coder/agent/debuglogs.go

package agent

import (
	"context"
	"fmt"
	"io"
	"io/fs"
	"net/http"
	"os"
	"regexp"
	"slices"
	"strings"
	"time"

	"golang.org/x/xerrors"

	"cdr.dev/slog/v3"
)

const (
	activeAgentLogName        = "coder-agent.log"
	debugLogsActiveMaxBytes   = 10 * 1024 * 1024
	debugLogsCombinedMaxBytes = 100 * 1024 * 1024
	// debugLogsWriteTimeout gives slow links well over the server's 20s
	// WriteTimeout to stream the combined logs.
	debugLogsWriteTimeout = 5 * time.Minute
)

// coderAgentRotatedLogPattern matches lumberjack's rotated filenames, e.g.
// coder-agent-2026-05-17T20-00-00.000.log.
var coderAgentRotatedLogPattern = regexp.MustCompile(`^coder-agent-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}\.\d{3}\.log$`)

type agentLogFile struct {
	name    string
	size    int64
	modTime time.Time
}

func (a *agent) HandleHTTPDebugLogs(w http.ResponseWriter, r *http.Request) {
	after, hasAfter, err := parseDebugLogsAfter(r)
	if err != nil {
		http.Error(w, err.Error(), http.StatusBadRequest)
		return
	}

	// Confine reads to logDir so a symlink there cannot escape it.
	root, err := os.OpenRoot(a.logDir)
	if err != nil {
		a.logger.Error(r.Context(), "open agent log dir", slog.Error(err), slog.F("log_dir", a.logDir))
		w.WriteHeader(http.StatusInternalServerError)
		_, _ = fmt.Fprintf(w, "could not open log dir: %s", err)
		return
	}
	defer root.Close()

	if !hasAfter {
		a.writeActiveDebugLog(w, r, root)
		return
	}

	// Streaming the combined logs can exceed the server's 20s WriteTimeout,
	// so extend the deadline for this response.
	if err := http.NewResponseController(w).SetWriteDeadline(time.Now().Add(debugLogsWriteTimeout)); err != nil {
		a.logger.Warn(r.Context(), "extend debug log write deadline", slog.Error(err))
	}

	// Open the required active log before the 200 so failures return 500.
	active, err := root.Open(activeAgentLogName)
	if err != nil {
		a.logger.Error(r.Context(), "open agent log file", slog.Error(err), slog.F("name", activeAgentLogName))
		w.WriteHeader(http.StatusInternalServerError)
		_, _ = fmt.Fprintf(w, "could not open log file: %s", err)
		return
	}
	activeInfo, err := active.Stat()
	if err != nil {
		_ = active.Close()
		a.logger.Error(r.Context(), "stat agent log file", slog.Error(err), slog.F("name", activeAgentLogName))
		w.WriteHeader(http.StatusInternalServerError)
		_, _ = fmt.Fprintf(w, "could not stat log file: %s", err)
		return
	}
	w.WriteHeader(http.StatusOK)
	remaining := int64(debugLogsCombinedMaxBytes)
	// Cap the active log at its own limit so it can't consume the whole
	// budget and starve the rotated logs.
	n, truncated, err := writeAgentLogSection(w, active, activeAgentLogName, activeInfo.Size(), activeInfo.ModTime(), "", min(remaining, debugLogsActiveMaxBytes))
	remaining -= n
	_ = active.Close()
	if err != nil {
		a.logger.Error(r.Context(), "read agent log file", slog.Error(err), slog.F("name", activeAgentLogName))
		return
	}

	// Then rotated logs after the cutoff, newest first.
	rotated, err := rotatedAgentLogFiles(r.Context(), a.logger, root, after)
	if err != nil {
		a.logger.Error(r.Context(), "find rotated agent log files", slog.Error(err), slog.F("log_dir", a.logDir))
		return
	}
	for _, file := range rotated {
		if remaining <= 0 {
			truncated = true
			break
		}
		f, err := root.Open(file.name)
		if err != nil {
			a.logger.Warn(r.Context(), "open rotated agent log file", slog.Error(err), slog.F("name", file.name))
			continue
		}
		var fileTruncated bool
		n, fileTruncated, err = writeAgentLogSection(w, f, file.name, file.size, file.modTime, "\n", remaining)
		remaining -= n
		truncated = truncated || fileTruncated
		_ = f.Close()
		if err != nil {
			a.logger.Error(r.Context(), "read rotated agent log file", slog.Error(err), slog.F("name", file.name))
			return
		}
	}
	if truncated {
		a.logger.Warn(r.Context(), "agent debug logs response truncated", slog.F("limit_bytes", debugLogsCombinedMaxBytes))
	}
}

func parseDebugLogsAfter(r *http.Request) (after time.Time, hasAfter bool, err error) {
	raw := strings.TrimSpace(r.URL.Query().Get("after"))
	if raw == "" {
		return time.Time{}, false, nil
	}
	after, err = time.Parse(time.RFC3339Nano, raw)
	if err != nil {
		return time.Time{}, false, xerrors.Errorf("after must be an RFC3339 timestamp: %w", err)
	}
	return after, true, nil
}

func (a *agent) writeActiveDebugLog(w http.ResponseWriter, r *http.Request, root *os.Root) {
	f, err := root.Open(activeAgentLogName)
	if err != nil {
		a.logger.Error(r.Context(), "open agent log file", slog.Error(err), slog.F("name", activeAgentLogName))
		w.WriteHeader(http.StatusInternalServerError)
		_, _ = fmt.Fprintf(w, "could not open log file: %s", err)
		return
	}
	defer f.Close()

	w.WriteHeader(http.StatusOK)
	_, err = io.Copy(w, io.LimitReader(f, debugLogsActiveMaxBytes))
	if err != nil {
		a.logger.Error(r.Context(), "read agent log file", slog.Error(err))
		return
	}
}

// writeAgentLogSection writes a separator and header for the file, then streams
// up to budget bytes of r. It returns the bytes written and, from size (r's
// full length), whether r was truncated.
func writeAgentLogSection(w io.Writer, r io.Reader, name string, size int64, modTime time.Time, separator string, budget int64) (written int64, truncated bool, err error) {
	header := separator + fmt.Sprintf("=== %s (mtime %s) ===\n", name, modTime.UTC().Format(time.RFC3339Nano))
	if int64(len(header)) > budget {
		return 0, size > 0, nil
	}
	if _, err := io.WriteString(w, header); err != nil {
		return 0, false, err
	}
	contentBudget := budget - int64(len(header))
	n, err := io.Copy(w, io.LimitReader(r, contentBudget))
	return int64(len(header)) + n, size > contentBudget, err
}

// rotatedAgentLogFiles returns rotated logs after the cutoff, newest first,
// excluding the active log and any non-regular files such as symlinks.
func rotatedAgentLogFiles(ctx context.Context, logger slog.Logger, root *os.Root, after time.Time) ([]agentLogFile, error) {
	entries, err := fs.ReadDir(root.FS(), ".")
	if err != nil {
		return nil, xerrors.Errorf("read log directory: %w", err)
	}
	rotated := make([]agentLogFile, 0, len(entries))
	for _, entry := range entries {
		base := entry.Name()
		if !coderAgentRotatedLogPattern.MatchString(base) {
			continue
		}
		info, err := entry.Info()
		if err != nil {
			logger.Warn(ctx, "stat rotated agent log file", slog.Error(err), slog.F("name", base))
			continue
		}
		if !info.Mode().IsRegular() || info.ModTime().Before(after) {
			continue
		}
		rotated = append(rotated, agentLogFile{
			name:    base,
			size:    info.Size(),
			modTime: info.ModTime(),
		})
	}
	slices.SortFunc(rotated, func(a, b agentLogFile) int {
		return b.modTime.Compare(a.modTime)
	})
	return rotated, nil
}