gwm-cli 1.0.0

//! End-to-end tests that invoke the compiled `gwm` binary via assert_cmd.
//! These exercise the user-visible CLI surface (subcommands, help, errors).

mod common;

use assert_cmd::Command;
use common::init_repo;
use predicates::prelude::*;
use std::fs;
use std::path::{Path, PathBuf};

#[test]
fn help_prints_subcommands() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--help");
  // Match the subcommand-listing column exactly: clap aligns subcommand
  // names with two leading spaces and at least two trailing spaces before
  // the description. A loose `contains("cd")` would also match prose like
  // "to cd into it" in another subcommand's description.
  // `cd` is now a visible alias of `path` (clap renders it as
  // `path  ...  [aliases: cd]`), so we assert the alias marker
  // rather than a separate `  cd ` row.
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("  init "))
    .stdout(predicate::str::contains("  list "))
    .stdout(predicate::str::contains("  create "))
    // Issue #83: create an issue from repo templates, then create the worktree.
    .stdout(predicate::str::contains("  new "))
    // Issue #84: render the PR body from `[pr_template]` and shell out to `gh pr create`.
    .stdout(predicate::str::contains("  pr "))
    // Issue #308: materialise an existing PR into a worktree (inbound review).
    .stdout(predicate::str::contains("  review "))
    .stdout(predicate::str::contains("  path "))
    .stdout(predicate::str::contains("[aliases: cd]"))
    .stdout(predicate::str::contains("  bootstrap "))
    // Issue #24: fetch + rebase/merge a worktree onto its upstream.
    .stdout(predicate::str::contains("  sync "))
    .stdout(predicate::str::contains("  prune "))
    .stdout(predicate::str::contains("  completions "))
    .stdout(predicate::str::contains("  shell-init "))
    .stdout(predicate::str::contains("  switch "))
    .stdout(predicate::str::contains("  tmux "))
    .stdout(predicate::str::contains("  zellij "))
    .stdout(predicate::str::contains("  doctor "))
    .stdout(predicate::str::contains("  link "))
    .stdout(predicate::str::contains("  unlink "))
    .stdout(predicate::str::contains("  open "))
    .stdout(predicate::str::contains("  status "))
    // Issue #81: declarative GitHub labels.
    .stdout(predicate::str::contains("  labels "))
    // Issue #82: declarative GitHub milestones.
    .stdout(predicate::str::contains("  milestones "))
    // Issue #95: TOFU trust ledger.
    .stdout(predicate::str::contains("  trust "))
    // Issue #86: CLI aliases (`gwm aliases list`).
    .stdout(predicate::str::contains("  aliases "))
    // Issue #89: git-config-style `.gwm.toml` editing.
    .stdout(predicate::str::contains("  config "))
    // Issue #85: gitmoji commit-prefix + commit-msg hook installer.
    .stdout(predicate::str::contains("  commit-prefix "))
    .stdout(predicate::str::contains("  hooks "))
    // Issue #29: operation journal + undo + history.
    .stdout(predicate::str::contains("  undo "))
    .stdout(predicate::str::contains("  history "))
    // Issue #87: configurable TUI keymap (`gwm tui keys`).
    .stdout(predicate::str::contains("  tui "))
    // Issue #38: long-running JSON-RPC daemon over a unix socket. The
    // subcommand is always listed (help is identical cross-platform); the
    // socket impl is `cfg(unix)`-gated and returns a clean error elsewhere.
    .stdout(predicate::str::contains("  daemon "))
    // Issue #309: first daemon consumer — compact statusline for prompts.
    .stdout(predicate::str::contains("  statusline "))
    // Issue #313: run a command in each worktree.
    .stdout(predicate::str::contains("  exec "))
    // Issue #313: report / reclaim heavy build artifacts across worktrees.
    .stdout(predicate::str::contains("  clean "));
}

// --- gitmoji (issue #85) ------------------------------------------------

#[test]
fn commit_prefix_resolves_branch_to_shortcode_form() {
  // The canonical contract: `gwm commit-prefix --branch feat/#41-foo`
  // prints `:sparkles: feat(#41):` — the prefix every commit in this
  // repo starts with. The shortcode form is the default (matches
  // most commit hooks and tooling that lint emoji on raw text).
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "feat/#41-foo"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":sparkles: feat(#41):"));
}

#[test]
fn commit_prefix_unicode_emits_real_emoji() {
  // The `--unicode` flag swaps `:sparkles:` for ✨ — meant for shell
  // prompts and the commit-msg hook (which wants the final byte
  // sequence in the message body, not the shortcode form).
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "feat/#41-foo", "--unicode"]);
  cmd.assert().success().stdout(predicate::str::contains("✨ feat(#41):"));
}

#[test]
fn commit_prefix_for_fix_branch_uses_bug_emoji() {
  // Second branch type to pin: `fix/#10-bar` ↔ `:bug:` ↔ 🐛. The two
  // most-used emojis in the history both need an end-to-end test
  // so a future refactor that breaks one trips a binary-level
  // assertion.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "fix/#10-bar"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":bug: fix(#10):"));
}

#[test]
fn commit_prefix_with_explicit_branch_honours_repo_gitmoji_overrides() {
  // Regression guard: `--branch <name>` is a scripted entry point —
  // shell prompts, AI assistants, the installed commit-msg hook —
  // but if it bypasses `.gwm.toml`'s `[gitmoji]` block the renderer
  // contradicts itself between `gwm types --gitmoji` (which loads
  // the config) and `gwm commit-prefix --branch …` (which used not
  // to). The two surfaces MUST agree.
  let (dir, _repo) = init_repo();
  let cfg = "[gitmoji]\nfeat = \":rocket:\"\n";
  std::fs::write(dir.path().join(".gwm.toml"), cfg).expect("seed .gwm.toml");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#41-foo"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":rocket: feat(#41):"));
}

#[test]
fn commit_prefix_on_non_gwm_branch_reports_error() {
  // `gwm commit-prefix --branch random` doesn't match the
  // `<type>/#<N>-<slug>` regex — the contract is "fail loudly with a
  // pointer to the convention" rather than silently rendering a
  // bogus prefix. The user typed `--branch <name>` explicitly, so
  // there's no auto-fallback to CWD to fall back to.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "random"]);
  cmd.assert().failure().stderr(predicate::str::contains("random"));
}

#[test]
fn commit_prefix_unicode_normalizes_known_shortcode_override() {
  // The UX guarantee from the PR #152 follow-up: under `--unicode`,
  // a `.gwm.toml` override that supplied a known `:shortcode:` (like
  // `:rocket:`) must render as the unicode glyph (🚀), not the
  // shortcode literal. Asymmetry between this surface and
  // `gwm types --gitmoji`'s unicode column was the original bug.
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":rocket:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#1-x", "--unicode"]);
  cmd.assert().success().stdout(predicate::str::contains("🚀 feat(#1):"));
}

#[test]
fn commit_prefix_unicode_leaves_unknown_shortcode_override_verbatim() {
  // Graceful degradation for shortcodes the built-in table doesn't
  // know about. `:foo:` is not in `shortcode_to_unicode`, so under
  // `--unicode` we keep the value verbatim — the surface must remain
  // usable on any user configuration without falling back to
  // `:question:`/❓ (which would hide the user's intent).
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":foo:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#1-x", "--unicode"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":foo: feat(#1):"));
}

#[test]
fn types_gitmoji_normalizes_known_shortcode_override_in_unicode_column() {
  // Symmetry with `gwm commit-prefix --unicode`: the `gwm types
  // --gitmoji` unicode column must show the GLYPH for a known
  // shortcode override (not the shortcode literal). The shortcode
  // column still shows the literal `:rocket:` so both forms remain
  // greppable on the same row.
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":rocket:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["types", "--gitmoji"]);
  let assert = cmd.assert().success();
  let stdout = String::from_utf8(assert.get_output().stdout.clone()).expect("utf8 stdout");
  // Find the `feat` row and check both columns on it. A per-row
  // assertion (rather than two independent `contains(...)` checks)
  // catches the regression where the glyph appears on some unrelated
  // row but `feat` still shows `:rocket:` in the unicode column.
  let feat_row = stdout
    .lines()
    .find(|l| l.trim_start().starts_with("feat "))
    .expect("feat row must be present in `gwm types --gitmoji` output");
  assert!(
    feat_row.contains("🚀"),
    "feat unicode column must be normalised to 🚀, got: {feat_row:?}"
  );
  assert!(
    feat_row.contains(":rocket:"),
    "feat shortcode column must still be :rocket:, got: {feat_row:?}"
  );
}

#[test]
fn types_with_gitmoji_flag_includes_emoji_columns() {
  // `gwm types --gitmoji` extends the existing per-type list with
  // two more columns: the unicode emoji and the shortcode form. The
  // shortcode is asserted via `:sparkles:` (textual, deterministic);
  // the unicode column is asserted via the ✨ character.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["types", "--gitmoji"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains(":sparkles:"))
    .stdout(predicate::str::contains("✨"))
    .stdout(predicate::str::contains(":bug:"))
    .stdout(predicate::str::contains("🐛"));
}

#[test]
fn types_without_gitmoji_flag_does_not_include_emoji_columns() {
  // Backwards compatibility: `gwm types` (no flag) must NOT spill
  // shortcodes into its output — every scripted parser of the
  // pre-#85 surface depends on the two-column layout.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains(":sparkles:").not())
    .stdout(predicate::str::contains("✨").not());
}

#[test]
fn hooks_install_commit_msg_creates_executable_hook() {
  // `gwm hooks install commit-msg` writes `.git/hooks/commit-msg` and
  // exits 0. We assert on the resulting file (not the stdout
  // message), so the test is robust to cosmetic copy changes.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["hooks", "install", "commit-msg"]);
  cmd.assert().success();

  let hook = dir.path().join(".git").join("hooks").join("commit-msg");
  assert!(hook.exists(), "commit-msg hook must exist after `gwm hooks install`");
  #[cfg(unix)]
  {
    use std::os::unix::fs::PermissionsExt;
    let mode = std::fs::metadata(&hook).expect("stat hook").permissions().mode();
    assert!(mode & 0o100 != 0, "hook must be executable by owner");
  }
}

#[test]
fn hooks_install_commit_msg_refuses_existing_hook_without_force() {
  // Idempotent-safe contract: a pre-existing `commit-msg` (husky,
  // commitlint, …) is left intact and the command exits non-zero
  // with a clear pointer to `--force`.
  let (dir, _repo) = init_repo();
  let hooks_dir = dir.path().join(".git").join("hooks");
  std::fs::create_dir_all(&hooks_dir).expect("hooks dir");
  let hook_path = hooks_dir.join("commit-msg");
  std::fs::write(&hook_path, "#!/bin/sh\necho 'pre-existing hook'\n").expect("seed hook");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["hooks", "install", "commit-msg"]);
  cmd.assert().failure().stderr(predicate::str::contains("--force"));

  let body = std::fs::read_to_string(&hook_path).expect("read seeded hook");
  assert!(
    body.contains("pre-existing hook"),
    "seeded hook must not be overwritten on the refusal path"
  );
}

#[test]
fn hooks_install_commit_msg_force_overwrites() {
  // The escape hatch.
  let (dir, _repo) = init_repo();
  let hooks_dir = dir.path().join(".git").join("hooks");
  std::fs::create_dir_all(&hooks_dir).expect("hooks dir");
  let hook_path = hooks_dir.join("commit-msg");
  std::fs::write(&hook_path, "#!/bin/sh\necho 'old'\n").expect("seed hook");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["hooks", "install", "commit-msg", "--force"]);
  cmd.assert().success();

  let body = std::fs::read_to_string(&hook_path).expect("read installed hook");
  assert!(
    body.contains("gwm commit-msg hook"),
    "installed hook must carry the gwm marker; got {:?}",
    body
  );
}

// --- labels (issue #81) -------------------------------------------------

#[test]
fn labels_help_lists_list_and_push() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["labels", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("push"));
}

#[test]
fn labels_list_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn labels_list_with_no_declared_labels_is_a_no_op() {
  // The no-op fast path: no `[[labels]]` in .gwm.toml ⇒ don't shell
  // out to `gh`, just print a single line and exit 0. The test
  // doesn't need `gh` on PATH to pass — that's the whole point.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

// --- sync (issue #24) -------------------------------------------------------

#[test]
fn sync_unknown_pattern_errors() {
  // A pattern that resolves to no worktree must fail loudly with the
  // worktree name, not silently no-op.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["sync", "does-not-exist"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("does-not-exist"));
}

#[test]
fn sync_in_repo_without_upstream_reports_missing_upstream() {
  // `gwm sync` with no pattern targets the CWD worktree. A fresh repo
  // on `main` with no remote has no upstream → clear, actionable error.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("sync")
    .assert()
    .failure()
    .stderr(predicate::str::contains("upstream"));
}

#[test]
fn sync_from_subdir_names_the_worktree_root_not_the_subdir() {
  // Regression for the Copilot nit on #172: run from a subdirectory,
  // the success line must name the worktree root (the dir tracking the
  // upstream), not the CWD basename. Set up a bare origin + tracking
  // clone so `gwm sync` reaches the "up to date" success print.
  use std::process::Command as Git;

  fn git(dir: &Path, args: &[&str]) {
    let out = Git::new("git")
      .arg("-C")
      .arg(dir)
      .args(["-c", "commit.gpgsign=false"])
      .args(args)
      .env("GIT_AUTHOR_NAME", "t")
      .env("GIT_AUTHOR_EMAIL", "t@t")
      .env("GIT_COMMITTER_NAME", "t")
      .env("GIT_COMMITTER_EMAIL", "t@t")
      .output()
      .unwrap();
    assert!(
      out.status.success(),
      "git {:?}: {}",
      args,
      String::from_utf8_lossy(&out.stderr)
    );
  }

  let td = tempfile::TempDir::new().unwrap();
  let origin = td.path().join("origin");
  let wt = td.path().join("my-worktree");
  std::fs::create_dir_all(&origin).unwrap();
  Git::new("git")
    .args(["init", "--bare", "-b", "main"])
    .arg(&origin)
    .output()
    .unwrap();
  Git::new("git").args(["init", "-b", "main"]).arg(&wt).output().unwrap();
  git(&wt, &["config", "user.email", "t@t"]);
  git(&wt, &["config", "user.name", "t"]);
  std::fs::write(wt.join("file.txt"), "base\n").unwrap();
  git(&wt, &["add", "-A"]);
  git(&wt, &["commit", "-m", "init"]);
  git(&wt, &["remote", "add", "origin", origin.to_str().unwrap()]);
  git(&wt, &["push", "-u", "origin", "main"]);

  let sub = wt.join("src/deep");
  std::fs::create_dir_all(&sub).unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(&sub)
    .arg("sync")
    .assert()
    .success()
    // Names the worktree root dir, not the "deep" subdir we ran from.
    .stdout(predicate::str::contains("my-worktree"))
    .stdout(predicate::str::contains("deep").not());
}

#[test]
fn labels_push_with_no_declared_labels_is_a_no_op() {
  // Same fast path as `list`. Push must not call `gh` when there's
  // nothing to push — that would surface `gh: not found` to users
  // who haven't yet configured `[[labels]]` and tried the command.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "push"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

#[test]
fn labels_push_dry_run_with_no_declared_labels_succeeds() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "push", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

#[test]
fn labels_list_surfaces_invalid_color_with_label_name() {
  // A typo in `color` must be caught at resolve time with the label
  // name in the error message — otherwise the user has to grep their
  // config to find which entry is broken.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[labels]]
name = "bug"
color = "not-a-hex"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("bug"))
    .stderr(predicate::str::contains("not-a-hex"));
}

// --- milestones (issue #82) ---------------------------------------------

#[test]
fn milestones_help_lists_list_and_push() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["milestones", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("push"));
}

#[test]
fn milestones_list_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn milestones_list_with_no_declared_is_a_no_op() {
  // No `[[milestones]]` in .gwm.toml ⇒ don't shell out to `gh`. The
  // test passes without `gh` on PATH — that's the whole point of the
  // fast path.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_push_with_no_declared_is_a_no_op() {
  // Same fast path as `list`. Push must not call `gh` when there's
  // nothing to push.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "push"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_push_dry_run_with_no_declared_succeeds() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "push", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_list_surfaces_invalid_due_on_with_title() {
  // A typo in `due_on` must be caught at resolve time with the
  // milestone title in the error message — otherwise the user has to
  // grep their config to find the offending entry.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[milestones]]
title = "v0.7.0"
due_on = "not-a-date"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("v0.7.0"));
}

#[test]
fn milestones_list_surfaces_invalid_state_with_title() {
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[milestones]]
title = "v0.7.0"
state = "draft"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("v0.7.0"))
    .stderr(predicate::str::contains("draft"));
}

#[test]
fn switch_alias_s_resolves_to_switch() {
  // Issue #22: `gwm s` is the daily-driver alias for `gwm switch`. Resolving
  // `gwm s --help` to the switch help text proves the alias is wired in.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["s", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Open an interactive picker"));
}

#[test]
fn top_level_help_advertises_switch_alias() {
  // The visible alias must show up in the top-level help summary so users
  // discover `gwm s` without reading the subcommand-specific page.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--help");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("switch").and(predicate::str::contains("[aliases: s]")));
}

#[test]
fn switch_outside_git_repo_fails() {
  // Same contract as the other repo-bound subcommands: bail out with a
  // clear error rather than dropping the user into an empty TUI.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("switch")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn doctor_on_fresh_repo_prints_checks() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  // Exit code is intentionally not asserted to be 0: in environments
  // without `lazygit` on PATH (most CI runners) or a pre-existing
  // `~/cc-worktree/` parent, the report legitimately surfaces Warning
  // entries and exits 1. But we still bound the contract — anything
  // other than 0 (all green) or 1 (warning) on a vanilla fresh repo
  // means the doctor is over-flagging (or panicking, which would also
  // produce a non-0/1 code) and we want the test to fail loudly.
  // The 0/1/2 mapping is unit-tested in `tests/doctor_tests.rs`.
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(predicate::in_iter([0_i32, 1]))
    .stdout(predicate::str::contains("✓"))
    .stdout(predicate::str::contains(".gwm.toml"))
    .stdout(predicate::str::contains("base directory writable"));
}

#[test]
fn doctor_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn doctor_exits_one_when_review_binary_missing() {
  // Issue #75: configuring [review] with a binary that's not on $PATH
  // must produce a Warning (exit code 1), not a Failed (exit code 2).
  // Review is opt-in — a CI pre-commit hook gated on `gwm doctor`
  // should still let the user push when only the review tool is
  // missing locally.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[review]
command = "definitely-not-on-path-review-cli {base}..{head}"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(1)
    .stdout(predicate::str::contains("definitely-not-on-path-review-cli"));
}

#[test]
fn doctor_exits_two_on_invalid_config() {
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "broken = [unterminated").unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(2)
    .stdout(predicate::str::contains("✗"));
}

#[test]
fn version_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--version");
  cmd.assert().success().stdout(predicate::str::contains("gwm"));
}

#[test]
fn types_lists_branch_types() {
  // Outside any repo (the temp cwd of `assert_cmd` is typically not a
  // git repo on CI runners) `gwm types` must still list the built-in
  // defaults and surface the `built-in defaults` footer so users can
  // tell they're not looking at a `.gwm.toml` override.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("fix"))
    .stdout(predicate::str::contains("hotfix"))
    .stdout(predicate::str::contains("chore"))
    .stdout(predicate::str::contains("(source: built-in defaults)"));
}

#[test]
fn types_lists_configured_branch_types_from_dot_gwm_toml() {
  // When `.gwm.toml` carries a `[[branch_types]]` block, `gwm types`
  // must reflect the override verbatim and update its source footer.
  // The legacy entries that aren't in the override must NOT bleed
  // through (e.g. `hotfix` is part of the built-in defaults but is
  // intentionally absent from this repo's list).
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[branch_types]]
name = "feat"
description = "Feature"

[[branch_types]]
name = "migration"
description = "Database migration"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("migration"))
    .stdout(predicate::str::contains("Database migration"))
    .stdout(predicate::str::contains("(source: .gwm.toml)"))
    .stdout(predicate::str::contains("hotfix").not());
}

#[test]
fn types_inside_bare_repo_falls_back_to_built_in_defaults() {
  // Bare repos have no `workdir()`, so there's no place to look for a
  // `.gwm.toml`. Regression: previously `cmd_types` would propagate a
  // misleading `NotInGitRepo` error here even though `discover_repo`
  // succeeded. The fallback is identical to the "outside any repo"
  // branch — the built-in defaults with a `(source: built-in
  // defaults)` footer.
  let dir = tempfile::TempDir::new().unwrap();
  git2::Repository::init_bare(dir.path()).expect("init bare repo");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("hotfix"))
    .stdout(predicate::str::contains("(source: built-in defaults)"));
}

#[test]
fn create_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("list");
  cmd
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn list_detect_pr_flag_adds_pr_column_with_detected_number() {
  // E2E (issue #181): `gwm list --detect-pr` shows a PR column populated
  // by `gh pr list` detection for each worktree's branch.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(fake_bin.path(), r#"[{"number":128}]"#, r#"{}"#);

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--detect-pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("PR"))
    .stdout(predicate::str::contains("#128"));
}

#[test]
fn list_without_detect_pr_flag_has_no_pr_column() {
  // Default `gwm list` stays network-free: no PR column, no `#` markers.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("STATUS"))
    .stdout(predicate::str::contains("PATH"))
    .stdout(predicate::str::contains('#').not());
}

#[test]
fn completions_zsh_emits_compdef_header() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "zsh"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("#compdef gwm"))
    .stdout(predicate::str::contains("_gwm"));
}

#[test]
fn completions_bash_emits_complete_directive() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "bash"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("_gwm"))
    .stdout(predicate::str::contains("complete "));
}

#[test]
fn completions_fish_emits_complete_directive() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("complete -c gwm"));
}

#[test]
fn completions_powershell_emits_register_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Register-ArgumentCompleter"))
    .stdout(predicate::str::contains("gwm"));
}

#[test]
fn completions_rejects_unknown_shell() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "tcsh"]);
  cmd.assert().failure();
}

#[test]
fn list_format_names_emits_one_name_per_line() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["list", "--format=names"])
    .assert()
    .success()
    // No table header, no leading "*" marker, no STATUS column.
    .stdout(predicate::str::contains("NAME").not())
    .stdout(predicate::str::contains("STATUS").not())
    // Main worktree is excluded so the output mirrors what `find_fuzzy`
    // accepts (path/remove/bootstrap skip the main workdir). A fresh repo
    // therefore prints nothing.
    .stdout(predicate::str::is_empty());
}

// --- JSON output flags (issue #38, phase 1) ----------------------------

#[test]
fn list_format_json_emits_a_parseable_worktree_array() {
  // Unlike `--format names`, the JSON array includes the main worktree:
  // an editor / statusbar consumer wants the full set, and resolves the
  // active worktree from it. A fresh repo has exactly the main worktree.
  let (dir, _repo) = init_repo();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list", "--format=json"])
    .output()
    .unwrap();
  assert!(out.status.success(), "list --format=json must exit 0");
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("stdout must be valid JSON");
  let arr = v.as_array().expect("top level must be a JSON array");
  assert_eq!(arr.len(), 1, "a fresh repo has exactly the main worktree");
  let main = &arr[0];
  assert_eq!(main["is_main"], serde_json::json!(true));
  // Stable schema keys present.
  assert!(main.get("name").is_some());
  assert!(main.get("path").is_some());
  assert!(main.get("status").is_some());
  assert!(main["status"].get("is_dirty").is_some());
  // Optional link fields are present and null on a fresh repo.
  assert_eq!(main["pr"], serde_json::Value::Null);
}

#[test]
fn list_format_json_with_detect_pr_populates_the_pr_field() {
  // `--format=json --detect-pr` must agree with the table: the JSON `pr`
  // field carries the freshly detected number, not just the persisted
  // link (issue #38 review).
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(fake_bin.path(), r#"[{"number":128}]"#, r#"{}"#);

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  // The main worktree's branch gets the detected PR #128.
  assert!(
    arr.iter().any(|w| w["pr"] == serde_json::json!(128)),
    "detected PR number must surface in the JSON `pr` field, got: {v}"
  );
}

#[test]
fn list_format_json_detect_pr_keeps_explicit_link_when_detection_cannot_run() {
  // Regression (issue #38 review): with `--detect-pr` in a repo that has
  // no GitHub slug, live detection can't run, so it must NOT clobber an
  // explicit/persisted local PR link that the plain listing already shows.
  let (dir, repo) = init_repo();
  // No remote → repo_slug fails → detection yields None for every row.
  let head = repo.head().unwrap();
  let branch = head.shorthand().unwrap().to_string();
  // Explicit PR link in branch config (`branch.<name>.gwm-pr`).
  repo
    .config()
    .unwrap()
    .set_i64(&format!("branch.{branch}.gwm-pr"), 77)
    .unwrap();

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  assert!(
    arr.iter().any(|w| w["pr"] == serde_json::json!(77)),
    "explicit PR link must be preserved when detection can't run, got: {v}"
  );
}

#[test]
fn list_format_json_detect_pr_clears_a_stale_persisted_pr() {
  // The flip side (issue #38 review): when detection DOES run (GitHub slug
  // present) and `gh pr list` returns no PR for a branch that had a
  // persisted detected PR, the JSON must clear it to null — matching the
  // table — not leave the stale number.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap();
  let branch = head.shorthand().unwrap().to_string();
  // A persisted (now stale) detected PR in branch config.
  repo
    .config()
    .unwrap()
    .set_i64(&format!("branch.{branch}.gwm-pr-detected"), 99)
    .unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  // `gh pr list --head` returns no PR → detection clears the cache.
  let fake_gh = write_dispatch_gh(fake_bin.path(), "[]", "{}");

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  assert!(
    arr.iter().all(|w| w["pr"] != serde_json::json!(99)),
    "a stale persisted PR must be cleared once detection runs, got: {v}"
  );
}

#[test]
fn doctor_format_json_emits_checks_severity_and_exit_code() {
  let (dir, _repo) = init_repo();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["doctor", "--format=json"])
    .output()
    .unwrap();
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("doctor json must parse");
  assert!(v["checks"].is_array(), "checks must be an array");
  assert!(
    !v["checks"].as_array().unwrap().is_empty(),
    "doctor runs at least one check"
  );
  let sev = v["severity"].as_str().expect("severity must be a string");
  assert!(
    matches!(sev, "ok" | "warning" | "failed"),
    "severity stable enum, got {sev}"
  );
  // The JSON exit_code mirrors the process exit code.
  let json_code = v["exit_code"].as_i64().expect("exit_code is an integer");
  let proc_code = out.status.code().unwrap_or(-1) as i64;
  assert_eq!(json_code, proc_code, "json exit_code must equal the process exit code");
  // Per-check shape.
  let first = &v["checks"][0];
  assert!(first.get("name").is_some());
  let cs = first["status"].as_str().unwrap();
  assert!(matches!(cs, "ok" | "warning" | "failed"));
}

#[test]
fn path_format_json_emits_name_path_branch() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "38", "json-path"])
    .assert()
    .success();

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["path", "json-path", "--format=json"])
    .output()
    .unwrap();
  assert!(out.status.success(), "path --format=json must exit 0");
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("path json must parse");
  let obj = v.as_object().expect("path json must be an object");
  assert_eq!(obj.len(), 3, "exactly {{name, path, branch}}");
  assert_eq!(v["name"], serde_json::json!("feat-38-json-path"));
  assert_eq!(v["branch"], serde_json::json!("feat/#38-json-path"));
  assert!(
    v["path"].as_str().unwrap().ends_with("feat-38-json-path"),
    "path points at the worktree dir"
  );
}

#[test]
fn daemon_rejects_zero_poll_ms() {
  // `--poll-ms 0` would spin a subscribe loop with no wait; clap rejects
  // it at parse time (range 1..) so the daemon never starts (issue #38
  // review). No repo / socket needed — validation fails first.
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["daemon", "--poll-ms", "0"])
    .assert()
    .failure()
    .stderr(
      predicate::str::contains("0").and(predicate::str::contains("not in").or(predicate::str::contains("invalid"))),
    );
}

#[test]
fn statusline_without_a_daemon_prints_blank_and_exits_zero() {
  // No daemon is listening at the given socket. A prompt substitution must
  // not break: the command exits 0 and emits no worktree summary, just a
  // blank line (issue #309 graceful-degradation contract).
  let sock_dir = tempfile::TempDir::new().unwrap();
  let missing = sock_dir.path().join("no-daemon.sock");
  Command::cargo_bin("gwm")
    .unwrap()
    .arg("statusline")
    .arg("--socket")
    .arg(&missing)
    .assert()
    .success()
    .stdout(predicate::str::contains(" wt").not());
}

#[test]
fn statusline_help_documents_watch_and_socket() {
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["statusline", "--help"])
    .assert()
    .success()
    .stdout(predicate::str::contains("--watch"))
    .stdout(predicate::str::contains("--socket"));
}

#[test]
fn cd_unknown_pattern_fails_with_not_found() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["cd", "nope"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not found"));
}

#[test]
fn cd_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["cd", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// Use `function gcd { ... }` (zsh-style, also valid in bash) rather than
// `gcd() { ... }`. The latter triggers `zsh: defining function based on
// alias 'gcd'` at parse time when an alias of the same name already
// exists — even if a preceding `unalias` would remove it, since zsh
// parses the whole eval'd block before running any of it.
#[test]
fn shell_init_bash_emits_gcd_function() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "bash"]);
  // Pin the invocation site: a regression that mentions `gwm cd` only in
  // a comment but doesn't actually call it from the function body would
  // pass a loose `contains("gwm cd")`. `gwm cd "$@"` (POSIX-style
  // argument forwarding) is what makes `gcd auth` translate into
  // `gwm cd auth`.
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd \"$@\""));
}

#[test]
fn shell_init_zsh_emits_gcd_function() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "zsh"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd \"$@\""));
}

// Regression: in zsh, an existing alias (e.g. `gcd='git checkout'` from
// oh-my-zsh's git plugin) wins over a same-named function and refuses to
// be shadowed at definition time ("defining function based on alias").
// The init script must `unalias gcd` first so the function takes effect
// regardless of the user's prior aliases.
#[test]
fn shell_init_posix_unaliases_gcd_first() {
  // regression: oh-my-zsh's git plugin defines `gcd='git checkout'` which
  // shadowed our gcd function ("defining function based on alias").
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd.assert().success().stdout(predicate::str::contains("unalias gcd"));
  }
}

#[test]
fn shell_init_powershell_unaliases_gcd_first() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Remove-Alias"))
    .stdout(predicate::str::contains("gcd"));
}

#[test]
fn shell_init_fish_emits_function_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd $argv"))
    .stdout(predicate::str::contains("end"));
}

// Regression: fish performs wildcard expansion on unquoted variables, so
// `cd $target` would mangle paths containing `[`, `]`, or `*`. The
// emitted helper must use `cd -- "$target"` to disable both option
// parsing and glob expansion.
#[test]
fn shell_init_fish_quotes_target_with_double_dash() {
  // regression: fish wildcard expansion mangled paths containing `[`, `]`,
  // or `*` when the helper used `cd $target` without `cd -- "$target"`.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("cd -- \"$target\""));
}

#[test]
fn shell_init_powershell_emits_function_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd $Pattern"))
    .stdout(predicate::str::contains("Set-Location"));
}

// Issue #22: with no argument, `gcd` should drop into `gwm switch` (the
// interactive picker) rather than print a usage error. The wrapper must
// still bail before cd'ing if the picker is cancelled (non-zero exit).
#[test]
fn shell_init_posix_no_arg_invokes_switch() {
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd
      .assert()
      .success()
      .stdout(predicate::str::contains("gwm switch"))
      .stdout(predicate::str::contains("\"$#\" -eq 0"));
  }
}

#[test]
fn shell_init_fish_no_arg_invokes_switch() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gwm switch"))
    .stdout(predicate::str::contains("count $argv) -eq 0"));
}

#[test]
fn shell_init_powershell_no_arg_invokes_switch() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gwm switch"))
    .stdout(predicate::str::contains("IsNullOrEmpty"));
}

// Issue #58: users who eval the wrapper without reading the README must
// still discover the no-arg route. Pin a one-line cheat-sheet comment in
// the script header that names the bridge to `gwm switch`. The exact
// phrase `picker via `gwm switch`` is asserted because the README, the
// CLI --help, and the wrapper now share that wording — drift in one
// surface should break the test instead of going unnoticed.
#[test]
fn shell_init_posix_header_documents_no_arg_route() {
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd
      .assert()
      .success()
      .stdout(predicate::str::contains("picker via `gwm switch`"));
  }
}

#[test]
fn shell_init_fish_header_documents_no_arg_route() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("picker via `gwm switch`"));
}

#[test]
fn shell_init_powershell_header_documents_no_arg_route() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("picker via `gwm switch`"));
}

// Issue #58: a user who lands on `gwm switch --help` first (e.g. via tab
// completion) should learn that the recommended invocation is the `gcd`
// wrapper from `gwm shell-init`, not the raw `cd "$(gwm switch)"` form.
#[test]
fn switch_help_mentions_gcd_wrapper() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["switch", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gcd").and(predicate::str::contains("shell-init")));
}

#[test]
fn shell_init_rejects_unknown_shell() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "tcsh"]);
  cmd.assert().failure();
}

#[test]
fn list_format_table_is_default() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("list")
    .assert()
    .success()
    .stdout(predicate::str::contains("NAME"))
    .stdout(predicate::str::contains("STATUS"));
}

// --------------------------------------------------------------------------
// Issue #23 — `gwm tmux <pattern>` / `gwm zellij <pattern>`
// --------------------------------------------------------------------------
//
// The actual spawn (`std::process::Command::new("tmux").args(...)`) is out
// of scope here — driving it would require a live tmux/zellij server on
// every CI runner. We instead pin the user-visible contract:
//
//   1. The subcommands exist and are listed in `gwm --help`.
//   2. Outside the corresponding multiplexer (no `$TMUX` / `$ZELLIJ`),
//      the command exits non-zero with a clear stderr that names the
//      missing multiplexer — no silent no-op.
//   3. Outside a git repo, the standard `NotInGitRepo` error wins.
//   4. The argv-builder unit tests in `tests/multiplexer_tests.rs`
//      cover what gets handed to the spawn.

#[test]
fn tmux_outside_tmux_session_fails_with_clear_error() {
  // CI runners and most local shells don't have `$TMUX` set. The command
  // must refuse loudly rather than spawn `tmux` against no server, which
  // would either start a brand-new tmux server or error opaquely.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("tmux").and(predicate::str::contains("not")));
}

#[test]
fn zellij_outside_zellij_session_fails_with_clear_error() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("zellij").and(predicate::str::contains("not")));
}

#[test]
fn tmux_outside_git_repo_fails() {
  // `NotInGitRepo` wins over the multiplexer-not-running gate when both
  // apply — the user is told to fix the more fundamental problem first.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn zellij_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// regression: PR #65 Copilot review — the not-running error carried a
// literal backslash before the env var name (`\$TMUX` instead of
// `$TMUX`). The `\\` came from a shell-escape habit; this is stderr,
// not shell source, so the dollar must render bare.
#[test]
fn tmux_outside_tmux_error_does_not_escape_dollar() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("\\$").not())
    // And `$TMUX` itself must still appear so the hint is actionable.
    .stderr(predicate::str::contains("$TMUX"));
}

#[test]
fn zellij_outside_zellij_error_does_not_escape_dollar() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("\\$").not())
    .stderr(predicate::str::contains("$ZELLIJ"));
}

#[test]
fn tmux_help_mentions_split_flag() {
  // The `-p` flag (split-pane instead of new-window) is the one knob users
  // care about; it must show up in `--help` so it's discoverable without
  // reading the README.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["tmux", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--split"));
}

#[test]
fn zellij_help_mentions_split_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["zellij", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--split"));
}

// --- Issue/PR linking (issue #67) ----------------------------------------

#[test]
fn link_help_documents_issue_and_pr_targets() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["link", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"));
}

#[test]
fn unlink_help_documents_issue_and_pr_targets() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["unlink", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"));
}

#[test]
fn open_help_documents_issue_and_pr_and_print_url() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["open", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"))
    .stdout(predicate::str::contains("--print-url"));
}

#[test]
fn status_help_documents_json_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["status", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--json"));
}

#[test]
fn link_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["link", "issue", "42"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn link_issue_persists_and_status_reflects_it() {
  // E2E: link an issue then `gwm status --json` reads it back.
  // The repo has no remote configured so `status` runs in "local link only" mode
  // (no GitHub fetch). The JSON output should still carry the linked number.
  let (dir, repo) = init_repo();
  // Need a branch that's checked out for the CWD-resolved status to find it.
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  // link
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "issue", "99"])
    .assert()
    .success()
    .stdout(predicate::str::contains("issue #99"));

  // status --json
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"issue\""))
    .stdout(predicate::str::contains("99"));
}

#[test]
fn unlink_issue_falls_back_to_branch_name_auto_detect() {
  let (dir, repo) = init_repo();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  // Override then unlink.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "issue", "99"])
    .assert()
    .success();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["unlink", "issue"])
    .assert()
    .success();

  // After unlink the branch-name auto-detect should resurface (issue #42).
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("42"));
}

#[test]
fn status_auto_detects_pr_when_none_explicitly_linked() {
  // E2E (issue #181): a branch with a GitHub remote and no explicit PR
  // link. `gwm status --json` should detect the branch's PR via `gh pr
  // list` and report it with source "detected".
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  // No issue number in the name → isolates the PR-detection path.
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":128}]"#,
    r#"{"number":128,"title":"Auto-detect PR","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/128"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"number\":128"))
    .stdout(predicate::str::contains("\"source\":\"detected\""));
}

#[test]
fn status_persists_detected_pr_title_after_fetch() {
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":128}]"#,
    r#"{"number":128,"title":"Auto-detect PR","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/128"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success();

  let link = gwm::github::read_link(&repo, "detect-me").unwrap();
  assert_eq!(link.pr, Some(128));
  assert_eq!(link.pr_source, gwm::github::LinkSource::Detected);
  assert_eq!(link.pr_title.as_deref(), Some("Auto-detect PR"));
}

#[test]
fn review_resolves_pr_metadata_and_names_branch_end_to_end() {
  // E2E (issue #308): drive `gwm review <PR#>` through the clap entry point.
  // A fake `gh` resolves the PR head metadata and `repo_slug` parses the
  // GitHub origin; `GIT_ALLOW_PROTOCOL=file` then makes the subsequent
  // `git fetch` over https fail instantly (no network) right after the
  // resolution block is printed — so the assertion stays hermetic and fast.
  //
  // This pins the clap surface + gh metadata resolution + review naming +
  // `[worktree].base` expansion that the unit / integration tests bypass. The
  // full fetch→worktree→link→base path is covered hermetically by
  // tests/review_integration.rs (which drives `review::materialize` directly
  // against a local origin and needs no GitHub URL — the slug/fetch coupling
  // makes that step un-mockable through the binary without a network call).
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    "[]",
    r#"{"number":1,"author":{"login":"alice"},"headRefName":"feat/spike-x","baseRefName":"main"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .env("GIT_ALLOW_PROTOCOL", "file") // reject the https fetch instantly, no network
    .args(["review", "1"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("PR     : #1 by alice (feat/spike-x → main)"))
    .stdout(predicate::str::contains("branch : review/pr-1-alice-spike-x"))
    .stdout(predicate::str::contains("review-pr-1-alice-spike-x"));
}

#[test]
fn status_explicit_pr_link_wins_over_detection() {
  // An explicit `gwm link --pr` must not be clobbered by detection: the
  // reported source stays "explicit" even though `gh pr list` would
  // return a different number.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":999}]"#,
    r#"{"number":61,"title":"Explicit","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/61"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "pr", "61"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"number\":61"))
    .stdout(predicate::str::contains("\"source\":\"explicit\""));
}

#[test]
fn open_print_url_emits_url_without_spawning_browser() {
  // `--print-url` is the test-friendly mode: we want to assert the URL
  // construction without actually shelling out to `open`/`xdg-open`.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["open", "issue", "--print-url"])
    .assert()
    .success()
    .stdout(predicate::str::contains("https://github.com/kbrdn1/gwm-cli/issues/42"));
}

#[test]
fn open_pr_without_link_fails_clearly() {
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  // Branch without an issue number (no auto-detect) and no explicit PR link.
  repo.branch("random-branch", &head, false).unwrap();
  repo.set_head("refs/heads/random-branch").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["open", "pr", "--print-url"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("no PR linked"));
}

#[test]
fn status_on_branch_with_no_link_reports_no_link() {
  let (dir, repo) = init_repo();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("random-branch", &head, false).unwrap();
  repo.set_head("refs/heads/random-branch").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no link"));
}

// --------------------------------------------------------------------------
// Issue #101 — E2E tests for the mutating subcommands (init / create / remove)
// --------------------------------------------------------------------------
//
// `cli_binary.rs` historically asserted only `--help` output and a handful
// of read-only error paths. The three subcommands that mutate state on
// disk (`init`, `create`, `remove`) had no end-to-end coverage, which let
// orchestration-layer regressions (e.g. issues #98 and #99) slip through
// unit-test review. The block below is the canonical CI signal for the
// CLI surface of those subcommands.
//
// Worktree-creating tests pin `[worktree].base` to a `tempfile::TempDir`
// so the test runner never writes under `~/cc-worktree/...`. The branch
// pattern is left at its default (`{type}/#{issue}-{desc}`) to exercise
// the production naming pipeline.

// --- init ---------------------------------------------------------------

#[test]
fn init_writes_gwm_toml_with_expected_sections() {
  // The default `.gwm.toml` shipped by `gwm init` is sourced from
  // `examples/gwm.toml.example`. Asserting on the exact contents would
  // couple the test to the example file character-for-character; we pin
  // the structural markers a user (and the rest of the codebase) relies
  // on: a `[worktree]` block with the documented placeholders, a
  // `[[bootstrap.copy]]` entry, and a `[[bootstrap.guard]]` entry. The
  // stdout line names the written path so users discover where it landed.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");
  assert!(!cfg_path.exists(), "precondition: no .gwm.toml in fresh repo");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .success()
    .stdout(predicate::str::contains(".gwm.toml"));

  assert!(cfg_path.exists(), "gwm init must write .gwm.toml on disk");
  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("[worktree]"), "missing [worktree] section");
  assert!(
    body.contains("base = ") && body.contains("{home}") && body.contains("{repo}"),
    "missing documented placeholders in [worktree].base"
  );
  assert!(
    body.contains("[[bootstrap.copy]]"),
    "missing [[bootstrap.copy]] template"
  );
  assert!(
    body.contains("[[bootstrap.guard]]"),
    "missing [[bootstrap.guard]] template"
  );
}

#[test]
fn init_refuses_to_overwrite_existing_gwm_toml() {
  // Idempotency contract: a second `gwm init` on a repo that already
  // carries a `.gwm.toml` must bail out instead of silently clobbering
  // user edits. The error must name the file *and* explain why so the
  // user knows what to remove if they truly want to start over. Pin
  // the exact "already exists" wording from `Config::write_default`
  // (src/config.rs) — a looser `.gwm.toml` contains-check would also
  // pass on a success run since the success path prints the same path.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");
  std::fs::write(&cfg_path, "# user edits\n[worktree]\nbase = \"/custom\"\n").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .failure()
    .stderr(predicate::str::contains(".gwm.toml"))
    .stderr(predicate::str::contains("already exists"));

  // Original contents must survive the failed init.
  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(
    body.contains("# user edits"),
    "failed gwm init must not modify the existing .gwm.toml"
  );
}

#[test]
fn init_outside_git_repo_fails() {
  // `cmd_init` calls `discover_repo` first — the standard `NotInGitRepo`
  // error wins so the user is steered to `git init` before configuring.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- init --preset (issue #37) ------------------------------------------

#[test]
fn init_list_presets_enumerates_builtins() {
  // `--list-presets` is a pure stdout enumeration — it must work without a
  // git repo (it returns before `discover_repo`) and name every built-in.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--list-presets"])
    .assert()
    .success()
    .stdout(predicate::str::contains("generic"))
    .stdout(predicate::str::contains("laravel"))
    .stdout(predicate::str::contains("node"))
    .stdout(predicate::str::contains("rust"))
    .stdout(predicate::str::contains("python-uv"));
}

#[test]
fn init_preset_show_prints_without_writing() {
  // `--show` prints the resolved preset to stdout and writes nothing — so a
  // user can diff a preset against an existing config.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "rust", "--show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[[bootstrap.no_symlink]]"))
    .stdout(predicate::str::contains("target"));

  assert!(!cfg_path.exists(), "--show must not write .gwm.toml to disk");
}

#[test]
fn init_preset_writes_stack_config() {
  // `--preset laravel` seeds the opinionated stack config: the AWS-RDS guard
  // and the vendor/ no-symlink are the markers that distinguish it from the
  // generic template.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "laravel"])
    .assert()
    .success()
    .stdout(predicate::str::contains(".gwm.toml"));

  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("no-aws-rds"), "laravel preset missing the AWS-RDS guard");
  assert!(body.contains("vendor"), "laravel preset missing the vendor no-symlink");
}

#[test]
fn init_unknown_preset_fails() {
  // An unknown preset name must fail loudly and point the user at
  // `--list-presets` rather than silently writing the generic template.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "cobol"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("cobol"))
    .stderr(predicate::str::contains("list-presets"));
}

#[test]
fn init_preset_nuxt_alias_writes_node_body() {
  // `nuxt` is an alias of `node`: it must seed the node_modules no-symlink.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "nuxt"])
    .assert()
    .success();

  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("node_modules"), "nuxt alias must seed the node preset");
}

// --- create -------------------------------------------------------------

/// Write a `.gwm.toml` that redirects `[worktree].base` into the test's
/// own `TempDir`. The caller already owns the `base` path (it's the
/// `TempDir` they passed in), so the test asserts on `base.join(...)`
/// directly — this helper has no return value. Bootstrap is left empty
/// by default so `gwm create` runs in its minimal shape; tests that
/// need bootstrap behaviour layer a second `.gwm.toml` write on top.
fn write_test_config(repo_root: &Path, base: &Path) {
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base),
  );
  std::fs::write(repo_root.join(".gwm.toml"), body).unwrap();
}

fn toml_basic_string(path: &Path) -> String {
  path.display().to_string().replace('\\', "\\\\").replace('"', "\\\"")
}

fn prepend_path(dir: &Path) -> String {
  let old = std::env::var_os("PATH").unwrap_or_default();
  let mut paths = vec![dir.to_path_buf()];
  paths.extend(std::env::split_paths(&old));
  std::env::join_paths(paths).unwrap().to_string_lossy().into_owned()
}

/// Fake `gh` that dispatches on the first two args, used to exercise the
/// PR auto-detection path (issue #181): `gh pr list …` returns
/// `pr_list_json`, `gh pr view …` returns `pr_view_json`. Both arms emit
/// the JSON verbatim so the real `find_pr_for_branch` / `fetch_pr` parse
/// it. Unix + Windows variants so CI stays green on both.
fn write_dispatch_gh(root: &Path, pr_list_json: &str, pr_view_json: &str) -> PathBuf {
  #[cfg(unix)]
  {
    let script = root.join("gh");
    fs::write(
      &script,
      format!(
        r#"#!/bin/sh
if [ "$1" = "pr" ] && [ "$2" = "list" ]; then
  printf '%s' '{list}'
elif [ "$1" = "pr" ] && [ "$2" = "view" ]; then
  printf '%s' '{view}'
fi
"#,
        list = pr_list_json.replace('\'', "'\\''"),
        view = pr_view_json.replace('\'', "'\\''"),
      ),
    )
    .unwrap();
    let mut perms = fs::metadata(&script).unwrap().permissions();
    use std::os::unix::fs::PermissionsExt;
    perms.set_mode(0o755);
    fs::set_permissions(&script, perms).unwrap();
    script
  }
  #[cfg(windows)]
  {
    let script = root.join("gh.cmd");
    fs::write(
      &script,
      format!(
        "@echo off\r\nif \"%~1\"==\"pr\" if \"%~2\"==\"list\" echo {list}\r\nif \"%~1\"==\"pr\" if \"%~2\"==\"view\" echo {view}\r\n",
        list = pr_list_json,
        view = pr_view_json,
      ),
    )
    .unwrap();
    script
  }
}

fn write_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  #[cfg(unix)]
  {
    write_unix_fake_gh(root, issue_url)
  }
  #[cfg(windows)]
  {
    write_windows_fake_gh(root, issue_url)
  }
}

#[cfg(unix)]
fn write_unix_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  let script = root.join("gh");
  fs::write(
    &script,
    format!(
      r#"#!/bin/sh
printf '%s\n' "$*" > '{args}'
body_file=""
prev=""
for arg in "$@"; do
  if [ "$prev" = "--body-file" ]; then
    body_file="$arg"
  fi
  prev="$arg"
done
if [ -n "$body_file" ]; then
  cp "$body_file" '{body}'
fi
printf '%s' '{url}'
"#,
      args = root.join("gh-args.txt").display(),
      body = root.join("gh-body.md").display(),
      url = issue_url.replace('\'', "'\\''"),
    ),
  )
  .unwrap();
  let mut perms = fs::metadata(&script).unwrap().permissions();
  use std::os::unix::fs::PermissionsExt;
  perms.set_mode(0o755);
  fs::set_permissions(&script, perms).unwrap();
  script
}

#[cfg(windows)]
fn write_windows_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  let script = root.join("gh.cmd");
  fs::write(
    &script,
    format!(
      r#"@echo off
echo %* > "{args}"
:scan
if "%~1"=="" goto done
if "%~1"=="--body-file" (
  copy "%~2" "{body}" > nul
)
shift
goto scan
:done
echo {url}
"#,
      args = root.join("gh-args.txt").display(),
      body = root.join("gh-body.md").display(),
      url = issue_url.trim(),
    ),
  )
  .unwrap();
  script
}

#[test]
fn test_config_base_path_is_escaped_for_toml_basic_strings() {
  assert_eq!(
    toml_basic_string(Path::new(r#"C:\Users\runner\AppData\Local\Temp"#)),
    r#"C:\\Users\\runner\\AppData\\Local\\Temp"#
  );
}

#[test]
fn create_adds_worktree_dir_and_branch_at_head() {
  // The full happy path through `cmd_create`:
  //   1. The dirname rendered from `[worktree].path_pattern` lands on disk
  //      under the configured `[worktree].base`.
  //   2. The branch rendered from `[worktree].branch_pattern` is created
  //      as a local ref pointing at the seed commit (`init_repo`'s HEAD).
  //   3. `branch.<name>.gwm-base` is recorded as the parent's short name
  //      (the launcher fallback chain depends on it — issue #75).
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());
  let head_oid = repo.head().unwrap().target().unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    // Issue #95: this test writes a `.gwm.toml` and runs `gwm
    // create` non-interactively, so the TOFU prompt would block.
    // Setting GWM_ALLOW_BOOTSTRAP=1 is the documented CI bypass.
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "42", "tui-search"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat/#42-tui-search"))
    .stdout(predicate::str::contains("worktree created"));

  let wt_dir = base.path().join("feat-42-tui-search");
  assert!(wt_dir.exists(), "worktree dir must exist on disk");
  assert!(wt_dir.join(".git").exists(), "worktree must carry a .git pointer");

  let branch = repo
    .find_branch("feat/#42-tui-search", git2::BranchType::Local)
    .expect("branch must be created");
  let branch_oid = branch.into_reference().target().unwrap();
  assert_eq!(branch_oid, head_oid, "fresh branch must point at the main HEAD commit");

  let cfg = repo.config().unwrap();
  let recorded_base = cfg.get_string("branch.feat/#42-tui-search.gwm-base").unwrap();
  assert_eq!(
    recorded_base, "main",
    "gwm create must record the parent ref for the launcher fallback chain"
  );
}

#[test]
fn create_runs_bootstrap_by_default() {
  // A `[[bootstrap.copy]]` step lands its destination file inside the
  // freshly-created worktree iff bootstrap actually ran. The source file
  // lives in the main repo's workdir; we pin a unique marker string so a
  // false positive (e.g. a cargo lock file collision) can't pass the
  // assertion by accident.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let marker = "GWM_E2E_BOOTSTRAP_MARKER_v1";
  std::fs::write(dir.path().join("seed.env"), marker).unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[bootstrap.copy]]
from = "seed.env"
to = "seed.env"
required = true
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    // Issue #95: bypass the TOFU prompt — the test's whole point
    // is to assert that bootstrap.copy actually runs, which is
    // gated behind the trust check.
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "7", "bootstrap-on"])
    .assert()
    .success();

  let copied = base.path().join("feat-7-bootstrap-on").join("seed.env");
  assert!(copied.exists(), "bootstrap copy step did not run");
  let body = std::fs::read_to_string(&copied).unwrap();
  assert!(
    body.contains(marker),
    "bootstrap copy must duplicate the source file content"
  );
}

#[test]
fn create_runs_lifecycle_hooks_and_legacy_bootstrap_command_alias() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "record pre-create"
run = "printf pre-{{branch}}-{{issue}}-{{desc}} > pre-create.txt"

[[hooks.post_create]]
name = "record post-create"
run = "printf post-{{branch}} > post-create.txt"

[[bootstrap.command]]
name = "legacy post-create"
run = "printf legacy > legacy-post-create.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "hooks"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[pre_create] record pre-create"))
    .stdout(predicate::str::contains("[post_create] record post-create"))
    .stdout(predicate::str::contains("[post_create] legacy post-create"));

  let worktree = base.path().join("feat-88-hooks");
  assert_eq!(
    std::fs::read_to_string(dir.path().join("pre-create.txt")).unwrap(),
    "pre-feat/#88-hooks-88-hooks"
  );
  assert_eq!(
    std::fs::read_to_string(worktree.join("post-create.txt")).unwrap(),
    "post-feat/#88-hooks"
  );
  assert_eq!(
    std::fs::read_to_string(worktree.join("legacy-post-create.txt")).unwrap(),
    "legacy"
  );
}

#[test]
fn new_creates_issue_from_template_then_creates_worktree() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/issues/142\n");
  fs::create_dir_all(dir.path().join(".github/ISSUE_TEMPLATE")).unwrap();
  fs::write(
    dir.path().join(".github/ISSUE_TEMPLATE/feature_request.yml"),
    r#"
name: Feature
title: "[Feature]: "
labels: ["feature"]
body:
  - type: markdown
    attributes:
      value: |
        Feature request for {desc}
  - type: dropdown
    id: surface
    attributes:
      label: Surface
      options:
        - cli
        - tui
  - type: textarea
    id: proposal
    attributes:
      label: Proposed solution
      placeholder: "Implement {type}"
"#,
  )
  .unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[issue_template]
default = "feature_request.yml"

[issue_template.by_type]
feat = {{ template = "feature_request.yml", surface = "cli", title_prefix = "[Feature]: ", labels = ["enhancement"] }}
"#,
    base = toml_basic_string(base.path()),
  );
  fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["new", "feat", "add-config-types", "--no-bootstrap"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created issue #142"))
    .stdout(predicate::str::contains("feat/#142-add-config-types"))
    .stdout(predicate::str::contains("worktree created"));

  assert!(base.path().join("feat-142-add-config-types").exists());
  let gh_args_raw = fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  // `cmd.exe`'s `echo %*` keeps the surrounding quotes on quoted args, so
  // normalise by stripping them before doing substring assertions.
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("issue create"), "{gh_args_raw}");
  assert!(gh_args.contains("--title [Feature]: add-config-types"), "{gh_args_raw}");
  assert!(gh_args.contains("--label feature"), "{gh_args_raw}");
  assert!(gh_args.contains("--label enhancement"), "{gh_args_raw}");
  let gh_body = fs::read_to_string(fake_bin.path().join("gh-body.md")).unwrap();
  assert!(gh_body.contains("Feature request for add-config-types"), "{gh_body}");
  assert!(gh_body.contains("**Surface:** cli"), "{gh_body}");
  assert!(gh_body.contains("Implement feat"), "{gh_body}");
}

#[test]
fn create_pre_create_abort_failure_leaves_no_worktree() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "block create"
run = "false"
on_fail = "abort"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "blocked"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("hook pre_create 'block create' failed"));

  assert!(
    !base.path().join("feat-88-blocked").exists(),
    "pre_create abort must happen before worktree creation"
  );
}

#[test]
fn create_warn_and_ignore_hook_failures_do_not_abort() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "warn only"
run = "false"
on_fail = "warn"

[[hooks.pre_create]]
name = "ignore failure"
run = "false"
on_fail = "ignore"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "nonfatal"])
    .assert()
    .success()
    .stdout(predicate::str::contains("! [pre_create] warn only"))
    .stdout(predicate::str::contains("· [pre_create] ignore failure"));

  assert!(base.path().join("feat-88-nonfatal").exists());
}

#[test]
fn create_skip_hooks_bypasses_named_phase() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "would block"
run = "false"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "skip", "--skip-hooks", "pre_create"])
    .assert()
    .success();

  assert!(base.path().join("feat-88-skip").exists());
}

#[test]
fn bootstrap_runs_pre_and_post_bootstrap_hooks() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_bootstrap]]
name = "before bootstrap"
run = "printf pre > pre-bootstrap.txt"

[[bootstrap.copy]]
from = "seed.txt"
to = "seed.txt"
required = true

[[hooks.post_bootstrap]]
name = "after bootstrap"
run = "printf post > post-bootstrap.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();
  std::fs::write(dir.path().join("seed.txt"), "seed").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "88", "boot-hooks", "--no-bootstrap"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["bootstrap", "feat-88-boot-hooks"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[pre_bootstrap] before bootstrap"))
    .stdout(predicate::str::contains("[post_bootstrap] after bootstrap"));

  let worktree = base.path().join("feat-88-boot-hooks");
  assert_eq!(
    std::fs::read_to_string(worktree.join("pre-bootstrap.txt")).unwrap(),
    "pre"
  );
  assert_eq!(std::fs::read_to_string(worktree.join("seed.txt")).unwrap(), "seed");
  assert_eq!(
    std::fs::read_to_string(worktree.join("post-bootstrap.txt")).unwrap(),
    "post"
  );
}

#[test]
fn remove_runs_pre_and_post_remove_hooks_and_force_skips_them() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "88", "remove-hooks", "--no-bootstrap"])
    .assert()
    .success();

  let config = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_remove]]
name = "block remove"
run = "false"

[[hooks.post_remove]]
name = "cleanup"
run = "printf removed-{{branch}} > post-remove.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), config).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["remove", "remove-hooks"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("hook pre_remove 'block remove' failed"));
  assert!(base.path().join("feat-88-remove-hooks").exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["remove", "remove-hooks", "--force"])
    .assert()
    .success();
  assert!(!base.path().join("feat-88-remove-hooks").exists());
  assert!(
    !dir.path().join("post-remove.txt").exists(),
    "--force must skip pre_remove and post_remove hooks"
  );
}

#[test]
fn create_skips_bootstrap_with_no_bootstrap_flag() {
  // Same scaffolding as the previous test, but `--no-bootstrap` must
  // short-circuit `bootstrap::run` BEFORE the copy step. The worktree
  // directory still appears (the branch + worktree are created first),
  // but `seed.env` is absent inside it. The stdout breadcrumb that
  // `cmd_create` prints when it skips makes the intent observable.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  std::fs::write(dir.path().join("seed.env"), "marker").unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[bootstrap.copy]]
from = "seed.env"
to = "seed.env"
required = true
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "8", "bootstrap-off", "--no-bootstrap"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped bootstrap"));

  let wt_dir = base.path().join("feat-8-bootstrap-off");
  assert!(wt_dir.exists(), "worktree dir must still be created");
  assert!(
    !wt_dir.join("seed.env").exists(),
    "--no-bootstrap must prevent the copy step from running"
  );
}

#[test]
fn create_rejects_unknown_branch_type() {
  // `BranchSpec::validate` rejects branch types outside the built-in /
  // configured allow-list before any filesystem operation. We must see
  // the failure surface on stderr with the offending value so the user
  // can grep their command history without re-running.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "blarg", "9", "nope"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("blarg"));

  assert!(
    !base.path().join("blarg-9-nope").exists(),
    "no worktree dir may be created when branch-type validation fails"
  );
}

#[test]
fn create_rejects_non_digit_issue() {
  // Issue must be digits-only — `abc` is rejected by `BranchSpec::new`
  // before any filesystem op. As with the unknown-branch-type test,
  // assert the no-side-effect invariant explicitly: the worktree dir
  // that *would* have been written (`<base>/feat-abc-thing`) must not
  // appear on disk. Otherwise a regression where validation runs
  // post-`worktree::add` could still satisfy a bare `.failure()` check
  // while leaving stray dirs behind.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "abc", "thing"])
    .assert()
    .failure();

  assert!(
    !base.path().join("feat-abc-thing").exists(),
    "no worktree dir may be created when issue-number validation fails"
  );
}

#[test]
fn create_refuses_stale_branch_without_reuse_flag() {
  // Issue #99 E2E. A pre-existing local branch of the same name must
  // surface `BranchExists` and refuse to create the worktree dir —
  // protecting the user from silently landing on whatever commit the
  // pre-existing ref points at. The error renders the stale tip's
  // OID and the `--reuse-branch` opt-in so the message is
  // self-explanatory.
  //
  // We pin the branch at the seed commit, THEN advance main by one
  // commit so the branch tip diverges from HEAD — the textbook
  // "stale" scenario from the issue. That divergence is what makes
  // the silent reuse a foot-gun in the first place, and asserting
  // the stale OID appears verbatim in stderr proves the error message
  // is grep-able for the value the user would otherwise be silently
  // attached to.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  let seed = repo.head().unwrap().peel_to_commit().unwrap();
  let stale_branch = repo.branch("feat/#99-stale", &seed, false).unwrap();
  let stale_oid = stale_branch.into_reference().target().unwrap().to_string();

  let sig = git2::Signature::now("gwm-test", "gwm@test").unwrap();
  let tree_id = repo.index().unwrap().write_tree().unwrap();
  let tree = repo.find_tree(tree_id).unwrap();
  repo
    .commit(Some("HEAD"), &sig, &sig, "advance main", &tree, &[&seed])
    .unwrap();
  let new_head = repo.head().unwrap().target().unwrap().to_string();
  assert_ne!(new_head, stale_oid, "precondition: HEAD must diverge from stale branch");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "stale"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("feat/#99-stale"))
    .stderr(predicate::str::contains("--reuse-branch"))
    .stderr(predicate::str::contains(stale_oid.as_str()));

  assert!(
    !base.path().join("feat-99-stale").exists(),
    "no worktree dir may be created when the branch is refused"
  );
}

#[test]
fn create_reuses_stale_branch_with_flag() {
  // Companion to `create_refuses_stale_branch_without_reuse_flag`: the
  // `--reuse-branch` opt-in restores the legacy attach-to-existing
  // behaviour, and the worktree directory does get created.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#99-stale", &head, false).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "stale", "--reuse-branch"])
    .assert()
    .success();

  assert!(
    base.path().join("feat-99-stale").exists(),
    "with --reuse-branch the worktree dir must be created against the stale branch"
  );
}

#[test]
fn create_subcommand_outside_git_repo_fails() {
  // The repo-bound contract: outside any git repo the standard
  // `NotInGitRepo` error wins, no worktree is touched. Named with the
  // `_subcommand_` infix to avoid colliding with the historical
  // `create_outside_git_repo_fails` test (line ~327) that — despite the
  // name — actually exercises `gwm list`.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "1", "x"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- remove -------------------------------------------------------------

#[test]
fn remove_deletes_worktree_dir_and_keeps_branch_by_default() {
  // Without `--delete-branch`, `gwm remove` is the inverse of `gwm
  // create` for the on-disk directory only: the worktree dir disappears
  // (and so does its admin entry under `.git/worktrees/`), but the
  // local branch survives so the user can re-create the worktree from
  // it later. Stdout names the dir for visual confirmation.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1") // issue #95: TOFU bypass for the setup step
    .args(["create", "feat", "10", "remove-me"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-10-remove-me");
  assert!(wt_dir.exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "remove-me"])
    .assert()
    .success()
    .stdout(predicate::str::contains("removed"));

  assert!(!wt_dir.exists(), "remove must delete the worktree directory");
  assert!(
    repo.find_branch("feat/#10-remove-me", git2::BranchType::Local).is_ok(),
    "remove without --delete-branch must keep the local branch"
  );
}

#[test]
fn remove_with_delete_branch_drops_branch() {
  // The `--delete-branch` flag drops the local branch in the same
  // command. The stdout breadcrumb names both the worktree dir and the
  // branch so two destructive operations are surfaced explicitly.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1") // issue #95: TOFU bypass for the setup step
    .args(["create", "feat", "11", "drop-branch"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "drop-branch", "--delete-branch"])
    .assert()
    .success()
    .stdout(predicate::str::contains("branch"))
    .stdout(predicate::str::contains("deleted"));

  assert!(
    repo
      .find_branch("feat/#11-drop-branch", git2::BranchType::Local)
      .is_err(),
    "--delete-branch must remove the local branch ref"
  );
}

#[test]
fn remove_unknown_pattern_fails() {
  // Fuzzy lookup must error loudly when nothing matches — silently
  // doing nothing would mask a user typo and leave them wondering why
  // their worktree is still around.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "ghost"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not found"));
}

#[test]
fn remove_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- remove --dry-run / prune --dry-run (issue #31) ---------------------

#[test]
fn remove_dry_run_prints_plan_and_keeps_worktree_intact() {
  // Issue #31 contract for `gwm remove --dry-run`: resolve the pattern,
  // print the would-remove plan (name + path + branch), exit 0, do NOT
  // touch the worktree directory or the local branch. The user can pipe
  // the output into a confirmation script.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "31", "preview"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-31-preview");
  assert!(wt_dir.exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "preview", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would remove"))
    .stdout(predicate::str::contains("feat-31-preview"))
    .stdout(predicate::str::contains("feat/#31-preview"));

  assert!(wt_dir.exists(), "--dry-run must not delete the worktree directory");
  assert!(
    repo.find_branch("feat/#31-preview", git2::BranchType::Local).is_ok(),
    "--dry-run must not delete the local branch"
  );
}

#[test]
fn remove_dry_run_with_delete_branch_flags_branch_deletion() {
  // When `--delete-branch` is combined with `--dry-run`, the plan must
  // surface that the branch would be deleted — without actually
  // dropping it. The user sees a single line that mirrors the live
  // command's would-do trail.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "32", "preview-drop"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "preview-drop", "--delete-branch", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would be deleted"));

  assert!(
    repo
      .find_branch("feat/#32-preview-drop", git2::BranchType::Local)
      .is_ok(),
    "--dry-run --delete-branch must not delete the local branch"
  );
}

#[test]
fn remove_dry_run_on_ambiguous_pattern_still_fails() {
  // Spec: an ambiguous pattern under `--dry-run` exits non-zero with the
  // candidate list — same error contract as the regular failure mode.
  // `--dry-run` only suppresses *destruction*, not resolution failures.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "33", "ambiguous-one"])
    .assert()
    .success();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "34", "ambiguous-two"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "ambiguous", "--dry-run"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("ambiguous"));
}

#[test]
fn prune_dry_run_prints_plan_without_pruning() {
  // Issue #31 contract for `gwm prune --dry-run`: walk the worktree
  // list, detect prunable entries, print each (name + path + reason),
  // exit 0, and leave the admin entries in place. The follow-up
  // (non-dry-run) `gwm prune` is the destructive sibling.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "35", "stale"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-35-stale");
  assert!(wt_dir.exists());

  // Simulate a "working dir missing" prunable: delete the worktree
  // directory on disk WITHOUT going through `gwm remove`, so the admin
  // entry under `.git/worktrees/<name>` stays around and libgit2 flags
  // the worktree as prunable.
  std::fs::remove_dir_all(&wt_dir).unwrap();

  let admin_dir = dir.path().join(".git").join("worktrees").join("feat-35-stale");
  assert!(admin_dir.exists(), "precondition: admin entry must still exist");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["prune", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would prune"))
    .stdout(predicate::str::contains("feat-35-stale"));

  assert!(admin_dir.exists(), "--dry-run must not remove the prunable admin entry");
  assert!(
    repo.find_worktree("feat-35-stale").is_ok(),
    "--dry-run must leave libgit2's worktree list untouched"
  );
}

#[test]
fn prune_dry_run_reports_no_candidates_when_clean() {
  // Empty case: a clean repo has nothing to prune. The command exits 0
  // with a friendly "0 worktree(s) to prune" so scripts that pipe the
  // output get a stable signal instead of an empty stdout.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["prune", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 worktree"));
}

// --- trust ledger (issue #95) -------------------------------------------

#[test]
fn trust_help_lists_list_revoke_show() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["trust", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("revoke"))
    .stdout(predicate::str::contains("show"));
}

#[test]
fn trust_list_empty_prints_zero_entries() {
  // Point GWM_TRUST_LEDGER at a freshly-created tempdir so we don't
  // clobber the user's real ~/.config/gwm/trust.toml and so the test
  // is hermetic on CI runners that have an empty $HOME.
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries in trust ledger"));
}

#[test]
fn trust_show_when_absent_says_so() {
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("absent.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("file does not exist yet"));
}

#[test]
fn trust_revoke_no_matching_origin_is_a_no_op() {
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "revoke", "git@github.com:foo/bar.git"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries matched"));
}

#[test]
fn trust_list_show_revoke_round_trip() {
  // Seed the ledger manually (we can't easily exercise the prompt
  // path from assert_cmd), then verify list → show → revoke all
  // reflect the same entry.
  use std::fs;
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  fs::write(
    &ledger,
    r#"[[entries]]
origin = "git@github.com:kbrdn1/gwm-cli.git"
config_sha = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
trusted_at = "2026-05-22T10:00:00Z"
trusted_by = "kylian@laptop"
"#,
  )
  .unwrap();

  // list ----------------------------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("git@github.com:kbrdn1/gwm-cli.git"))
    // Short sha (first 12) is what list renders.
    .stdout(predicate::str::contains("deadbeefdead"));

  // show prints the raw toml -------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("kylian@laptop"));

  // revoke removes it --------------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "revoke", "git@github.com:kbrdn1/gwm-cli.git"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓ revoked 1"));

  // and list is empty again --------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries"));
}

#[test]
fn allow_bootstrap_flag_is_global_and_documented() {
  // `--allow-bootstrap` is the CI bypass; if it ever stops being a
  // global flag (e.g. accidentally scoped to one subcommand), the
  // `gwm bootstrap --allow-bootstrap` invocation in user scripts
  // silently fails. Pin it down at the help level.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("--allow-bootstrap"))
    .stdout(predicate::str::contains("--deny-bootstrap"));
}

#[test]
fn create_without_trust_in_non_interactive_aborts_cleanly() {
  // Black-box the TOFU gate at the CLI boundary: a fresh repo with
  // a `.gwm.toml` carrying any bootstrap surface, run from a
  // non-tty (assert_cmd's piped stdin), no `--allow-bootstrap`, no
  // ledger entry → must abort with a clear message rather than
  // silently running the bootstrap commands.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo trapped"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    // No `GWM_ALLOW_BOOTSTRAP` env, no flag → must abort.
    .args(["create", "feat", "42", "trapped"])
    .assert()
    .failure()
    .stderr(
      predicate::str::contains("not in the trust ledger").or(predicate::str::contains("stdin is not interactive")),
    );
}

#[test]
fn create_with_allow_bootstrap_flag_bypasses_the_prompt() {
  // The `--allow-bootstrap` escape hatch is what makes scripted /
  // CI usage workable; this asserts the FLAG (not the env var)
  // actually short-circuits the trust gate. The env-var path is
  // covered by other tests that set GWM_ALLOW_BOOTSTRAP=1 — here
  // we exercise the clap-level wiring so a future refactor that
  // accidentally scopes the flag to one subcommand breaks loudly.
  //
  // `--no-bootstrap` is added so we don't actually shell out to
  // anything — the test is about the trust gate, not the bootstrap
  // step itself.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo would-have-run"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    // No env-var bypass — the flag must do the work on its own.
    // `--allow-bootstrap` is a clap `global = true` flag declared on
    // `Cli`, so it MUST appear before the subcommand on the argv.
    .args(["--allow-bootstrap", "create", "feat", "42", "trapped", "--no-bootstrap"])
    .assert()
    .success();

  // The ledger MUST still be empty — Allow mode bypasses without
  // recording, so the next interactive run on the same machine
  // re-prompts. That's the "don't pollute the user's ledger from CI"
  // contract.
  assert!(
    !ledger.exists()
      || std::fs::read_to_string(&ledger).unwrap().contains("entries = []")
      || std::fs::read_to_string(&ledger).unwrap().is_empty()
  );
}

#[test]
fn create_with_gwm_allow_bootstrap_env_bypasses_the_prompt() {
  // Sibling of the previous test: same fixture, but exercise the
  // `GWM_ALLOW_BOOTSTRAP=1` env-var bypass with no flag. This is
  // the CI-runner code path — scripts can't always inject extra
  // args, so the env-var path has to keep working independently.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo would-have-run"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "42", "env-trapped", "--no-bootstrap"])
    .assert()
    .success();

  assert!(
    !ledger.exists()
      || std::fs::read_to_string(&ledger).unwrap().contains("entries = []")
      || std::fs::read_to_string(&ledger).unwrap().is_empty()
  );
}

#[test]
fn create_skips_trust_gate_when_bootstrap_surface_is_empty() {
  // A `.gwm.toml` that declares nothing executable (no copies, no
  // guards, no no_symlinks, no commands) carries no RCE risk —
  // prompting for trust in that case would just train the user to
  // mash `y`. Verify the gate is a silent no-op when the config has
  // only `[worktree]`.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    format!(
      r#"[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
      base = toml_basic_string(base.path()),
    ),
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  // No --allow-bootstrap, no env bypass, no ledger entry, no tty —
  // the gate would normally abort. With an empty bootstrap surface
  // it must short-circuit and let the create proceed.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["create", "feat", "13", "empty-surface"])
    .assert()
    .success();

  // Ledger MUST stay untouched — the skip doesn't record anything.
  assert!(
    !ledger.exists(),
    "empty-surface short-circuit must not write to the ledger"
  );
}

#[test]
fn allow_bootstrap_succeeds_even_when_ledger_is_malformed() {
  // The whole point of `--allow-bootstrap` / `GWM_ALLOW_BOOTSTRAP=1`
  // is to be the unconditional CI escape hatch. A malformed
  // trust.toml on the CI host must NOT make the bypass fail — the
  // Allow check has to short-circuit before the ledger is touched.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[[bootstrap.command]]\nname = \"x\"\nrun = \"true\"\n",
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");
  std::fs::write(&ledger, b"this is not valid toml @@@@").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "broken-ledger", "--no-bootstrap"])
    .assert()
    .success();
}

#[test]
fn deny_bootstrap_aborts_even_when_trusted() {
  // `--deny-bootstrap` is the forensic mode: even if the ledger
  // says the config is trusted, refuse to run bootstrap. Asserts
  // the precedence resolution in `resolve_trust_mode`.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[[bootstrap.command]]\nname = \"x\"\nrun = \"true\"\n",
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["--deny-bootstrap", "bootstrap"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("--deny-bootstrap"));
}

// --- aliases (issue #86) ------------------------------------------------

#[test]
fn aliases_help_lists_list() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["aliases", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("list"));
}

#[test]
fn aliases_list_prints_built_in_section_outside_repo() {
  // `aliases list` is read-only and must work outside a git repo —
  // built-in clap aliases are static and independent of any repo
  // config. The user fallback (`~/.config/gwm/aliases.toml`) is
  // silently empty when missing.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    // Isolate the test from the developer's real `~/.config/gwm/aliases.toml`.
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("built-in:"))
    // Canonical built-in entries from `BUILT_IN_ALIASES`. Assert the full
    // formatted row (`  <name>  → <expansion>` with width-2 padding) rather
    // than a loose `contains("s")` — the latter matched incidental letters
    // in unrelated words (`aliases`, `built-ins`, …) and let the test pass
    // even when the `s → switch` row was missing or malformed.
    .stdout(predicate::str::contains("  s  → switch"))
    .stdout(predicate::str::contains("  cd → path"));
}

#[test]
fn aliases_list_prints_repo_aliases_with_source() {
  // `.gwm.toml` with `[aliases]` ⇒ `aliases list` surfaces them under
  // the `repo (.gwm.toml):` section.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
wip = "create feat 0 wip"
ll = "list --format names"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("repo (.gwm.toml)"))
    .stdout(predicate::str::contains("wip"))
    .stdout(predicate::str::contains("create feat 0 wip"))
    .stdout(predicate::str::contains("ll"))
    .stdout(predicate::str::contains("list --format names"));
}

#[test]
fn aliases_list_prints_user_aliases_with_source() {
  // `~/.config/gwm/aliases.toml` (XDG resolved via `$XDG_CONFIG_HOME`)
  // surfaces under the user section.
  let dir = tempfile::TempDir::new().unwrap();
  let user_cfg = dir.path().join("gwm");
  std::fs::create_dir_all(&user_cfg).unwrap();
  std::fs::write(
    user_cfg.join("aliases.toml"),
    r#"
[aliases]
copy = "path"
"#,
  )
  .unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("user"))
    .stdout(predicate::str::contains("aliases.toml"))
    .stdout(predicate::str::contains("copy"))
    .stdout(predicate::str::contains("path"));
}

#[test]
fn aliases_list_repo_overrides_user_for_same_name() {
  // When repo and user both declare the same alias, the repo entry
  // takes precedence at expansion time. `aliases list` still prints
  // BOTH sections so the user can see what's being shadowed.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
copy = "path bar"
"#,
  )
  .unwrap();
  let user_cfg = dir.path().join("gwm");
  std::fs::create_dir_all(&user_cfg).unwrap();
  std::fs::write(
    user_cfg.join("aliases.toml"),
    r#"
[aliases]
copy = "path foo"
"#,
  )
  .unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("path bar"))
    .stdout(predicate::str::contains("path foo"));
}

#[test]
fn aliases_list_surfaces_shadow_error_with_alias_name() {
  // An invalid alias in `.gwm.toml` must fail `aliases list` with a
  // message naming the offending entry.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
list = "create feat 0 wip"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("list").and(predicate::str::contains("built-in")));
}

#[test]
fn alias_expansion_runs_built_in_subcommand() {
  // End-to-end expansion: declare `lst = "list --format names"`,
  // invoke `gwm lst` — must behave as `gwm list --format names`.
  // The repo has no worktrees yet so the names output is just empty.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
lst = "list --format names"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .arg("lst")
    .assert()
    .success();
}

#[test]
fn alias_expansion_preserves_trailing_user_args() {
  // `gwm typ` with `typ = "types"` plus a trailing `--help` must
  // surface clap's `types` help (or success), proving the trailing
  // arg made it through the expansion.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
typ = "types"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["typ", "--help"])
    .assert()
    .success()
    .stdout(predicate::str::contains("branch types"));
}

#[test]
fn alias_does_not_shadow_built_in_subcommand_at_runtime() {
  // Even if a hostile `.gwm.toml` somehow tries to alias `types`,
  // the load gate refuses — `gwm types` always reaches the
  // built-in. This is the "defence in depth" pillar of the design.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
types = "list"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["types"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("types"));
}

// --- argv robustness (issue #86 — Copilot follow-up) --------------------

#[cfg(unix)]
#[test]
fn binary_tolerates_non_utf8_argv() {
  // `std::env::args()` panics if any argv entry is non-UTF-8, which is
  // a regression vs. clap's default `args_os` handling. The binary
  // must NOT abort the process on a perfectly valid OS argv just
  // because someone passed bytes that don't decode as UTF-8.
  //
  // We don't care about the exit code per se — the contract is "no
  // panic, no SIGABRT". clap may legitimately reject the unknown
  // subcommand and exit non-zero (UsageError = 2), which is fine.
  // What we forbid is the process aborting before clap even sees
  // the args.
  use std::ffi::OsString;
  use std::os::unix::ffi::OsStringExt;

  let dir = tempfile::TempDir::new().unwrap();
  let invalid_utf8: OsString = OsString::from_vec(vec![0xff, 0xfe, 0x80]);

  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .arg(&invalid_utf8)
    .output()
    .expect("binary must launch");

  // Reject SIGABRT / SIGSEGV / SIGILL — anything that indicates the
  // process died on a signal rather than exited normally. On Unix,
  // signal deaths surface as `status.code() == None` from `assert_cmd`.
  assert!(
    output.status.code().is_some(),
    "binary died on a signal (likely a panic abort) when given non-UTF-8 argv; stderr={:?}",
    String::from_utf8_lossy(&output.stderr)
  );

  // Belt-and-suspenders: the stderr should not contain the libstd panic
  // banner for invalid UTF-8 in argv.
  let stderr = String::from_utf8_lossy(&output.stderr);
  assert!(
    !stderr.contains("invalid utf-8") && !stderr.contains("panicked at"),
    "binary panicked instead of gracefully handling non-UTF-8 argv: {}",
    stderr
  );
}

// --- Issue #29: gwm history + gwm undo --------------------------------------

/// Seed a journal file at `path` with a single recorded `remove` op
/// rooted at `repo_root` (canonical form). The OID is a synthetic 40-
/// char hex string the journal accepts verbatim — `gwm history` is a
/// read-only listing so it never resolves the OID against the object
/// DB, which means we don't need to seed a matching commit.
///
/// `repo_root` is escaped via `toml_basic_string` because Windows
/// paths (`\\?\C:\...`) contain backslashes that TOML treats as
/// escape sequences; without the escape the parser fails with
/// "missing escaped value, expected b, e, f, n, r, \\, …".
fn write_seed_history(path: &Path, repo_root: &Path, worktree: &str, branch: &str) {
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "{worktree}"
branch = "{branch}"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/{worktree}"
deleted_branch = false
repo_root = "{repo_root}"
"#,
    repo_root = toml_basic_string(repo_root),
  );
  if let Some(parent) = path.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(path, body).unwrap();
}

#[test]
fn history_empty_journal_reports_no_ops() {
  // Empty case: a fresh repo with no recorded operations must print
  // a clear "no operations recorded" line and exit 0. Scripted callers
  // (e.g. `gwm history | head -n1`) need a stable signal — silent
  // stdout would force them to also check `$?` to disambiguate.
  let (dir, _) = init_repo();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("no operations recorded"));
}

#[test]
fn history_lists_recorded_remove_op() {
  // Happy path: a seeded journal with one `remove` op produces a
  // single-row listing carrying the worktree name. The exact
  // column shape is intentionally flexible — we pin only the
  // load-bearing tokens (kind = `remove`, worktree name) so the
  // formatter can evolve without test churn.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");
  write_seed_history(&history_file, &repo_root, "feat-29-foo", "feat/#29-foo");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("remove"))
    .stdout(predicate::str::contains("feat-29-foo"));
}

#[test]
fn history_filters_to_current_repo_by_default() {
  // Two ops recorded against two different repos. From inside
  // repo A, `gwm history` must surface ONLY the entry whose
  // `repo_root` matches the current repo — the per-repo
  // separation contract.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // Seed two ops: one for the current repo, one for a fake "other-repo"
  // path. Only the first should surface in the default listing.
  // `toml_basic_string` escapes the repo path for TOML — Windows
  // canonical paths (`\\?\C:\…`) would otherwise break the parser.
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-here-foo"
branch = "feat/#1-here"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-here-foo"
deleted_branch = false
repo_root = "{repo_root}"

[[op]]
ts = "2026-05-19T09:00:00Z"
kind = "remove"
worktree = "feat-elsewhere-bar"
branch = "feat/#2-elsewhere"
branch_oid = "b2c3d4e5f60718293a4b5c6d7e8f9012345678a1"
path = "/tmp/cc-worktree/feat-elsewhere-bar"
deleted_branch = false
repo_root = "/nonexistent/other-repo"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  if let Some(parent) = history_file.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("feat-here-foo"))
    .stdout(predicate::str::contains("feat-elsewhere-bar").not());
}

#[test]
fn remove_records_journal_entry_before_destruction() {
  // Issue #29: `gwm remove <name>` must write a journal entry naming
  // the doomed worktree + branch + OID BEFORE the destructive call
  // runs. Without this hook `gwm undo` has nothing to replay. The
  // assertion is intentionally loose on the exact TOML shape — we
  // pin only that the journal file exists, is non-empty, and
  // contains the worktree name we asked to remove.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  // Seed a worktree the test will then remove.
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "29", "doomed", "--no-bootstrap"])
    .assert()
    .success();

  // No journal entry should exist yet — `gwm create` does NOT hook
  // the journal (only destructive ops do).
  assert!(
    !history_file.exists() || std::fs::read_to_string(&history_file).unwrap().trim().is_empty(),
    "create must not record a journal entry"
  );

  // Now remove it — the journal must capture the op.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-29-doomed"])
    .assert()
    .success();

  assert!(
    history_file.exists(),
    "remove must create the journal file at {}",
    history_file.display()
  );
  let body = std::fs::read_to_string(&history_file).unwrap();
  assert!(
    body.contains("feat-29-doomed"),
    "journal must record the removed worktree name; got:\n{}",
    body
  );
  assert!(
    body.contains("kind = \"remove\""),
    "journal must record kind = remove; got:\n{}",
    body
  );
  assert!(
    body.contains("feat/#29-doomed"),
    "journal must record the branch name; got:\n{}",
    body
  );
}

#[test]
fn remove_dry_run_does_not_record_journal_entry() {
  // The dry-run flag (issue #31) gives the user a preview without
  // touching state. The journal hook MUST gate on the destructive
  // path only — a `--dry-run` invocation that wrote to the journal
  // would let the user "undo" something that never happened.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "31", "preview", "--no-bootstrap"])
    .assert()
    .success();

  // dry-run must not write to the journal.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-31-preview", "--dry-run"])
    .assert()
    .success();

  assert!(
    !history_file.exists() || std::fs::read_to_string(&history_file).unwrap().trim().is_empty(),
    "remove --dry-run must NOT write to the journal; got: {:?}",
    std::fs::read_to_string(&history_file).ok()
  );
}

#[test]
fn undo_recreates_branch_and_worktree_after_remove() {
  // The full round-trip contract: create → remove → undo. After
  // `gwm undo`, the worktree dir must exist again AND the local
  // branch must resolve. The journal entry must be consumed.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  // 1. Create.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "29", "undo-rt", "--no-bootstrap"])
    .assert()
    .success();
  let wt_path = base.path().join("feat-29-undo-rt");
  assert!(wt_path.exists(), "create must produce the worktree dir");

  // 2. Remove (with --delete-branch so we exercise the harder
  //    resurrection path).
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-29-undo-rt", "--delete-branch"])
    .assert()
    .success();
  assert!(!wt_path.exists(), "remove must drop the worktree dir");

  let repo = git2::Repository::open(dir.path()).unwrap();
  assert!(
    repo.find_branch("feat/#29-undo-rt", git2::BranchType::Local).is_err(),
    "remove --delete-branch must drop the local branch"
  );

  // 3. Undo. The branch must come back at the same OID, and the
  //    worktree dir must reappear.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .success()
    .stdout(predicate::str::contains("recreated branch"))
    .stdout(predicate::str::contains("re-added worktree"));

  assert!(wt_path.exists(), "undo must restore the worktree dir");
  let repo = git2::Repository::open(dir.path()).unwrap();
  assert!(
    repo.find_branch("feat/#29-undo-rt", git2::BranchType::Local).is_ok(),
    "undo must recreate the local branch"
  );

  // 4. The journal entry is consumed — a second undo errors with
  //    "nothing to undo".
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("nothing to undo"));
}

#[test]
fn undo_refuses_detached_head_entry_with_clear_error() {
  // PR #155 Copilot review: a journal entry with `branch = ""` (the
  // serialised form of `branch: None`) flags a worktree that was
  // removed while on a detached HEAD. The pre-fix code fell back to
  // `branch_name = "HEAD"` and called `worktree::add`, which either
  // failed at the libgit2 level (invalid refname) or created a real
  // branch named "HEAD" — a foot-gun. The fix surfaces a clear
  // error message so the user knows the limitation and can file a
  // follow-up if it matters.
  //
  // We seed the journal directly with a `branch = ""` entry rather
  // than going through `gwm create / gwm remove` because the create
  // path always attaches a branch — there's no shortcut to a
  // detached-HEAD worktree from the CLI. The fixture matches what
  // serde produces for `Option<String>::None` once round-tripped
  // through TOML.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // Direct TOML seed without a `branch` key — serde will deserialise
  // it as `Option::None`, which is the detached-HEAD discriminator.
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-detached-foo"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-detached-foo"
deleted_branch = false
repo_root = "{repo_root}"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("detached-HEAD"));
}

#[test]
fn history_with_zero_limit_prints_nothing_but_does_not_lie() {
  // PR #155 Copilot review: `--limit 0` used to truncate the row list
  // to empty, which then triggered the "no operations recorded"
  // branch — factually wrong when ops exist, and breaks the scripted
  // signal callers rely on. The fix prints nothing and exits 0,
  // leaving the "no operations recorded" sentinel reserved for the
  // truly-empty case.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");
  write_seed_history(&history_file, &repo_root, "feat-zero-foo", "feat/#1-zero");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["history", "--limit", "0"])
    .assert()
    .success()
    .stdout(predicate::eq(""));
}

#[test]
fn undo_with_empty_journal_errors_clearly() {
  // A clean install with no recorded operations: `gwm undo` must
  // exit non-zero with a clear "nothing to undo" message — silent
  // success would mislead users into thinking the previous op was
  // already undone.
  let (dir, _) = init_repo();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("nothing to undo"));
}

#[test]
fn history_all_flag_surfaces_every_repo() {
  // `--all` opt-out from the per-repo filter: useful for power users
  // grepping the journal for forensic purposes. Both entries must
  // appear in the listing.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // `toml_basic_string` escapes the repo path for TOML so this seed
  // parses on Windows (canonical paths there start with `\\?\C:\…`).
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-here-foo"
branch = "feat/#1-here"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-here-foo"
deleted_branch = false
repo_root = "{repo_root}"

[[op]]
ts = "2026-05-19T09:00:00Z"
kind = "remove"
worktree = "feat-elsewhere-bar"
branch = "feat/#2-elsewhere"
branch_oid = "b2c3d4e5f60718293a4b5c6d7e8f9012345678a1"
path = "/tmp/cc-worktree/feat-elsewhere-bar"
deleted_branch = false
repo_root = "/nonexistent/other-repo"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  std::fs::create_dir_all(history_file.parent().unwrap()).unwrap();
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["history", "--all"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat-here-foo"))
    .stdout(predicate::str::contains("feat-elsewhere-bar"));
}

// --- gwm pr (issue #84) -------------------------------------------------

/// Build a `feat/#<issue>-<desc>` branch on top of `main` carrying one
/// extra commit so `git log main..HEAD` and `git diff --stat main..HEAD`
/// produce non-empty output for the `{commits}` and `{files_changed}`
/// placeholders. Switches the working tree to that branch.
fn make_feature_branch_with_commit(
  repo: &git2::Repository,
  workdir: &std::path::Path,
  branch: &str,
  filename: &str,
  contents: &str,
  message: &str,
) {
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  let branch_ref = repo.branch(branch, &head, false).unwrap();
  let ref_name = branch_ref.into_reference().name().unwrap().to_string();
  repo.set_head(&ref_name).unwrap();
  repo
    .checkout_head(Some(git2::build::CheckoutBuilder::new().force()))
    .unwrap();

  let dest = workdir.join(filename);
  if let Some(parent) = dest.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(&dest, contents).unwrap();
  let mut index = repo.index().unwrap();
  index.add_path(std::path::Path::new(filename)).unwrap();
  index.write().unwrap();
  let tree_id = index.write_tree().unwrap();
  let tree = repo.find_tree(tree_id).unwrap();
  let sig = git2::Signature::now("gwm-test", "gwm@test").unwrap();
  repo.commit(Some("HEAD"), &sig, &sig, message, &tree, &[&head]).unwrap();
}

#[test]
fn pr_render_prints_body_with_placeholders_substituted() {
  // `gwm pr --render` resolves the template configured for the current
  // branch type, substitutes the placeholders against the current
  // branch's context (type / issue / desc / base / head / commits /
  // files_changed), and prints the rendered Markdown to stdout. It
  // never shells out to `gh` — the canonical pipe-friendly form is
  // `gwm pr --render | gh pr create --body-file -`.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "docs/note.md",
    "hello pr\n",
    "✨ feat: pr templates",
  );

  let body = r###"
[pr_template.by_type.feat]
body = """
## Summary

{desc} (#{issue})

## Commits

{commits}

## Files changed

{files_changed}
"""
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("pr-templates (#84)"))
    .stdout(predicate::str::contains("- ✨ feat: pr templates"))
    .stdout(predicate::str::contains("docs/note.md"));
}

#[test]
fn pr_creates_pull_request_via_gh() {
  // `gwm pr` (no `--render`) renders the body, writes it to a temp
  // file, and shells out to `gh pr create --title … --body-file …
  // --head <branch>`. The fake gh prints a PR URL so the CLI can
  // surface the new number in stdout.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/x.rs",
    "fn x() {}\n",
    "✨ feat: x",
  );

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/pull/321\n");

  let body = r###"
[pr_template.by_type.feat]
body = "## Summary\n{desc} (#{issue})\n"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created PR #321"))
    .stdout(predicate::str::contains("https://github.com/acme/widgets/pull/321"));

  let gh_args_raw = std::fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("pr create"), "{gh_args_raw}");
  assert!(gh_args.contains("--head feat/#84-pr-templates"), "{gh_args_raw}");
  let gh_body = std::fs::read_to_string(fake_bin.path().join("gh-body.md")).unwrap();
  assert!(gh_body.contains("pr-templates (#84)"), "{gh_body}");
}

#[test]
fn pr_draft_flag_is_forwarded_to_gh() {
  // `gwm pr --draft` passes `--draft` through to `gh pr create` so the
  // resulting PR opens as a draft instead of a normal review-ready PR.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/y.rs",
    "fn y() {}\n",
    "✨ feat: y",
  );

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/pull/777\n");

  let body = r###"
[pr_template.by_type.feat]
body = "draft body for {desc}"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["pr", "--draft"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created PR #777"));

  let gh_args_raw = std::fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("--draft"), "{gh_args_raw}");
}

#[test]
fn pr_falls_back_to_common_trunk_when_configured_trunks_do_not_resolve() {
  // If `[doctor].trunks` only lists refs that don't exist locally
  // (e.g. a repo customised the list but the trunk hasn't been
  // created yet, or the repo uses `master`), `gwm pr` must still
  // find a sensible base ref by walking the common trunk names
  // (`main` / `master` / `dev` / `develop` / `trunk`) before giving
  // up — otherwise `{commits}` / `{files_changed}` come out empty
  // and the user has no signal as to why (Copilot review on PR #164).
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-fallback",
    "src/fallback.rs",
    "fn fb() {}\n",
    "✨ feat: fallback",
  );

  let body = r###"
[doctor]
trunks = ["nonexistent-trunk"]

[pr_template.by_type.feat]
body = "summary: {desc} (#{issue})\ncommits:\n{commits}\n"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("fallback (#84)"))
    .stdout(predicate::str::contains("- ✨ feat: fallback"));
}

#[test]
fn pr_errors_when_no_template_configured() {
  // Without any `[pr_template]` block in `.gwm.toml`, `gwm pr` exits
  // non-zero with a hint about the missing config — same shape as the
  // `gwm new` failure for an unconfigured branch type.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/z.rs",
    "fn z() {}\n",
    "✨ feat: z",
  );
  std::fs::write(dir.path().join(".gwm.toml"), "").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("pr_template"))
    .stderr(predicate::str::contains("feat"));
}

// --- gwm tui keys (issue #87) -------------------------------------------

#[test]
fn tui_keys_lists_default_bindings() {
  // The bare invocation prints the full resolved keymap as a
  // human-readable table. Default surface ships with `down → j, Down`,
  // `top → g g`, `quit → q`, … — assert the canary rows so a regression
  // in the table layout or the defaults map fails loudly.
  let (dir, _) = init_repo();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .stdout(predicate::str::contains("down"))
    .stdout(predicate::str::contains("j"))
    .stdout(predicate::str::contains("top"))
    .stdout(predicate::str::contains("g g"))
    .stdout(predicate::str::contains("quit"))
    .stdout(predicate::str::contains("default"));
}

#[test]
fn tui_keys_marks_user_overrides_in_source_column() {
  // When the user overrides a binding via `[tui.keys]`, the source
  // column for that row flips from `default` to a non-default marker
  // (we use `.gwm.toml`). The other rows keep `default`.
  let (dir, _) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[tui.keys]
down = ["Ctrl+n"]
"#,
  )
  .unwrap();

  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .get_output()
    .clone();

  let stdout = String::from_utf8(output.stdout).unwrap();
  // Find the `down` row and assert it carries the user-config marker.
  let down_line = stdout
    .lines()
    .find(|l| l.starts_with("down"))
    .unwrap_or_else(|| panic!("expected a `down` row in:\n{stdout}"));
  assert!(
    down_line.contains("Ctrl+n"),
    "expected `down` row to show the override, got: {down_line}"
  );
  assert!(
    down_line.contains(".gwm.toml"),
    "expected `down` row source to be `.gwm.toml`, got: {down_line}"
  );
  // `up` was not overridden — must still read as default.
  let up_line = stdout
    .lines()
    .find(|l| l.starts_with("up"))
    .unwrap_or_else(|| panic!("expected an `up` row in:\n{stdout}"));
  assert!(
    up_line.contains("default"),
    "expected `up` row source to stay `default`, got: {up_line}"
  );
}

// --- gwm theme list / show (issue #33) ----------------------------------

#[test]
fn theme_list_includes_builtin_presets() {
  // `gwm theme list` prints the names of every built-in preset
  // shipped by the binary. Catppuccin is the named example in the
  // issue; the exact catalogue can grow over time.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("catppuccin"))
    .stdout(predicate::str::contains("claude-dark"));
}

#[test]
fn theme_show_claude_dark_emits_the_orange_accent_as_hex() {
  // The Claude dark port (#185) is RGB-based, so `theme show` must
  // render its accent as a copy-pasteable `#RRGGBB` string that
  // round-trips through the `[theme]` parser.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "claude-dark"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[theme]"))
    .stdout(predicate::str::contains("#d4825d"));
}

#[test]
fn theme_show_emits_toml_block_users_can_copy() {
  // `gwm theme show catppuccin` dumps a `[theme]` block that, when
  // pasted into a `.gwm.toml`, reproduces the preset.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[theme]"))
    .stdout(predicate::str::contains("focus"));
}

#[test]
fn theme_show_includes_name_and_path_chrome_roles() {
  // #210: the `name` / `path` chrome roles must be part of the dumpable
  // block so users can discover and override them like any other role.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("name         ="))
    .stdout(predicate::str::contains("path         ="));
}

#[test]
fn theme_show_includes_git_status_family_roles() {
  // #211: the staged / modified / untracked roles must be dumpable so
  // users can discover and override the working-tree colours.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("staged       ="))
    .stdout(predicate::str::contains("modified     ="))
    .stdout(predicate::str::contains("untracked    ="));
}

#[test]
fn theme_show_rejects_unknown_preset() {
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "does-not-exist"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("does-not-exist"));
}

#[test]
fn theme_show_output_round_trips_through_gwm_toml() {
  // Copilot review on PR #168 caught that `Color::Indexed(n)` was
  // emitted as a bare integer, breaking the round-trip because
  // `ThemeConfig.overrides` is a `BTreeMap<String, String>` and
  // TOML integers won't deserialise as `String`. Pin the
  // round-trip contract end-to-end: capture stdout, drop the
  // first `preset = "…"` line (preset is a dedicated field, not
  // an override), write the rest as `.gwm.toml`, reload, assert
  // no error.
  let (dir, _) = init_repo();
  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .get_output()
    .clone();
  let toml_block = String::from_utf8(output.stdout).unwrap();
  // Pasting verbatim into a fresh `.gwm.toml` and reloading must
  // succeed — every value in the block has to be a TOML string.
  let target = dir.path().join(".gwm.toml");
  std::fs::write(&target, &toml_block).unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["doctor"])
    .assert()
    // doctor's exit code may be 0 or 1 depending on local env
    // (it's advisory). What matters is that the config parses —
    // a TOML parse error would produce a `failed` config check
    // and exit code 2 / a hard error before doctor runs. We
    // assert the absence of "invalid TOML" / "config error" in
    // stderr to pin the round-trip.
    .stderr(predicate::str::contains("invalid TOML").not())
    .stderr(predicate::str::contains("config error").not());
}

#[test]
fn tui_keys_lists_modal_contexts() {
  // Issue #219: the listing prints the contextual modal bindings under
  // their `[tui.keys.modal.<context>]` headings, including nested link stages.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[tui.keys.modal.confirm]"))
    .stdout(predicate::str::contains("focus_confirm"))
    .stdout(predicate::str::contains("[tui.keys.modal.link.choose_target]"));
}

// --- exec / clean (issue #313) ------------------------------------------

/// Spin up a repo plus one non-main worktree via the real binary, so the
/// `exec` / `clean` tests exercise the actual worktree-discovery and
/// target-selection path (not just the pure helpers). Returns the main repo
/// tempdir, the worktree-base tempdir (kept alive), and the worktree path.
fn repo_with_one_worktree() -> (tempfile::TempDir, tempfile::TempDir, PathBuf) {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  // Reuse the shared writer so the tempdir path is TOML-escaped (backslashes
  // on Windows CI would otherwise make `.gwm.toml` invalid).
  write_test_config(dir.path(), base.path());
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "1", "wt"])
    .assert()
    .success();
  let wt = base.path().join("feat-1-wt");
  assert!(wt.exists(), "worktree must exist for the exec/clean tests");
  (dir, base, wt)
}

#[test]
fn exec_runs_the_command_inside_each_worktree() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // The command's CWD is the worktree, so the marker lands there — proving
  // discovery + per-worktree execution, not just a parse.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "echo hi > exec_marker.txt"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓"))
    .stdout(predicate::str::contains("feat-1-wt"));
  assert!(
    wt.join("exec_marker.txt").exists(),
    "the command must run with the worktree as its working directory"
  );
}

#[test]
fn exec_exits_nonzero_when_a_worktree_command_fails() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "exit 5"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗"))
    .stdout(predicate::str::contains("exit 5"));
}

/// Append a TOML snippet to the repo's `.gwm.toml` (the writer created by
/// `repo_with_one_worktree`), so a test can add `[exec.profiles.*]` /
/// `[clean.profiles.*]` entries on top of the base config.
fn append_config(repo_root: &Path, snippet: &str) {
  use std::io::Write;
  let mut f = std::fs::OpenOptions::new()
    .append(true)
    .open(repo_root.join(".gwm.toml"))
    .unwrap();
  writeln!(f, "{snippet}").unwrap();
}

// --- exec/clean named profiles (issue #324) ---------------------------------

#[test]
fn exec_runs_a_named_profile_command() {
  let (dir, _base, wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[exec.profiles.greet]\ncommand = [\"sh\", \"-c\", \"echo hi > prof_marker.txt\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "greet"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓"));
  assert!(
    wt.join("prof_marker.txt").exists(),
    "the profile's command must run in the worktree"
  );
}

#[test]
fn exec_jobs_runs_the_parallel_capture_path() {
  // `--jobs > 1` runs the bounded-parallel path: each worktree's output is
  // captured and printed as a block (after its header), and the command still
  // runs and rolls up ✓.
  let (dir, _base, wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args([
      "exec",
      "--jobs",
      "2",
      "--",
      "sh",
      "-c",
      "echo blockline; echo hi > exec_jobs_marker.txt",
    ])
    .assert()
    .success()
    .stdout(predicate::str::contains("blockline")) // captured stdout printed as a block
    .stdout(predicate::str::contains("feat-1-wt"))
    .stdout(predicate::str::contains("✓"));
  assert!(
    wt.join("exec_jobs_marker.txt").exists(),
    "the command must still run under --jobs"
  );
}

#[test]
fn exec_jobs_preserves_raw_binary_output() {
  // The parallel path captures bytes, but must re-emit them RAW — a
  // `String::from_utf8_lossy` would mangle a non-UTF-8 byte (0xFF) into the
  // U+FFFD replacement char. `printf '\377'` emits a literal 0xFF.
  let (dir, _base, _wt) = repo_with_one_worktree();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "2", "--", "printf", "\\377"])
    .output()
    .unwrap();
  assert!(out.status.success(), "exec should succeed: {out:?}");
  assert!(
    out.stdout.contains(&0xFFu8),
    "the raw 0xFF byte must survive the capture, not be UTF-8-mangled"
  );
}

#[test]
fn exec_inline_inside_bare_repo_does_not_require_a_workdir() {
  // A bare repo has no `workdir()`, so there's no `.gwm.toml` to read — but
  // inline `gwm exec` must still run (it enumerates worktrees, not config).
  // Regression: reading the `[exec] jobs` default must fall back gracefully
  // here instead of failing with `NotInGitRepo` (#324 review).
  let dir = tempfile::TempDir::new().unwrap();
  git2::Repository::init_bare(dir.path()).expect("init bare repo");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "true"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no worktrees to run in"));
}

#[test]
fn exec_jobs_flag_skips_config_when_inline() {
  // Inline + `--jobs`: the flag is authoritative and the command is on the
  // CLI, so `[exec]` is never read — a malformed sibling profile can't block
  // `gwm exec --jobs N -- <cmd>` (#324 review).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.bad]\ncommand = []\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "2", "--", "true"])
    .assert()
    .success();
}

#[test]
fn exec_inline_jobs_default_tolerates_a_semantic_sibling_profile() {
  // Inline + no `--jobs`: the `[exec] jobs` default IS read, but sibling
  // profiles are NOT semantically validated (inline uses none of them), so a
  // `command = []` sibling doesn't block the inline run.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec]\njobs = 1\n[exec.profiles.bad]\ncommand = []\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "true"])
    .assert()
    .success();
}

#[test]
fn exec_jobs_flag_parses_and_propagates_failure() {
  // The parallel path propagates a non-zero rollup just like sequential.
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "3", "--", "sh", "-c", "exit 4"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗"))
    .stdout(predicate::str::contains("exit 4"));
}

#[test]
fn exec_inline_command_ignores_a_broken_gwm_toml() {
  // The inline `gwm exec -- <cmd>` surface is promised config-free: an
  // unrelated `.gwm.toml` error must NOT break it (it only reads config for
  // a `--profile` lookup). Here a stray top-level key would fail a config
  // load, yet the inline command still runs.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "true"])
    .assert()
    .success();
}

#[test]
fn exec_profile_tolerates_an_unrelated_config_error() {
  // The `--profile` path reads only the `[exec]` section, so an UNRELATED
  // top-level typo is tolerated — the failure is the unknown profile, not the
  // typo (exit 1 either way, but for the right reason).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "whatever"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `whatever`"));
}

#[test]
fn exec_profile_surfaces_a_malformed_exec_section() {
  // A shape error in the `[exec]` section ITSELF still surfaces (exit 1):
  // an unknown field in a profile is rejected by `deny_unknown_fields`.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.bad]\ncommand = [\"true\"]\nbogus = 1\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "bad"])
    .assert()
    .failure()
    .code(1);
}

#[test]
fn exec_profile_and_inline_command_are_mutually_exclusive() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.t]\ncommand = [\"true\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "t", "--", "echo", "hi"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("mutually exclusive"));
}

#[test]
fn exec_unknown_profile_exits_one() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn clean_unknown_profile_exits_one() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn clean_builtin_ignores_a_broken_gwm_toml() {
  // The built-in `gwm clean` (no `--profile`) is opt-in/config-tolerant: an
  // unrelated `.gwm.toml` error (a stray top-level key) must NOT block it —
  // only the `[clean]` section is read, so it falls back to the built-in dirs.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success();
}

#[test]
fn clean_honors_default_profile_despite_an_unrelated_config_error() {
  // A configured `[clean.profiles.default]` must NOT be silently dropped
  // (reverting to the built-in set) just because an unrelated key is wrong —
  // that would make a destructive `--yes` delete the wrong set. The default
  // profile's `coverage` (only reclaimable under that profile) is reported.
  let (dir, _base, wt) = repo_with_one_worktree();
  std::fs::create_dir_all(wt.join("coverage")).unwrap();
  std::fs::write(wt.join("coverage/lcov.info"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "coverage/\n").unwrap();
  append_config(
    dir.path(),
    "nonsense_key = true\n[clean.profiles.default]\ndirs = [\"coverage\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("coverage"));
}

#[test]
fn clean_surfaces_a_malformed_clean_section() {
  // A shape error in the `[clean]` section ITSELF still surfaces (exit 1),
  // even without `--profile` — a profile missing its required `dirs` must not
  // be silently ignored before a destructive clean.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[clean.profiles.broken]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .failure()
    .code(1);
}

#[test]
fn clean_rejects_a_sibling_invalid_profile() {
  // The `[clean]` loader validates EVERY profile, not just the selected one:
  // a sibling `bad` that escapes the worktree fails `--profile good` too, so
  // the command path matches `gwm config validate` / doctor (#324 review).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[clean.profiles.good]\ndirs = [\"target\"]\n[clean.profiles.bad]\ndirs = [\"..\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "good"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains(".."));
}

#[test]
fn exec_rejects_a_sibling_invalid_profile() {
  // Same for `[exec]`: a sibling `bad` with an empty command fails
  // `--profile good`.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[exec.profiles.good]\ncommand = [\"true\"]\n[exec.profiles.bad]\ncommand = []\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "good"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("empty `command`"));
}

#[test]
fn clean_profile_with_an_unsafe_dir_exits_one() {
  // A `dirs` entry that could escape the worktree (here `..`) is refused at
  // resolution, before any filesystem scan — exit 1, nothing walked.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[clean.profiles.evil]\ndirs = [\"..\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "evil"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("escape the worktree"));
}

#[test]
fn clean_named_profile_scopes_the_reclaim_to_its_dirs() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // `coverage/` is only reclaimable under a profile that lists it; the
  // built-in set (target/node_modules/dist/build) would ignore it.
  std::fs::create_dir_all(wt.join("coverage")).unwrap();
  std::fs::write(wt.join("coverage/lcov.info"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "coverage/\n").unwrap();
  append_config(dir.path(), "[clean.profiles.cov]\ndirs = [\"coverage\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "cov"])
    .assert()
    .success()
    .stdout(predicate::str::contains("coverage"));
}

#[test]
fn clean_reclaims_a_leading_dash_profile_dir() {
  // A profile dir whose name starts with `-` (e.g. `-cache`) must flow through
  // the git-ignored safety check correctly — the check passes `--` so git
  // doesn't parse the name as an option and wrongly skip it (#324 review P3).
  let (dir, _base, wt) = repo_with_one_worktree();
  std::fs::create_dir_all(wt.join("-cache")).unwrap();
  std::fs::write(wt.join("-cache/blob.bin"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "/-cache/\n").unwrap();
  append_config(dir.path(), "[clean.profiles.dash]\ndirs = [\"-cache\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "dash", "--yes"])
    .assert()
    .success();
  assert!(
    !wt.join("-cache").exists(),
    "a git-ignored `-cache` profile dir must be reclaimed, not skipped"
  );
}

#[test]
fn clean_reports_artifacts_without_deleting_by_default() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // target/ is git-ignored ⇒ deletable, so the dry-run preview counts it and
  // prompts to re-run — but report-only must not actually delete it.
  fs::write(wt.join(".gitignore"), "/target\n").unwrap();
  fs::create_dir_all(wt.join("target")).unwrap();
  fs::write(wt.join("target").join("blob.bin"), vec![0u8; 4096]).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("target"))
    .stdout(predicate::str::contains("re-run with --yes"));

  assert!(wt.join("target").exists(), "report-only mode must not delete anything");
}

#[test]
fn clean_preview_excludes_non_deletable_dirs_from_total() {
  // A non-ignored dist/ must not be counted as reclaimable nor trigger the
  // "re-run with --yes" promise — the preview must match what --yes would do.
  let (dir, _base, wt) = repo_with_one_worktree();
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("keep.txt"), b"hand-authored").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"))
    .stdout(predicate::str::contains("nothing to reclaim"))
    .stdout(predicate::str::contains("re-run with --yes").not());
}

#[test]
fn clean_yes_deletes_gitignored_artifacts() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // target/ is ignored ⇒ safe to reclaim.
  fs::write(wt.join(".gitignore"), "/target\n").unwrap();
  fs::create_dir_all(wt.join("target")).unwrap();
  fs::write(wt.join("target").join("blob.bin"), vec![0u8; 4096]).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("reclaimed"));

  assert!(
    !wt.join("target").exists(),
    "a git-ignored target/ should be deleted with --yes"
  );
}

#[test]
fn clean_yes_refuses_to_delete_non_ignored_artifacts() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // dist/ is NOT ignored (no matching rule) and holds hand-authored content;
  // the safety gate must skip it rather than destroy it.
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("keep.txt"), b"non-regenerable work").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"));

  assert!(wt.join("dist").exists(), "a non-ignored dist/ must be preserved");
  assert!(
    wt.join("dist").join("keep.txt").exists(),
    "hand-authored content under a non-ignored dir must survive --yes"
  );
}

#[test]
fn clean_yes_refuses_ignored_dir_holding_tracked_files() {
  // git tracks files, not directories: a `dist/` ignore rule can coexist with
  // a force-added, committed `dist/index.html`. `check-ignore dist` succeeds,
  // but the dir holds tracked work — the gate must still skip it.
  let (dir, _base, wt) = repo_with_one_worktree();
  fs::write(wt.join(".gitignore"), "/dist\n").unwrap();
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("index.html"), b"tracked output").unwrap();
  // Force-track the file despite the ignore rule.
  std::process::Command::new("git")
    .current_dir(&wt)
    .args(["add", "-f", "dist/index.html"])
    .status()
    .expect("git add -f");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"));

  assert!(
    wt.join("dist").join("index.html").exists(),
    "a tracked file under an ignored dir must survive --yes"
  );
}

/// Run `git <args>` in `dir`, asserting success — fixture setup helper.
fn git_at(dir: &Path, args: &[&str]) {
  // Pin signing off so a developer with `commit.gpgsign=true` (or a missing
  // signing key) in their ambient git config doesn't make these fixtures fail
  // before `gwm` is even exercised (#326 review).
  let ok = std::process::Command::new("git")
    .current_dir(dir)
    .args(["-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false"])
    .args(args)
    .status()
    .unwrap()
    .success();
  assert!(ok, "git {args:?} in {} failed", dir.display());
}

/// A workspace root with two child repos (`alpha`, `beta`), each carrying one
/// non-main linked worktree at `<root>/alpha-wt` / `<root>/beta-wt`. `discover`
/// collapses each worktree onto its owning repo, so the workspace has exactly
/// the two repos and `exec`/`clean` fan out over their worktrees.
fn workspace_with_worktrees() -> tempfile::TempDir {
  let root = tempfile::TempDir::new().unwrap();
  for (repo, wt) in [("alpha", "alpha-wt"), ("beta", "beta-wt")] {
    let repo_dir = root.path().join(repo);
    std::fs::create_dir_all(&repo_dir).unwrap();
    git_at(&repo_dir, &["init", "-b", "main"]);
    git_at(&repo_dir, &["config", "user.email", "t@t.t"]);
    git_at(&repo_dir, &["config", "user.name", "t"]);
    std::fs::write(repo_dir.join("README.md"), "x").unwrap();
    git_at(&repo_dir, &["add", "."]);
    git_at(&repo_dir, &["commit", "-m", "init"]);
    let wt_path = root.path().join(wt);
    git_at(
      &repo_dir,
      &["worktree", "add", "-b", "feat/x", wt_path.to_str().unwrap()],
    );
  }
  root
}

/// A workspace root with two child repos that have ONLY their main checkout
/// (no linked worktrees) — so exec/clean fan-out finds no targets anywhere.
fn workspace_main_only() -> tempfile::TempDir {
  let root = tempfile::TempDir::new().unwrap();
  for repo in ["alpha", "beta"] {
    let repo_dir = root.path().join(repo);
    std::fs::create_dir_all(&repo_dir).unwrap();
    git_at(&repo_dir, &["init", "-b", "main"]);
    git_at(&repo_dir, &["config", "user.email", "t@t.t"]);
    git_at(&repo_dir, &["config", "user.name", "t"]);
    std::fs::write(repo_dir.join("README.md"), "x").unwrap();
    git_at(&repo_dir, &["add", "."]);
    git_at(&repo_dir, &["commit", "-m", "init"]);
  }
  root
}

// `gwm exec` / `gwm clean` now FAN OUT across a workspace's child repos under
// `--workspace <root>` (issue #326), reversing the #319 deferral. This is an
// additive transition — a previous refusal turning into a success is not a
// breaking change. These tests pin the fan-out: a repo-tagged rollup/report
// across every child repo, with an aggregated exit code. The `--workspace`
// refusal now only applies to commands that still don't implement it (covered
// by `workspace_refuses_unsupported_subcommand` below).

#[test]
fn exec_fans_out_across_workspace_child_repos() {
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "sh", "-c", "echo ran > ws_exec_marker.txt"])
    .assert()
    .success()
    // A `══ <repo>` header per child repo, and a repo-tagged rollup.
    .stdout(predicate::str::contains("══ alpha"))
    .stdout(predicate::str::contains("══ beta"))
    .stdout(predicate::str::contains("✓ alpha/"))
    .stdout(predicate::str::contains("✓ beta/"));
  // The command actually ran in each child repo's worktree.
  assert!(root.path().join("alpha-wt/ws_exec_marker.txt").exists());
  assert!(root.path().join("beta-wt/ws_exec_marker.txt").exists());
}

#[test]
fn exec_workspace_scopes_to_a_matching_slug() {
  // A slug matching a worktree in only one child repo scopes the fan-out to
  // that repo (the others contribute nothing — not an error).
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["alpha-wt", "--", "sh", "-c", "echo hi > scoped.txt"])
    .assert()
    .success();
  assert!(root.path().join("alpha-wt/scoped.txt").exists(), "alpha matched");
  assert!(
    !root.path().join("beta-wt/scoped.txt").exists(),
    "beta did not match the slug"
  );
}

#[test]
fn exec_workspace_scoped_slug_ignores_an_unrelated_repos_missing_profile() {
  // Only `alpha` defines `[exec.profiles.fmt]`; `beta` has none. Scoping to
  // `alpha-wt` must not resolve `beta`'s config (it contributes no target), so
  // the run succeeds despite `beta` lacking the profile (#326 review).
  let root = workspace_with_worktrees();
  std::fs::write(
    root.path().join("alpha/.gwm.toml"),
    "[exec.profiles.fmt]\ncommand = [\"sh\", \"-c\", \"echo hi > prof.txt\"]\n",
  )
  .unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["alpha-wt", "--profile", "fmt"])
    .assert()
    .success();
  assert!(root.path().join("alpha-wt/prof.txt").exists(), "alpha's profile ran");
}

#[test]
fn exec_workspace_errors_on_a_slug_matching_no_child_repo() {
  // A typo that matches nothing in ANY child repo is an error, not a silent
  // exit-0 having run nothing (#326 review).
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["ghost-typo", "--", "true"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("ghost-typo"));
}

#[test]
fn exec_workspace_aggregates_a_nonzero_exit() {
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "sh", "-c", "exit 3"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗ alpha/"))
    .stdout(predicate::str::contains("✗ beta/"));
}

#[test]
fn clean_fans_out_across_workspace_child_repos() {
  let root = workspace_with_worktrees();
  // A git-ignored `target/` in each child repo's worktree is reclaimable.
  for (repo, wt) in [("alpha", "alpha-wt"), ("beta", "beta-wt")] {
    let _ = repo;
    let wtdir = root.path().join(wt);
    std::fs::create_dir_all(wtdir.join("target")).unwrap();
    std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
    std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  }
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .assert()
    .success()
    // Report is repo-tagged; report-only must not delete.
    .stdout(predicate::str::contains("alpha/"))
    .stdout(predicate::str::contains("beta/"))
    .stdout(predicate::str::contains("re-run with --yes"));
  assert!(
    root.path().join("alpha-wt/target").exists(),
    "report-only keeps target/"
  );
}

#[test]
fn clean_workspace_yes_deletes_in_every_child_repo() {
  let root = workspace_with_worktrees();
  for wt in ["alpha-wt", "beta-wt"] {
    let wtdir = root.path().join(wt);
    std::fs::create_dir_all(wtdir.join("target")).unwrap();
    std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
    std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  }
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .arg("--yes")
    .assert()
    .success()
    .stdout(predicate::str::contains("reclaimed"));
  assert!(!root.path().join("alpha-wt/target").exists());
  assert!(!root.path().join("beta-wt/target").exists());
}

#[test]
fn clean_workspace_errors_before_deleting_on_a_corrupt_child_repo() {
  // A child that looks like a repo (.git present) but won't open must fail the
  // whole fan-out BEFORE any deletion — not be silently skipped while the valid
  // repos get cleaned (#326 review).
  let root = workspace_with_worktrees();
  let wtdir = root.path().join("alpha-wt");
  std::fs::create_dir_all(wtdir.join("target")).unwrap();
  std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
  std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  let corrupt = root.path().join("corrupt");
  std::fs::create_dir_all(&corrupt).unwrap();
  std::fs::write(corrupt.join(".git"), "gitdir: /nonexistent-gitdir\n").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .arg("--yes")
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("corrupt"));
  // The valid repo's reclaimable target/ survives — nothing was deleted.
  assert!(wtdir.join("target").exists(), "fan-out must fail before any deletion");
}

#[test]
fn exec_workspace_all_empty_errors_on_a_missing_command() {
  // Every repo is main-only (no targets), but a usage error (neither inline
  // command nor --profile) must still surface, not a silent exit 0 (#326 rev).
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("provide a command"));
}

#[test]
fn exec_workspace_all_empty_errors_on_an_unknown_profile() {
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn exec_workspace_all_empty_inline_command_exits_zero() {
  // A valid inline command with no targets anywhere is "nothing to do", exit 0.
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "true"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no worktrees to run in"));
}

#[test]
fn clean_workspace_all_empty_errors_on_an_unknown_profile() {
  // A typo'd `--profile` with no targets anywhere must surface, not silently
  // report "nothing to reclaim" (#326 review).
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .args(["--profile", "ghost", "--yes"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn workspace_refuses_a_still_unsupported_subcommand() {
  // `--workspace` is still refused on commands that don't implement it (only
  // list/create/exec/clean and the bare TUI do).
  let (dir, _base, _wt) = repo_with_one_worktree();
  let ws = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["sync", "--workspace", ws.path().to_str().unwrap()])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("--workspace is only supported"));
}