gitwig 2.6.7

//! Configuration loader, migrator, and settings persistence for TOML configs.

use std::error::Error;
use std::fs;
use std::path::{Path, PathBuf};

use serde::{Deserialize, Serialize};

use crate::state::{AppState, load_state, save_state};

#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum SortOrder {
    Alphabetical,
    RecentVisit,
    LatestChanges,
    Custom,
}

impl SortOrder {
    /// The next mode in the `o` cycle: Custom → Alphabetical → Recent Visit →
    /// Latest Changes → Custom.
    pub fn next(self) -> Self {
        match self {
            SortOrder::Custom => SortOrder::Alphabetical,
            SortOrder::Alphabetical => SortOrder::RecentVisit,
            SortOrder::RecentVisit => SortOrder::LatestChanges,
            SortOrder::LatestChanges => SortOrder::Custom,
        }
    }

    /// The previous mode in the cycle (the inverse of [`SortOrder::next`]).
    pub fn prev(self) -> Self {
        match self {
            SortOrder::Custom => SortOrder::LatestChanges,
            SortOrder::Alphabetical => SortOrder::Custom,
            SortOrder::RecentVisit => SortOrder::Alphabetical,
            SortOrder::LatestChanges => SortOrder::RecentVisit,
        }
    }

    /// Human-readable name used by the sort caption and settings rows.
    pub fn display_name(self) -> &'static str {
        match self {
            SortOrder::Custom => "Custom",
            SortOrder::Alphabetical => "Alphabetical",
            SortOrder::RecentVisit => "Recent Visit",
            SortOrder::LatestChanges => "Latest Changes",
        }
    }
}

fn default_sort_by() -> SortOrder {
    SortOrder::Custom
}

/// How long the event loop waits for input before re-drawing (milliseconds).
/// Lower values feel more responsive; higher values use less CPU.
fn default_poll_interval_ms() -> u64 {
    100
}

/// How long a background `git fetch` may run before it is cancelled (seconds).
///
/// A remote that accepts the TCP connection but never replies — a firewall
/// blackhole, a dead VPN route — would otherwise leave the card spinning forever
/// with no way to clear it. `0` disables the limit.
fn default_fetch_timeout_secs() -> u64 {
    30
}

fn default_max_commits() -> usize {
    500
}

fn default_graph_max_commits() -> usize {
    1000
}

fn default_detail_cache_ttl_secs() -> u64 {
    30
}

fn default_tab_ttl_secs() -> u64 {
    60
}

fn default_page_size() -> usize {
    10
}

fn default_git_app() -> String {
    "gitui".to_string()
}

/// `BatchMode=yes` is load-bearing: without it, ssh bypasses the captured
/// stdio pipes and prompts for passphrases or confirmations directly on
/// `/dev/tty`, painting raw text over the TUI's alternate screen. With it,
/// ssh fails immediately and the error is captured, classified, and shown
/// through the normal error popup instead.
pub fn ssh_command_val() -> &'static str {
    if std::env::var("GITWIG_SSH_STRICT").map(|v| v == "1").unwrap_or(false) {
        "ssh -o BatchMode=yes -o StrictHostKeyChecking=yes"
    } else {
        "ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new"
    }
}

#[derive(Debug, Deserialize, Serialize, Clone, PartialEq, Eq)]
pub struct ThemeConfig {
    #[serde(default = "default_accent")]
    pub accent: String,
    #[serde(default = "default_warning")]
    pub warning: String,
    #[serde(default = "default_danger")]
    pub danger: String,
    #[serde(default = "default_success")]
    pub success: String,
    #[serde(default = "default_border_type")]
    pub border_type: String,
}

#[derive(Debug, Deserialize, Serialize, Clone, PartialEq, Eq, Default)]
pub struct RepoConfig {
    #[serde(default)]
    pub theme: Option<String>,
    #[serde(default)]
    pub page_size: Option<usize>,
    #[serde(default)]
    pub max_commits: Option<usize>,
    #[serde(default)]
    pub resync_on_tab_change: Option<bool>,
    /// Per-repository auto-fetch cadence in minutes. `None` inherits the global
    /// `auto_fetch_interval_mins`; `Some(0)` disables auto-fetch for this repo only.
    #[serde(default)]
    pub auto_fetch_interval_mins: Option<u64>,
    #[serde(default)]
    pub editor: Option<String>,
    #[serde(default)]
    pub note: Option<String>,
}

/// Settings that can be attached to a label and shared by every repository
/// carrying that label. This is the *settings* subset of [`RepoConfig`] — it
/// deliberately excludes per-repo data like `note`, which describes one
/// repository rather than a group. (Commit-message history, which older
/// versions also kept here, now lives in `state.toml`; see `crate::state`.)
///
/// Resolution is three-tier: a per-repo override in [`RepoConfig`] wins first,
/// then the first of the repo's labels (in stored order) that defines the
/// setting, then the global [`Config`] default.
#[derive(Debug, Deserialize, Serialize, Clone, PartialEq, Eq, Default)]
pub struct LabelConfig {
    #[serde(default)]
    pub theme: Option<String>,
    #[serde(default)]
    pub page_size: Option<usize>,
    #[serde(default)]
    pub max_commits: Option<usize>,
    #[serde(default)]
    pub resync_on_tab_change: Option<bool>,
    /// Auto-fetch cadence in minutes for repos with this label. `None` inherits
    /// the global `auto_fetch_interval_mins`; `Some(0)` disables auto-fetch for
    /// the whole group.
    #[serde(default)]
    pub auto_fetch_interval_mins: Option<u64>,
    #[serde(default)]
    pub editor: Option<String>,
    /// Sort mode for the home list while this label's filter ("project view")
    /// is active. `None` inherits the global `sort_by`. Unlike the other rows
    /// this is a property of the label view, not of the repositories in it,
    /// so it has no per-repo counterpart.
    #[serde(default)]
    pub sort_by: Option<SortOrder>,
    /// Sort direction for the home list while this label's filter is active.
    /// `None` inherits the global `sort_reverse`.
    #[serde(default)]
    pub sort_reverse: Option<bool>,
    /// Home list layout (cards, compact rows or the tile grid) while this
    /// label's filter is active. `None` inherits the global `view_mode`. Like
    /// the sort, a property of the label view with no per-repo counterpart.
    #[serde(default)]
    pub view_mode: Option<HomeViewMode>,
}

#[derive(Debug, Deserialize, Serialize, Clone, PartialEq, Eq)]
pub struct ScanConfig {
    #[serde(default = "default_scan_max_depth")]
    pub max_depth: usize,
    #[serde(default = "default_scan_excludes")]
    pub excludes: Vec<String>,
    #[serde(default = "default_scan_start_dir")]
    pub start_dir: String,
    #[serde(default = "default_scan_git_only")]
    pub git_only: bool,
}

impl Default for ThemeConfig {
    fn default() -> Self {
        default_theme()
    }
}

impl Default for ScanConfig {
    fn default() -> Self {
        default_scan()
    }
}

impl Default for Config {
    fn default() -> Self {
        Config {
            items: Vec::new(),
            poll_interval_ms: default_poll_interval_ms(),
            fetch_timeout_secs: default_fetch_timeout_secs(),
            max_commits: default_max_commits(),
            graph_max_commits: default_graph_max_commits(),
            detail_cache_ttl_secs: default_detail_cache_ttl_secs(),
            tab_ttl_secs: default_tab_ttl_secs(),
            page_size: default_page_size(),
            sort_by: default_sort_by(),
            labels: std::collections::HashMap::new(),
            repo_configs: std::collections::HashMap::new(),
            label_configs: std::collections::HashMap::new(),
            sort_reverse: false,
            pinned: std::collections::HashSet::new(),
            starred: std::collections::HashSet::new(),
            watch_dirs: Vec::new(),
            theme: ThemeConfig::default(),
            theme_name: default_theme_name(),
            scan: default_scan(),
            git_app: default_git_app(),
            compatibility_mode: default_compatibility_mode(),
            resync_on_tab_change: default_resync_on_tab_change(),
            prompt_cwd_repo: default_prompt_cwd_repo(),
            enable_commit_signatures: default_enable_commit_signatures(),
            ssh_strict_host_checking: default_ssh_strict_host_checking(),
            editor: default_editor(),
            compact_view: false,
            view_mode: HomeViewMode::Normal,
            tile_columns: 0,
            show_grouping: true,
            auto_fetch_interval_mins: default_auto_fetch_interval_mins(),
            show_system_stats: default_show_system_stats(),
            show_separators: default_show_separators(),
            stale_threshold_months: default_stale_threshold_months(),
            show_stale_projects: default_show_stale_projects(),
            enable_watch_dirs: default_enable_watch_dirs(),
        }
    }
}

fn default_ssh_strict_host_checking() -> bool {
    false
}

fn default_editor() -> String {
    std::env::var("EDITOR").or_else(|_| std::env::var("VISUAL")).unwrap_or_else(|_| {
        if cfg!(target_os = "windows") { "notepad".to_string() } else { "vim".to_string() }
    })
}

fn default_accent() -> String {
    "cyan".to_string()
}
fn default_warning() -> String {
    "yellow".to_string()
}
fn default_danger() -> String {
    "red".to_string()
}
fn default_success() -> String {
    "green".to_string()
}
fn default_border_type() -> String {
    "rounded".to_string()
}

fn default_theme() -> ThemeConfig {
    ThemeConfig {
        accent: default_accent(),
        warning: default_warning(),
        danger: default_danger(),
        success: default_success(),
        border_type: default_border_type(),
    }
}

fn default_theme_name() -> String {
    "default".to_string()
}

fn default_scan_max_depth() -> usize {
    6
}
pub fn default_scan_excludes() -> Vec<String> {
    vec![
        "node_modules".to_string(),
        "target".to_string(),
        "venv".to_string(),
        ".venv".to_string(),
        "checkout".to_string(),
    ]
}

fn default_scan_start_dir() -> String {
    dirs::home_dir()
        .map(|p| {
            let mut s = p.to_string_lossy().into_owned();
            if !s.ends_with(std::path::MAIN_SEPARATOR) {
                s.push(std::path::MAIN_SEPARATOR);
            }
            s
        })
        .unwrap_or_else(|| "/".to_string())
}
fn default_scan_git_only() -> bool {
    true
}
fn default_compatibility_mode() -> bool {
    true
}
fn default_show_grouping() -> bool {
    true
}
fn default_resync_on_tab_change() -> bool {
    false
}
fn default_enable_commit_signatures() -> bool {
    false
}
fn default_auto_fetch_interval_mins() -> u64 {
    10
}
fn default_show_system_stats() -> bool {
    false
}
fn default_show_separators() -> bool {
    true
}
fn default_stale_threshold_months() -> u32 {
    1
}
fn default_show_stale_projects() -> bool {
    true
}
fn default_enable_watch_dirs() -> bool {
    true
}
fn default_prompt_cwd_repo() -> bool {
    true
}

fn default_scan() -> ScanConfig {
    ScanConfig {
        max_depth: default_scan_max_depth(),
        excludes: default_scan_excludes(),
        start_dir: default_scan_start_dir(),
        git_only: default_scan_git_only(),
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize, Default)]
#[serde(rename_all = "snake_case")]
pub enum HomeViewMode {
    #[default]
    Normal,
    Compact,
    Tile,
}

impl HomeViewMode {
    /// The layout the `v` key moves to: cards → compact → tile → cards.
    pub fn next(self) -> Self {
        match self {
            HomeViewMode::Normal => HomeViewMode::Compact,
            HomeViewMode::Compact => HomeViewMode::Tile,
            HomeViewMode::Tile => HomeViewMode::Normal,
        }
    }

    /// The layout before this one in the `v` cycle.
    pub fn prev(self) -> Self {
        match self {
            HomeViewMode::Normal => HomeViewMode::Tile,
            HomeViewMode::Compact => HomeViewMode::Normal,
            HomeViewMode::Tile => HomeViewMode::Compact,
        }
    }

    pub fn display_name(self) -> &'static str {
        match self {
            HomeViewMode::Normal => "Normal",
            HomeViewMode::Compact => "Compact",
            HomeViewMode::Tile => "Tile",
        }
    }
}

/// Represents the structure of the configuration file.
#[derive(Debug, Deserialize, Serialize, Clone)]
pub struct Config {
    /// Repository/directory paths shown in the main list.
    pub items: Vec<String>,
    /// Event-loop poll interval in milliseconds (default: 100).
    /// Lower → more responsive, higher → less CPU. Sane range: 16–500;
    /// the Settings editor refuses anything below 10.
    #[serde(default = "default_poll_interval_ms")]
    pub poll_interval_ms: u64,
    /// Seconds a background `git fetch` may run before it is cancelled (default: 30).
    /// `0` disables the limit. Raise it for slow remotes on high-latency links.
    #[serde(default = "default_fetch_timeout_secs")]
    pub fetch_timeout_secs: u64,
    /// Maximum commits to load in workspace view. Default: 500; 0 = unlimited.
    #[serde(default = "default_max_commits")]
    pub max_commits: usize,
    /// Maximum commits visualised in the Graph tab (0 = unlimited; default 1000)
    #[serde(default = "default_graph_max_commits")]
    pub graph_max_commits: usize,
    /// TTL in seconds for the detail view cache (default: 30)
    #[serde(default = "default_detail_cache_ttl_secs")]
    pub detail_cache_ttl_secs: u64,
    /// TTL in seconds for the lazy-loaded tabs (default: 60)
    #[serde(default = "default_tab_ttl_secs")]
    pub tab_ttl_secs: u64,
    /// Number of lines/items to scroll when PageUp or PageDown is pressed. Default is 10.
    #[serde(default = "default_page_size")]
    pub page_size: usize,
    /// Sort mode for the main page.
    #[serde(default = "default_sort_by")]
    pub sort_by: SortOrder,
    /// Map of repository paths to their labels.
    #[serde(default)]
    pub labels: std::collections::HashMap<String, Vec<String>>,
    /// Repository specific configurations.
    #[serde(default)]
    pub repo_configs: std::collections::HashMap<String, RepoConfig>,
    /// Per-label settings shared by every repository carrying that label.
    /// Resolved between the per-repo override and the global default.
    #[serde(default)]
    pub label_configs: std::collections::HashMap<String, LabelConfig>,
    /// Whether sorting should be reversed.
    #[serde(default)]
    pub sort_reverse: bool,
    /// List of pinned repository paths.
    #[serde(default)]
    pub pinned: std::collections::HashSet<String>,
    /// List of starred repository paths.
    #[serde(default)]
    pub starred: std::collections::HashSet<String>,
    /// Directories to watch for automatic workspace syncing.
    #[serde(default)]
    pub watch_dirs: Vec<String>,
    /// Theme configurations for styling the terminal TUI.
    #[serde(skip)]
    pub theme: ThemeConfig,
    /// Active theme name selection.
    #[serde(rename = "theme", default = "default_theme_name")]
    pub theme_name: String,
    /// Configuration for repository discovery via scanning.
    #[serde(alias = "fzf", rename = "scan", default = "default_scan")]
    pub scan: ScanConfig,
    /// Preferred Git application (e.g. gitui or lazygit).
    #[serde(default = "default_git_app")]
    pub git_app: String,
    /// Enable compatibility mode to use ASCII/simple symbols instead of complex Unicode.
    #[serde(default = "default_compatibility_mode")]
    pub compatibility_mode: bool,
    /// Whether to resync the repository details from disk on tab change.
    #[serde(default = "default_resync_on_tab_change")]
    pub resync_on_tab_change: bool,
    /// Whether to offer to track the repository Gitwig was launched from, when
    /// the working directory sits inside a repo that is not on the list yet.
    #[serde(default = "default_prompt_cwd_repo")]
    pub prompt_cwd_repo: bool,
    /// Whether to enable commit GPG/SSH signatures collection (spawns a git shell process).
    #[serde(default = "default_enable_commit_signatures")]
    pub enable_commit_signatures: bool,
    /// Whether to enforce strict SSH host key checking (StrictHostKeyChecking=yes)
    #[serde(default = "default_ssh_strict_host_checking")]
    pub ssh_strict_host_checking: bool,
    /// Custom terminal editor to open files with.
    #[serde(default = "default_editor")]
    pub editor: String,
    /// Whether to show the compact (1-row) list on the home page.
    #[serde(default)]
    pub compact_view: bool,
    /// The view mode to use for the home page list.
    #[serde(default)]
    pub view_mode: HomeViewMode,
    /// Number of columns in tile mode. 0 means auto-calculate.
    #[serde(default)]
    pub tile_columns: usize,
    /// Whether to enable repository grouping on the home page.
    #[serde(default = "default_show_grouping")]
    pub show_grouping: bool,
    /// Time interval in minutes to automatically run git fetch in the background for all repositories. Set to 0 to disable.
    #[serde(default = "default_auto_fetch_interval_mins")]
    pub auto_fetch_interval_mins: u64,
    /// Whether to show current CPU & Memory stats in the status bar at the bottom.
    #[serde(default = "default_show_system_stats")]
    pub show_system_stats: bool,
    /// Whether to draw the home page's separator rules: the one between the
    /// summary bar and the quick-label chips, the dashes of the sort rule
    /// (its caption stays), and the one under the last pinned repository.
    #[serde(default = "default_show_separators")]
    pub show_separators: bool,
    /// Number of months inactive to be considered stale.
    #[serde(default = "default_stale_threshold_months")]
    pub stale_threshold_months: u32,
    /// Hide stale projects if disabled.
    #[serde(default = "default_show_stale_projects")]
    pub show_stale_projects: bool,
    /// Whether the Watch Directories auto-discovery feature is enabled.
    #[serde(default = "default_enable_watch_dirs")]
    pub enable_watch_dirs: bool,
}

impl Config {
    pub fn sym(&self, key: &str) -> &'static str {
        if self.compatibility_mode {
            match key {
                "branch" => "* ",
                "git_repo" => "G  ",
                "arrow_down" => "v",
                "arrow_right" => ">",
                "folder_tree_expanded" => "v ",
                "folder_tree_collapsed" => "> ",
                "file_tree" => "  -  ",
                "folder" => "[D]",
                "file" => "[F]",
                "pinned" => "[P]",
                "action" => "[!]",
                "warning" => "! ",
                "close" => "x",
                "bullet_empty" => "o",
                "bullet_filled" => "*",
                "rule" => "-",
                "star" => "*",
                "block" => "#",
                "bar" => "|",
                "esc" => "ESC",
                "backspace" => "Backspace",
                "tab" => "Tab",
                "shift" => "Shift",
                "enter" => "Enter",
                "up" => "^",
                "down" => "v",
                "page_up" => "PgUp",
                "page_down" => "PgDn",
                "transfer" => "<->",
                "up_down" => "^/v",
                "selection_mark" => "> ",
                _ => "",
            }
        } else {
            match key {
                "branch" => " ",
                "git_repo" => "⎇  ",
                "arrow_down" => "▼",
                "arrow_right" => "▶",
                "folder_tree_expanded" => "▼ ",
                "folder_tree_collapsed" => "> ",
                "file_tree" => "  📄 ",
                "folder" => "📁 ",
                "file" => "📄 ",
                "pinned" => "📌 ",
                "action" => "⚡ ",
                "warning" => "⚠ ",
                "close" => "✕",
                "bullet_empty" => "○",
                "bullet_filled" => "●",
                "rule" => "┄",
                "star" => "★",
                "block" => "█",
                "bar" => "▍",
                "esc" => "⎋",
                "backspace" => "⌫",
                "tab" => "⇥",
                "shift" => "⇧",
                "enter" => "↵",
                "up" => "↑",
                "down" => "↓",
                "page_up" => "⇞",
                "page_down" => "⇟",
                "transfer" => "⇆",
                "up_down" => "↑↓",
                "selection_mark" => "▌ ",
                _ => "",
            }
        }
    }
}

/// Returns `~/.gitwig/`, the canonical Gitwig data directory.
/// Falls back to `./.gitwig/` in the unlikely event that the home directory
/// cannot be resolved (e.g. inside a stripped-down container).
fn home_gitwig_dir() -> PathBuf {
    dirs::home_dir().unwrap_or_else(|| PathBuf::from(".")).join(".gitwig")
}

fn handle_parse_error(path: &Path, _error: Box<dyn Error>) -> (Config, Option<String>) {
    let ts = std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
        .map(|d| d.as_secs())
        .unwrap_or(0);
    let corrupt_path = path.with_extension(format!("toml.corrupt-{}", ts));
    let rename_result = fs::rename(path, &corrupt_path);

    let fallback = Config {
        items: vec![],
        poll_interval_ms: default_poll_interval_ms(),
        fetch_timeout_secs: default_fetch_timeout_secs(),
        max_commits: default_max_commits(),
        graph_max_commits: default_graph_max_commits(),
        detail_cache_ttl_secs: default_detail_cache_ttl_secs(),
        tab_ttl_secs: default_tab_ttl_secs(),
        page_size: default_page_size(),
        sort_by: default_sort_by(),
        labels: std::collections::HashMap::new(),
        repo_configs: std::collections::HashMap::new(),
        label_configs: std::collections::HashMap::new(),
        sort_reverse: false,
        pinned: std::collections::HashSet::new(),
        starred: std::collections::HashSet::new(),
        watch_dirs: vec![],
        theme_name: default_theme_name(),
        theme: default_theme(),
        scan: default_scan(),
        git_app: default_git_app(),
        compatibility_mode: true,
        resync_on_tab_change: false,
        enable_commit_signatures: false,
        ssh_strict_host_checking: false,
        editor: default_editor(),
        compact_view: false,
        view_mode: HomeViewMode::Normal,
        tile_columns: 0,
        show_grouping: true,
        auto_fetch_interval_mins: default_auto_fetch_interval_mins(),
        show_system_stats: default_show_system_stats(),
        show_separators: default_show_separators(),
        stale_threshold_months: default_stale_threshold_months(),
        show_stale_projects: default_show_stale_projects(),
        prompt_cwd_repo: default_prompt_cwd_repo(),
        enable_watch_dirs: default_enable_watch_dirs(),
    };

    // Attempt to save the fallback back to the original path.
    let _ = save_config(&fallback, path);

    let msg = match rename_result {
        Ok(_) => format!(
            "Config corrupt! Moved to {} and reset to defaults",
            corrupt_path.file_name().unwrap_or_default().to_string_lossy()
        ),
        Err(e) => format!("Config corrupt! Reset to defaults (failed to rename: {})", e),
    };
    (fallback, Some(msg))
}

/// Parses `path` into a [`Config`]. Usage state that older versions kept in
/// `config.toml` (`visits`, `label_slots`, `active_label_filter`, and each
/// repo's `commit_history`) is lifted out and returned separately so
/// `load_config` can fold it into `state.toml`.
fn load_and_parse_config(path: &Path) -> (Config, Option<AppState>, Option<String>) {
    let parsed = fs::read_to_string(path).map_err(|e| e.into()).and_then(|contents| {
        toml::from_str::<toml::Table>(&contents).map_err(|e| e.into()).and_then(|mut table| {
            let legacy = AppState::take_legacy(&mut table);
            toml::Value::Table(table)
                .try_into::<Config>()
                .map(|config| (config, legacy))
                .map_err(|e| e.into())
        })
    });
    match parsed {
        Ok((config, legacy)) => {
            let (config, warning) = sanitize_config(config);
            (config, legacy, warning)
        }
        Err(err) => {
            let (config, warning) = handle_parse_error(path, err);
            (config, None, warning)
        }
    }
}

/// Applies the one-off migrations and validations a freshly parsed config needs.
fn sanitize_config(mut config: Config) -> (Config, Option<String>) {
    if config.compact_view && config.view_mode == HomeViewMode::Normal {
        config.view_mode = HomeViewMode::Compact;
        config.compact_view = false;
    }

    if config.scan.excludes.is_empty() {
        config.scan.excludes = default_scan_excludes();
    } else if config.scan.excludes.contains(&"target".to_string())
        && !config.scan.excludes.contains(&"checkout".to_string())
    {
        config.scan.excludes.push("checkout".to_string());
    }

    let allowed = ["git", "gitui", "lazygit"];
    if !allowed.contains(&config.git_app.as_str()) {
        let old_val = config.git_app.clone();
        config.git_app = "gitui".to_string();
        let warning = format!("Invalid preferred Git client '{}' reset to 'gitui'", old_val);
        (config, Some(warning))
    } else {
        (config, None)
    }
}

/// Loads the configuration, ensuring `~/.gitwig/` always exists.
///
/// Resolution order:
/// 1. CLI-provided path (if given, skip all migration logic).
/// 2. `~/.gitwig/config.toml` — the canonical location. If it already
///    exists it is loaded directly.
/// 3. First-run migration: copy the first config found among
///    `./config/config.toml` (CWD or exe-dir), `~/.twig/config.toml`,
///    `~/.config/gitwig/config.toml`, or `~/.config/twig/config.toml`
///    into `~/.gitwig/config.toml`, then load from there.
/// 4. No prior config anywhere: write a default config to
///    `~/.gitwig/config.toml` so the next run is an ordinary case 2.
///
/// Whichever file the config came from, the usage state is read from the
/// `state.toml` beside it. State keys still found inside `config.toml`
/// (written by older versions) are moved across: merged into `state.toml`
/// without overriding what it already holds, and dropped from `config.toml`
/// by rewriting it.
///
/// # Returns
/// `Ok((Config, AppState, PathBuf, Option<String>))` — the parsed config, the
/// usage state, the config's write-back path, and an optional recovery warning.
pub fn load_config(cli_path: Option<PathBuf>) -> Result<LoadedConfig, Box<dyn Error>> {
    let (config, legacy, path, warning) = load_config_file(cli_path)?;
    let state_path = AppState::path_for(&path);
    let (mut state, state_warning) = load_state(&state_path);

    if let Some(legacy) = legacy {
        state.absorb(legacy);
        // Move the keys across for good: state.toml first, then a clean
        // config.toml. A failure here is not fatal — the next run retries.
        if save_state(&state, &state_path).is_ok() {
            let _ = save_config(&config, &path);
        }
    }

    let warning = match (warning, state_warning) {
        (Some(a), Some(b)) => Some(format!("{}; {}", a, b)),
        (a, b) => a.or(b),
    };
    Ok((config, state, path, warning))
}

/// What [`load_config`] hands back: the config, the usage state, the config's
/// write-back path, and an optional recovery warning for the status bar.
pub type LoadedConfig = (Config, AppState, PathBuf, Option<String>);

/// What [`load_config_file`] hands back: the config, any legacy usage state
/// found inside the file, the config's write-back path, and a recovery warning.
type LoadedConfigFile = (Config, Option<AppState>, PathBuf, Option<String>);

/// The config-file half of [`load_config`]: finds, migrates and parses the
/// config, returning any legacy usage state found inside it alongside.
fn load_config_file(cli_path: Option<PathBuf>) -> Result<LoadedConfigFile, Box<dyn Error>> {
    // ── 1. CLI override ───────────────────────────────────────────────────
    if let Some(path) = cli_path {
        if path.exists() {
            let (mut config, legacy, warning) = load_and_parse_config(&path);

            let themes_dir = path.parent().unwrap_or(&path).join("themes");
            let _ = fs::create_dir_all(&themes_dir);
            let _ = write_popular_themes(&themes_dir);

            let theme_path = themes_dir.join(format!("{}.theme", config.theme_name));
            if theme_path.exists() {
                if let Ok(theme_contents) = fs::read_to_string(&theme_path) {
                    if let Ok(theme) = toml::from_str::<ThemeConfig>(&theme_contents) {
                        config.theme = theme;
                    } else {
                        config.theme = default_theme();
                    }
                } else {
                    config.theme = default_theme();
                }
            } else {
                let legacy_theme_path = path.with_file_name("theme.toml");
                if legacy_theme_path.exists() {
                    let _ = fs::copy(&legacy_theme_path, themes_dir.join("default.theme"));
                    let _ = fs::remove_file(&legacy_theme_path);
                }

                if let Ok(theme_serialized) = toml::to_string_pretty(&config.theme) {
                    let _ = fs::write(&theme_path, theme_serialized);
                }
            }

            return Ok((config, legacy, path, warning));
        }
        let fallback_theme = default_theme();
        let fallback_theme_name = default_theme_name();

        let themes_dir = path.parent().unwrap_or(&path).join("themes");
        let _ = fs::create_dir_all(&themes_dir);
        let _ = write_popular_themes(&themes_dir);
        let theme_path = themes_dir.join(format!("{}.theme", fallback_theme_name));
        if let Ok(theme_serialized) = toml::to_string_pretty(&fallback_theme) {
            let _ = fs::write(&theme_path, theme_serialized);
        }

        return Ok((
            Config {
                items: vec![],
                poll_interval_ms: default_poll_interval_ms(),
                fetch_timeout_secs: default_fetch_timeout_secs(),
                max_commits: default_max_commits(),
                graph_max_commits: default_graph_max_commits(),
                detail_cache_ttl_secs: default_detail_cache_ttl_secs(),
                tab_ttl_secs: default_tab_ttl_secs(),
                page_size: default_page_size(),
                sort_by: default_sort_by(),
                labels: std::collections::HashMap::new(),
                repo_configs: std::collections::HashMap::new(),
                label_configs: std::collections::HashMap::new(),
                sort_reverse: false,
                pinned: std::collections::HashSet::new(),
                starred: std::collections::HashSet::new(),
                watch_dirs: vec![],
                theme_name: fallback_theme_name,
                theme: fallback_theme,
                scan: default_scan(),
                git_app: default_git_app(),
                compatibility_mode: true,
                resync_on_tab_change: false,
                enable_commit_signatures: false,
                ssh_strict_host_checking: false,
                editor: default_editor(),
                compact_view: false,
                view_mode: HomeViewMode::Normal,
                tile_columns: 0,
                show_grouping: true,
                auto_fetch_interval_mins: default_auto_fetch_interval_mins(),
                show_system_stats: default_show_system_stats(),
                show_separators: default_show_separators(),
                stale_threshold_months: default_stale_threshold_months(),
                show_stale_projects: default_show_stale_projects(),
                prompt_cwd_repo: default_prompt_cwd_repo(),
                enable_watch_dirs: default_enable_watch_dirs(),
            },
            None,
            path,
            None,
        ));
    }

    // ── Always ensure ~/.gitwig/ exists ───────────────────────────────────
    let gitwig_dir = home_gitwig_dir();
    let _ = fs::create_dir_all(&gitwig_dir);
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        if let Ok(meta) = fs::metadata(&gitwig_dir) {
            let mut perms = meta.permissions();
            perms.set_mode(0o700);
            let _ = fs::set_permissions(&gitwig_dir, perms);
        }
    }
    let canonical = gitwig_dir.join("config.toml");
    let themes_dir = gitwig_dir.join("themes");
    let _ = fs::create_dir_all(&themes_dir);
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        if let Ok(meta) = fs::metadata(&themes_dir) {
            let mut perms = meta.permissions();
            perms.set_mode(0o700);
            let _ = fs::set_permissions(&themes_dir, perms);
        }
    }
    let _ = write_popular_themes(&themes_dir);

    // ── 2. Canonical file already present ─────────────────────────────────
    if canonical.exists() {
        let (mut config, legacy, warning) = load_and_parse_config(&canonical);

        let theme_path = themes_dir.join(format!("{}.theme", config.theme_name));
        if theme_path.exists() {
            if let Ok(theme_contents) = fs::read_to_string(&theme_path) {
                if let Ok(theme) = toml::from_str::<ThemeConfig>(&theme_contents) {
                    config.theme = theme;
                } else {
                    config.theme = default_theme();
                }
            } else {
                config.theme = default_theme();
            }
        } else {
            let legacy_theme_path = gitwig_dir.join("theme.toml");
            if legacy_theme_path.exists() {
                let _ = fs::copy(&legacy_theme_path, themes_dir.join("default.theme"));
                let _ = fs::remove_file(&legacy_theme_path);
            }

            if let Ok(theme_serialized) = toml::to_string_pretty(&config.theme) {
                let _ = fs::write(&theme_path, theme_serialized);
            }
        }

        return Ok((config, legacy, canonical, warning));
    }

    // ── 3. First run: migrate an existing config into ~/.gitwig/ ──────────
    if let Some(source) = find_legacy_config() {
        fs::copy(&source, &canonical)?;
        let (mut config, legacy, warning) = load_and_parse_config(&canonical);

        let theme_path = themes_dir.join(format!("{}.theme", config.theme_name));
        if theme_path.exists() {
            if let Ok(theme_contents) = fs::read_to_string(&theme_path) {
                if let Ok(theme) = toml::from_str::<ThemeConfig>(&theme_contents) {
                    config.theme = theme;
                } else {
                    config.theme = default_theme();
                }
            } else {
                config.theme = default_theme();
            }
        } else {
            let legacy_theme_path = gitwig_dir.join("theme.toml");
            if legacy_theme_path.exists() {
                let _ = fs::copy(&legacy_theme_path, themes_dir.join("default.theme"));
                let _ = fs::remove_file(&legacy_theme_path);
            }

            if let Ok(theme_serialized) = toml::to_string_pretty(&config.theme) {
                let _ = fs::write(&theme_path, theme_serialized);
            }
        }

        return Ok((config, legacy, canonical, warning));
    }

    // ── 4. No config anywhere: write a default and use it ─────────────────
    let fallback = Config {
        items: vec![
            "Nice job. You forgot the config, genius.".to_string(),
            "Still looking... it's not here either.".to_string(),
        ],
        poll_interval_ms: default_poll_interval_ms(),
        fetch_timeout_secs: default_fetch_timeout_secs(),
        max_commits: default_max_commits(),
        graph_max_commits: default_graph_max_commits(),
        detail_cache_ttl_secs: default_detail_cache_ttl_secs(),
        tab_ttl_secs: default_tab_ttl_secs(),
        page_size: default_page_size(),
        sort_by: default_sort_by(),
        labels: std::collections::HashMap::new(),
        repo_configs: std::collections::HashMap::new(),
        label_configs: std::collections::HashMap::new(),
        sort_reverse: false,
        pinned: std::collections::HashSet::new(),
        starred: std::collections::HashSet::new(),
        watch_dirs: vec![],
        theme_name: default_theme_name(),
        theme: default_theme(),
        scan: default_scan(),
        git_app: default_git_app(),
        compatibility_mode: true,
        resync_on_tab_change: false,
        enable_commit_signatures: false,
        ssh_strict_host_checking: false,
        editor: default_editor(),
        compact_view: false,
        view_mode: HomeViewMode::Normal,
        tile_columns: 0,
        show_grouping: true,
        auto_fetch_interval_mins: default_auto_fetch_interval_mins(),
        show_system_stats: default_show_system_stats(),
        show_separators: default_show_separators(),
        stale_threshold_months: default_stale_threshold_months(),
        show_stale_projects: default_show_stale_projects(),
        prompt_cwd_repo: default_prompt_cwd_repo(),
        enable_watch_dirs: default_enable_watch_dirs(),
    };
    save_config(&fallback, &canonical)?;

    let theme_path = themes_dir.join(format!("{}.theme", fallback.theme_name));
    if let Ok(theme_serialized) = toml::to_string_pretty(&fallback.theme) {
        let _ = fs::write(&theme_path, theme_serialized);
    }

    Ok((fallback, None, canonical, None))
}

/// Writes the popular themes to the themes directory if they don't already exist.
fn write_popular_themes(themes_dir: &Path) -> Result<(), Box<dyn Error>> {
    let popular_themes = [
        (
            "catppuccin",
            r#"accent = "lightblue"
warning = "lightyellow"
danger = "lightred"
success = "lightgreen"
border_type = "rounded"
"#,
        ),
        (
            "cyberpunk",
            r#"accent = "lightmagenta"
warning = "lightyellow"
danger = "lightred"
success = "lightcyan"
border_type = "double"
"#,
        ),
        (
            "dracula",
            r#"accent = "lightmagenta"
warning = "lightyellow"
danger = "lightred"
success = "lightgreen"
border_type = "rounded"
"#,
        ),
        (
            "forest",
            r#"accent = "lightgreen"
warning = "yellow"
danger = "lightred"
success = "green"
border_type = "rounded"
"#,
        ),
        (
            // Pulled straight from the checked-in theme file so the brand palette
            // has exactly one source of truth; see `branding/theme.json`.
            "gitwig",
            include_str!("../config/themes/gitwig.theme"),
        ),
        (
            "gruvbox",
            r#"accent = "yellow"
warning = "lightyellow"
danger = "red"
success = "green"
border_type = "plain"
"#,
        ),
        (
            "monokai",
            r#"accent = "lightyellow"
warning = "yellow"
danger = "red"
success = "green"
border_type = "rounded"
"#,
        ),
        (
            "nord",
            r#"accent = "lightblue"
warning = "yellow"
danger = "red"
success = "green"
border_type = "rounded"
"#,
        ),
        (
            "oceanic",
            r#"accent = "lightcyan"
warning = "yellow"
danger = "red"
success = "lightgreen"
border_type = "rounded"
"#,
        ),
        (
            "onedark",
            r#"accent = "blue"
warning = "yellow"
danger = "lightred"
success = "green"
border_type = "rounded"
"#,
        ),
        (
            "rosepine",
            r#"accent = "lightmagenta"
warning = "yellow"
danger = "lightred"
success = "lightcyan"
border_type = "rounded"
"#,
        ),
        (
            "solarized_dark",
            r#"accent = "cyan"
warning = "yellow"
danger = "red"
success = "green"
border_type = "rounded"
"#,
        ),
        (
            "tokyonight",
            r#"accent = "lightcyan"
warning = "yellow"
danger = "red"
success = "lightgreen"
border_type = "rounded"
"#,
        ),
    ];

    for (name, content) in popular_themes {
        let theme_path = themes_dir.join(format!("{}.theme", name));
        if !theme_path.exists() {
            fs::write(theme_path, content)?;
        }
    }
    Ok(())
}

/// Searches for a pre-existing config at legacy / local locations.
/// Returns the first path that exists, or `None`.
fn find_legacy_config() -> Option<PathBuf> {
    // Local project config relative to CWD.
    let local = PathBuf::from("config/config.toml");
    if local.exists() {
        return Some(local);
    }
    // Local project config relative to the executable directory.
    if let Ok(exe) = std::env::current_exe() {
        if let Some(dir) = exe.parent() {
            let p = dir.join("config/config.toml");
            if p.exists() {
                return Some(p);
            }
        }
    }
    // Legacy Twig home location: ~/.twig/config.toml.
    if let Some(home) = dirs::home_dir() {
        let p = home.join(".twig/config.toml");
        if p.exists() {
            return Some(p);
        }
    }
    // New Gitwig XDG config location: ~/.config/gitwig/config.toml.
    if let Some(p) = dirs::config_dir().map(|d| d.join("gitwig/config.toml")) {
        if p.exists() {
            return Some(p);
        }
    }
    // Legacy Twig XDG config location: ~/.config/twig/config.toml.
    if let Some(p) = dirs::config_dir().map(|d| d.join("twig/config.toml")) {
        if p.exists() {
            return Some(p);
        }
    }
    None
}

/// Serializes the config back to TOML and writes it to `path`, creating any
/// missing parent directories first.
pub fn save_config(config: &Config, path: &Path) -> Result<(), Box<dyn Error>> {
    let serialized = toml::to_string_pretty(config)?;
    write_toml_atomic(path, &serialized)
}

/// Writes `serialized` to `path` atomically (via a `.tmp` sibling and a
/// rename), creating any missing parent directories first and keeping both
/// the directory and the file private to the user.
pub(crate) fn write_toml_atomic(path: &Path, serialized: &str) -> Result<(), Box<dyn Error>> {
    if let Some(parent) = path.parent() {
        if !parent.as_os_str().is_empty() {
            fs::create_dir_all(parent)?;
            #[cfg(unix)]
            {
                use std::os::unix::fs::PermissionsExt;
                if let Ok(meta) = fs::metadata(parent) {
                    let mut perms = meta.permissions();
                    perms.set_mode(0o700);
                    let _ = fs::set_permissions(parent, perms);
                }
            }
        }
    }
    // Write atomically: write to a .tmp file first, then rename. The tmp name
    // is unique per process and write so two writers aiming at the same file
    // (parallel tests, two Gitwig instances) cannot rename each other's tmp
    // away mid-flight; the loser simply gets overwritten by the final rename.
    static TMP_COUNTER: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
    let tmp_path = path.with_extension(format!(
        "toml.tmp-{}-{}",
        std::process::id(),
        TMP_COUNTER.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
    ));
    if let Err(e) = fs::write(&tmp_path, serialized) {
        let _ = fs::remove_file(&tmp_path);
        return Err(e.into());
    }

    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        if let Ok(meta) = fs::metadata(&tmp_path) {
            let mut perms = meta.permissions();
            perms.set_mode(0o600);
            let _ = fs::set_permissions(&tmp_path, perms);
        }
    }

    if let Err(e) = fs::rename(&tmp_path, path) {
        let _ = fs::remove_file(&tmp_path);
        return Err(e.into());
    }
    Ok(())
}

#[cfg(test)]
#[allow(clippy::unwrap_used, clippy::panic)]
mod tests {
    use super::*;
    use std::sync::atomic::{AtomicUsize, Ordering};

    static TEST_DIR_COUNTER: AtomicUsize = AtomicUsize::new(0);

    fn get_unique_id() -> String {
        let count = TEST_DIR_COUNTER.fetch_add(1, Ordering::SeqCst);
        let pid = std::process::id();
        let nanos =
            std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
        format!("{}_{}_{}", pid, nanos, count)
    }

    #[test]
    fn test_theme_separation_load_and_save() {
        let unique_id = get_unique_id();
        let test_dir = std::env::temp_dir().join(format!("gitwig_test_theme_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let config_path = test_dir.join("config.toml");
        let themes_dir = test_dir.join("themes");
        let theme_path = themes_dir.join("default.theme");

        // 1. Initial load when files do not exist (should write themes/default.theme but not config.toml in CLI mode)
        let (config, _, path, _) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(path, config_path);
        assert!(!config_path.exists());
        assert!(theme_path.exists());

        // Verify config.theme is default
        assert_eq!(config.theme.accent, "cyan");
        assert_eq!(config.theme_name, "default");

        // Verify default.theme contains "accent = "cyan""
        let theme_content = fs::read_to_string(&theme_path).unwrap();
        assert!(theme_content.contains("accent = \"cyan\""));

        // Save config
        save_config(&config, &config_path).unwrap();
        assert!(config_path.exists());

        // Verify config.toml does NOT contain the [theme] section but has theme name string
        let config_content = fs::read_to_string(&config_path).unwrap();
        assert!(!config_content.contains("[theme]"));
        assert!(config_content.contains("theme = \"default\""));

        // 2. Modify default.theme and reload
        let custom_theme = r#"accent = "magenta"
warning = "yellow"
danger = "red"
success = "green"
border_type = "double"
"#;
        fs::write(&theme_path, custom_theme).unwrap();
        let (loaded_config, _, _, _) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(loaded_config.theme.accent, "magenta");
        assert_eq!(loaded_config.theme.border_type, "double");

        // 3. Save config and verify config.toml still has no [theme] section but has theme name string
        save_config(&loaded_config, &config_path).unwrap();
        let config_content_after_save = fs::read_to_string(&config_path).unwrap();
        assert!(!config_content_after_save.contains("[theme]"));
        assert!(config_content_after_save.contains("theme = \"default\""));

        // Clean up
        let _ = fs::remove_dir_all(&test_dir);
    }

    #[test]
    fn test_write_popular_themes_creates_files() {
        let unique_id = get_unique_id();
        let test_dir =
            std::env::temp_dir().join(format!("gitwig_test_popular_themes_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();

        write_popular_themes(&test_dir).unwrap();

        // Verify that Dracula, Forest, Gruvbox, Monokai, Nord, Oceanic and new popular themes are written
        assert!(test_dir.join("catppuccin.theme").exists());
        assert!(test_dir.join("cyberpunk.theme").exists());
        assert!(test_dir.join("dracula.theme").exists());
        assert!(test_dir.join("forest.theme").exists());
        assert!(test_dir.join("gitwig.theme").exists());
        assert!(test_dir.join("gruvbox.theme").exists());
        assert!(test_dir.join("monokai.theme").exists());
        assert!(test_dir.join("nord.theme").exists());
        assert!(test_dir.join("oceanic.theme").exists());
        assert!(test_dir.join("onedark.theme").exists());
        assert!(test_dir.join("rosepine.theme").exists());
        assert!(test_dir.join("solarized_dark.theme").exists());
        assert!(test_dir.join("tokyonight.theme").exists());

        // Read one theme to verify content
        let contents = fs::read_to_string(test_dir.join("oceanic.theme")).unwrap();
        assert!(contents.contains("accent = \"lightcyan\""));

        let _ = fs::remove_dir_all(&test_dir);
    }

    #[test]
    fn test_corrupt_config_recovery() {
        let unique_id = get_unique_id();
        let test_dir = std::env::temp_dir().join(format!("gitwig_test_corrupt_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let config_path = test_dir.join("config.toml");

        // Write a corrupt/invalid TOML file
        fs::write(&config_path, "items = [").unwrap();

        // Load config (should move to .corrupt-<ts>, create default config and return warning)
        let (config, _, path, warning) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(path, config_path);
        assert!(config_path.exists());
        assert!(warning.is_some());
        assert!(warning.unwrap().contains("Config corrupt!"));

        // Verify loaded config is default
        assert!(config.items.is_empty());

        // Verify that a corrupt backup file was created in the same directory
        let files = fs::read_dir(&test_dir).unwrap();
        let corrupt_exists = files
            .filter_map(Result::ok)
            .any(|entry| entry.file_name().to_string_lossy().contains("config.toml.corrupt-"));
        assert!(corrupt_exists);

        let _ = fs::remove_dir_all(&test_dir);
    }

    #[test]
    fn test_git_app_validation_recovery() {
        let unique_id = get_unique_id();
        let test_dir = std::env::temp_dir().join(format!("gitwig_test_git_app_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let config_path = test_dir.join("config.toml");

        let config_toml = r#"
items = []
poll_interval_ms = 1000
max_commits = 100
graph_max_commits = 100
detail_cache_ttl_secs = 60
tab_ttl_secs = 60
page_size = 50
sort_by = "alphabetical"
visits = {}
labels = {}
repo_configs = {}
sort_reverse = false
pinned = []
theme_name = "default"
scan = { excludes = [], max_depth = 5, start_dir = "~" }
git_app = "malicious_binary"
compatibility_mode = true
resync_on_tab_change = false
enable_commit_signatures = false
"#;
        fs::write(&config_path, config_toml).unwrap();

        let (config, _, path, warning) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(path, config_path);
        assert_eq!(config.git_app, "gitui");
        assert!(warning.is_some());
        assert!(warning.unwrap().contains("Invalid preferred Git client"));

        let _ = fs::remove_dir_all(&test_dir);
    }

    #[test]
    fn test_config_coverage_boost() {
        // 1. ssh_command_val
        let ssh_val = ssh_command_val();
        assert!(!ssh_val.is_empty());

        // 2. sym on configuration symbols
        let config = Config { compatibility_mode: true, ..Config::default() };
        assert_eq!(config.sym("branch"), "* ");
        let config2 = Config { compatibility_mode: false, ..Config::default() };
        assert_eq!(config2.sym("branch"), "\u{e0a0} ");

        // 3. handle_parse_error
        let unique_id = get_unique_id();
        let test_dir = std::env::temp_dir().join(format!("gitwig_test_parse_err_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let err_path = test_dir.join("config.toml");
        let (config, warning) =
            handle_parse_error(&err_path, Box::new(std::io::Error::other("mock error")));
        assert!(warning.is_some());
        assert!(config.items.is_empty());
        let _ = fs::remove_dir_all(&test_dir);

        // 4. find_legacy_config
        let _legacy = find_legacy_config();
    }

    #[test]
    fn test_state_keys_migrate_out_of_config_toml() {
        let unique_id = get_unique_id();
        let test_dir =
            std::env::temp_dir().join(format!("gitwig_test_state_migrate_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let config_path = test_dir.join("config.toml");
        let state_path = AppState::path_for(&config_path);

        // A config written by a version that still kept usage state inline.
        let legacy_config = r#"
items = ["/a", "/b"]
sort_by = "recent_visit"
active_label_filter = "work"
label_slots = ["work", "oss"]

[visits]
"/a" = 10
"/b" = 20

[labels]
"/a" = ["work"]

[repo_configs."/a"]
page_size = 5
commit_history = ["second", "first"]
"#;
        fs::write(&config_path, legacy_config).unwrap();
        assert!(!state_path.exists());

        let (config, state, path, warning) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(path, config_path);
        assert!(warning.is_none());

        // Settings survive untouched...
        assert_eq!(config.items, vec!["/a".to_string(), "/b".to_string()]);
        assert_eq!(config.sort_by, SortOrder::RecentVisit);
        assert_eq!(config.repo_configs["/a"].page_size, Some(5));
        assert_eq!(config.labels["/a"], vec!["work".to_string()]);

        // ...and the usage state comes back through `AppState`.
        assert_eq!(state.visits.get("/a"), Some(&10));
        assert_eq!(state.visits.get("/b"), Some(&20));
        assert_eq!(state.active_label_filter.as_deref(), Some("work"));
        assert_eq!(state.label_slots, vec!["work".to_string(), "oss".to_string()]);
        assert_eq!(state.commit_history_for("/a"), vec!["second".to_string(), "first".to_string()]);

        // The move is made permanent on disk: state.toml exists and config.toml
        // was rewritten without the state keys but with everything else.
        assert!(state_path.exists());
        let rewritten = fs::read_to_string(&config_path).unwrap();
        for key in ["visits", "active_label_filter", "label_slots", "commit_history"] {
            assert!(!rewritten.contains(key), "`{}` still in config.toml:\n{}", key, rewritten);
        }
        assert!(rewritten.contains("page_size = 5"), "rewritten: {}", rewritten);
        let (from_disk, _) = load_state(&state_path);
        assert_eq!(from_disk, state);

        // A second load is an ordinary run: nothing left to migrate, same result.
        let (_, state_again, _, warning) = load_config(Some(config_path.clone())).unwrap();
        assert!(warning.is_none());
        assert_eq!(state_again, state);

        let _ = fs::remove_dir_all(&test_dir);
    }

    #[test]
    fn test_state_toml_wins_over_stale_keys_left_in_config_toml() {
        let unique_id = get_unique_id();
        let test_dir = std::env::temp_dir().join(format!("gitwig_test_state_merge_{}", unique_id));
        fs::create_dir_all(&test_dir).unwrap();
        let config_path = test_dir.join("config.toml");
        let state_path = AppState::path_for(&config_path);

        fs::write(
            &config_path,
            "items = [\"/a\"]\nactive_label_filter = \"old\"\n[visits]\n\"/a\" = 1\n\"/b\" = 2\n",
        )
        .unwrap();
        let mut existing = AppState::default();
        existing.visits.insert("/a".to_string(), 99);
        existing.active_label_filter = Some("new".to_string());
        save_state(&existing, &state_path).unwrap();

        let (_, state, _, _) = load_config(Some(config_path.clone())).unwrap();
        assert_eq!(state.visits.get("/a"), Some(&99), "state.toml value kept");
        assert_eq!(state.visits.get("/b"), Some(&2), "missing entry filled from config");
        assert_eq!(state.active_label_filter.as_deref(), Some("new"));

        let _ = fs::remove_dir_all(&test_dir);
    }
}