-func updateAgentChatLastInjectedContextFromMessages(
-	ctx context.Context,
-	logger slog.Logger,
-	db database.Store,
-	chatID uuid.UUID,
-) error {
-	messages, err := db.GetChatMessagesByChatID(ctx, database.GetChatMessagesByChatIDParams{
-		ChatID:  chatID,
-		AfterID: 0,
-	})
-	if err != nil {
-		return xerrors.Errorf("load context messages for injected context: %w", err)
-	}
-
-	sortChatMessagesByCreatedAtAndID(messages)
-
-	parts, err := chatd.CollectContextPartsFromMessages(ctx, logger, messages, true)
-	if err != nil {
-		return xerrors.Errorf("collect injected context parts: %w", err)
-	}
-	parts = chatd.FilterContextPartsToLatestAgent(parts)
-
-	param, err := chatd.BuildLastInjectedContext(parts)
-	if err != nil {
-		return xerrors.Errorf("update injected context: %w", err)
-	}
-	if _, err := db.UpdateChatLastInjectedContext(ctx, database.UpdateChatLastInjectedContextParams{
-		ID:                  chatID,
-		LastInjectedContext: param,
-	}); err != nil {
-		return xerrors.Errorf("update injected context: %w", err)
-	}
-	return nil
-}
-
-func messageHasPartTypes(raw []byte, types ...codersdk.ChatMessagePartType) bool {
-	var parts []codersdk.ChatMessagePart
-	if err := json.Unmarshal(raw, &parts); err != nil {
-		return false
-	}
-	for _, part := range parts {
-		for _, typ := range types {
-			if part.Type == typ {
-				return true
-			}
-		}
-	}
-	return false
-}
-
-// writeAgentChatError translates resolveAgentChat errors to HTTP
-// responses.
-func writeAgentChatError(
-	ctx context.Context,
-	rw http.ResponseWriter,
-	err error,
-) {
-	if errors.Is(err, errNoActiveChats) {
-		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
-			Message: "No active chats found for this agent.",
-		})
-		return
-	}
-	if errors.Is(err, errChatNotFound) {
-		httpapi.Write(ctx, rw, http.StatusNotFound, codersdk.Response{
-			Message: "Chat not found.",
-		})
-		return
-	}
-	if errors.Is(err, errChatDoesNotBelongToAgent) {
-		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-			Message: "Chat does not belong to this agent.",
-		})
-		return
-	}
-	if errors.Is(err, errChatDoesNotBelongToWorkspaceOwner) {
-		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
-			Message: "Chat does not belong to this workspace owner.",
-		})
-		return
-	}
-	if errors.Is(err, errChatNotActive) {
-		httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
-			Message: "Cannot modify context: this chat is no longer active.",
-		})
-		return
-	}
-
-	var multipleErr *multipleActiveChatsError
-	if errors.As(err, &multipleErr) {
-		httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
-			Message: err.Error(),
-		})
-		return
-	}
-
-	httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-		Message: "Failed to resolve chat.",
-		Detail:  err.Error(),
-	})
-}