gwm-cli 1.6.0

//! End-to-end tests that invoke the compiled `gwm` binary via assert_cmd.
//! These exercise the user-visible CLI surface (subcommands, help, errors).

mod common;

use assert_cmd::Command;
use common::init_repo;
use predicates::prelude::*;
use std::fs;
use std::path::{Path, PathBuf};

#[test]
fn help_prints_subcommands() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--help");
  // Match the subcommand-listing column exactly: clap aligns subcommand
  // names with two leading spaces and at least two trailing spaces before
  // the description. A loose `contains("cd")` would also match prose like
  // "to cd into it" in another subcommand's description.
  // `cd` is now a visible alias of `path` (clap renders it as
  // `path  ...  [alias: cd]`), so we assert the alias marker rather than a
  // separate `  cd ` row. The regex tolerates clap's singular/plural churn:
  // 4.6.1 printed `[aliases: cd]`, 4.6.2 prints `[alias: cd]` for a lone
  // alias — `alias(es)?` matches both so a cosmetic upstream change to the
  // help formatter can't break the test again.
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("  init "))
    .stdout(predicate::str::contains("  list "))
    // Issue #408: agent-session surface (list / attach / detach).
    .stdout(predicate::str::contains("  agents "))
    .stdout(predicate::str::contains("  create "))
    // Issue #83: create an issue from repo templates, then create the worktree.
    .stdout(predicate::str::contains("  new "))
    // Issue #84: render the PR body from `[pr_template]` and shell out to `gh pr create`.
    .stdout(predicate::str::contains("  pr "))
    // Issue #308: materialise an existing PR into a worktree (inbound review).
    .stdout(predicate::str::contains("  review "))
    .stdout(predicate::str::contains("  path "))
    .stdout(predicate::str::is_match(r"\[alias(es)?: cd\]").unwrap())
    .stdout(predicate::str::contains("  bootstrap "))
    // Issue #24: fetch + rebase/merge a worktree onto its upstream.
    .stdout(predicate::str::contains("  sync "))
    .stdout(predicate::str::contains("  prune "))
    .stdout(predicate::str::contains("  completions "))
    .stdout(predicate::str::contains("  shell-init "))
    .stdout(predicate::str::contains("  switch "))
    .stdout(predicate::str::contains("  tmux "))
    .stdout(predicate::str::contains("  zellij "))
    .stdout(predicate::str::contains("  doctor "))
    .stdout(predicate::str::contains("  link "))
    .stdout(predicate::str::contains("  unlink "))
    .stdout(predicate::str::contains("  open "))
    .stdout(predicate::str::contains("  status "))
    // Issue #81: declarative GitHub labels.
    .stdout(predicate::str::contains("  labels "))
    // Issue #82: declarative GitHub milestones.
    .stdout(predicate::str::contains("  milestones "))
    // Issue #95: TOFU trust ledger.
    .stdout(predicate::str::contains("  trust "))
    // Issue #86: CLI aliases (`gwm aliases list`).
    .stdout(predicate::str::contains("  aliases "))
    // Issue #89: git-config-style `.gwm.toml` editing.
    .stdout(predicate::str::contains("  config "))
    // Issue #85: gitmoji commit-prefix + commit-msg hook installer.
    .stdout(predicate::str::contains("  commit-prefix "))
    .stdout(predicate::str::contains("  hooks "))
    // Issue #29: operation journal + undo + history.
    .stdout(predicate::str::contains("  undo "))
    .stdout(predicate::str::contains("  history "))
    // Issue #87: configurable TUI keymap (`gwm tui keys`).
    .stdout(predicate::str::contains("  tui "))
    // Issue #38: long-running JSON-RPC daemon over a unix socket. The
    // subcommand is always listed (help is identical cross-platform); the
    // socket impl is `cfg(unix)`-gated and returns a clean error elsewhere.
    .stdout(predicate::str::contains("  daemon "))
    // Issue #309: first daemon consumer — compact statusline for prompts.
    .stdout(predicate::str::contains("  statusline "))
    // Issue #313: run a command in each worktree.
    .stdout(predicate::str::contains("  exec "))
    // Issue #313: report / reclaim heavy build artifacts across worktrees.
    .stdout(predicate::str::contains("  clean "));
}

// --- gitmoji (issue #85) ------------------------------------------------

#[test]
fn commit_prefix_resolves_branch_to_shortcode_form() {
  // The canonical contract: `gwm commit-prefix --branch feat/#41-foo`
  // prints `:sparkles: feat(#41):` — the prefix every commit in this
  // repo starts with. The shortcode form is the default (matches
  // most commit hooks and tooling that lint emoji on raw text).
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "feat/#41-foo"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":sparkles: feat(#41):"));
}

#[test]
fn commit_prefix_unicode_emits_real_emoji() {
  // The `--unicode` flag swaps `:sparkles:` for ✨ — meant for shell
  // prompts and the commit-msg hook (which wants the final byte
  // sequence in the message body, not the shortcode form).
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "feat/#41-foo", "--unicode"]);
  cmd.assert().success().stdout(predicate::str::contains("✨ feat(#41):"));
}

#[test]
fn commit_prefix_for_fix_branch_uses_bug_emoji() {
  // Second branch type to pin: `fix/#10-bar` ↔ `:bug:` ↔ 🐛. The two
  // most-used emojis in the history both need an end-to-end test
  // so a future refactor that breaks one trips a binary-level
  // assertion.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "fix/#10-bar"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":bug: fix(#10):"));
}

#[test]
fn commit_prefix_with_explicit_branch_honours_repo_gitmoji_overrides() {
  // Regression guard: `--branch <name>` is a scripted entry point —
  // shell prompts, AI assistants, the installed commit-msg hook —
  // but if it bypasses `.gwm.toml`'s `[gitmoji]` block the renderer
  // contradicts itself between `gwm types --gitmoji` (which loads
  // the config) and `gwm commit-prefix --branch …` (which used not
  // to). The two surfaces MUST agree.
  let (dir, _repo) = init_repo();
  let cfg = "[gitmoji]\nfeat = \":rocket:\"\n";
  std::fs::write(dir.path().join(".gwm.toml"), cfg).expect("seed .gwm.toml");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#41-foo"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":rocket: feat(#41):"));
}

#[test]
fn commit_prefix_on_non_gwm_branch_reports_error() {
  // `gwm commit-prefix --branch random` doesn't match the
  // `<type>/#<N>-<slug>` regex — the contract is "fail loudly with a
  // pointer to the convention" rather than silently rendering a
  // bogus prefix. The user typed `--branch <name>` explicitly, so
  // there's no auto-fallback to CWD to fall back to.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["commit-prefix", "--branch", "random"]);
  cmd.assert().failure().stderr(predicate::str::contains("random"));
}

#[test]
fn commit_prefix_unicode_normalizes_known_shortcode_override() {
  // The UX guarantee from the PR #152 follow-up: under `--unicode`,
  // a `.gwm.toml` override that supplied a known `:shortcode:` (like
  // `:rocket:`) must render as the unicode glyph (🚀), not the
  // shortcode literal. Asymmetry between this surface and
  // `gwm types --gitmoji`'s unicode column was the original bug.
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":rocket:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#1-x", "--unicode"]);
  cmd.assert().success().stdout(predicate::str::contains("🚀 feat(#1):"));
}

#[test]
fn commit_prefix_unicode_leaves_unknown_shortcode_override_verbatim() {
  // Graceful degradation for shortcodes the built-in table doesn't
  // know about. `:foo:` is not in `shortcode_to_unicode`, so under
  // `--unicode` we keep the value verbatim — the surface must remain
  // usable on any user configuration without falling back to
  // `:question:`/❓ (which would hide the user's intent).
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":foo:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/#1-x", "--unicode"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":foo: feat(#1):"));
}

#[test]
fn types_gitmoji_normalizes_known_shortcode_override_in_unicode_column() {
  // Symmetry with `gwm commit-prefix --unicode`: the `gwm types
  // --gitmoji` unicode column must show the GLYPH for a known
  // shortcode override (not the shortcode literal). The shortcode
  // column still shows the literal `:rocket:` so both forms remain
  // greppable on the same row.
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "[gitmoji]\nfeat = \":rocket:\"\n").expect("seed .gwm.toml");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["types", "--gitmoji"]);
  let assert = cmd.assert().success();
  let stdout = String::from_utf8(assert.get_output().stdout.clone()).expect("utf8 stdout");
  // Find the `feat` row and check both columns on it. A per-row
  // assertion (rather than two independent `contains(...)` checks)
  // catches the regression where the glyph appears on some unrelated
  // row but `feat` still shows `:rocket:` in the unicode column.
  let feat_row = stdout
    .lines()
    .find(|l| l.trim_start().starts_with("feat "))
    .expect("feat row must be present in `gwm types --gitmoji` output");
  assert!(
    feat_row.contains("🚀"),
    "feat unicode column must be normalised to 🚀, got: {feat_row:?}"
  );
  assert!(
    feat_row.contains(":rocket:"),
    "feat shortcode column must still be :rocket:, got: {feat_row:?}"
  );
}

#[test]
fn types_with_gitmoji_flag_includes_emoji_columns() {
  // `gwm types --gitmoji` extends the existing per-type list with
  // two more columns: the unicode emoji and the shortcode form. The
  // shortcode is asserted via `:sparkles:` (textual, deterministic);
  // the unicode column is asserted via the ✨ character.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["types", "--gitmoji"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains(":sparkles:"))
    .stdout(predicate::str::contains("✨"))
    .stdout(predicate::str::contains(":bug:"))
    .stdout(predicate::str::contains("🐛"));
}

#[test]
fn types_without_gitmoji_flag_does_not_include_emoji_columns() {
  // Backwards compatibility: `gwm types` (no flag) must NOT spill
  // shortcodes into its output — every scripted parser of the
  // pre-#85 surface depends on the two-column layout.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains(":sparkles:").not())
    .stdout(predicate::str::contains("✨").not());
}

#[test]
fn hooks_install_commit_msg_creates_executable_hook() {
  // `gwm hooks install commit-msg` writes `.git/hooks/commit-msg` and
  // exits 0. We assert on the resulting file (not the stdout
  // message), so the test is robust to cosmetic copy changes.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["hooks", "install", "commit-msg"]);
  cmd.assert().success();

  let hook = dir.path().join(".git").join("hooks").join("commit-msg");
  assert!(hook.exists(), "commit-msg hook must exist after `gwm hooks install`");
  #[cfg(unix)]
  {
    use std::os::unix::fs::PermissionsExt;
    let mode = std::fs::metadata(&hook).expect("stat hook").permissions().mode();
    assert!(mode & 0o100 != 0, "hook must be executable by owner");
  }
}

#[test]
fn hooks_install_commit_msg_refuses_existing_hook_without_force() {
  // Idempotent-safe contract: a pre-existing `commit-msg` (husky,
  // commitlint, …) is left intact and the command exits non-zero
  // with a clear pointer to `--force`.
  let (dir, _repo) = init_repo();
  let hooks_dir = dir.path().join(".git").join("hooks");
  std::fs::create_dir_all(&hooks_dir).expect("hooks dir");
  let hook_path = hooks_dir.join("commit-msg");
  std::fs::write(&hook_path, "#!/bin/sh\necho 'pre-existing hook'\n").expect("seed hook");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).args(["hooks", "install", "commit-msg"]);
  cmd.assert().failure().stderr(predicate::str::contains("--force"));

  let body = std::fs::read_to_string(&hook_path).expect("read seeded hook");
  assert!(
    body.contains("pre-existing hook"),
    "seeded hook must not be overwritten on the refusal path"
  );
}

#[test]
fn hooks_install_commit_msg_force_overwrites() {
  // The escape hatch.
  let (dir, _repo) = init_repo();
  let hooks_dir = dir.path().join(".git").join("hooks");
  std::fs::create_dir_all(&hooks_dir).expect("hooks dir");
  let hook_path = hooks_dir.join("commit-msg");
  std::fs::write(&hook_path, "#!/bin/sh\necho 'old'\n").expect("seed hook");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["hooks", "install", "commit-msg", "--force"]);
  cmd.assert().success();

  let body = std::fs::read_to_string(&hook_path).expect("read installed hook");
  assert!(
    body.contains("gwm commit-msg hook"),
    "installed hook must carry the gwm marker; got {:?}",
    body
  );
}

// --- labels (issue #81) -------------------------------------------------

#[test]
fn labels_help_lists_list_and_push() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["labels", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("push"));
}

#[test]
fn labels_list_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn labels_list_with_no_declared_labels_is_a_no_op() {
  // The no-op fast path: no `[[labels]]` in .gwm.toml ⇒ don't shell
  // out to `gh`, just print a single line and exit 0. The test
  // doesn't need `gh` on PATH to pass — that's the whole point.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

// --- sync (issue #24) -------------------------------------------------------

#[test]
fn sync_unknown_pattern_errors() {
  // A pattern that resolves to no worktree must fail loudly with the
  // worktree name, not silently no-op.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["sync", "does-not-exist"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("does-not-exist"));
}

#[test]
fn sync_in_repo_without_upstream_reports_missing_upstream() {
  // `gwm sync` with no pattern targets the CWD worktree. A fresh repo
  // on `main` with no remote has no upstream → clear, actionable error.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("sync")
    .assert()
    .failure()
    .stderr(predicate::str::contains("upstream"));
}

#[test]
fn sync_from_subdir_names_the_worktree_root_not_the_subdir() {
  // Regression for the Copilot nit on #172: run from a subdirectory,
  // the success line must name the worktree root (the dir tracking the
  // upstream), not the CWD basename. Set up a bare origin + tracking
  // clone so `gwm sync` reaches the "up to date" success print.
  use std::process::Command as Git;

  fn git(dir: &Path, args: &[&str]) {
    let out = Git::new("git")
      .arg("-C")
      .arg(dir)
      .args(["-c", "commit.gpgsign=false"])
      .args(args)
      .env("GIT_AUTHOR_NAME", "t")
      .env("GIT_AUTHOR_EMAIL", "t@t")
      .env("GIT_COMMITTER_NAME", "t")
      .env("GIT_COMMITTER_EMAIL", "t@t")
      .output()
      .unwrap();
    assert!(
      out.status.success(),
      "git {:?}: {}",
      args,
      String::from_utf8_lossy(&out.stderr)
    );
  }

  let td = tempfile::TempDir::new().unwrap();
  let origin = td.path().join("origin");
  let wt = td.path().join("my-worktree");
  std::fs::create_dir_all(&origin).unwrap();
  Git::new("git")
    .args(["init", "--bare", "-b", "main"])
    .arg(&origin)
    .output()
    .unwrap();
  Git::new("git").args(["init", "-b", "main"]).arg(&wt).output().unwrap();
  git(&wt, &["config", "user.email", "t@t"]);
  git(&wt, &["config", "user.name", "t"]);
  std::fs::write(wt.join("file.txt"), "base\n").unwrap();
  git(&wt, &["add", "-A"]);
  git(&wt, &["commit", "-m", "init"]);
  git(&wt, &["remote", "add", "origin", origin.to_str().unwrap()]);
  git(&wt, &["push", "-u", "origin", "main"]);

  let sub = wt.join("src/deep");
  std::fs::create_dir_all(&sub).unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(&sub)
    .arg("sync")
    .assert()
    .success()
    // Names the worktree root dir, not the "deep" subdir we ran from.
    .stdout(predicate::str::contains("my-worktree"))
    .stdout(predicate::str::contains("deep").not());
}

#[test]
fn labels_push_with_no_declared_labels_is_a_no_op() {
  // Same fast path as `list`. Push must not call `gh` when there's
  // nothing to push — that would surface `gh: not found` to users
  // who haven't yet configured `[[labels]]` and tried the command.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "push"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

#[test]
fn labels_push_dry_run_with_no_declared_labels_succeeds() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "push", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 labels declared"));
}

#[test]
fn labels_list_surfaces_invalid_color_with_label_name() {
  // A typo in `color` must be caught at resolve time with the label
  // name in the error message — otherwise the user has to grep their
  // config to find which entry is broken.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[labels]]
name = "bug"
color = "not-a-hex"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["labels", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("bug"))
    .stderr(predicate::str::contains("not-a-hex"));
}

// --- milestones (issue #82) ---------------------------------------------

#[test]
fn milestones_help_lists_list_and_push() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["milestones", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("push"));
}

#[test]
fn milestones_list_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn milestones_list_with_no_declared_is_a_no_op() {
  // No `[[milestones]]` in .gwm.toml ⇒ don't shell out to `gh`. The
  // test passes without `gh` on PATH — that's the whole point of the
  // fast path.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_push_with_no_declared_is_a_no_op() {
  // Same fast path as `list`. Push must not call `gh` when there's
  // nothing to push.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "push"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_push_dry_run_with_no_declared_succeeds() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "push", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 milestones declared"));
}

#[test]
fn milestones_list_surfaces_invalid_due_on_with_title() {
  // A typo in `due_on` must be caught at resolve time with the
  // milestone title in the error message — otherwise the user has to
  // grep their config to find the offending entry.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[milestones]]
title = "v0.7.0"
due_on = "not-a-date"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("v0.7.0"));
}

#[test]
fn milestones_list_surfaces_invalid_state_with_title() {
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[milestones]]
title = "v0.7.0"
state = "draft"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["milestones", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("v0.7.0"))
    .stderr(predicate::str::contains("draft"));
}

#[test]
fn switch_alias_s_resolves_to_switch() {
  // Issue #22: `gwm s` is the daily-driver alias for `gwm switch`. Resolving
  // `gwm s --help` to the switch help text proves the alias is wired in.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["s", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Open an interactive picker"));
}

#[test]
fn top_level_help_advertises_switch_alias() {
  // The visible alias must show up in the top-level help summary so users
  // discover `gwm s` without reading the subcommand-specific page. `aliases?`
  // tolerates clap's singular/plural rendering (4.6.1 `[aliases: s]`, 4.6.2
  // `[alias: s]`).
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--help");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("switch").and(predicate::str::is_match(r"\[alias(es)?: s\]").unwrap()));
}

#[test]
fn switch_outside_git_repo_fails() {
  // Same contract as the other repo-bound subcommands: bail out with a
  // clear error rather than dropping the user into an empty TUI.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("switch")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn doctor_on_fresh_repo_prints_checks() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  // Exit code is intentionally not asserted to be 0: in environments
  // without `lazygit` on PATH (most CI runners) or a pre-existing
  // `~/cc-worktree/` parent, the report legitimately surfaces Warning
  // entries and exits 1. But we still bound the contract — anything
  // other than 0 (all green) or 1 (warning) on a vanilla fresh repo
  // means the doctor is over-flagging (or panicking, which would also
  // produce a non-0/1 code) and we want the test to fail loudly.
  // The 0/1/2 mapping is unit-tested in `tests/doctor_tests.rs`.
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(predicate::in_iter([0_i32, 1]))
    .stdout(predicate::str::contains("✓"))
    .stdout(predicate::str::contains(".gwm.toml"))
    .stdout(predicate::str::contains("base directory writable"));
}

#[test]
fn doctor_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn doctor_exits_one_when_review_binary_missing() {
  // Issue #75: configuring [review] with a binary that's not on $PATH
  // must produce a Warning (exit code 1), not a Failed (exit code 2).
  // Review is opt-in — a CI pre-commit hook gated on `gwm doctor`
  // should still let the user push when only the review tool is
  // missing locally.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[review]
command = "definitely-not-on-path-review-cli {base}..{head}"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(1)
    .stdout(predicate::str::contains("definitely-not-on-path-review-cli"));
}

#[test]
fn doctor_exits_two_on_invalid_config() {
  let (dir, _repo) = init_repo();
  std::fs::write(dir.path().join(".gwm.toml"), "broken = [unterminated").unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("doctor")
    .assert()
    .code(2)
    .stdout(predicate::str::contains("✗"));
}

#[test]
fn version_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.arg("--version");
  cmd.assert().success().stdout(predicate::str::contains("gwm"));
}

#[test]
fn types_lists_branch_types() {
  // Outside any repo (the temp cwd of `assert_cmd` is typically not a
  // git repo on CI runners) `gwm types` must still list the built-in
  // defaults and surface the `built-in defaults` footer so users can
  // tell they're not looking at a `.gwm.toml` override.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("fix"))
    .stdout(predicate::str::contains("hotfix"))
    .stdout(predicate::str::contains("chore"))
    .stdout(predicate::str::contains("(source: built-in defaults)"));
}

#[test]
fn types_lists_configured_branch_types_from_dot_gwm_toml() {
  // When `.gwm.toml` carries a `[[branch_types]]` block, `gwm types`
  // must reflect the override verbatim and update its source footer.
  // The legacy entries that aren't in the override must NOT bleed
  // through (e.g. `hotfix` is part of the built-in defaults but is
  // intentionally absent from this repo's list).
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[[branch_types]]
name = "feat"
description = "Feature"

[[branch_types]]
name = "migration"
description = "Database migration"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("migration"))
    .stdout(predicate::str::contains("Database migration"))
    .stdout(predicate::str::contains("(source: .gwm.toml)"))
    .stdout(predicate::str::contains("hotfix").not());
}

#[test]
fn types_inside_bare_repo_falls_back_to_built_in_defaults() {
  // Bare repos have no `workdir()`, so there's no place to look for a
  // `.gwm.toml`. Regression: previously `cmd_types` would propagate a
  // misleading `NotInGitRepo` error here even though `discover_repo`
  // succeeded. The fallback is identical to the "outside any repo"
  // branch — the built-in defaults with a `(source: built-in
  // defaults)` footer.
  let dir = tempfile::TempDir::new().unwrap();
  git2::Repository::init_bare(dir.path()).expect("init bare repo");
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("types");
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("feat"))
    .stdout(predicate::str::contains("hotfix"))
    .stdout(predicate::str::contains("(source: built-in defaults)"));
}

#[test]
fn create_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.current_dir(dir.path()).arg("list");
  cmd
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn list_detect_pr_flag_adds_pr_column_with_detected_number() {
  // E2E (issue #181): `gwm list --detect-pr` shows a PR column populated
  // by `gh pr list` detection for each worktree's branch.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(fake_bin.path(), r#"[{"number":128}]"#, r#"{}"#);

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--detect-pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("PR"))
    .stdout(predicate::str::contains("#128"));
}

// --- GitLab dispatch, end to end (issue #419) -----------------------------

#[cfg(unix)]
#[test]
fn list_detect_pr_dispatches_to_glab_on_a_gitlab_origin() {
  // The forge split's most basic observable claim, and until now only
  // covered by argv unit tests: a GitLab origin must reach `glab`, with
  // the MR vocabulary and the `--repo` selector, not `gh`.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://gitlab.com/group/proj.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let log = fake_bin.path().join("calls.log");
  let fake_glab = write_recording_glab(
    fake_bin.path(),
    r#"[{"iid":128,"project_id":7,"source_project_id":7}]"#,
    "{}",
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GLAB", &fake_glab)
    .env("GWM_FAKE_LOG", &log)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--detect-pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("#128"));

  let calls = fs::read_to_string(&log).unwrap();
  assert!(calls.contains("ARGV:mr list"), "must speak MR, not PR: {calls}");
  assert!(
    calls.contains("--repo group/proj"),
    "must target the origin slug: {calls}"
  );
}

#[cfg(unix)]
#[test]
fn the_glab_child_does_not_inherit_the_environment_that_would_retarget_it() {
  // The end-to-end counterpart to the unit tests on `glab_env_remove`,
  // and the reason this harness exists: rounds 4, 7, 9 and 10 each found
  // an inherited variable that silently redirected the CLI, and every
  // fix was verified only against a pure function. This asserts the
  // contract where it actually matters — on the spawned process.
  //
  // `GITLAB_TOKEN` is in here as the negative control: tier 3 of the
  // rule says authentication is never stripped, so a test that only
  // checked "things are cleared" could pass while breaking every auth.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://gitlab.com/group/proj.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let log = fake_bin.path().join("calls.log");
  let fake_glab = write_recording_glab(fake_bin.path(), "[]", "{}");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GLAB", &fake_glab)
    .env("GWM_FAKE_LOG", &log)
    .env("PATH", prepend_path(fake_bin.path()))
    // Exported by the user, pointing somewhere else entirely.
    .env("GITLAB_REPO", "someone-else/private")
    .env("GITLAB_GROUP", "someone-else")
    .env("GITLAB_TOKEN", "keep-me")
    // Outranks the host pin inside glab, and points at another tenant.
    .env("GITLAB_API_HOST", "https://api.gitlab.example.com")
    .env("GL_HOST", "https://gitlab.other.example")
    // Would downgrade the pinned https instance to cleartext.
    .env("API_PROTOCOL", "http")
    .args(["list", "--detect-pr"])
    .assert()
    .success();

  let calls = fs::read_to_string(&log).unwrap();
  assert!(
    calls.contains("GITLAB_REPO:<unset>"),
    "selector must be cleared: {calls}"
  );
  assert!(
    calls.contains("GITLAB_GROUP:<unset>"),
    "selector must be cleared: {calls}"
  );
  assert!(
    calls.contains("GITLAB_HOST:https://gitlab.com"),
    "an authoritative origin must be pinned: {calls}"
  );
  assert!(
    calls.contains("GITLAB_TOKEN:keep-me"),
    "authentication is the user's to set and must survive: {calls}"
  );
  // Behind the pin all three of these have a replacement: glab falls
  // back to `apiHost = repoHost`, `GITLAB_HOST` already outranks the
  // other host spellings, and gwm knows the scheme from the origin.
  assert!(
    calls.contains("GITLAB_API_HOST:<unset>"),
    "an inherited API host outranks the pin and must go: {calls}"
  );
  assert!(calls.contains("GL_HOST:<unset>"), "{calls}");
  assert!(
    calls.contains("API_PROTOCOL:https"),
    "the scheme is pinned, not merely cleared: {calls}"
  );
}

#[test]
fn list_without_detect_pr_flag_has_no_pr_column() {
  // Default `gwm list` stays network-free: no PR column, no `#` markers.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("STATUS"))
    .stdout(predicate::str::contains("PATH"))
    .stdout(predicate::str::contains('#').not());
}

#[test]
fn completions_zsh_emits_compdef_header() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "zsh"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("#compdef gwm"))
    .stdout(predicate::str::contains("_gwm"));
}

#[test]
fn completions_bash_emits_complete_directive() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "bash"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("_gwm"))
    .stdout(predicate::str::contains("complete "));
}

#[test]
fn completions_fish_emits_complete_directive() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("complete -c gwm"));
}

#[test]
fn completions_powershell_emits_register_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Register-ArgumentCompleter"))
    .stdout(predicate::str::contains("gwm"));
}

#[test]
fn completions_rejects_unknown_shell() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["completions", "tcsh"]);
  cmd.assert().failure();
}

#[test]
fn list_format_names_emits_one_name_per_line() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["list", "--format=names"])
    .assert()
    .success()
    // No table header, no leading "*" marker, no STATUS column.
    .stdout(predicate::str::contains("NAME").not())
    .stdout(predicate::str::contains("STATUS").not())
    // Main worktree is excluded so the output mirrors what `find_fuzzy`
    // accepts (path/remove/bootstrap skip the main workdir). A fresh repo
    // therefore prints nothing.
    .stdout(predicate::str::is_empty());
}

// --- JSON output flags (issue #38, phase 1) ----------------------------

#[test]
fn list_format_json_emits_a_parseable_worktree_array() {
  // Unlike `--format names`, the JSON array includes the main worktree:
  // an editor / statusbar consumer wants the full set, and resolves the
  // active worktree from it. A fresh repo has exactly the main worktree.
  let (dir, _repo) = init_repo();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list", "--format=json"])
    .output()
    .unwrap();
  assert!(out.status.success(), "list --format=json must exit 0");
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("stdout must be valid JSON");
  let arr = v.as_array().expect("top level must be a JSON array");
  assert_eq!(arr.len(), 1, "a fresh repo has exactly the main worktree");
  let main = &arr[0];
  assert_eq!(main["is_main"], serde_json::json!(true));
  // Stable schema keys present.
  assert!(main.get("name").is_some());
  assert!(main.get("path").is_some());
  assert!(main.get("status").is_some());
  assert!(main["status"].get("is_dirty").is_some());
  // Optional link fields are present and null on a fresh repo.
  assert_eq!(main["pr"], serde_json::Value::Null);
}

#[test]
fn list_format_json_with_detect_pr_populates_the_pr_field() {
  // `--format=json --detect-pr` must agree with the table: the JSON `pr`
  // field carries the freshly detected number, not just the persisted
  // link (issue #38 review).
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(fake_bin.path(), r#"[{"number":128}]"#, r#"{}"#);

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  // The main worktree's branch gets the detected PR #128.
  assert!(
    arr.iter().any(|w| w["pr"] == serde_json::json!(128)),
    "detected PR number must surface in the JSON `pr` field, got: {v}"
  );
}

#[test]
fn list_format_json_detect_pr_keeps_explicit_link_when_detection_cannot_run() {
  // Regression (issue #38 review): with `--detect-pr` in a repo that has
  // no GitHub slug, live detection can't run, so it must NOT clobber an
  // explicit/persisted local PR link that the plain listing already shows.
  let (dir, repo) = init_repo();
  // No remote → repo_slug fails → detection yields None for every row.
  let head = repo.head().unwrap();
  let branch = head.shorthand().unwrap().to_string();
  // Explicit PR link in branch config (`branch.<name>.gwm-pr`).
  repo
    .config()
    .unwrap()
    .set_i64(&format!("branch.{branch}.gwm-pr"), 77)
    .unwrap();

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  assert!(
    arr.iter().any(|w| w["pr"] == serde_json::json!(77)),
    "explicit PR link must be preserved when detection can't run, got: {v}"
  );
}

#[test]
fn list_format_json_detect_pr_clears_a_stale_persisted_pr() {
  // The flip side (issue #38 review): when detection DOES run (GitHub slug
  // present) and `gh pr list` returns no PR for a branch that had a
  // persisted detected PR, the JSON must clear it to null — matching the
  // table — not leave the stale number.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap();
  let branch = head.shorthand().unwrap().to_string();
  // A persisted (now stale) detected PR in branch config.
  repo
    .config()
    .unwrap()
    .set_i64(&format!("branch.{branch}.gwm-pr-detected"), 99)
    .unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  // `gh pr list --head` returns no PR → detection clears the cache.
  let fake_gh = write_dispatch_gh(fake_bin.path(), "[]", "{}");

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["list", "--format=json", "--detect-pr"])
    .output()
    .unwrap();
  assert!(out.status.success());
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("valid JSON");
  let arr = v.as_array().unwrap();
  assert!(
    arr.iter().all(|w| w["pr"] != serde_json::json!(99)),
    "a stale persisted PR must be cleared once detection runs, got: {v}"
  );
}

#[test]
fn doctor_format_json_emits_checks_severity_and_exit_code() {
  let (dir, _repo) = init_repo();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["doctor", "--format=json"])
    .output()
    .unwrap();
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("doctor json must parse");
  assert!(v["checks"].is_array(), "checks must be an array");
  assert!(
    !v["checks"].as_array().unwrap().is_empty(),
    "doctor runs at least one check"
  );
  let sev = v["severity"].as_str().expect("severity must be a string");
  assert!(
    matches!(sev, "ok" | "warning" | "failed"),
    "severity stable enum, got {sev}"
  );
  // The JSON exit_code mirrors the process exit code.
  let json_code = v["exit_code"].as_i64().expect("exit_code is an integer");
  let proc_code = out.status.code().unwrap_or(-1) as i64;
  assert_eq!(json_code, proc_code, "json exit_code must equal the process exit code");
  // Per-check shape.
  let first = &v["checks"][0];
  assert!(first.get("name").is_some());
  let cs = first["status"].as_str().unwrap();
  assert!(matches!(cs, "ok" | "warning" | "failed"));
}

#[test]
fn path_format_json_emits_name_path_branch() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "38", "json-path"])
    .assert()
    .success();

  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["path", "json-path", "--format=json"])
    .output()
    .unwrap();
  assert!(out.status.success(), "path --format=json must exit 0");
  let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("path json must parse");
  let obj = v.as_object().expect("path json must be an object");
  assert_eq!(obj.len(), 3, "exactly {{name, path, branch}}");
  assert_eq!(v["name"], serde_json::json!("feat-38-json-path"));
  assert_eq!(v["branch"], serde_json::json!("feat/#38-json-path"));
  assert!(
    v["path"].as_str().unwrap().ends_with("feat-38-json-path"),
    "path points at the worktree dir"
  );
}

#[test]
fn daemon_rejects_zero_poll_ms() {
  // `--poll-ms 0` would spin a subscribe loop with no wait; clap rejects
  // it at parse time (range 1..) so the daemon never starts (issue #38
  // review). No repo / socket needed — validation fails first.
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["daemon", "--poll-ms", "0"])
    .assert()
    .failure()
    .stderr(
      predicate::str::contains("0").and(predicate::str::contains("not in").or(predicate::str::contains("invalid"))),
    );
}

#[test]
fn statusline_without_a_daemon_prints_blank_and_exits_zero() {
  // No daemon is listening at the given socket. A prompt substitution must
  // not break: the command exits 0 and emits no worktree summary, just a
  // blank line (issue #309 graceful-degradation contract).
  let sock_dir = tempfile::TempDir::new().unwrap();
  let missing = sock_dir.path().join("no-daemon.sock");
  Command::cargo_bin("gwm")
    .unwrap()
    .arg("statusline")
    .arg("--socket")
    .arg(&missing)
    .assert()
    .success()
    .stdout(predicate::str::contains(" wt").not());
}

#[test]
fn statusline_help_documents_watch_and_socket() {
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["statusline", "--help"])
    .assert()
    .success()
    .stdout(predicate::str::contains("--watch"))
    .stdout(predicate::str::contains("--socket"));
}

#[test]
fn cd_unknown_pattern_fails_with_not_found() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["cd", "nope"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not found"));
}

#[test]
fn cd_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["cd", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// Use `function gcd { ... }` (zsh-style, also valid in bash) rather than
// `gcd() { ... }`. The latter triggers `zsh: defining function based on
// alias 'gcd'` at parse time when an alias of the same name already
// exists — even if a preceding `unalias` would remove it, since zsh
// parses the whole eval'd block before running any of it.
#[test]
fn shell_init_bash_emits_gcd_function() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "bash"]);
  // Pin the invocation site: a regression that mentions `gwm cd` only in
  // a comment but doesn't actually call it from the function body would
  // pass a loose `contains("gwm cd")`. `gwm cd "$@"` (POSIX-style
  // argument forwarding) is what makes `gcd auth` translate into
  // `gwm cd auth`.
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd \"$@\""));
}

#[test]
fn shell_init_zsh_emits_gcd_function() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "zsh"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd \"$@\""));
}

// Regression: in zsh, an existing alias (e.g. `gcd='git checkout'` from
// oh-my-zsh's git plugin) wins over a same-named function and refuses to
// be shadowed at definition time ("defining function based on alias").
// The init script must `unalias gcd` first so the function takes effect
// regardless of the user's prior aliases.
#[test]
fn shell_init_posix_unaliases_gcd_first() {
  // regression: oh-my-zsh's git plugin defines `gcd='git checkout'` which
  // shadowed our gcd function ("defining function based on alias").
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd.assert().success().stdout(predicate::str::contains("unalias gcd"));
  }
}

#[test]
fn shell_init_powershell_unaliases_gcd_first() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("Remove-Alias"))
    .stdout(predicate::str::contains("gcd"));
}

#[test]
fn shell_init_fish_emits_function_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd $argv"))
    .stdout(predicate::str::contains("end"));
}

// Regression: fish performs wildcard expansion on unquoted variables, so
// `cd $target` would mangle paths containing `[`, `]`, or `*`. The
// emitted helper must use `cd -- "$target"` to disable both option
// parsing and glob expansion.
#[test]
fn shell_init_fish_quotes_target_with_double_dash() {
  // regression: fish wildcard expansion mangled paths containing `[`, `]`,
  // or `*` when the helper used `cd $target` without `cd -- "$target"`.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("cd -- \"$target\""));
}

#[test]
fn shell_init_powershell_emits_function_block() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("function gcd"))
    .stdout(predicate::str::contains("gwm cd $Pattern"))
    .stdout(predicate::str::contains("Set-Location"));
}

// Issue #22: with no argument, `gcd` should drop into `gwm switch` (the
// interactive picker) rather than print a usage error. The wrapper must
// still bail before cd'ing if the picker is cancelled (non-zero exit).
#[test]
fn shell_init_posix_no_arg_invokes_switch() {
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd
      .assert()
      .success()
      .stdout(predicate::str::contains("gwm switch"))
      .stdout(predicate::str::contains("\"$#\" -eq 0"));
  }
}

#[test]
fn shell_init_fish_no_arg_invokes_switch() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gwm switch"))
    .stdout(predicate::str::contains("count $argv) -eq 0"));
}

#[test]
fn shell_init_powershell_no_arg_invokes_switch() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gwm switch"))
    .stdout(predicate::str::contains("IsNullOrEmpty"));
}

// Issue #58: users who eval the wrapper without reading the README must
// still discover the no-arg route. Pin a one-line cheat-sheet comment in
// the script header that names the bridge to `gwm switch`. The exact
// phrase `picker via `gwm switch`` is asserted because the README, the
// CLI --help, and the wrapper now share that wording — drift in one
// surface should break the test instead of going unnoticed.
#[test]
fn shell_init_posix_header_documents_no_arg_route() {
  for shell in ["bash", "zsh"] {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.args(["shell-init", shell]);
    cmd
      .assert()
      .success()
      .stdout(predicate::str::contains("picker via `gwm switch`"));
  }
}

#[test]
fn shell_init_fish_header_documents_no_arg_route() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "fish"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("picker via `gwm switch`"));
}

#[test]
fn shell_init_powershell_header_documents_no_arg_route() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "powershell"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("picker via `gwm switch`"));
}

// Issue #58: a user who lands on `gwm switch --help` first (e.g. via tab
// completion) should learn that the recommended invocation is the `gcd`
// wrapper from `gwm shell-init`, not the raw `cd "$(gwm switch)"` form.
#[test]
fn switch_help_mentions_gcd_wrapper() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["switch", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("gcd").and(predicate::str::contains("shell-init")));
}

#[test]
fn shell_init_rejects_unknown_shell() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["shell-init", "tcsh"]);
  cmd.assert().failure();
}

#[test]
fn list_format_table_is_default() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .arg("list")
    .assert()
    .success()
    .stdout(predicate::str::contains("NAME"))
    .stdout(predicate::str::contains("STATUS"));
}

// --------------------------------------------------------------------------
// Issue #23 — `gwm tmux <pattern>` / `gwm zellij <pattern>`
// --------------------------------------------------------------------------
//
// The actual spawn (`std::process::Command::new("tmux").args(...)`) is out
// of scope here — driving it would require a live tmux/zellij server on
// every CI runner. We instead pin the user-visible contract:
//
//   1. The subcommands exist and are listed in `gwm --help`.
//   2. Outside the corresponding multiplexer (no `$TMUX` / `$ZELLIJ`),
//      the command exits non-zero with a clear stderr that names the
//      missing multiplexer — no silent no-op.
//   3. Outside a git repo, the standard `NotInGitRepo` error wins.
//   4. The argv-builder unit tests in `tests/multiplexer_tests.rs`
//      cover what gets handed to the spawn.

#[test]
fn tmux_outside_tmux_session_fails_with_clear_error() {
  // CI runners and most local shells don't have `$TMUX` set. The command
  // must refuse loudly rather than spawn `tmux` against no server, which
  // would either start a brand-new tmux server or error opaquely.
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("tmux").and(predicate::str::contains("not")));
}

#[test]
fn zellij_outside_zellij_session_fails_with_clear_error() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("zellij").and(predicate::str::contains("not")));
}

#[test]
fn tmux_outside_git_repo_fails() {
  // `NotInGitRepo` wins over the multiplexer-not-running gate when both
  // apply — the user is told to fix the more fundamental problem first.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn zellij_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// regression: PR #65 Copilot review — the not-running error carried a
// literal backslash before the env var name (`\$TMUX` instead of
// `$TMUX`). The `\\` came from a shell-escape habit; this is stderr,
// not shell source, so the dollar must render bare.
#[test]
fn tmux_outside_tmux_error_does_not_escape_dollar() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("TMUX")
    .args(["tmux", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("\\$").not())
    // And `$TMUX` itself must still appear so the hint is actionable.
    .stderr(predicate::str::contains("$TMUX"));
}

#[test]
fn zellij_outside_zellij_error_does_not_escape_dollar() {
  let (dir, _repo) = init_repo();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env_remove("ZELLIJ")
    .args(["zellij", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("\\$").not())
    .stderr(predicate::str::contains("$ZELLIJ"));
}

#[test]
fn tmux_help_mentions_split_flag() {
  // The `-p` flag (split-pane instead of new-window) is the one knob users
  // care about; it must show up in `--help` so it's discoverable without
  // reading the README.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["tmux", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--split"));
}

#[test]
fn zellij_help_mentions_split_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["zellij", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--split"));
}

// --- Issue/PR linking (issue #67) ----------------------------------------

#[test]
fn link_help_documents_issue_and_pr_targets() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["link", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"));
}

#[test]
fn unlink_help_documents_issue_and_pr_targets() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["unlink", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"));
}

#[test]
fn open_help_documents_issue_and_pr_and_print_url() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["open", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("issue"))
    .stdout(predicate::str::contains("pr"))
    .stdout(predicate::str::contains("--print-url"));
}

#[test]
fn status_help_documents_json_flag() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["status", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("--json"));
}

#[test]
fn link_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["link", "issue", "42"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

#[test]
fn link_issue_persists_and_status_reflects_it() {
  // E2E: link an issue then `gwm status --json` reads it back.
  // The repo has no remote configured so `status` runs in "local link only" mode
  // (no GitHub fetch). The JSON output should still carry the linked number.
  let (dir, repo) = init_repo();
  // Need a branch that's checked out for the CWD-resolved status to find it.
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  // link
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "issue", "99"])
    .assert()
    .success()
    .stdout(predicate::str::contains("issue #99"));

  // status --json
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"issue\""))
    .stdout(predicate::str::contains("99"));
}

#[test]
fn unlink_issue_falls_back_to_branch_name_auto_detect() {
  let (dir, repo) = init_repo();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  // Override then unlink.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "issue", "99"])
    .assert()
    .success();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["unlink", "issue"])
    .assert()
    .success();

  // After unlink the branch-name auto-detect should resurface (issue #42).
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("42"));
}

#[test]
fn status_auto_detects_pr_when_none_explicitly_linked() {
  // E2E (issue #181): a branch with a GitHub remote and no explicit PR
  // link. `gwm status --json` should detect the branch's PR via `gh pr
  // list` and report it with source "detected".
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  // No issue number in the name → isolates the PR-detection path.
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":128}]"#,
    r#"{"number":128,"title":"Auto-detect PR","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/128"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"number\":128"))
    .stdout(predicate::str::contains("\"source\":\"detected\""));
}

#[test]
fn status_persists_detected_pr_title_after_fetch() {
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":128}]"#,
    r#"{"number":128,"title":"Auto-detect PR","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/128"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success();

  let link = gwm::github::read_link(&repo, "detect-me").unwrap();
  assert_eq!(link.pr, Some(128));
  assert_eq!(link.pr_source, gwm::github::LinkSource::Detected);
  assert_eq!(link.pr_title.as_deref(), Some("Auto-detect PR"));
}

#[test]
fn review_resolves_pr_metadata_and_names_branch_end_to_end() {
  // E2E (issue #308): drive `gwm review <PR#>` through the clap entry point.
  // A fake `gh` resolves the PR head metadata and `repo_slug` parses the
  // GitHub origin; `GIT_ALLOW_PROTOCOL=file` then makes the subsequent
  // `git fetch` over https fail instantly (no network) right after the
  // resolution block is printed — so the assertion stays hermetic and fast.
  //
  // This pins the clap surface + gh metadata resolution + review naming +
  // `[worktree].base` expansion that the unit / integration tests bypass. The
  // full fetch→worktree→link→base path is covered hermetically by
  // tests/review_integration.rs (which drives `review::materialize` directly
  // against a local origin and needs no GitHub URL — the slug/fetch coupling
  // makes that step un-mockable through the binary without a network call).
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    "[]",
    r#"{"number":1,"author":{"login":"alice"},"headRefName":"feat/spike-x","baseRefName":"main"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .env("GIT_ALLOW_PROTOCOL", "file") // reject the https fetch instantly, no network
    .args(["review", "1"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("PR     : #1 by alice (feat/spike-x → main)"))
    .stdout(predicate::str::contains("branch : review/pr-1-alice-spike-x"))
    .stdout(predicate::str::contains("review-pr-1-alice-spike-x"));
}

#[test]
fn status_explicit_pr_link_wins_over_detection() {
  // An explicit `gwm link --pr` must not be clobbered by detection: the
  // reported source stays "explicit" even though `gh pr list` would
  // return a different number.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("detect-me", &head, false).unwrap();
  repo.set_head("refs/heads/detect-me").unwrap();

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_dispatch_gh(
    fake_bin.path(),
    r#"[{"number":999}]"#,
    r#"{"number":61,"title":"Explicit","state":"OPEN","isDraft":false,"url":"https://github.com/kbrdn1/gwm-cli/pull/61"}"#,
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["link", "pr", "61"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["status", "--json"])
    .assert()
    .success()
    .stdout(predicate::str::contains("\"number\":61"))
    .stdout(predicate::str::contains("\"source\":\"explicit\""));
}

#[test]
fn open_print_url_emits_url_without_spawning_browser() {
  // `--print-url` is the test-friendly mode: we want to assert the URL
  // construction without actually shelling out to `open`/`xdg-open`.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#42-tui-search", &head, false).unwrap();
  repo.set_head("refs/heads/feat/#42-tui-search").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["open", "issue", "--print-url"])
    .assert()
    .success()
    .stdout(predicate::str::contains("https://github.com/kbrdn1/gwm-cli/issues/42"));
}

#[test]
fn open_pr_without_link_fails_clearly() {
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://github.com/kbrdn1/gwm-cli.git").unwrap();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  // Branch without an issue number (no auto-detect) and no explicit PR link.
  repo.branch("random-branch", &head, false).unwrap();
  repo.set_head("refs/heads/random-branch").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["open", "pr", "--print-url"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("no PR linked"));
}

#[test]
fn status_on_branch_with_no_link_reports_no_link() {
  let (dir, repo) = init_repo();
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("random-branch", &head, false).unwrap();
  repo.set_head("refs/heads/random-branch").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["status"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no link"));
}

// --------------------------------------------------------------------------
// Issue #101 — E2E tests for the mutating subcommands (init / create / remove)
// --------------------------------------------------------------------------
//
// `cli_binary.rs` historically asserted only `--help` output and a handful
// of read-only error paths. The three subcommands that mutate state on
// disk (`init`, `create`, `remove`) had no end-to-end coverage, which let
// orchestration-layer regressions (e.g. issues #98 and #99) slip through
// unit-test review. The block below is the canonical CI signal for the
// CLI surface of those subcommands.
//
// Worktree-creating tests pin `[worktree].base` to a `tempfile::TempDir`
// so the test runner never writes under `~/cc-worktree/...`. The branch
// pattern is left at its default (`{type}/#{issue}-{desc}`) to exercise
// the production naming pipeline.

// --- init ---------------------------------------------------------------

#[test]
fn init_writes_gwm_toml_with_expected_sections() {
  // The default `.gwm.toml` shipped by `gwm init` is sourced from
  // `examples/gwm.toml.example`. Asserting on the exact contents would
  // couple the test to the example file character-for-character; we pin
  // the structural markers a user (and the rest of the codebase) relies
  // on: a `[worktree]` block with the documented placeholders, a
  // `[[bootstrap.copy]]` entry, and a `[[bootstrap.guard]]` entry. The
  // stdout line names the written path so users discover where it landed.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");
  assert!(!cfg_path.exists(), "precondition: no .gwm.toml in fresh repo");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .success()
    .stdout(predicate::str::contains(".gwm.toml"));

  assert!(cfg_path.exists(), "gwm init must write .gwm.toml on disk");
  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("[worktree]"), "missing [worktree] section");
  assert!(
    body.contains("base = ") && body.contains("{home}") && body.contains("{repo}"),
    "missing documented placeholders in [worktree].base"
  );
  assert!(
    body.contains("[[bootstrap.copy]]"),
    "missing [[bootstrap.copy]] template"
  );
  assert!(
    body.contains("[[bootstrap.guard]]"),
    "missing [[bootstrap.guard]] template"
  );
}

#[test]
fn init_refuses_to_overwrite_existing_gwm_toml() {
  // Idempotency contract: a second `gwm init` on a repo that already
  // carries a `.gwm.toml` must bail out instead of silently clobbering
  // user edits. The error must name the file *and* explain why so the
  // user knows what to remove if they truly want to start over. Pin
  // the exact "already exists" wording from `Config::write_default`
  // (src/config.rs) — a looser `.gwm.toml` contains-check would also
  // pass on a success run since the success path prints the same path.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");
  std::fs::write(&cfg_path, "# user edits\n[worktree]\nbase = \"/custom\"\n").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .failure()
    .stderr(predicate::str::contains(".gwm.toml"))
    .stderr(predicate::str::contains("already exists"));

  // Original contents must survive the failed init.
  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(
    body.contains("# user edits"),
    "failed gwm init must not modify the existing .gwm.toml"
  );
}

#[test]
fn init_outside_git_repo_fails() {
  // `cmd_init` calls `discover_repo` first — the standard `NotInGitRepo`
  // error wins so the user is steered to `git init` before configuring.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .arg("init")
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- init --preset (issue #37) ------------------------------------------

#[test]
fn init_list_presets_enumerates_builtins() {
  // `--list-presets` is a pure stdout enumeration — it must work without a
  // git repo (it returns before `discover_repo`) and name every built-in.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--list-presets"])
    .assert()
    .success()
    .stdout(predicate::str::contains("generic"))
    .stdout(predicate::str::contains("laravel"))
    .stdout(predicate::str::contains("node"))
    .stdout(predicate::str::contains("rust"))
    .stdout(predicate::str::contains("python-uv"));
}

#[test]
fn init_preset_show_prints_without_writing() {
  // `--show` prints the resolved preset to stdout and writes nothing — so a
  // user can diff a preset against an existing config.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "rust", "--show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[[bootstrap.no_symlink]]"))
    .stdout(predicate::str::contains("target"));

  assert!(!cfg_path.exists(), "--show must not write .gwm.toml to disk");
}

#[test]
fn init_preset_writes_stack_config() {
  // `--preset laravel` seeds the opinionated stack config: the AWS-RDS guard
  // and the vendor/ no-symlink are the markers that distinguish it from the
  // generic template.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "laravel"])
    .assert()
    .success()
    .stdout(predicate::str::contains(".gwm.toml"));

  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("no-aws-rds"), "laravel preset missing the AWS-RDS guard");
  assert!(body.contains("vendor"), "laravel preset missing the vendor no-symlink");
}

#[test]
fn init_unknown_preset_fails() {
  // An unknown preset name must fail loudly and point the user at
  // `--list-presets` rather than silently writing the generic template.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "cobol"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("cobol"))
    .stderr(predicate::str::contains("list-presets"));
}

#[test]
fn init_preset_nuxt_alias_writes_node_body() {
  // `nuxt` is an alias of `node`: it must seed the node_modules no-symlink.
  let (dir, _repo) = init_repo();
  let cfg_path = dir.path().join(".gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["init", "--preset", "nuxt"])
    .assert()
    .success();

  let body = std::fs::read_to_string(&cfg_path).unwrap();
  assert!(body.contains("node_modules"), "nuxt alias must seed the node preset");
}

// --- create -------------------------------------------------------------

/// Write a `.gwm.toml` that redirects `[worktree].base` into the test's
/// own `TempDir`. The caller already owns the `base` path (it's the
/// `TempDir` they passed in), so the test asserts on `base.join(...)`
/// directly — this helper has no return value. Bootstrap is left empty
/// by default so `gwm create` runs in its minimal shape; tests that
/// need bootstrap behaviour layer a second `.gwm.toml` write on top.
fn write_test_config(repo_root: &Path, base: &Path) {
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base),
  );
  std::fs::write(repo_root.join(".gwm.toml"), body).unwrap();
}

fn toml_basic_string(path: &Path) -> String {
  path.display().to_string().replace('\\', "\\\\").replace('"', "\\\"")
}

fn prepend_path(dir: &Path) -> String {
  let old = std::env::var_os("PATH").unwrap_or_default();
  let mut paths = vec![dir.to_path_buf()];
  paths.extend(std::env::split_paths(&old));
  std::env::join_paths(paths).unwrap().to_string_lossy().into_owned()
}

/// Fake `gh` that dispatches on the first two args, used to exercise the
/// PR auto-detection path (issue #181): `gh pr list …` returns
/// `pr_list_json`, `gh pr view …` returns `pr_view_json`. Both arms emit
/// the JSON verbatim so the real `find_pr_for_branch` / `fetch_pr` parse
/// it. Unix + Windows variants so CI stays green on both.
fn write_dispatch_gh(root: &Path, pr_list_json: &str, pr_view_json: &str) -> PathBuf {
  #[cfg(unix)]
  {
    let script = root.join("gh");
    fs::write(
      &script,
      format!(
        r#"#!/bin/sh
if [ "$1" = "pr" ] && [ "$2" = "list" ]; then
  printf '%s' '{list}'
elif [ "$1" = "pr" ] && [ "$2" = "view" ]; then
  printf '%s' '{view}'
fi
"#,
        list = pr_list_json.replace('\'', "'\\''"),
        view = pr_view_json.replace('\'', "'\\''"),
      ),
    )
    .unwrap();
    let mut perms = fs::metadata(&script).unwrap().permissions();
    use std::os::unix::fs::PermissionsExt;
    perms.set_mode(0o755);
    fs::set_permissions(&script, perms).unwrap();
    script
  }
  #[cfg(windows)]
  {
    let script = root.join("gh.cmd");
    fs::write(
      &script,
      format!(
        "@echo off\r\nif \"%~1\"==\"pr\" if \"%~2\"==\"list\" echo {list}\r\nif \"%~1\"==\"pr\" if \"%~2\"==\"view\" echo {view}\r\n",
        list = pr_list_json,
        view = pr_view_json,
      ),
    )
    .unwrap();
    script
  }
}

/// A fake `glab` that records how it was invoked before answering.
///
/// The existing fakes only stub stdout, which is enough to test parsing
/// but blind to the contract nine review rounds kept breaking: *which*
/// binary gets picked, *where* it runs, and *what environment* it
/// inherits. This one appends `ARGV` / `CWD` / the targeting variables
/// to `$GWM_FAKE_LOG`, so a test can assert the spawn itself.
///
/// Unix-only on purpose: the contract under test (argv, cwd, child
/// environment) is platform-independent in gwm's own code, whereas a
/// `.cmd` shim would mostly exercise `cmd.exe` quoting rules.
#[cfg(unix)]
fn write_recording_glab(root: &Path, mr_list_json: &str, api_json: &str) -> PathBuf {
  let script = root.join("glab");
  fs::write(
    &script,
    format!(
      r#"#!/bin/sh
{{
  echo "ARGV:$*"
  echo "CWD:$(pwd)"
  echo "GITLAB_HOST:${{GITLAB_HOST-<unset>}}"
  echo "GITLAB_REPO:${{GITLAB_REPO-<unset>}}"
  echo "GITLAB_GROUP:${{GITLAB_GROUP-<unset>}}"
  echo "GITLAB_API_HOST:${{GITLAB_API_HOST-<unset>}}"
  echo "GL_HOST:${{GL_HOST-<unset>}}"
  echo "API_PROTOCOL:${{API_PROTOCOL-<unset>}}"
  echo "GITLAB_TOKEN:${{GITLAB_TOKEN-<unset>}}"
  echo "GLAB_DEBUG_HTTP:${{GLAB_DEBUG_HTTP-<unset>}}"
}} >> "$GWM_FAKE_LOG"
if [ "$1" = "mr" ] && [ "$2" = "list" ]; then
  printf '%s' '{list}'
elif [ "$1" = "api" ]; then
  # Drain the request body so a test can assert what travelled on the
  # pipe rather than on the command line (issue #459).
  cat > "$GWM_FAKE_STDIN"
  printf '%s' '{api}'
fi
"#,
      list = mr_list_json.replace('\'', "'\\''"),
      api = api_json.replace('\'', "'\\''"),
    ),
  )
  .unwrap();
  let mut perms = fs::metadata(&script).unwrap().permissions();
  use std::os::unix::fs::PermissionsExt;
  perms.set_mode(0o755);
  fs::set_permissions(&script, perms).unwrap();
  script
}

fn write_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  #[cfg(unix)]
  {
    write_unix_fake_gh(root, issue_url)
  }
  #[cfg(windows)]
  {
    write_windows_fake_gh(root, issue_url)
  }
}

#[cfg(unix)]
fn write_unix_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  let script = root.join("gh");
  fs::write(
    &script,
    format!(
      r#"#!/bin/sh
printf '%s\n' "$*" > '{args}'
body_file=""
prev=""
for arg in "$@"; do
  if [ "$prev" = "--body-file" ]; then
    body_file="$arg"
  fi
  prev="$arg"
done
if [ -n "$body_file" ]; then
  cp "$body_file" '{body}'
fi
printf '%s' '{url}'
"#,
      args = root.join("gh-args.txt").display(),
      body = root.join("gh-body.md").display(),
      url = issue_url.replace('\'', "'\\''"),
    ),
  )
  .unwrap();
  let mut perms = fs::metadata(&script).unwrap().permissions();
  use std::os::unix::fs::PermissionsExt;
  perms.set_mode(0o755);
  fs::set_permissions(&script, perms).unwrap();
  script
}

#[cfg(windows)]
fn write_windows_fake_gh(root: &Path, issue_url: &str) -> PathBuf {
  let script = root.join("gh.cmd");
  fs::write(
    &script,
    format!(
      r#"@echo off
echo %* > "{args}"
:scan
if "%~1"=="" goto done
if "%~1"=="--body-file" (
  copy "%~2" "{body}" > nul
)
shift
goto scan
:done
echo {url}
"#,
      args = root.join("gh-args.txt").display(),
      body = root.join("gh-body.md").display(),
      url = issue_url.trim(),
    ),
  )
  .unwrap();
  script
}

#[test]
fn test_config_base_path_is_escaped_for_toml_basic_strings() {
  assert_eq!(
    toml_basic_string(Path::new(r#"C:\Users\runner\AppData\Local\Temp"#)),
    r#"C:\\Users\\runner\\AppData\\Local\\Temp"#
  );
}

#[test]
fn create_adds_worktree_dir_and_branch_at_head() {
  // The full happy path through `cmd_create`:
  //   1. The dirname rendered from `[worktree].path_pattern` lands on disk
  //      under the configured `[worktree].base`.
  //   2. The branch rendered from `[worktree].branch_pattern` is created
  //      as a local ref pointing at the seed commit (`init_repo`'s HEAD).
  //   3. `branch.<name>.gwm-base` is recorded as the parent's short name
  //      (the launcher fallback chain depends on it — issue #75).
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());
  let head_oid = repo.head().unwrap().target().unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    // Issue #95: this test writes a `.gwm.toml` and runs `gwm
    // create` non-interactively, so the TOFU prompt would block.
    // Setting GWM_ALLOW_BOOTSTRAP=1 is the documented CI bypass.
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "42", "tui-search"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat/#42-tui-search"))
    .stdout(predicate::str::contains("worktree created"));

  let wt_dir = base.path().join("feat-42-tui-search");
  assert!(wt_dir.exists(), "worktree dir must exist on disk");
  assert!(wt_dir.join(".git").exists(), "worktree must carry a .git pointer");

  let branch = repo
    .find_branch("feat/#42-tui-search", git2::BranchType::Local)
    .expect("branch must be created");
  let branch_oid = branch.into_reference().target().unwrap();
  assert_eq!(branch_oid, head_oid, "fresh branch must point at the main HEAD commit");

  let cfg = repo.config().unwrap();
  let recorded_base = cfg.get_string("branch.feat/#42-tui-search.gwm-base").unwrap();
  assert_eq!(
    recorded_base, "main",
    "gwm create must record the parent ref for the launcher fallback chain"
  );
}

#[test]
fn create_runs_bootstrap_by_default() {
  // A `[[bootstrap.copy]]` step lands its destination file inside the
  // freshly-created worktree iff bootstrap actually ran. The source file
  // lives in the main repo's workdir; we pin a unique marker string so a
  // false positive (e.g. a cargo lock file collision) can't pass the
  // assertion by accident.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let marker = "GWM_E2E_BOOTSTRAP_MARKER_v1";
  std::fs::write(dir.path().join("seed.env"), marker).unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[bootstrap.copy]]
from = "seed.env"
to = "seed.env"
required = true
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    // Issue #95: bypass the TOFU prompt — the test's whole point
    // is to assert that bootstrap.copy actually runs, which is
    // gated behind the trust check.
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "7", "bootstrap-on"])
    .assert()
    .success();

  let copied = base.path().join("feat-7-bootstrap-on").join("seed.env");
  assert!(copied.exists(), "bootstrap copy step did not run");
  let body = std::fs::read_to_string(&copied).unwrap();
  assert!(
    body.contains(marker),
    "bootstrap copy must duplicate the source file content"
  );
}

#[test]
fn create_runs_lifecycle_hooks_and_legacy_bootstrap_command_alias() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "record pre-create"
run = "printf pre-{{branch}}-{{issue}}-{{desc}} > pre-create.txt"

[[hooks.post_create]]
name = "record post-create"
run = "printf post-{{branch}} > post-create.txt"

[[bootstrap.command]]
name = "legacy post-create"
run = "printf legacy > legacy-post-create.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "hooks"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[pre_create] record pre-create"))
    .stdout(predicate::str::contains("[post_create] record post-create"))
    .stdout(predicate::str::contains("[post_create] legacy post-create"));

  let worktree = base.path().join("feat-88-hooks");
  assert_eq!(
    std::fs::read_to_string(dir.path().join("pre-create.txt")).unwrap(),
    "pre-feat/#88-hooks-88-hooks"
  );
  assert_eq!(
    std::fs::read_to_string(worktree.join("post-create.txt")).unwrap(),
    "post-feat/#88-hooks"
  );
  assert_eq!(
    std::fs::read_to_string(worktree.join("legacy-post-create.txt")).unwrap(),
    "legacy"
  );
}

#[test]
fn new_creates_issue_from_template_then_creates_worktree() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/issues/142\n");
  fs::create_dir_all(dir.path().join(".github/ISSUE_TEMPLATE")).unwrap();
  fs::write(
    dir.path().join(".github/ISSUE_TEMPLATE/feature_request.yml"),
    r#"
name: Feature
title: "[Feature]: "
labels: ["feature"]
body:
  - type: markdown
    attributes:
      value: |
        Feature request for {desc}
  - type: dropdown
    id: surface
    attributes:
      label: Surface
      options:
        - cli
        - tui
  - type: textarea
    id: proposal
    attributes:
      label: Proposed solution
      placeholder: "Implement {type}"
"#,
  )
  .unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[issue_template]
default = "feature_request.yml"

[issue_template.by_type]
feat = {{ template = "feature_request.yml", surface = "cli", title_prefix = "[Feature]: ", labels = ["enhancement"] }}
"#,
    base = toml_basic_string(base.path()),
  );
  fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["new", "feat", "add-config-types", "--no-bootstrap"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created issue #142"))
    .stdout(predicate::str::contains("feat/#142-add-config-types"))
    .stdout(predicate::str::contains("worktree created"));

  assert!(base.path().join("feat-142-add-config-types").exists());
  let gh_args_raw = fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  // `cmd.exe`'s `echo %*` keeps the surrounding quotes on quoted args, so
  // normalise by stripping them before doing substring assertions.
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("issue create"), "{gh_args_raw}");
  assert!(gh_args.contains("--title [Feature]: add-config-types"), "{gh_args_raw}");
  assert!(gh_args.contains("--label feature"), "{gh_args_raw}");
  assert!(gh_args.contains("--label enhancement"), "{gh_args_raw}");
  let gh_body = fs::read_to_string(fake_bin.path().join("gh-body.md")).unwrap();
  assert!(gh_body.contains("Feature request for add-config-types"), "{gh_body}");
  assert!(gh_body.contains("**Surface:** cli"), "{gh_body}");
  assert!(gh_body.contains("Implement feat"), "{gh_body}");
}

#[test]
fn create_pre_create_abort_failure_leaves_no_worktree() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "block create"
run = "false"
on_fail = "abort"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "blocked"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("hook pre_create 'block create' failed"));

  assert!(
    !base.path().join("feat-88-blocked").exists(),
    "pre_create abort must happen before worktree creation"
  );
}

#[test]
fn create_warn_and_ignore_hook_failures_do_not_abort() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "warn only"
run = "false"
on_fail = "warn"

[[hooks.pre_create]]
name = "ignore failure"
run = "false"
on_fail = "ignore"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "nonfatal"])
    .assert()
    .success()
    .stdout(predicate::str::contains("! [pre_create] warn only"))
    .stdout(predicate::str::contains("· [pre_create] ignore failure"));

  assert!(base.path().join("feat-88-nonfatal").exists());
}

#[test]
fn create_skip_hooks_bypasses_named_phase() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_create]]
name = "would block"
run = "false"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "88", "skip", "--skip-hooks", "pre_create"])
    .assert()
    .success();

  assert!(base.path().join("feat-88-skip").exists());
}

#[test]
fn bootstrap_runs_pre_and_post_bootstrap_hooks() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_bootstrap]]
name = "before bootstrap"
run = "printf pre > pre-bootstrap.txt"

[[bootstrap.copy]]
from = "seed.txt"
to = "seed.txt"
required = true

[[hooks.post_bootstrap]]
name = "after bootstrap"
run = "printf post > post-bootstrap.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();
  std::fs::write(dir.path().join("seed.txt"), "seed").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "88", "boot-hooks", "--no-bootstrap"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["bootstrap", "feat-88-boot-hooks"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[pre_bootstrap] before bootstrap"))
    .stdout(predicate::str::contains("[post_bootstrap] after bootstrap"));

  let worktree = base.path().join("feat-88-boot-hooks");
  assert_eq!(
    std::fs::read_to_string(worktree.join("pre-bootstrap.txt")).unwrap(),
    "pre"
  );
  assert_eq!(std::fs::read_to_string(worktree.join("seed.txt")).unwrap(), "seed");
  assert_eq!(
    std::fs::read_to_string(worktree.join("post-bootstrap.txt")).unwrap(),
    "post"
  );
}

#[test]
fn remove_runs_pre_and_post_remove_hooks_and_force_skips_them() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "88", "remove-hooks", "--no-bootstrap"])
    .assert()
    .success();

  let config = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[hooks.pre_remove]]
name = "block remove"
run = "false"

[[hooks.post_remove]]
name = "cleanup"
run = "printf removed-{{branch}} > post-remove.txt"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), config).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["remove", "remove-hooks"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("hook pre_remove 'block remove' failed"));
  assert!(base.path().join("feat-88-remove-hooks").exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["remove", "remove-hooks", "--force"])
    .assert()
    .success();
  assert!(!base.path().join("feat-88-remove-hooks").exists());
  assert!(
    !dir.path().join("post-remove.txt").exists(),
    "--force must skip pre_remove and post_remove hooks"
  );
}

#[test]
fn create_skips_bootstrap_with_no_bootstrap_flag() {
  // Same scaffolding as the previous test, but `--no-bootstrap` must
  // short-circuit `bootstrap::run` BEFORE the copy step. The worktree
  // directory still appears (the branch + worktree are created first),
  // but `seed.env` is absent inside it. The stdout breadcrumb that
  // `cmd_create` prints when it skips makes the intent observable.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  std::fs::write(dir.path().join("seed.env"), "marker").unwrap();
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[bootstrap.copy]]
from = "seed.env"
to = "seed.env"
required = true
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "8", "bootstrap-off", "--no-bootstrap"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped bootstrap"));

  let wt_dir = base.path().join("feat-8-bootstrap-off");
  assert!(wt_dir.exists(), "worktree dir must still be created");
  assert!(
    !wt_dir.join("seed.env").exists(),
    "--no-bootstrap must prevent the copy step from running"
  );
}

#[test]
fn create_rejects_unknown_branch_type() {
  // `BranchSpec::validate` rejects branch types outside the built-in /
  // configured allow-list before any filesystem operation. We must see
  // the failure surface on stderr with the offending value so the user
  // can grep their command history without re-running.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "blarg", "9", "nope"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("blarg"));

  assert!(
    !base.path().join("blarg-9-nope").exists(),
    "no worktree dir may be created when branch-type validation fails"
  );
}

#[test]
fn create_rejects_non_digit_issue() {
  // Issue must be digits-only — `abc` is rejected by `BranchSpec::new`
  // before any filesystem op. As with the unknown-branch-type test,
  // assert the no-side-effect invariant explicitly: the worktree dir
  // that *would* have been written (`<base>/feat-abc-thing`) must not
  // appear on disk. Otherwise a regression where validation runs
  // post-`worktree::add` could still satisfy a bare `.failure()` check
  // while leaving stray dirs behind.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "abc", "thing"])
    .assert()
    .failure();

  assert!(
    !base.path().join("feat-abc-thing").exists(),
    "no worktree dir may be created when issue-number validation fails"
  );
}

#[test]
fn create_refuses_stale_branch_without_reuse_flag() {
  // Issue #99 E2E. A pre-existing local branch of the same name must
  // surface `BranchExists` and refuse to create the worktree dir —
  // protecting the user from silently landing on whatever commit the
  // pre-existing ref points at. The error renders the stale tip's
  // OID and the `--reuse-branch` opt-in so the message is
  // self-explanatory.
  //
  // We pin the branch at the seed commit, THEN advance main by one
  // commit so the branch tip diverges from HEAD — the textbook
  // "stale" scenario from the issue. That divergence is what makes
  // the silent reuse a foot-gun in the first place, and asserting
  // the stale OID appears verbatim in stderr proves the error message
  // is grep-able for the value the user would otherwise be silently
  // attached to.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  let seed = repo.head().unwrap().peel_to_commit().unwrap();
  let stale_branch = repo.branch("feat/#99-stale", &seed, false).unwrap();
  let stale_oid = stale_branch.into_reference().target().unwrap().to_string();

  let sig = git2::Signature::now("gwm-test", "gwm@test").unwrap();
  let tree_id = repo.index().unwrap().write_tree().unwrap();
  let tree = repo.find_tree(tree_id).unwrap();
  repo
    .commit(Some("HEAD"), &sig, &sig, "advance main", &tree, &[&seed])
    .unwrap();
  let new_head = repo.head().unwrap().target().unwrap().to_string();
  assert_ne!(new_head, stale_oid, "precondition: HEAD must diverge from stale branch");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "stale"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("feat/#99-stale"))
    .stderr(predicate::str::contains("--reuse-branch"))
    .stderr(predicate::str::contains(stale_oid.as_str()));

  assert!(
    !base.path().join("feat-99-stale").exists(),
    "no worktree dir may be created when the branch is refused"
  );
}

#[test]
fn create_reuses_stale_branch_with_flag() {
  // Companion to `create_refuses_stale_branch_without_reuse_flag`: the
  // `--reuse-branch` opt-in restores the legacy attach-to-existing
  // behaviour, and the worktree directory does get created.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  let head = repo.head().unwrap().peel_to_commit().unwrap();
  repo.branch("feat/#99-stale", &head, false).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "stale", "--reuse-branch"])
    .assert()
    .success();

  assert!(
    base.path().join("feat-99-stale").exists(),
    "with --reuse-branch the worktree dir must be created against the stale branch"
  );
}

#[test]
fn create_subcommand_outside_git_repo_fails() {
  // The repo-bound contract: outside any git repo the standard
  // `NotInGitRepo` error wins, no worktree is touched. Named with the
  // `_subcommand_` infix to avoid colliding with the historical
  // `create_outside_git_repo_fails` test (line ~327) that — despite the
  // name — actually exercises `gwm list`.
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["create", "feat", "1", "x"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- remove -------------------------------------------------------------

#[test]
fn remove_deletes_worktree_dir_and_keeps_branch_by_default() {
  // Without `--delete-branch`, `gwm remove` is the inverse of `gwm
  // create` for the on-disk directory only: the worktree dir disappears
  // (and so does its admin entry under `.git/worktrees/`), but the
  // local branch survives so the user can re-create the worktree from
  // it later. Stdout names the dir for visual confirmation.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1") // issue #95: TOFU bypass for the setup step
    .args(["create", "feat", "10", "remove-me"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-10-remove-me");
  assert!(wt_dir.exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "remove-me"])
    .assert()
    .success()
    .stdout(predicate::str::contains("removed"));

  assert!(!wt_dir.exists(), "remove must delete the worktree directory");
  assert!(
    repo.find_branch("feat/#10-remove-me", git2::BranchType::Local).is_ok(),
    "remove without --delete-branch must keep the local branch"
  );
}

#[test]
fn remove_with_delete_branch_drops_branch() {
  // The `--delete-branch` flag drops the local branch in the same
  // command. The stdout breadcrumb names both the worktree dir and the
  // branch so two destructive operations are surfaced explicitly.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1") // issue #95: TOFU bypass for the setup step
    .args(["create", "feat", "11", "drop-branch"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "drop-branch", "--delete-branch"])
    .assert()
    .success()
    .stdout(predicate::str::contains("branch"))
    .stdout(predicate::str::contains("deleted"));

  assert!(
    repo
      .find_branch("feat/#11-drop-branch", git2::BranchType::Local)
      .is_err(),
    "--delete-branch must remove the local branch ref"
  );
}

#[test]
fn remove_unknown_pattern_fails() {
  // Fuzzy lookup must error loudly when nothing matches — silently
  // doing nothing would mask a user typo and leave them wondering why
  // their worktree is still around.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "ghost"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not found"));
}

#[test]
fn remove_outside_git_repo_fails() {
  let dir = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "anything"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("not inside a git repository"));
}

// --- remove --dry-run / prune --dry-run (issue #31) ---------------------

#[test]
fn remove_dry_run_prints_plan_and_keeps_worktree_intact() {
  // Issue #31 contract for `gwm remove --dry-run`: resolve the pattern,
  // print the would-remove plan (name + path + branch), exit 0, do NOT
  // touch the worktree directory or the local branch. The user can pipe
  // the output into a confirmation script.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "31", "preview"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-31-preview");
  assert!(wt_dir.exists());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "preview", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would remove"))
    .stdout(predicate::str::contains("feat-31-preview"))
    .stdout(predicate::str::contains("feat/#31-preview"));

  assert!(wt_dir.exists(), "--dry-run must not delete the worktree directory");
  assert!(
    repo.find_branch("feat/#31-preview", git2::BranchType::Local).is_ok(),
    "--dry-run must not delete the local branch"
  );
}

#[test]
fn remove_dry_run_with_delete_branch_flags_branch_deletion() {
  // When `--delete-branch` is combined with `--dry-run`, the plan must
  // surface that the branch would be deleted — without actually
  // dropping it. The user sees a single line that mirrors the live
  // command's would-do trail.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "32", "preview-drop"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "preview-drop", "--delete-branch", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would be deleted"));

  assert!(
    repo
      .find_branch("feat/#32-preview-drop", git2::BranchType::Local)
      .is_ok(),
    "--dry-run --delete-branch must not delete the local branch"
  );
}

#[test]
fn remove_dry_run_on_ambiguous_pattern_still_fails() {
  // Spec: an ambiguous pattern under `--dry-run` exits non-zero with the
  // candidate list — same error contract as the regular failure mode.
  // `--dry-run` only suppresses *destruction*, not resolution failures.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "33", "ambiguous-one"])
    .assert()
    .success();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "34", "ambiguous-two"])
    .assert()
    .success();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["remove", "ambiguous", "--dry-run"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("ambiguous"));
}

#[test]
fn prune_dry_run_prints_plan_without_pruning() {
  // Issue #31 contract for `gwm prune --dry-run`: walk the worktree
  // list, detect prunable entries, print each (name + path + reason),
  // exit 0, and leave the admin entries in place. The follow-up
  // (non-dry-run) `gwm prune` is the destructive sibling.
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "35", "stale"])
    .assert()
    .success();
  let wt_dir = base.path().join("feat-35-stale");
  assert!(wt_dir.exists());

  // Simulate a "working dir missing" prunable: delete the worktree
  // directory on disk WITHOUT going through `gwm remove`, so the admin
  // entry under `.git/worktrees/<name>` stays around and libgit2 flags
  // the worktree as prunable.
  std::fs::remove_dir_all(&wt_dir).unwrap();

  let admin_dir = dir.path().join(".git").join("worktrees").join("feat-35-stale");
  assert!(admin_dir.exists(), "precondition: admin entry must still exist");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["prune", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("would prune"))
    .stdout(predicate::str::contains("feat-35-stale"));

  assert!(admin_dir.exists(), "--dry-run must not remove the prunable admin entry");
  assert!(
    repo.find_worktree("feat-35-stale").is_ok(),
    "--dry-run must leave libgit2's worktree list untouched"
  );
}

#[test]
fn prune_dry_run_reports_no_candidates_when_clean() {
  // Empty case: a clean repo has nothing to prune. The command exits 0
  // with a friendly "0 worktree(s) to prune" so scripts that pipe the
  // output get a stable signal instead of an empty stdout.
  let (dir, _repo) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["prune", "--dry-run"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 worktree"));
}

// --- trust ledger (issue #95) -------------------------------------------

#[test]
fn trust_help_lists_list_revoke_show() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["trust", "--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("list"))
    .stdout(predicate::str::contains("revoke"))
    .stdout(predicate::str::contains("show"));
}

#[test]
fn trust_list_empty_prints_zero_entries() {
  // Point GWM_TRUST_LEDGER at a freshly-created tempdir so we don't
  // clobber the user's real ~/.config/gwm/trust.toml and so the test
  // is hermetic on CI runners that have an empty $HOME.
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries in trust ledger"));
}

#[test]
fn trust_show_when_absent_says_so() {
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("absent.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("file does not exist yet"));
}

#[test]
fn trust_revoke_no_matching_origin_is_a_no_op() {
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "revoke", "git@github.com:foo/bar.git"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries matched"));
}

#[test]
fn trust_list_show_revoke_round_trip() {
  // Seed the ledger manually (we can't easily exercise the prompt
  // path from assert_cmd), then verify list → show → revoke all
  // reflect the same entry.
  use std::fs;
  let dir = tempfile::TempDir::new().unwrap();
  let ledger = dir.path().join("trust.toml");
  fs::write(
    &ledger,
    r#"[[entries]]
origin = "git@github.com:kbrdn1/gwm-cli.git"
config_sha = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
trusted_at = "2026-05-22T10:00:00Z"
trusted_by = "kylian@laptop"
"#,
  )
  .unwrap();

  // list ----------------------------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("git@github.com:kbrdn1/gwm-cli.git"))
    // Short sha (first 12) is what list renders.
    .stdout(predicate::str::contains("deadbeefdead"));

  // show prints the raw toml -------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "show"])
    .assert()
    .success()
    .stdout(predicate::str::contains("kylian@laptop"));

  // revoke removes it --------------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "revoke", "git@github.com:kbrdn1/gwm-cli.git"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓ revoked 1"));

  // and list is empty again --------------------------------------
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["trust", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("0 entries"));
}

#[test]
fn allow_bootstrap_flag_is_global_and_documented() {
  // `--allow-bootstrap` is the CI bypass; if it ever stops being a
  // global flag (e.g. accidentally scoped to one subcommand), the
  // `gwm bootstrap --allow-bootstrap` invocation in user scripts
  // silently fails. Pin it down at the help level.
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["--help"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains("--allow-bootstrap"))
    .stdout(predicate::str::contains("--deny-bootstrap"));
}

#[test]
fn create_without_trust_in_non_interactive_aborts_cleanly() {
  // Black-box the TOFU gate at the CLI boundary: a fresh repo with
  // a `.gwm.toml` carrying any bootstrap surface, run from a
  // non-tty (assert_cmd's piped stdin), no `--allow-bootstrap`, no
  // ledger entry → must abort with a clear message rather than
  // silently running the bootstrap commands.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo trapped"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    // No `GWM_ALLOW_BOOTSTRAP` env, no flag → must abort.
    .args(["create", "feat", "42", "trapped"])
    .assert()
    .failure()
    .stderr(
      predicate::str::contains("not in the trust ledger").or(predicate::str::contains("stdin is not interactive")),
    );
}

#[test]
fn create_with_allow_bootstrap_flag_bypasses_the_prompt() {
  // The `--allow-bootstrap` escape hatch is what makes scripted /
  // CI usage workable; this asserts the FLAG (not the env var)
  // actually short-circuits the trust gate. The env-var path is
  // covered by other tests that set GWM_ALLOW_BOOTSTRAP=1 — here
  // we exercise the clap-level wiring so a future refactor that
  // accidentally scopes the flag to one subcommand breaks loudly.
  //
  // `--no-bootstrap` is added so we don't actually shell out to
  // anything — the test is about the trust gate, not the bootstrap
  // step itself.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo would-have-run"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    // No env-var bypass — the flag must do the work on its own.
    // `--allow-bootstrap` is a clap `global = true` flag declared on
    // `Cli`, so it MUST appear before the subcommand on the argv.
    .args(["--allow-bootstrap", "create", "feat", "42", "trapped", "--no-bootstrap"])
    .assert()
    .success();

  // The ledger MUST still be empty — Allow mode bypasses without
  // recording, so the next interactive run on the same machine
  // re-prompts. That's the "don't pollute the user's ledger from CI"
  // contract.
  assert!(
    !ledger.exists()
      || std::fs::read_to_string(&ledger).unwrap().contains("entries = []")
      || std::fs::read_to_string(&ledger).unwrap().is_empty()
  );
}

#[test]
fn create_with_gwm_allow_bootstrap_env_bypasses_the_prompt() {
  // Sibling of the previous test: same fixture, but exercise the
  // `GWM_ALLOW_BOOTSTRAP=1` env-var bypass with no flag. This is
  // the CI-runner code path — scripts can't always inject extra
  // args, so the env-var path has to keep working independently.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"[[bootstrap.command]]
name = "echo"
run  = "echo would-have-run"
"#,
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "42", "env-trapped", "--no-bootstrap"])
    .assert()
    .success();

  assert!(
    !ledger.exists()
      || std::fs::read_to_string(&ledger).unwrap().contains("entries = []")
      || std::fs::read_to_string(&ledger).unwrap().is_empty()
  );
}

#[test]
fn create_skips_trust_gate_when_bootstrap_surface_is_empty() {
  // A `.gwm.toml` that declares nothing executable (no copies, no
  // guards, no no_symlinks, no commands) carries no RCE risk —
  // prompting for trust in that case would just train the user to
  // mash `y`. Verify the gate is a silent no-op when the config has
  // only `[worktree]`.
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    format!(
      r#"[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
      base = toml_basic_string(base.path()),
    ),
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  // No --allow-bootstrap, no env bypass, no ledger entry, no tty —
  // the gate would normally abort. With an empty bootstrap surface
  // it must short-circuit and let the create proceed.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["create", "feat", "13", "empty-surface"])
    .assert()
    .success();

  // Ledger MUST stay untouched — the skip doesn't record anything.
  assert!(
    !ledger.exists(),
    "empty-surface short-circuit must not write to the ledger"
  );
}

#[test]
fn allow_bootstrap_succeeds_even_when_ledger_is_malformed() {
  // The whole point of `--allow-bootstrap` / `GWM_ALLOW_BOOTSTRAP=1`
  // is to be the unconditional CI escape hatch. A malformed
  // trust.toml on the CI host must NOT make the bypass fail — the
  // Allow check has to short-circuit before the ledger is touched.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[[bootstrap.command]]\nname = \"x\"\nrun = \"true\"\n",
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");
  std::fs::write(&ledger, b"this is not valid toml @@@@").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "99", "broken-ledger", "--no-bootstrap"])
    .assert()
    .success();
}

#[test]
fn deny_bootstrap_aborts_even_when_trusted() {
  // `--deny-bootstrap` is the forensic mode: even if the ledger
  // says the config is trusted, refuse to run bootstrap. Asserts
  // the precedence resolution in `resolve_trust_mode`.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[[bootstrap.command]]\nname = \"x\"\nrun = \"true\"\n",
  )
  .unwrap();

  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .args(["--deny-bootstrap", "bootstrap"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("--deny-bootstrap"));
}

// --- aliases (issue #86) ------------------------------------------------

#[test]
fn aliases_help_lists_list() {
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd.args(["aliases", "--help"]);
  cmd.assert().success().stdout(predicate::str::contains("list"));
}

#[test]
fn aliases_list_prints_built_in_section_outside_repo() {
  // `aliases list` is read-only and must work outside a git repo —
  // built-in clap aliases are static and independent of any repo
  // config. The user fallback (`~/.config/gwm/aliases.toml`) is
  // silently empty when missing.
  let dir = tempfile::TempDir::new().unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    // Isolate the test from the developer's real `~/.config/gwm/aliases.toml`.
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("built-in:"))
    // Canonical built-in entries from `BUILT_IN_ALIASES`. Assert the full
    // formatted row (`  <name>  → <expansion>` with width-2 padding) rather
    // than a loose `contains("s")` — the latter matched incidental letters
    // in unrelated words (`aliases`, `built-ins`, …) and let the test pass
    // even when the `s → switch` row was missing or malformed.
    .stdout(predicate::str::contains("  s  → switch"))
    .stdout(predicate::str::contains("  cd → path"));
}

#[test]
fn aliases_list_prints_repo_aliases_with_source() {
  // `.gwm.toml` with `[aliases]` ⇒ `aliases list` surfaces them under
  // the `repo (.gwm.toml):` section.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
wip = "create feat 0 wip"
ll = "list --format names"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("repo (.gwm.toml)"))
    .stdout(predicate::str::contains("wip"))
    .stdout(predicate::str::contains("create feat 0 wip"))
    .stdout(predicate::str::contains("ll"))
    .stdout(predicate::str::contains("list --format names"));
}

#[test]
fn aliases_list_prints_user_aliases_with_source() {
  // `~/.config/gwm/aliases.toml` (XDG resolved via `$XDG_CONFIG_HOME`)
  // surfaces under the user section.
  let dir = tempfile::TempDir::new().unwrap();
  let user_cfg = dir.path().join("gwm");
  std::fs::create_dir_all(&user_cfg).unwrap();
  std::fs::write(
    user_cfg.join("aliases.toml"),
    r#"
[aliases]
copy = "path"
"#,
  )
  .unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("user"))
    .stdout(predicate::str::contains("aliases.toml"))
    .stdout(predicate::str::contains("copy"))
    .stdout(predicate::str::contains("path"));
}

#[test]
fn aliases_list_repo_overrides_user_for_same_name() {
  // When repo and user both declare the same alias, the repo entry
  // takes precedence at expansion time. `aliases list` still prints
  // BOTH sections so the user can see what's being shadowed.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
copy = "path bar"
"#,
  )
  .unwrap();
  let user_cfg = dir.path().join("gwm");
  std::fs::create_dir_all(&user_cfg).unwrap();
  std::fs::write(
    user_cfg.join("aliases.toml"),
    r#"
[aliases]
copy = "path foo"
"#,
  )
  .unwrap();

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("path bar"))
    .stdout(predicate::str::contains("path foo"));
}

#[test]
fn aliases_list_surfaces_shadow_error_with_alias_name() {
  // An invalid alias in `.gwm.toml` must fail `aliases list` with a
  // message naming the offending entry.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
list = "create feat 0 wip"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["aliases", "list"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("list").and(predicate::str::contains("built-in")));
}

#[test]
fn alias_expansion_runs_built_in_subcommand() {
  // End-to-end expansion: declare `lst = "list --format names"`,
  // invoke `gwm lst` — must behave as `gwm list --format names`.
  // The repo has no worktrees yet so the names output is just empty.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
lst = "list --format names"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .arg("lst")
    .assert()
    .success();
}

#[test]
fn alias_expansion_preserves_trailing_user_args() {
  // `gwm typ` with `typ = "types"` plus a trailing `--help` must
  // surface clap's `types` help (or success), proving the trailing
  // arg made it through the expansion.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
typ = "types"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["typ", "--help"])
    .assert()
    .success()
    .stdout(predicate::str::contains("branch types"));
}

#[test]
fn alias_does_not_shadow_built_in_subcommand_at_runtime() {
  // Even if a hostile `.gwm.toml` somehow tries to alias `types`,
  // the load gate refuses — `gwm types` always reaches the
  // built-in. This is the "defence in depth" pillar of the design.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[aliases]
types = "list"
"#,
  )
  .unwrap();
  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .args(["types"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("types"));
}

// --- argv robustness (issue #86 — Copilot follow-up) --------------------

#[cfg(unix)]
#[test]
fn binary_tolerates_non_utf8_argv() {
  // `std::env::args()` panics if any argv entry is non-UTF-8, which is
  // a regression vs. clap's default `args_os` handling. The binary
  // must NOT abort the process on a perfectly valid OS argv just
  // because someone passed bytes that don't decode as UTF-8.
  //
  // We don't care about the exit code per se — the contract is "no
  // panic, no SIGABRT". clap may legitimately reject the unknown
  // subcommand and exit non-zero (UsageError = 2), which is fine.
  // What we forbid is the process aborting before clap even sees
  // the args.
  use std::ffi::OsString;
  use std::os::unix::ffi::OsStringExt;

  let dir = tempfile::TempDir::new().unwrap();
  let invalid_utf8: OsString = OsString::from_vec(vec![0xff, 0xfe, 0x80]);

  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("XDG_CONFIG_HOME", dir.path())
    .env("HOME", dir.path())
    .arg(&invalid_utf8)
    .output()
    .expect("binary must launch");

  // Reject SIGABRT / SIGSEGV / SIGILL — anything that indicates the
  // process died on a signal rather than exited normally. On Unix,
  // signal deaths surface as `status.code() == None` from `assert_cmd`.
  assert!(
    output.status.code().is_some(),
    "binary died on a signal (likely a panic abort) when given non-UTF-8 argv; stderr={:?}",
    String::from_utf8_lossy(&output.stderr)
  );

  // Belt-and-suspenders: the stderr should not contain the libstd panic
  // banner for invalid UTF-8 in argv.
  let stderr = String::from_utf8_lossy(&output.stderr);
  assert!(
    !stderr.contains("invalid utf-8") && !stderr.contains("panicked at"),
    "binary panicked instead of gracefully handling non-UTF-8 argv: {}",
    stderr
  );
}

// --- Issue #29: gwm history + gwm undo --------------------------------------

/// Seed a journal file at `path` with a single recorded `remove` op
/// rooted at `repo_root` (canonical form). The OID is a synthetic 40-
/// char hex string the journal accepts verbatim — `gwm history` is a
/// read-only listing so it never resolves the OID against the object
/// DB, which means we don't need to seed a matching commit.
///
/// `repo_root` is escaped via `toml_basic_string` because Windows
/// paths (`\\?\C:\...`) contain backslashes that TOML treats as
/// escape sequences; without the escape the parser fails with
/// "missing escaped value, expected b, e, f, n, r, \\, …".
fn write_seed_history(path: &Path, repo_root: &Path, worktree: &str, branch: &str) {
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "{worktree}"
branch = "{branch}"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/{worktree}"
deleted_branch = false
repo_root = "{repo_root}"
"#,
    repo_root = toml_basic_string(repo_root),
  );
  if let Some(parent) = path.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(path, body).unwrap();
}

#[test]
fn history_empty_journal_reports_no_ops() {
  // Empty case: a fresh repo with no recorded operations must print
  // a clear "no operations recorded" line and exit 0. Scripted callers
  // (e.g. `gwm history | head -n1`) need a stable signal — silent
  // stdout would force them to also check `$?` to disambiguate.
  let (dir, _) = init_repo();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("no operations recorded"));
}

#[test]
fn history_lists_recorded_remove_op() {
  // Happy path: a seeded journal with one `remove` op produces a
  // single-row listing carrying the worktree name. The exact
  // column shape is intentionally flexible — we pin only the
  // load-bearing tokens (kind = `remove`, worktree name) so the
  // formatter can evolve without test churn.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");
  write_seed_history(&history_file, &repo_root, "feat-29-foo", "feat/#29-foo");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("remove"))
    .stdout(predicate::str::contains("feat-29-foo"));
}

#[test]
fn history_filters_to_current_repo_by_default() {
  // Two ops recorded against two different repos. From inside
  // repo A, `gwm history` must surface ONLY the entry whose
  // `repo_root` matches the current repo — the per-repo
  // separation contract.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // Seed two ops: one for the current repo, one for a fake "other-repo"
  // path. Only the first should surface in the default listing.
  // `toml_basic_string` escapes the repo path for TOML — Windows
  // canonical paths (`\\?\C:\…`) would otherwise break the parser.
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-here-foo"
branch = "feat/#1-here"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-here-foo"
deleted_branch = false
repo_root = "{repo_root}"

[[op]]
ts = "2026-05-19T09:00:00Z"
kind = "remove"
worktree = "feat-elsewhere-bar"
branch = "feat/#2-elsewhere"
branch_oid = "b2c3d4e5f60718293a4b5c6d7e8f9012345678a1"
path = "/tmp/cc-worktree/feat-elsewhere-bar"
deleted_branch = false
repo_root = "/nonexistent/other-repo"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  if let Some(parent) = history_file.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("history")
    .assert()
    .success()
    .stdout(predicate::str::contains("feat-here-foo"))
    .stdout(predicate::str::contains("feat-elsewhere-bar").not());
}

#[test]
fn remove_records_journal_entry_before_destruction() {
  // Issue #29: `gwm remove <name>` must write a journal entry naming
  // the doomed worktree + branch + OID BEFORE the destructive call
  // runs. Without this hook `gwm undo` has nothing to replay. The
  // assertion is intentionally loose on the exact TOML shape — we
  // pin only that the journal file exists, is non-empty, and
  // contains the worktree name we asked to remove.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  // Seed a worktree the test will then remove.
  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "29", "doomed", "--no-bootstrap"])
    .assert()
    .success();

  // No journal entry should exist yet — `gwm create` does NOT hook
  // the journal (only destructive ops do).
  assert!(
    !history_file.exists() || std::fs::read_to_string(&history_file).unwrap().trim().is_empty(),
    "create must not record a journal entry"
  );

  // Now remove it — the journal must capture the op.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-29-doomed"])
    .assert()
    .success();

  assert!(
    history_file.exists(),
    "remove must create the journal file at {}",
    history_file.display()
  );
  let body = std::fs::read_to_string(&history_file).unwrap();
  assert!(
    body.contains("feat-29-doomed"),
    "journal must record the removed worktree name; got:\n{}",
    body
  );
  assert!(
    body.contains("kind = \"remove\""),
    "journal must record kind = remove; got:\n{}",
    body
  );
  assert!(
    body.contains("feat/#29-doomed"),
    "journal must record the branch name; got:\n{}",
    body
  );
}

#[test]
fn remove_dry_run_does_not_record_journal_entry() {
  // The dry-run flag (issue #31) gives the user a preview without
  // touching state. The journal hook MUST gate on the destructive
  // path only — a `--dry-run` invocation that wrote to the journal
  // would let the user "undo" something that never happened.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "31", "preview", "--no-bootstrap"])
    .assert()
    .success();

  // dry-run must not write to the journal.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-31-preview", "--dry-run"])
    .assert()
    .success();

  assert!(
    !history_file.exists() || std::fs::read_to_string(&history_file).unwrap().trim().is_empty(),
    "remove --dry-run must NOT write to the journal; got: {:?}",
    std::fs::read_to_string(&history_file).ok()
  );
}

#[test]
fn undo_recreates_branch_and_worktree_after_remove() {
  // The full round-trip contract: create → remove → undo. After
  // `gwm undo`, the worktree dir must exist again AND the local
  // branch must resolve. The journal entry must be consumed.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  // 1. Create.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "29", "undo-rt", "--no-bootstrap"])
    .assert()
    .success();
  let wt_path = base.path().join("feat-29-undo-rt");
  assert!(wt_path.exists(), "create must produce the worktree dir");

  // 2. Remove (with --delete-branch so we exercise the harder
  //    resurrection path).
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-29-undo-rt", "--delete-branch"])
    .assert()
    .success();
  assert!(!wt_path.exists(), "remove must drop the worktree dir");

  let repo = git2::Repository::open(dir.path()).unwrap();
  assert!(
    repo.find_branch("feat/#29-undo-rt", git2::BranchType::Local).is_err(),
    "remove --delete-branch must drop the local branch"
  );

  // 3. Undo. The branch must come back at the same OID, and the
  //    worktree dir must reappear.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .success()
    .stdout(predicate::str::contains("recreated branch"))
    .stdout(predicate::str::contains("re-added worktree"));

  assert!(wt_path.exists(), "undo must restore the worktree dir");
  let repo = git2::Repository::open(dir.path()).unwrap();
  assert!(
    repo.find_branch("feat/#29-undo-rt", git2::BranchType::Local).is_ok(),
    "undo must recreate the local branch"
  );

  // 4. The journal entry is consumed — a second undo errors with
  //    "nothing to undo".
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("nothing to undo"));
}

#[test]
fn undo_bootstrap_without_trust_aborts() {
  // Issue #338: `gwm undo --bootstrap` must mediate the repo's
  // `[[bootstrap.command]]` shell through the SAME TOFU trust gate as
  // create / review / bootstrap. Before the fix, `cmd_undo` had no
  // `trust_mode` parameter and called `bootstrap::run` directly, so the
  // bootstrap commands ran unprompted on undo. Pin the gate at the CLI
  // boundary: create → remove → `undo --bootstrap` from a non-tty with
  // an empty ledger and no `GWM_ALLOW_BOOTSTRAP` must abort with the
  // trust message rather than silently running the bootstrap surface.
  let (dir, _) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");
  let ledger_dir = tempfile::TempDir::new().unwrap();
  let ledger = ledger_dir.path().join("trust.toml");

  let body = format!(
    r#"
[worktree]
base = "{base}"
path_pattern = "{{type}}-{{issue}}-{{desc}}"
branch_pattern = "{{type}}/#{{issue}}-{{desc}}"

[[bootstrap.command]]
name = "trap"
run  = "echo trapped"
"#,
    base = toml_basic_string(base.path()),
  );
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  // 1. Create — bypass the gate via the env var, skip the shell step.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["create", "feat", "338", "undo-trust", "--no-bootstrap"])
    .assert()
    .success();

  // 2. Remove — records the journal entry `undo` will replay.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["remove", "feat-338-undo-trust"])
    .assert()
    .success();

  // 3. `undo --bootstrap` with an empty ledger and no allow-bypass,
  //    from a non-tty → the trust gate must abort rather than running
  //    the `[[bootstrap.command]]` shell unprompted.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["undo", "--bootstrap"])
    .assert()
    .failure()
    .stderr(
      predicate::str::contains("not in the trust ledger").or(predicate::str::contains("stdin is not interactive")),
    );

  // 4. The gate runs BEFORE any resurrection (fail-fast), so a denied
  //    undo must leave the journal entry and worktree untouched — not
  //    half-apply then exit non-zero. The worktree must still be gone…
  let wt_path = base.path().join("feat-338-undo-trust");
  assert!(
    !wt_path.exists(),
    "a denied trust gate must NOT restore the worktree — undo must stay retryable"
  );

  // …and a follow-up `undo` (no --bootstrap → no gate) must still find
  //    the journal entry and restore the worktree, proving the denied
  //    run consumed nothing.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .success();
  assert!(
    wt_path.exists(),
    "retry undo must restore the worktree — the entry was preserved"
  );
}

#[test]
fn undo_refuses_detached_head_entry_with_clear_error() {
  // PR #155 Copilot review: a journal entry with `branch = ""` (the
  // serialised form of `branch: None`) flags a worktree that was
  // removed while on a detached HEAD. The pre-fix code fell back to
  // `branch_name = "HEAD"` and called `worktree::add`, which either
  // failed at the libgit2 level (invalid refname) or created a real
  // branch named "HEAD" — a foot-gun. The fix surfaces a clear
  // error message so the user knows the limitation and can file a
  // follow-up if it matters.
  //
  // We seed the journal directly with a `branch = ""` entry rather
  // than going through `gwm create / gwm remove` because the create
  // path always attaches a branch — there's no shortcut to a
  // detached-HEAD worktree from the CLI. The fixture matches what
  // serde produces for `Option<String>::None` once round-tripped
  // through TOML.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // Direct TOML seed without a `branch` key — serde will deserialise
  // it as `Option::None`, which is the detached-HEAD discriminator.
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-detached-foo"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-detached-foo"
deleted_branch = false
repo_root = "{repo_root}"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("detached-HEAD"));
}

#[test]
fn history_with_zero_limit_prints_nothing_but_does_not_lie() {
  // PR #155 Copilot review: `--limit 0` used to truncate the row list
  // to empty, which then triggered the "no operations recorded"
  // branch — factually wrong when ops exist, and breaks the scripted
  // signal callers rely on. The fix prints nothing and exits 0,
  // leaving the "no operations recorded" sentinel reserved for the
  // truly-empty case.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");
  write_seed_history(&history_file, &repo_root, "feat-zero-foo", "feat/#1-zero");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["history", "--limit", "0"])
    .assert()
    .success()
    .stdout(predicate::eq(""));
}

#[test]
fn undo_with_empty_journal_errors_clearly() {
  // A clean install with no recorded operations: `gwm undo` must
  // exit non-zero with a clear "nothing to undo" message — silent
  // success would mislead users into thinking the previous op was
  // already undone.
  let (dir, _) = init_repo();
  let history_dir = tempfile::TempDir::new().unwrap();
  let history_file = history_dir.path().join("history.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .arg("undo")
    .assert()
    .failure()
    .stderr(predicate::str::contains("nothing to undo"));
}

#[test]
fn history_all_flag_surfaces_every_repo() {
  // `--all` opt-out from the per-repo filter: useful for power users
  // grepping the journal for forensic purposes. Both entries must
  // appear in the listing.
  let (dir, _) = init_repo();
  let repo_root = dir.path().canonicalize().unwrap();
  let tmp = tempfile::TempDir::new().unwrap();
  let history_file = tmp.path().join("history.toml");

  // `toml_basic_string` escapes the repo path for TOML so this seed
  // parses on Windows (canonical paths there start with `\\?\C:\…`).
  let body = format!(
    r#"[[op]]
ts = "2026-05-19T08:42:11Z"
kind = "remove"
worktree = "feat-here-foo"
branch = "feat/#1-here"
branch_oid = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
path = "/tmp/cc-worktree/feat-here-foo"
deleted_branch = false
repo_root = "{repo_root}"

[[op]]
ts = "2026-05-19T09:00:00Z"
kind = "remove"
worktree = "feat-elsewhere-bar"
branch = "feat/#2-elsewhere"
branch_oid = "b2c3d4e5f60718293a4b5c6d7e8f9012345678a1"
path = "/tmp/cc-worktree/feat-elsewhere-bar"
deleted_branch = false
repo_root = "/nonexistent/other-repo"
"#,
    repo_root = toml_basic_string(&repo_root),
  );
  std::fs::create_dir_all(history_file.parent().unwrap()).unwrap();
  std::fs::write(&history_file, body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_HISTORY_FILE", &history_file)
    .args(["history", "--all"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat-here-foo"))
    .stdout(predicate::str::contains("feat-elsewhere-bar"));
}

// --- gwm pr (issue #84) -------------------------------------------------

/// Build a `feat/#<issue>-<desc>` branch on top of `main` carrying one
/// extra commit so `git log main..HEAD` and `git diff --stat main..HEAD`
/// produce non-empty output for the `{commits}` and `{files_changed}`
/// placeholders. Switches the working tree to that branch.
fn make_feature_branch_with_commit(
  repo: &git2::Repository,
  workdir: &std::path::Path,
  branch: &str,
  filename: &str,
  contents: &str,
  message: &str,
) {
  let head = repo.head().unwrap().peel_to_commit().unwrap();
  let branch_ref = repo.branch(branch, &head, false).unwrap();
  let ref_name = branch_ref.into_reference().name().unwrap().to_string();
  repo.set_head(&ref_name).unwrap();
  repo
    .checkout_head(Some(git2::build::CheckoutBuilder::new().force()))
    .unwrap();

  let dest = workdir.join(filename);
  if let Some(parent) = dest.parent() {
    std::fs::create_dir_all(parent).unwrap();
  }
  std::fs::write(&dest, contents).unwrap();
  let mut index = repo.index().unwrap();
  index.add_path(std::path::Path::new(filename)).unwrap();
  index.write().unwrap();
  let tree_id = index.write_tree().unwrap();
  let tree = repo.find_tree(tree_id).unwrap();
  let sig = git2::Signature::now("gwm-test", "gwm@test").unwrap();
  repo.commit(Some("HEAD"), &sig, &sig, message, &tree, &[&head]).unwrap();
}

#[test]
fn pr_render_prints_body_with_placeholders_substituted() {
  // `gwm pr --render` resolves the template configured for the current
  // branch type, substitutes the placeholders against the current
  // branch's context (type / issue / desc / base / head / commits /
  // files_changed), and prints the rendered Markdown to stdout. It
  // never shells out to `gh` — the canonical pipe-friendly form is
  // `gwm pr --render | gh pr create --body-file -`.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "docs/note.md",
    "hello pr\n",
    "✨ feat: pr templates",
  );

  let body = r###"
[pr_template.by_type.feat]
body = """
## Summary

{desc} (#{issue})

## Commits

{commits}

## Files changed

{files_changed}
"""
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("pr-templates (#84)"))
    .stdout(predicate::str::contains("- ✨ feat: pr templates"))
    .stdout(predicate::str::contains("docs/note.md"));
}

#[test]
fn pr_creates_pull_request_via_gh() {
  // `gwm pr` (no `--render`) renders the body, writes it to a temp
  // file, and shells out to `gh pr create --title … --body-file …
  // --head <branch>`. The fake gh prints a PR URL so the CLI can
  // surface the new number in stdout.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/x.rs",
    "fn x() {}\n",
    "✨ feat: x",
  );

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/pull/321\n");

  let body = r###"
[pr_template.by_type.feat]
body = "## Summary\n{desc} (#{issue})\n"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created PR #321"))
    .stdout(predicate::str::contains("https://github.com/acme/widgets/pull/321"));

  let gh_args_raw = std::fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("pr create"), "{gh_args_raw}");
  assert!(gh_args.contains("--head feat/#84-pr-templates"), "{gh_args_raw}");
  let gh_body = std::fs::read_to_string(fake_bin.path().join("gh-body.md")).unwrap();
  assert!(gh_body.contains("pr-templates (#84)"), "{gh_body}");
}

#[cfg(unix)]
#[test]
fn pr_body_travels_on_stdin_and_never_reaches_the_glab_argv() {
  // Issue #459: `glab` has no `--body-file`, so the previous
  // `glab mr create --description "<body>"` published the whole rendered
  // document on the command line, readable by any local process through
  // `ps`. The creation path now goes through `glab api --input -`.
  //
  // The assertion is deliberately on the *recorded argv*, not on the
  // argv builder: a unit test on the builder cannot see a body that some
  // other layer appends later.
  let (dir, repo) = init_repo();
  repo.remote("origin", "https://gitlab.com/group/proj.git").unwrap();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/x.rs",
    "fn x() {}\n",
    "✨ feat: x",
  );

  let fake_bin = tempfile::TempDir::new().unwrap();
  let log = fake_bin.path().join("calls.log");
  let stdin_dump = fake_bin.path().join("stdin.json");
  let fake_glab = write_recording_glab(
    fake_bin.path(),
    "[]",
    r#"{"iid":321,"web_url":"https://gitlab.com/group/proj/-/merge_requests/321"}"#,
  );

  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[pr_template.by_type.feat]\nbody = \"## Summary\\nSUPER-SECRET-BODY (#{issue})\\n\"\n",
  )
  .unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GLAB", &fake_glab)
    .env("GWM_FAKE_LOG", &log)
    .env("GWM_FAKE_STDIN", &stdin_dump)
    // Set by a user debugging something else entirely. It makes glab
    // dump full requests and responses — bodies included — to stderr,
    // which the transcript keeps and the error path quotes verbatim.
    .env("GLAB_DEBUG_HTTP", "1")
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["pr"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created MR #321"))
    .stdout(predicate::str::contains(
      "https://gitlab.com/group/proj/-/merge_requests/321",
    ));

  let calls = fs::read_to_string(&log).unwrap();
  assert!(
    !calls.contains("SUPER-SECRET-BODY"),
    "the body must not be visible in the argv: {calls}"
  );
  assert!(calls.contains("--input -"), "{calls}");
  assert!(
    calls.contains("GLAB_DEBUG_HTTP:<unset>"),
    "the HTTP debug dump would print the body straight back out: {calls}"
  );

  // ...and it must still actually arrive, or the test above would pass
  // just as well with the body silently dropped.
  let sent: serde_json::Value = serde_json::from_str(&fs::read_to_string(&stdin_dump).unwrap()).unwrap();
  assert!(
    sent["description"].as_str().unwrap().contains("SUPER-SECRET-BODY"),
    "{sent}"
  );
  assert_eq!(sent["source_branch"], "feat/#84-pr-templates");
}

#[test]
fn pr_draft_flag_is_forwarded_to_gh() {
  // `gwm pr --draft` passes `--draft` through to `gh pr create` so the
  // resulting PR opens as a draft instead of a normal review-ready PR.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/y.rs",
    "fn y() {}\n",
    "✨ feat: y",
  );

  let fake_bin = tempfile::TempDir::new().unwrap();
  let fake_gh = write_fake_gh(fake_bin.path(), "https://github.com/acme/widgets/pull/777\n");

  let body = r###"
[pr_template.by_type.feat]
body = "draft body for {desc}"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_GH", &fake_gh)
    .env("PATH", prepend_path(fake_bin.path()))
    .args(["pr", "--draft"])
    .assert()
    .success()
    .stdout(predicate::str::contains("created PR #777"));

  let gh_args_raw = std::fs::read_to_string(fake_bin.path().join("gh-args.txt")).unwrap();
  let gh_args = gh_args_raw.replace('"', "");
  assert!(gh_args.contains("--draft"), "{gh_args_raw}");
}

#[test]
fn pr_falls_back_to_common_trunk_when_configured_trunks_do_not_resolve() {
  // If `[doctor].trunks` only lists refs that don't exist locally
  // (e.g. a repo customised the list but the trunk hasn't been
  // created yet, or the repo uses `master`), `gwm pr` must still
  // find a sensible base ref by walking the common trunk names
  // (`main` / `master` / `dev` / `develop` / `trunk`) before giving
  // up — otherwise `{commits}` / `{files_changed}` come out empty
  // and the user has no signal as to why (Copilot review on PR #164).
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-fallback",
    "src/fallback.rs",
    "fn fb() {}\n",
    "✨ feat: fallback",
  );

  let body = r###"
[doctor]
trunks = ["nonexistent-trunk"]

[pr_template.by_type.feat]
body = "summary: {desc} (#{issue})\ncommits:\n{commits}\n"
"###;
  std::fs::write(dir.path().join(".gwm.toml"), body).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("fallback (#84)"))
    .stdout(predicate::str::contains("- ✨ feat: fallback"));
}

#[test]
fn pr_errors_when_no_template_configured() {
  // Without any `[pr_template]` block in `.gwm.toml`, `gwm pr` exits
  // non-zero with a hint about the missing config — same shape as the
  // `gwm new` failure for an unconfigured branch type.
  let (dir, repo) = init_repo();
  make_feature_branch_with_commit(
    &repo,
    dir.path(),
    "feat/#84-pr-templates",
    "src/z.rs",
    "fn z() {}\n",
    "✨ feat: z",
  );
  std::fs::write(dir.path().join(".gwm.toml"), "").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("pr_template"))
    .stderr(predicate::str::contains("feat"));
}

// --- gwm tui keys (issue #87) -------------------------------------------

#[test]
fn tui_keys_lists_default_bindings() {
  // The bare invocation prints the full resolved keymap as a
  // human-readable table. Default surface ships with `down → j, Down`,
  // `top → g g`, `quit → q`, … — assert the canary rows so a regression
  // in the table layout or the defaults map fails loudly.
  let (dir, _) = init_repo();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .stdout(predicate::str::contains("down"))
    .stdout(predicate::str::contains("j"))
    .stdout(predicate::str::contains("top"))
    .stdout(predicate::str::contains("g g"))
    .stdout(predicate::str::contains("quit"))
    .stdout(predicate::str::contains("default"));
}

#[test]
fn tui_keys_marks_user_overrides_in_source_column() {
  // When the user overrides a binding via `[tui.keys]`, the source
  // column for that row flips from `default` to a non-default marker
  // (we use `.gwm.toml`). The other rows keep `default`.
  let (dir, _) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    r#"
[tui.keys]
down = ["Ctrl+n"]
"#,
  )
  .unwrap();

  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .get_output()
    .clone();

  let stdout = String::from_utf8(output.stdout).unwrap();
  // Find the `down` row and assert it carries the user-config marker.
  let down_line = stdout
    .lines()
    .find(|l| l.starts_with("down"))
    .unwrap_or_else(|| panic!("expected a `down` row in:\n{stdout}"));
  assert!(
    down_line.contains("Ctrl+n"),
    "expected `down` row to show the override, got: {down_line}"
  );
  assert!(
    down_line.contains(".gwm.toml"),
    "expected `down` row source to be `.gwm.toml`, got: {down_line}"
  );
  // `up` was not overridden — must still read as default.
  let up_line = stdout
    .lines()
    .find(|l| l.starts_with("up"))
    .unwrap_or_else(|| panic!("expected an `up` row in:\n{stdout}"));
  assert!(
    up_line.contains("default"),
    "expected `up` row source to stay `default`, got: {up_line}"
  );
}

// --- gwm theme list / show (issue #33) ----------------------------------

#[test]
fn theme_list_includes_builtin_presets() {
  // `gwm theme list` prints the names of every built-in preset
  // shipped by the binary. Catppuccin is the named example in the
  // issue; the exact catalogue can grow over time.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "list"])
    .assert()
    .success()
    .stdout(predicate::str::contains("catppuccin"))
    .stdout(predicate::str::contains("claude-dark"));
}

#[test]
fn theme_show_claude_dark_emits_the_orange_accent_as_hex() {
  // The Claude dark port (#185) is RGB-based, so `theme show` must
  // render its accent as a copy-pasteable `#RRGGBB` string that
  // round-trips through the `[theme]` parser.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "claude-dark"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[theme]"))
    .stdout(predicate::str::contains("#d4825d"));
}

#[test]
fn theme_show_emits_toml_block_users_can_copy() {
  // `gwm theme show catppuccin` dumps a `[theme]` block that, when
  // pasted into a `.gwm.toml`, reproduces the preset.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[theme]"))
    .stdout(predicate::str::contains("focus"));
}

#[test]
fn theme_show_includes_name_and_path_chrome_roles() {
  // #210: the `name` / `path` chrome roles must be part of the dumpable
  // block so users can discover and override them like any other role.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("name         ="))
    .stdout(predicate::str::contains("path         ="));
}

#[test]
fn theme_show_includes_git_status_family_roles() {
  // #211: the staged / modified / untracked roles must be dumpable so
  // users can discover and override the working-tree colours.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .stdout(predicate::str::contains("staged       ="))
    .stdout(predicate::str::contains("modified     ="))
    .stdout(predicate::str::contains("untracked    ="));
}

#[test]
fn theme_show_rejects_unknown_preset() {
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "does-not-exist"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("does-not-exist"));
}

#[test]
fn theme_show_output_round_trips_through_gwm_toml() {
  // Copilot review on PR #168 caught that `Color::Indexed(n)` was
  // emitted as a bare integer, breaking the round-trip because
  // `ThemeConfig.overrides` is a `BTreeMap<String, String>` and
  // TOML integers won't deserialise as `String`. Pin the
  // round-trip contract end-to-end: capture stdout, drop the
  // first `preset = "…"` line (preset is a dedicated field, not
  // an override), write the rest as `.gwm.toml`, reload, assert
  // no error.
  let (dir, _) = init_repo();
  let output = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["theme", "show", "catppuccin"])
    .assert()
    .success()
    .get_output()
    .clone();
  let toml_block = String::from_utf8(output.stdout).unwrap();
  // Pasting verbatim into a fresh `.gwm.toml` and reloading must
  // succeed — every value in the block has to be a TOML string.
  let target = dir.path().join(".gwm.toml");
  std::fs::write(&target, &toml_block).unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["doctor"])
    .assert()
    // doctor's exit code may be 0 or 1 depending on local env
    // (it's advisory). What matters is that the config parses —
    // a TOML parse error would produce a `failed` config check
    // and exit code 2 / a hard error before doctor runs. We
    // assert the absence of "invalid TOML" / "config error" in
    // stderr to pin the round-trip.
    .stderr(predicate::str::contains("invalid TOML").not())
    .stderr(predicate::str::contains("config error").not());
}

#[test]
fn tui_keys_lists_modal_contexts() {
  // Issue #219: the listing prints the contextual modal bindings under
  // their `[tui.keys.modal.<context>]` headings, including nested link stages.
  let (dir, _) = init_repo();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["tui", "keys"])
    .assert()
    .success()
    .stdout(predicate::str::contains("[tui.keys.modal.confirm]"))
    .stdout(predicate::str::contains("focus_confirm"))
    .stdout(predicate::str::contains("[tui.keys.modal.link.choose_target]"));
}

// --- exec / clean (issue #313) ------------------------------------------

/// Spin up a repo plus one non-main worktree via the real binary, so the
/// `exec` / `clean` tests exercise the actual worktree-discovery and
/// target-selection path (not just the pure helpers). Returns the main repo
/// tempdir, the worktree-base tempdir (kept alive), and the worktree path.
fn repo_with_one_worktree() -> (tempfile::TempDir, tempfile::TempDir, PathBuf) {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  // Reuse the shared writer so the tempdir path is TOML-escaped (backslashes
  // on Windows CI would otherwise make `.gwm.toml` invalid).
  write_test_config(dir.path(), base.path());
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "1", "wt"])
    .assert()
    .success();
  let wt = base.path().join("feat-1-wt");
  assert!(wt.exists(), "worktree must exist for the exec/clean tests");
  (dir, base, wt)
}

#[test]
fn exec_runs_the_command_inside_each_worktree() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // The command's CWD is the worktree, so the marker lands there — proving
  // discovery + per-worktree execution, not just a parse.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "echo hi > exec_marker.txt"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓"))
    .stdout(predicate::str::contains("feat-1-wt"));
  assert!(
    wt.join("exec_marker.txt").exists(),
    "the command must run with the worktree as its working directory"
  );
}

#[test]
fn exec_exits_nonzero_when_a_worktree_command_fails() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "exit 5"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗"))
    .stdout(predicate::str::contains("exit 5"));
}

/// Append a TOML snippet to the repo's `.gwm.toml` (the writer created by
/// `repo_with_one_worktree`), so a test can add `[exec.profiles.*]` /
/// `[clean.profiles.*]` entries on top of the base config.
fn append_config(repo_root: &Path, snippet: &str) {
  use std::io::Write;
  let mut f = std::fs::OpenOptions::new()
    .append(true)
    .open(repo_root.join(".gwm.toml"))
    .unwrap();
  writeln!(f, "{snippet}").unwrap();
}

// --- exec/clean named profiles (issue #324) ---------------------------------

#[test]
fn exec_runs_a_named_profile_command() {
  let (dir, _base, wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[exec.profiles.greet]\ncommand = [\"sh\", \"-c\", \"echo hi > prof_marker.txt\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "greet"])
    .assert()
    .success()
    .stdout(predicate::str::contains("✓"));
  assert!(
    wt.join("prof_marker.txt").exists(),
    "the profile's command must run in the worktree"
  );
}

#[test]
fn exec_jobs_runs_the_parallel_capture_path() {
  // `--jobs > 1` runs the bounded-parallel path: each worktree's output is
  // captured and printed as a block (after its header), and the command still
  // runs and rolls up ✓.
  let (dir, _base, wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args([
      "exec",
      "--jobs",
      "2",
      "--",
      "sh",
      "-c",
      "echo blockline; echo hi > exec_jobs_marker.txt",
    ])
    .assert()
    .success()
    .stdout(predicate::str::contains("blockline")) // captured stdout printed as a block
    .stdout(predicate::str::contains("feat-1-wt"))
    .stdout(predicate::str::contains("✓"));
  assert!(
    wt.join("exec_jobs_marker.txt").exists(),
    "the command must still run under --jobs"
  );
}

#[test]
fn exec_jobs_preserves_raw_binary_output() {
  // The parallel path captures bytes, but must re-emit them RAW — a
  // `String::from_utf8_lossy` would mangle a non-UTF-8 byte (0xFF) into the
  // U+FFFD replacement char. `printf '\377'` emits a literal 0xFF.
  let (dir, _base, _wt) = repo_with_one_worktree();
  let out = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "2", "--", "printf", "\\377"])
    .output()
    .unwrap();
  assert!(out.status.success(), "exec should succeed: {out:?}");
  assert!(
    out.stdout.contains(&0xFFu8),
    "the raw 0xFF byte must survive the capture, not be UTF-8-mangled"
  );
}

#[test]
fn exec_inline_inside_bare_repo_does_not_require_a_workdir() {
  // A bare repo has no `workdir()`, so there's no `.gwm.toml` to read — but
  // inline `gwm exec` must still run (it enumerates worktrees, not config).
  // Regression: reading the `[exec] jobs` default must fall back gracefully
  // here instead of failing with `NotInGitRepo` (#324 review).
  let dir = tempfile::TempDir::new().unwrap();
  git2::Repository::init_bare(dir.path()).expect("init bare repo");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "true"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no worktrees to run in"));
}

#[test]
fn exec_jobs_flag_skips_config_when_inline() {
  // Inline + `--jobs`: the flag is authoritative and the command is on the
  // CLI, so `[exec]` is never read — a malformed sibling profile can't block
  // `gwm exec --jobs N -- <cmd>` (#324 review).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.bad]\ncommand = []\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "2", "--", "true"])
    .assert()
    .success();
}

#[test]
fn exec_inline_jobs_default_tolerates_a_semantic_sibling_profile() {
  // Inline + no `--jobs`: the `[exec] jobs` default IS read, but sibling
  // profiles are NOT semantically validated (inline uses none of them), so a
  // `command = []` sibling doesn't block the inline run.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec]\njobs = 1\n[exec.profiles.bad]\ncommand = []\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "true"])
    .assert()
    .success();
}

#[test]
fn exec_jobs_flag_parses_and_propagates_failure() {
  // The parallel path propagates a non-zero rollup just like sequential.
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--jobs", "3", "--", "sh", "-c", "exit 4"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗"))
    .stdout(predicate::str::contains("exit 4"));
}

#[test]
fn exec_inline_command_ignores_a_broken_gwm_toml() {
  // The inline `gwm exec -- <cmd>` surface is promised config-free: an
  // unrelated `.gwm.toml` error must NOT break it (it only reads config for
  // a `--profile` lookup). Here a stray top-level key would fail a config
  // load, yet the inline command still runs.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--", "sh", "-c", "true"])
    .assert()
    .success();
}

#[test]
fn exec_profile_tolerates_an_unrelated_config_error() {
  // The `--profile` path reads only the `[exec]` section, so an UNRELATED
  // top-level typo is tolerated — the failure is the unknown profile, not the
  // typo (exit 1 either way, but for the right reason).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "whatever"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `whatever`"));
}

#[test]
fn exec_profile_surfaces_a_malformed_exec_section() {
  // A shape error in the `[exec]` section ITSELF still surfaces (exit 1):
  // an unknown field in a profile is rejected by `deny_unknown_fields`.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.bad]\ncommand = [\"true\"]\nbogus = 1\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "bad"])
    .assert()
    .failure()
    .code(1);
}

#[test]
fn exec_profile_and_inline_command_are_mutually_exclusive() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[exec.profiles.t]\ncommand = [\"true\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "t", "--", "echo", "hi"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("mutually exclusive"));
}

#[test]
fn exec_unknown_profile_exits_one() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn clean_unknown_profile_exits_one() {
  let (dir, _base, _wt) = repo_with_one_worktree();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn clean_builtin_ignores_a_broken_gwm_toml() {
  // The built-in `gwm clean` (no `--profile`) is opt-in/config-tolerant: an
  // unrelated `.gwm.toml` error (a stray top-level key) must NOT block it —
  // only the `[clean]` section is read, so it falls back to the built-in dirs.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "nonsense_key = true\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success();
}

#[test]
fn clean_honors_default_profile_despite_an_unrelated_config_error() {
  // A configured `[clean.profiles.default]` must NOT be silently dropped
  // (reverting to the built-in set) just because an unrelated key is wrong —
  // that would make a destructive `--yes` delete the wrong set. The default
  // profile's `coverage` (only reclaimable under that profile) is reported.
  let (dir, _base, wt) = repo_with_one_worktree();
  std::fs::create_dir_all(wt.join("coverage")).unwrap();
  std::fs::write(wt.join("coverage/lcov.info"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "coverage/\n").unwrap();
  append_config(
    dir.path(),
    "nonsense_key = true\n[clean.profiles.default]\ndirs = [\"coverage\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("coverage"));
}

#[test]
fn clean_surfaces_a_malformed_clean_section() {
  // A shape error in the `[clean]` section ITSELF still surfaces (exit 1),
  // even without `--profile` — a profile missing its required `dirs` must not
  // be silently ignored before a destructive clean.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[clean.profiles.broken]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .failure()
    .code(1);
}

#[test]
fn clean_rejects_a_sibling_invalid_profile() {
  // The `[clean]` loader validates EVERY profile, not just the selected one:
  // a sibling `bad` that escapes the worktree fails `--profile good` too, so
  // the command path matches `gwm config validate` / doctor (#324 review).
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[clean.profiles.good]\ndirs = [\"target\"]\n[clean.profiles.bad]\ndirs = [\"..\"]\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "good"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains(".."));
}

#[test]
fn exec_rejects_a_sibling_invalid_profile() {
  // Same for `[exec]`: a sibling `bad` with an empty command fails
  // `--profile good`.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(
    dir.path(),
    "[exec.profiles.good]\ncommand = [\"true\"]\n[exec.profiles.bad]\ncommand = []\n",
  );
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--profile", "good"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("empty `command`"));
}

#[test]
fn clean_profile_with_an_unsafe_dir_exits_one() {
  // A `dirs` entry that could escape the worktree (here `..`) is refused at
  // resolution, before any filesystem scan — exit 1, nothing walked.
  let (dir, _base, _wt) = repo_with_one_worktree();
  append_config(dir.path(), "[clean.profiles.evil]\ndirs = [\"..\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "evil"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("escape the worktree"));
}

#[test]
fn clean_named_profile_scopes_the_reclaim_to_its_dirs() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // `coverage/` is only reclaimable under a profile that lists it; the
  // built-in set (target/node_modules/dist/build) would ignore it.
  std::fs::create_dir_all(wt.join("coverage")).unwrap();
  std::fs::write(wt.join("coverage/lcov.info"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "coverage/\n").unwrap();
  append_config(dir.path(), "[clean.profiles.cov]\ndirs = [\"coverage\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "cov"])
    .assert()
    .success()
    .stdout(predicate::str::contains("coverage"));
}

#[test]
fn clean_reclaims_a_leading_dash_profile_dir() {
  // A profile dir whose name starts with `-` (e.g. `-cache`) must flow through
  // the git-ignored safety check correctly — the check passes `--` so git
  // doesn't parse the name as an option and wrongly skip it (#324 review P3).
  let (dir, _base, wt) = repo_with_one_worktree();
  std::fs::create_dir_all(wt.join("-cache")).unwrap();
  std::fs::write(wt.join("-cache/blob.bin"), vec![0u8; 2048]).unwrap();
  std::fs::write(wt.join(".gitignore"), "/-cache/\n").unwrap();
  append_config(dir.path(), "[clean.profiles.dash]\ndirs = [\"-cache\"]\n");
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--profile", "dash", "--yes"])
    .assert()
    .success();
  assert!(
    !wt.join("-cache").exists(),
    "a git-ignored `-cache` profile dir must be reclaimed, not skipped"
  );
}

#[test]
fn clean_reports_artifacts_without_deleting_by_default() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // target/ is git-ignored ⇒ deletable, so the dry-run preview counts it and
  // prompts to re-run — but report-only must not actually delete it.
  fs::write(wt.join(".gitignore"), "/target\n").unwrap();
  fs::create_dir_all(wt.join("target")).unwrap();
  fs::write(wt.join("target").join("blob.bin"), vec![0u8; 4096]).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("target"))
    .stdout(predicate::str::contains("re-run with --yes"));

  assert!(wt.join("target").exists(), "report-only mode must not delete anything");
}

#[test]
fn clean_preview_excludes_non_deletable_dirs_from_total() {
  // A non-ignored dist/ must not be counted as reclaimable nor trigger the
  // "re-run with --yes" promise — the preview must match what --yes would do.
  let (dir, _base, wt) = repo_with_one_worktree();
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("keep.txt"), b"hand-authored").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"))
    .stdout(predicate::str::contains("nothing to reclaim"))
    .stdout(predicate::str::contains("re-run with --yes").not());
}

#[test]
fn clean_yes_deletes_gitignored_artifacts() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // target/ is ignored ⇒ safe to reclaim.
  fs::write(wt.join(".gitignore"), "/target\n").unwrap();
  fs::create_dir_all(wt.join("target")).unwrap();
  fs::write(wt.join("target").join("blob.bin"), vec![0u8; 4096]).unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("reclaimed"));

  assert!(
    !wt.join("target").exists(),
    "a git-ignored target/ should be deleted with --yes"
  );
}

#[test]
fn clean_yes_refuses_to_delete_non_ignored_artifacts() {
  let (dir, _base, wt) = repo_with_one_worktree();
  // dist/ is NOT ignored (no matching rule) and holds hand-authored content;
  // the safety gate must skip it rather than destroy it.
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("keep.txt"), b"non-regenerable work").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"));

  assert!(wt.join("dist").exists(), "a non-ignored dist/ must be preserved");
  assert!(
    wt.join("dist").join("keep.txt").exists(),
    "hand-authored content under a non-ignored dir must survive --yes"
  );
}

#[test]
fn clean_yes_refuses_ignored_dir_holding_tracked_files() {
  // git tracks files, not directories: a `dist/` ignore rule can coexist with
  // a force-added, committed `dist/index.html`. `check-ignore dist` succeeds,
  // but the dir holds tracked work — the gate must still skip it.
  let (dir, _base, wt) = repo_with_one_worktree();
  fs::write(wt.join(".gitignore"), "/dist\n").unwrap();
  fs::create_dir_all(wt.join("dist")).unwrap();
  fs::write(wt.join("dist").join("index.html"), b"tracked output").unwrap();
  // Force-track the file despite the ignore rule.
  std::process::Command::new("git")
    .current_dir(&wt)
    .args(["add", "-f", "dist/index.html"])
    .status()
    .expect("git add -f");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--yes"])
    .assert()
    .success()
    .stdout(predicate::str::contains("skipped"))
    .stdout(predicate::str::contains("dist"));

  assert!(
    wt.join("dist").join("index.html").exists(),
    "a tracked file under an ignored dir must survive --yes"
  );
}

/// Run `git <args>` in `dir`, asserting success — fixture setup helper.
fn git_at(dir: &Path, args: &[&str]) {
  // Pin signing off so a developer with `commit.gpgsign=true` (or a missing
  // signing key) in their ambient git config doesn't make these fixtures fail
  // before `gwm` is even exercised (#326 review).
  let ok = std::process::Command::new("git")
    .current_dir(dir)
    .args(["-c", "commit.gpgsign=false", "-c", "tag.gpgsign=false"])
    .args(args)
    .status()
    .unwrap()
    .success();
  assert!(ok, "git {args:?} in {} failed", dir.display());
}

/// A workspace root with two child repos (`alpha`, `beta`), each carrying one
/// non-main linked worktree at `<root>/alpha-wt` / `<root>/beta-wt`. `discover`
/// collapses each worktree onto its owning repo, so the workspace has exactly
/// the two repos and `exec`/`clean` fan out over their worktrees.
fn workspace_with_worktrees() -> tempfile::TempDir {
  let root = tempfile::TempDir::new().unwrap();
  for (repo, wt) in [("alpha", "alpha-wt"), ("beta", "beta-wt")] {
    let repo_dir = root.path().join(repo);
    std::fs::create_dir_all(&repo_dir).unwrap();
    git_at(&repo_dir, &["init", "-b", "main"]);
    git_at(&repo_dir, &["config", "user.email", "t@t.t"]);
    git_at(&repo_dir, &["config", "user.name", "t"]);
    std::fs::write(repo_dir.join("README.md"), "x").unwrap();
    git_at(&repo_dir, &["add", "."]);
    git_at(&repo_dir, &["commit", "-m", "init"]);
    let wt_path = root.path().join(wt);
    git_at(
      &repo_dir,
      &["worktree", "add", "-b", "feat/x", wt_path.to_str().unwrap()],
    );
  }
  root
}

/// A workspace root with two child repos that have ONLY their main checkout
/// (no linked worktrees) — so exec/clean fan-out finds no targets anywhere.
fn workspace_main_only() -> tempfile::TempDir {
  let root = tempfile::TempDir::new().unwrap();
  for repo in ["alpha", "beta"] {
    let repo_dir = root.path().join(repo);
    std::fs::create_dir_all(&repo_dir).unwrap();
    git_at(&repo_dir, &["init", "-b", "main"]);
    git_at(&repo_dir, &["config", "user.email", "t@t.t"]);
    git_at(&repo_dir, &["config", "user.name", "t"]);
    std::fs::write(repo_dir.join("README.md"), "x").unwrap();
    git_at(&repo_dir, &["add", "."]);
    git_at(&repo_dir, &["commit", "-m", "init"]);
  }
  root
}

// `gwm exec` / `gwm clean` now FAN OUT across a workspace's child repos under
// `--workspace <root>` (issue #326), reversing the #319 deferral. This is an
// additive transition — a previous refusal turning into a success is not a
// breaking change. These tests pin the fan-out: a repo-tagged rollup/report
// across every child repo, with an aggregated exit code. The `--workspace`
// refusal now only applies to commands that still don't implement it (covered
// by `workspace_refuses_unsupported_subcommand` below).

#[test]
fn exec_fans_out_across_workspace_child_repos() {
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "sh", "-c", "echo ran > ws_exec_marker.txt"])
    .assert()
    .success()
    // A `══ <repo>` header per child repo, and a repo-tagged rollup.
    .stdout(predicate::str::contains("══ alpha"))
    .stdout(predicate::str::contains("══ beta"))
    .stdout(predicate::str::contains("✓ alpha/"))
    .stdout(predicate::str::contains("✓ beta/"));
  // The command actually ran in each child repo's worktree.
  assert!(root.path().join("alpha-wt/ws_exec_marker.txt").exists());
  assert!(root.path().join("beta-wt/ws_exec_marker.txt").exists());
}

#[test]
fn exec_workspace_scopes_to_a_matching_slug() {
  // A slug matching a worktree in only one child repo scopes the fan-out to
  // that repo (the others contribute nothing — not an error).
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["alpha-wt", "--", "sh", "-c", "echo hi > scoped.txt"])
    .assert()
    .success();
  assert!(root.path().join("alpha-wt/scoped.txt").exists(), "alpha matched");
  assert!(
    !root.path().join("beta-wt/scoped.txt").exists(),
    "beta did not match the slug"
  );
}

#[test]
fn exec_workspace_scoped_slug_ignores_an_unrelated_repos_missing_profile() {
  // Only `alpha` defines `[exec.profiles.fmt]`; `beta` has none. Scoping to
  // `alpha-wt` must not resolve `beta`'s config (it contributes no target), so
  // the run succeeds despite `beta` lacking the profile (#326 review).
  let root = workspace_with_worktrees();
  std::fs::write(
    root.path().join("alpha/.gwm.toml"),
    "[exec.profiles.fmt]\ncommand = [\"sh\", \"-c\", \"echo hi > prof.txt\"]\n",
  )
  .unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["alpha-wt", "--profile", "fmt"])
    .assert()
    .success();
  assert!(root.path().join("alpha-wt/prof.txt").exists(), "alpha's profile ran");
}

#[test]
fn exec_workspace_errors_on_a_slug_matching_no_child_repo() {
  // A typo that matches nothing in ANY child repo is an error, not a silent
  // exit-0 having run nothing (#326 review).
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["ghost-typo", "--", "true"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("ghost-typo"));
}

#[test]
fn exec_workspace_aggregates_a_nonzero_exit() {
  let root = workspace_with_worktrees();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "sh", "-c", "exit 3"])
    .assert()
    .failure()
    .stdout(predicate::str::contains("✗ alpha/"))
    .stdout(predicate::str::contains("✗ beta/"));
}

#[test]
fn clean_fans_out_across_workspace_child_repos() {
  let root = workspace_with_worktrees();
  // A git-ignored `target/` in each child repo's worktree is reclaimable.
  for (repo, wt) in [("alpha", "alpha-wt"), ("beta", "beta-wt")] {
    let _ = repo;
    let wtdir = root.path().join(wt);
    std::fs::create_dir_all(wtdir.join("target")).unwrap();
    std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
    std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  }
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .assert()
    .success()
    // Report is repo-tagged; report-only must not delete.
    .stdout(predicate::str::contains("alpha/"))
    .stdout(predicate::str::contains("beta/"))
    .stdout(predicate::str::contains("re-run with --yes"));
  assert!(
    root.path().join("alpha-wt/target").exists(),
    "report-only keeps target/"
  );
}

#[test]
fn clean_workspace_yes_deletes_in_every_child_repo() {
  let root = workspace_with_worktrees();
  for wt in ["alpha-wt", "beta-wt"] {
    let wtdir = root.path().join(wt);
    std::fs::create_dir_all(wtdir.join("target")).unwrap();
    std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
    std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  }
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .arg("--yes")
    .assert()
    .success()
    .stdout(predicate::str::contains("reclaimed"));
  assert!(!root.path().join("alpha-wt/target").exists());
  assert!(!root.path().join("beta-wt/target").exists());
}

#[test]
fn clean_workspace_errors_before_deleting_on_a_corrupt_child_repo() {
  // A child that looks like a repo (.git present) but won't open must fail the
  // whole fan-out BEFORE any deletion — not be silently skipped while the valid
  // repos get cleaned (#326 review).
  let root = workspace_with_worktrees();
  let wtdir = root.path().join("alpha-wt");
  std::fs::create_dir_all(wtdir.join("target")).unwrap();
  std::fs::write(wtdir.join("target/blob.bin"), vec![0u8; 4096]).unwrap();
  std::fs::write(wtdir.join(".gitignore"), "/target\n").unwrap();
  let corrupt = root.path().join("corrupt");
  std::fs::create_dir_all(&corrupt).unwrap();
  std::fs::write(corrupt.join(".git"), "gitdir: /nonexistent-gitdir\n").unwrap();

  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .arg("--yes")
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("corrupt"));
  // The valid repo's reclaimable target/ survives — nothing was deleted.
  assert!(wtdir.join("target").exists(), "fan-out must fail before any deletion");
}

#[test]
fn exec_workspace_all_empty_errors_on_a_missing_command() {
  // Every repo is main-only (no targets), but a usage error (neither inline
  // command nor --profile) must still surface, not a silent exit 0 (#326 rev).
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("provide a command"));
}

#[test]
fn exec_workspace_all_empty_errors_on_an_unknown_profile() {
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--profile", "ghost"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn exec_workspace_all_empty_inline_command_exits_zero() {
  // A valid inline command with no targets anywhere is "nothing to do", exit 0.
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["exec", "--workspace"])
    .arg(root.path())
    .args(["--", "true"])
    .assert()
    .success()
    .stdout(predicate::str::contains("no worktrees to run in"));
}

#[test]
fn clean_workspace_all_empty_errors_on_an_unknown_profile() {
  // A typo'd `--profile` with no targets anywhere must surface, not silently
  // report "nothing to reclaim" (#326 review).
  let root = workspace_main_only();
  Command::cargo_bin("gwm")
    .unwrap()
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["clean", "--workspace"])
    .arg(root.path())
    .args(["--profile", "ghost", "--yes"])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("no profile named `ghost`"));
}

#[test]
fn workspace_refuses_a_still_unsupported_subcommand() {
  // `--workspace` is still refused on commands that don't implement it (only
  // list/create/exec/clean and the bare TUI do).
  let (dir, _base, _wt) = repo_with_one_worktree();
  let ws = tempfile::TempDir::new().unwrap();
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["sync", "--workspace", ws.path().to_str().unwrap()])
    .assert()
    .failure()
    .code(1)
    .stderr(predicate::str::contains("--workspace is only supported"));
}

// -- gwm agents (issue #408, US4) ------------------------------------------
//
// Detection is hermetic here: GWM_AGENTS_HOME points every scan at a seeded
// TempDir, so no test depends on the runner's real home or installed agents.

mod agents_cmd {
  use super::*;
  use common::init_repo;
  use std::path::Path;

  /// Seed a codex session recorded at `cwd` under `home`.
  fn seed_codex(home: &Path, cwd: &Path, sid: &str) {
    let dir = home
      .join(".codex/sessions")
      .join(gwm::agent_sessions::codex_day_dir(std::time::SystemTime::now()));
    std::fs::create_dir_all(&dir).unwrap();
    // Windows paths carry backslashes — escape them or the JSON line is
    // invalid and the session is silently dropped.
    let cwd = cwd.display().to_string().replace('\\', "\\\\");
    let line = format!(
      r#"{{"timestamp":"2026-07-22T10:00:00.000Z","type":"session_meta","payload":{{"session_id":"{sid}","cwd":"{cwd}"}}}}"#,
    );
    std::fs::write(dir.join(format!("rollout-{sid}.jsonl")), format!("{line}\n")).unwrap();
  }

  fn gwm_in(dir: &Path, home: &Path) -> Command {
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd.current_dir(dir).env("GWM_AGENTS_HOME", home);
    cmd
  }

  #[test]
  fn opencode_db_sessions_are_read_without_a_sqlite3_cli() {
    // Codex review round I (P1): Windows rarely ships a `sqlite3` CLI, so
    // shelling out silently degraded every opencode ≥ 1.x install to the
    // dead legacy JSON. The db must be read in-process — strip PATH so any
    // external sqlite3 is unreachable and the session must still surface.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    let dir = home.path().join(".local/share/opencode");
    std::fs::create_dir_all(dir.join("storage/project")).unwrap();
    let now_ms = std::time::SystemTime::now()
      .duration_since(std::time::SystemTime::UNIX_EPOCH)
      .unwrap()
      .as_millis() as i64;
    let conn = rusqlite::Connection::open(dir.join("opencode.db")).unwrap();
    conn
      .execute_batch(
        "CREATE TABLE session (id text, parent_id text, directory text, title text, time_updated integer, time_archived integer);",
      )
      .unwrap();
    conn
      .execute(
        "INSERT INTO session VALUES (?1, NULL, ?2, ?3, ?4, NULL)",
        rusqlite::params![
          "oc-nocli",
          repo_dir.path().display().to_string(),
          "db without cli",
          now_ms
        ],
      )
      .unwrap();
    drop(conn);

    gwm_in(repo_dir.path(), home.path())
      .env("PATH", "")
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("opencode"))
      .stdout(predicate::str::contains("db without cli"));
  }

  #[test]
  fn attach_resolves_exact_names_before_substrings() {
    // Codex review round K (P2): the agents worktree matcher did a bare
    // case-sensitive substring match, so with worktrees `foo` and
    // `foo-extra`, `gwm agents attach foo <id>` errored as ambiguous
    // instead of selecting the exact name — `find_fuzzy`'s tiering (exact
    // name, exact id, then case-insensitive substring) applies here too.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    let side = tempfile::TempDir::new().unwrap();
    let foo = side.path().join("foo");
    let foo_extra = side.path().join("foo-extra");
    git_at(
      repo_dir.path(),
      &["worktree", "add", "-b", "b-foo", foo.to_str().unwrap()],
    );
    git_at(
      repo_dir.path(),
      &["worktree", "add", "-b", "b-foo-extra", foo_extra.to_str().unwrap()],
    );
    seed_codex(home.path(), &foo, "ffff-exact");

    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "attach", "foo", "ffff-exact"])
      .assert()
      .success();
  }

  #[test]
  fn opencode_detection_honors_xdg_data_home() {
    // Codex review round O (P2): with `XDG_DATA_HOME` set, opencode keeps
    // `opencode.db` under `$XDG_DATA_HOME/opencode` — the hardcoded
    // `~/.local/share` base made every session invisible there. No
    // GWM_AGENTS_HOME here: the seam deliberately IGNORES XDG (round T),
    // so the XDG resolution is exercised against the real-home path — the
    // assertions only require the seeded session to be present, ambient
    // sessions from the machine's own stores may appear alongside.
    let (repo_dir, _repo) = init_repo();
    let xdg = tempfile::TempDir::new().unwrap();
    let dir = xdg.path().join("opencode");
    std::fs::create_dir_all(dir.join("storage/project")).unwrap();
    let now_ms = std::time::SystemTime::now()
      .duration_since(std::time::SystemTime::UNIX_EPOCH)
      .unwrap()
      .as_millis() as i64;
    let conn = rusqlite::Connection::open(dir.join("opencode.db")).unwrap();
    conn
      .execute_batch(
        "CREATE TABLE session (id text, parent_id text, directory text, title text, time_updated integer, time_archived integer);",
      )
      .unwrap();
    conn
      .execute(
        "INSERT INTO session VALUES (?1, NULL, ?2, ?3, ?4, NULL)",
        rusqlite::params!["oc-xdg", repo_dir.path().display().to_string(), "xdg session", now_ms],
      )
      .unwrap();
    drop(conn);

    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd
      .current_dir(repo_dir.path())
      .env_remove("GWM_AGENTS_HOME")
      .env("XDG_DATA_HOME", xdg.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("opencode"))
      .stdout(predicate::str::contains("xdg session"));
  }

  #[test]
  fn gwm_agents_home_beats_an_inherited_xdg_data_home() {
    // Codex review round T (P2): with GWM_AGENTS_HOME isolating a run but
    // an absolute XDG_DATA_HOME inherited from the environment, the
    // opencode scan followed XDG into the REAL machine store — the seam
    // must win for every backend or tests and the documented override
    // become machine-dependent.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    let xdg = tempfile::TempDir::new().unwrap(); // absolute, and NOT the seam
    let dir = home.path().join(".local/share/opencode");
    std::fs::create_dir_all(dir.join("storage/project")).unwrap();
    let now_ms = std::time::SystemTime::now()
      .duration_since(std::time::SystemTime::UNIX_EPOCH)
      .unwrap()
      .as_millis() as i64;
    let conn = rusqlite::Connection::open(dir.join("opencode.db")).unwrap();
    conn
      .execute_batch(
        "CREATE TABLE session (id text, parent_id text, directory text, title text, time_updated integer, time_archived integer);",
      )
      .unwrap();
    conn
      .execute(
        "INSERT INTO session VALUES (?1, NULL, ?2, ?3, ?4, NULL)",
        rusqlite::params!["oc-seam", repo_dir.path().display().to_string(), "seam wins", now_ms],
      )
      .unwrap();
    drop(conn);

    gwm_in(repo_dir.path(), home.path())
      .env("XDG_DATA_HOME", xdg.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("seam wins"));
  }

  #[test]
  fn agents_lists_detected_sessions_per_worktree() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "0000-cafe");

    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("codex"))
      .stdout(predicate::str::contains("0000-cafe"))
      .stdout(predicate::str::contains("active"))
      // Codex review round A: the human listing must also carry the last
      // activity (spec US4) — a relative form like "0m ago".
      .stdout(predicate::str::contains("ago"));
  }

  #[test]
  fn list_hides_the_agent_column_without_any_detected_session() {
    // Codex review round D: with no agent tooling / no session, the human
    // table must be byte-identical to the pre-#408 layout — no AGENT
    // header squeezing NAME/BRANCH/PATH.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();

    gwm_in(repo_dir.path(), home.path())
      .arg("list")
      .assert()
      .success()
      .stdout(predicate::str::contains("AGENT").not());
  }

  #[test]
  fn list_shows_the_agent_column_when_a_session_is_detected() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "1111-cafe");

    gwm_in(repo_dir.path(), home.path())
      .arg("list")
      .assert()
      .success()
      .stdout(predicate::str::contains("AGENT"))
      .stdout(predicate::str::contains("codex"));
  }

  #[test]
  fn agents_lists_unmatched_sessions_in_a_dedicated_section() {
    // Codex review round C: the attach error says "run `gwm agents` to see
    // the detected ids", so a session matched to NO worktree — precisely
    // the one worth attaching — must be listed too, under `unmatched`.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), Path::new("/somewhere/else"), "9999-lost");

    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("unmatched"))
      .stdout(predicate::str::contains("9999-lost"));
  }

  #[test]
  fn agents_omits_the_unmatched_section_when_every_session_is_matched() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "0000-cafe");

    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("unmatched").not());
  }

  #[test]
  fn agents_listing_prefers_the_session_name_when_present() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    let dir = home
      .path()
      .join(".codex/sessions")
      .join(gwm::agent_sessions::codex_day_dir(std::time::SystemTime::now()));
    std::fs::create_dir_all(&dir).unwrap();
    let cwd = repo_dir.path().display().to_string().replace('\\', "\\\\");
    let meta = format!(r#"{{"type":"session_meta","payload":{{"session_id":"named-1","cwd":"{cwd}"}}}}"#);
    let user = r#"{"type":"event_msg","payload":{"type":"user_message","message":"refactor the login flow"}}"#;
    std::fs::write(
      dir.join("rollout-named.jsonl"),
      format!(
        "{meta}
{user}
"
      ),
    )
    .unwrap();

    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      // Name shown alongside the (full) id — both visible, the id is what
      // attach takes.
      .stdout(predicate::str::contains("refactor the login flow"))
      .stdout(predicate::str::contains("named-1"));
  }

  #[test]
  fn pinned_marker_is_scoped_to_the_pinned_worktree_only() {
    // Codex review round A: a session detected on worktree A but pinned on
    // B must be flagged "pinned" only under B.
    let (repo_dir, repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    // Session recorded on the MAIN checkout path (detected on A).
    seed_codex(home.path(), repo_dir.path(), "4444-cafe");
    // A second worktree B to pin onto.
    let wt_b = repo_dir.path().join("wt-b");
    {
      let head = repo.head().unwrap().peel_to_commit().unwrap();
      repo.branch("feat/b", &head, false).unwrap();
      let mut opts = git2::WorktreeAddOptions::new();
      let branch = repo.find_branch("feat/b", git2::BranchType::Local).unwrap();
      opts.reference(Some(branch.get()));
      repo.worktree("wt-b", &wt_b, Some(&opts)).unwrap();
    }
    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "attach", "wt-b", "4444-cafe"])
      .assert()
      .success();

    let out = gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    let text = String::from_utf8_lossy(&out);
    // Split per worktree block: the main checkout's block must NOT carry
    // "pinned"; wt-b's block must.
    let blocks: Vec<&str> = text.split("\n\n").collect();
    let _ = blocks; // block layout is free; assert line-wise instead:
    let pinned_lines: Vec<&str> = text.lines().filter(|l| l.contains("pinned")).collect();
    assert_eq!(pinned_lines.len(), 1, "exactly one pinned line, got: {text}");
  }

  #[test]
  fn attach_accumulates_pins_and_detach_removes_one_or_all() {
    // User feedback 2026-07-22: several agents can work one worktree —
    // attach ADDS a pin, `detach <wt> <id>` removes that one, bare
    // `detach <wt>` clears them all.
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "aaaa-multi");
    seed_codex(home.path(), repo_dir.path(), "bbbb-multi");

    for sid in ["aaaa-multi", "bbbb-multi"] {
      gwm_in(repo_dir.path(), home.path())
        .args(["agents", "attach", ".", sid])
        .assert()
        .success();
    }
    let out = gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    let text = String::from_utf8_lossy(&out);
    let pinned = text.lines().filter(|l| l.contains("pinned")).count();
    assert_eq!(pinned, 2, "both pins marked, got: {text}");

    // Targeted detach removes exactly one pin.
    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "detach", ".", "aaaa-multi"])
      .assert()
      .success();
    let out = gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    let text = String::from_utf8_lossy(&out);
    assert_eq!(text.lines().filter(|l| l.contains("pinned")).count(), 1, "got: {text}");
    assert!(
      text.lines().any(|l| l.contains("bbbb-multi") && l.contains("pinned")),
      "the other pin survives: {text}"
    );

    // Bare detach clears the rest.
    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "detach", "."])
      .assert()
      .success();
    let out = gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    assert!(!String::from_utf8_lossy(&out).contains("pinned"));
  }

  #[test]
  fn workspace_list_table_carries_the_agent_column() {
    // Codex review round A: `gwm list --workspace` (human table) must show
    // AGENT like the single-repo table — and like it, only when a session
    // was actually detected (round D conditional).
    let root = workspace_with_worktrees();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), &root.path().join("alpha-wt"), "aaaa-ws");
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd
      .current_dir(root.path())
      .env("GWM_AGENTS_HOME", home.path())
      .args(["list", "--workspace", "."])
      .assert()
      .success()
      .stdout(predicate::str::contains("AGENT"))
      .stdout(predicate::str::contains("codex"));
  }

  #[test]
  fn workspace_list_table_hides_the_agent_column_without_sessions() {
    let root = workspace_with_worktrees();
    let home = tempfile::TempDir::new().unwrap();
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd
      .current_dir(root.path())
      .env("GWM_AGENTS_HOME", home.path())
      .args(["list", "--workspace", "."])
      .assert()
      .success()
      .stdout(predicate::str::contains("AGENT").not())
      // Codex review round E: the DATA rows must drop the 8-wide `-`
      // placeholder cell too, not just the header — otherwise the table
      // grows a headerless column that shifts PATH.
      .stdout(predicate::str::is_match(r"clean\s+-\s+/").unwrap().not());
  }

  #[test]
  fn workspace_listings_honor_per_repo_pins() {
    // Codex review round I (P2): a session pinned in a child repo vanished
    // from every workspace surface — the workspace pass handed detection an
    // empty pin list instead of opening each row's owning repo.
    let root = workspace_with_worktrees();
    let home = tempfile::TempDir::new().unwrap();
    // Recorded OUTSIDE any workspace path: only the pin can surface it.
    seed_codex(home.path(), &home.path().join("elsewhere"), "cccc-wspin");
    let alpha_wt = root.path().join("alpha-wt");
    Command::cargo_bin("gwm")
      .unwrap()
      .current_dir(&alpha_wt)
      .env("GWM_AGENTS_HOME", home.path())
      .args(["agents", "attach", ".", "cccc-wspin"])
      .assert()
      .success();

    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd
      .current_dir(root.path())
      .env("GWM_AGENTS_HOME", home.path())
      .args(["list", "--workspace", ".", "--format=json"])
      .assert()
      .success()
      .stdout(predicate::str::contains("cccc-wspin"));
    // Human table too: the pinned session drives the AGENT column.
    let mut cmd = Command::cargo_bin("gwm").unwrap();
    cmd
      .current_dir(root.path())
      .env("GWM_AGENTS_HOME", home.path())
      .args(["list", "--workspace", "."])
      .assert()
      .success()
      .stdout(predicate::str::contains("codex"));
  }

  #[test]
  fn agents_json_returns_the_wire_shape() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "1111-cafe");

    let out = gwm_in(repo_dir.path(), home.path())
      .args(["agents", "--format=json"])
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    let v: serde_json::Value = serde_json::from_slice(&out).expect("valid JSON");
    let rows = v.as_array().expect("array of worktrees");
    let with = rows
      .iter()
      .find(|r| r["agents"].is_object())
      .expect("one row carries agents");
    assert_eq!(with["agents"]["top"]["kind"], "codex");
    assert_eq!(with["agents"]["top"]["id"], "1111-cafe");
  }

  #[test]
  fn agents_with_nothing_detected_says_so_and_exits_zero() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("no agent session"));
  }

  #[test]
  fn attach_pins_an_unmatched_session_and_detach_restores_detection() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    // Session recorded elsewhere: pure detection matches nothing.
    seed_codex(home.path(), Path::new("/somewhere/else"), "2222-cafe");

    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "attach", ".", "2222-cafe"])
      .assert()
      .success()
      .stdout(predicate::str::contains("2222-cafe"));

    // The pin is honoured by `agents` AND by the list JSON surface.
    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("codex"))
      .stdout(predicate::str::contains("pinned"));
    let out = gwm_in(repo_dir.path(), home.path())
      .args(["list", "--format=json"])
      .assert()
      .success()
      .get_output()
      .stdout
      .clone();
    let v: serde_json::Value = serde_json::from_slice(&out).unwrap();
    assert!(
      v.as_array()
        .unwrap()
        .iter()
        .any(|r| r["agents"]["top"]["id"] == "2222-cafe"),
      "pinned session must ride the list JSON"
    );

    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "detach", "."])
      .assert()
      .success();
    // Codex review round C: with the pin gone the session is no longer
    // attributed to any worktree, but it stays discoverable — listed under
    // `unmatched` (unpinned) instead of vanishing from the output.
    gwm_in(repo_dir.path(), home.path())
      .arg("agents")
      .assert()
      .success()
      .stdout(predicate::str::contains("unmatched"))
      .stdout(predicate::str::contains("2222-cafe"))
      .stdout(predicate::str::contains("pinned").not());
  }

  #[test]
  fn attach_unknown_session_id_fails_with_a_hint() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    gwm_in(repo_dir.path(), home.path())
      .args(["agents", "attach", ".", "nope-nope"])
      .assert()
      .failure()
      .stderr(predicate::str::contains("gwm agents"));
  }

  #[test]
  fn plain_list_table_carries_the_agent_column() {
    let (repo_dir, _repo) = init_repo();
    let home = tempfile::TempDir::new().unwrap();
    seed_codex(home.path(), repo_dir.path(), "3333-cafe");
    gwm_in(repo_dir.path(), home.path())
      .arg("list")
      .assert()
      .success()
      .stdout(predicate::str::contains("AGENT"))
      .stdout(predicate::str::contains("codex"));
  }
}

#[test]
fn a_link_written_after_a_backend_flip_survives_the_next_command() {
  // The reconcile lives in `forge::resolve`, and `gwm link` did not
  // resolve. So after flipping `forge` the write succeeded against the
  // previous backend's marker, and the next command that *did* resolve
  // saw the mismatch and deleted what the user had just linked (Codex
  // review #458).
  //
  // `gwm open --print-url` brackets this rather than `gwm list`: the
  // network-free list never resolves a forge, so it neither records the
  // marker nor triggers the purge, and a test built on it would pass
  // against the bug.
  let (dir, repo) = init_repo();
  repo
    .remote("origin", "https://git.acme.internal/team/proj.git")
    .unwrap();
  let branch = repo.head().unwrap().shorthand().unwrap().to_string();

  let ledger = dir.path().join("trust.toml");
  let gwm = |args: &[&str]| {
    Command::cargo_bin("gwm")
      .unwrap()
      .current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("GWM_NO_GLOBAL_CONFIG", "1")
      .args(args)
      .assert()
      .success();
  };

  // `git.acme.internal` says nothing about which forge it runs, so the
  // backend is named explicitly on both sides of the flip — that is the
  // gate from `forge::resolve`, not part of what this test pins.
  fs::write(dir.path().join(".gwm.toml"), "forge = \"github\"\n").unwrap();
  gwm(&["trust", "add"]);
  // Record the GitHub backend against the repo.
  gwm(&["link", "issue", "7"]);
  gwm(&["open", "issue", "--print-url"]);

  fs::write(dir.path().join(".gwm.toml"), "forge = \"gitlab\"\n").unwrap();
  // `git.acme.internal` states no forge, so the repo's own `.gwm.toml`
  // is what names it — and that file ships with the repo, so it only
  // counts once the repo is approved. Editing it above changed its
  // hash, which is why this runs again here.
  gwm(&["trust", "add"]);
  gwm(&["link", "pr", "42"]);

  // Resolves as GitLab. Before the fix this purged the line above and
  // the command failed with "no PR linked".
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .args(["open", "pr", "--print-url"])
    .assert()
    .success()
    .stdout(predicate::str::contains("/-/merge_requests/42"));

  let reopened = git2::Repository::open(dir.path()).unwrap();
  assert_eq!(
    gwm::github::read_link(&reopened, &branch).unwrap().pr,
    Some(42),
    "the user linked this under the new backend; nothing may drop it"
  );
}

#[test]
fn a_repo_cannot_authorise_its_own_host_until_it_is_trusted() {
  // The hole three review rounds kept naming: `.gwm.toml` ships with the
  // repo, so letting its `forge` key point gwm at an unrecognised host
  // meant a hostile clone could aim `gh` / `glab` at its own server —
  // and whatever token the environment carries — from a plain
  // `gwm status` or a TUI selection (Codex review #458).
  //
  // Same ledger as `[[bootstrap.command]]`, because it is the same
  // decision about the same file. It is checked non-interactively, since
  // `forge::resolve` runs on the TUI's selection path; `gwm trust add`
  // is how the user answers.
  let (dir, repo) = init_repo();
  repo
    .remote("origin", "https://code.acme.internal/team/proj.git")
    .unwrap();
  fs::write(dir.path().join(".gwm.toml"), "forge = \"gitlab\"\n").unwrap();
  let ledger = dir.path().join("trust.toml");

  let run = |args: &[&str]| {
    let mut c = Command::cargo_bin("gwm").unwrap();
    c.current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("GWM_NO_GLOBAL_CONFIG", "1")
      .args(args);
    c.assert()
  };

  run(&["link", "issue", "7"]).success();
  run(&["open", "issue", "--print-url"])
    .failure()
    .stderr(predicate::str::contains("gwm trust add"));

  run(&["trust", "add"]).success();
  run(&["open", "issue", "--print-url"])
    .success()
    .stdout(predicate::str::contains("code.acme.internal"));

  // Approving covers the file as it was: editing it revokes that.
  fs::write(dir.path().join(".gwm.toml"), "forge = \"gitlab\"\n# changed\n").unwrap();
  run(&["open", "issue", "--print-url"]).failure();

  // And the escape hatch the rest of the trust surface already has,
  // for CI runners with no one to answer.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_TRUST_LEDGER", &ledger)
    .env("GWM_NO_GLOBAL_CONFIG", "1")
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["open", "issue", "--print-url"])
    .assert()
    .success();
}

#[test]
fn a_global_forge_kind_does_not_authorise_an_arbitrary_host() {
  // `forge = "gitlab"` in the user's own config says which *backend* they
  // use. It does not say which *hosts* may receive an authenticated call,
  // and reading it as though it did left the gate wide open for the most
  // ordinary setup there is: anyone working at a GitLab shop sets that key
  // once, and from then on every clone — including one whose `origin` an
  // attacker chose — got `glab` pointed at it.
  //
  // That is not theoretical. Verified against glab 1.109.0: with
  // `GITLAB_HOST` naming an arbitrary host, glab sends the ambient
  // `GITLAB_TOKEN` there as a `Private-Token` header, with no host
  // scoping of any kind. The repo does not even need a `.gwm.toml` —
  // the global value merges in on its own.
  let (dir, repo) = init_repo();
  repo
    .remote("origin", "https://code.acme.internal/team/proj.git")
    .unwrap();

  let xdg = tempfile::TempDir::new().unwrap();
  fs::create_dir_all(xdg.path().join("gwm")).unwrap();
  fs::write(xdg.path().join("gwm").join("config.toml"), "forge = \"gitlab\"\n").unwrap();
  let ledger = dir.path().join("trust.toml");

  let run = |args: &[&str]| {
    let mut c = Command::cargo_bin("gwm").unwrap();
    c.current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("XDG_CONFIG_HOME", xdg.path())
      .env_remove("GWM_NO_GLOBAL_CONFIG")
      .args(args);
    c.assert()
  };

  // Link first, so the refusal below can only come from the gate. Without
  // it the command stops at "no issue linked" and the test passes while
  // the host is still being authorised.
  run(&["link", "issue", "7"]).success();
  run(&["open", "issue", "--print-url"])
    .failure()
    .stderr(predicate::str::contains("forge_hosts"));
}

#[test]
fn a_global_config_authorises_the_hosts_it_names_with_their_kind() {
  // The remedy, and the reason the kind lives *per host*: a shop with both
  // a self-hosted GitLab and a GitHub Enterprise cannot be described by a
  // single `forge` key. Naming each host with its own backend covers the
  // mixed fleet, and covers it declaratively — one entry per host, in a
  // file that never ships with a repo, so nothing a clone carries can add
  // to it.
  let xdg = tempfile::TempDir::new().unwrap();
  fs::create_dir_all(xdg.path().join("gwm")).unwrap();
  fs::write(
    xdg.path().join("gwm").join("config.toml"),
    // `Code.ACME.internal` deliberately mis-cased: hosts are compared
    // case-insensitively, like DNS and like `known_kind`, so a config that
    // spells the host the way a human would must still cover the origin.
    "[forge_hosts]\n\"Code.ACME.internal\" = \"gitlab\"\n\"ghe.acme.internal\" = \"github\"\n",
  )
  .unwrap();

  let case = |url: &str, want: &str| {
    let (dir, repo) = init_repo();
    repo.remote("origin", url).unwrap();
    let ledger = dir.path().join("trust.toml");
    Command::cargo_bin("gwm")
      .unwrap()
      .current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("XDG_CONFIG_HOME", xdg.path())
      .env_remove("GWM_NO_GLOBAL_CONFIG")
      .args(["link", "issue", "7"])
      .assert()
      .success();
    Command::cargo_bin("gwm")
      .unwrap()
      .current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("XDG_CONFIG_HOME", xdg.path())
      .env_remove("GWM_NO_GLOBAL_CONFIG")
      .args(["open", "issue", "--print-url"])
      .assert()
      .success()
      .stdout(predicate::str::contains(want));
  };

  // GitLab nests the issue under `/-/issues`, GitHub does not: the URL
  // shape is what proves the *kind* came from the host's own entry and
  // not from a shared default.
  case(
    "https://code.acme.internal/team/proj.git",
    "code.acme.internal/team/proj/-/issues/7",
  );
  case(
    "https://ghe.acme.internal/team/proj.git",
    "ghe.acme.internal/team/proj/issues/7",
  );
}

#[test]
fn approving_one_repo_does_not_approve_its_neighbour_on_the_same_host() {
  // The ledger is keyed on `(origin, sha256(.gwm.toml))`, and the `origin`
  // half has to identify the *repo*. Building it from `RemoteRef::web_origin`
  // degraded it to the *host*, so the pair collapsed to
  // `(https://code.acme.internal, <hash>)` — shared by every repo on that
  // host whose config hashes the same.
  //
  // That is not a corner case: `.gwm.toml` is normally a template copied
  // across a team's repos, so byte-identical files are the common shape. A
  // hostile repo could ship a sibling's config verbatim and inherit its
  // approval, which is exactly the capability the #419 gate exists to
  // withhold.
  let ledger = tempfile::TempDir::new().unwrap();
  let ledger = ledger.path().join("trust.toml");
  let config = "forge = \"gitlab\"\n";

  let make = |slug: &str| {
    let (dir, repo) = init_repo();
    repo
      .remote("origin", &format!("https://code.acme.internal/{slug}.git"))
      .unwrap();
    fs::write(dir.path().join(".gwm.toml"), config).unwrap();
    dir
  };
  let mine = make("team/mine");
  let theirs = make("team/theirs");

  let run = |dir: &tempfile::TempDir, args: &[&str]| {
    let mut c = Command::cargo_bin("gwm").unwrap();
    c.current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("GWM_NO_GLOBAL_CONFIG", "1")
      .args(args);
    c.assert()
  };

  run(&mine, &["link", "issue", "7"]).success();
  run(&theirs, &["link", "issue", "7"]).success();
  run(&mine, &["trust", "add"]).success();

  run(&mine, &["open", "issue", "--print-url"]).success();
  run(&theirs, &["open", "issue", "--print-url"])
    .failure()
    .stderr(predicate::str::contains("trust ledger"));
}

#[test]
fn trust_add_satisfies_the_gate_that_bootstrap_checks() {
  // `gwm trust add` printed `✓ trusted …` and `gwm create` in the same repo
  // still refused, because the two wrote and read different keys. One helper
  // now builds both, so approving a repo means the same thing everywhere.
  let (dir, repo) = init_repo();
  repo
    .remote("origin", "https://code.acme.internal/team/proj.git")
    .unwrap();
  fs::write(
    dir.path().join(".gwm.toml"),
    "forge = \"gitlab\"\n\n[[bootstrap.command]]\nname = \"noop\"\nrun = \"true\"\n",
  )
  .unwrap();
  let ledger = dir.path().join("trust.toml");

  let run = |args: &[&str]| {
    let mut c = Command::cargo_bin("gwm").unwrap();
    c.current_dir(dir.path())
      .env("GWM_TRUST_LEDGER", &ledger)
      .env("GWM_NO_GLOBAL_CONFIG", "1")
      .args(args);
    c.assert()
  };

  run(&["trust", "add"]).success();
  // Both gates, one approval: the forge host gate and the bootstrap gate.
  run(&["link", "issue", "7"]).success();
  run(&["open", "issue", "--print-url"]).success();
  run(&["bootstrap"]).success();
}

// --- create --name (issue #416) -----------------------------------------

#[test]
fn create_name_flag_appears_in_help() {
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["create", "--help"])
    .assert()
    .success()
    .stdout(predicate::str::contains("--name"));
}

/// The mode is chosen by an explicit flag, never inferred from how many
/// positionals were supplied — two of the three is a typo, not a request
/// for free-form naming.
#[test]
fn create_rejects_a_partial_triple() {
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["create", "feat", "42"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("<DESC>").or(predicate::str::contains("required")));
}

#[test]
fn create_name_conflicts_with_the_structured_triple() {
  Command::cargo_bin("gwm")
    .unwrap()
    .args(["create", "--name", "spike-redis", "feat", "42", "x"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("cannot be used with").or(predicate::str::contains("conflict")));
}

#[test]
fn create_name_makes_a_worktree_whose_branch_is_the_name() {
  let (dir, repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "--name", "spike-redis"])
    .assert()
    .success()
    .stdout(predicate::str::contains("spike-redis"))
    .stdout(predicate::str::contains("worktree created"));

  // `path_pattern` is `{type}-{issue}-{desc}` in the test config and must
  // NOT have been applied — a free-form name has none of those tokens.
  let wt_dir = base.path().join("spike-redis");
  assert!(wt_dir.exists(), "worktree dir must be the name verbatim");
  assert!(
    repo.find_branch("spike-redis", git2::BranchType::Local).is_ok(),
    "the branch must be the name verbatim"
  );
}

#[test]
fn create_name_rejects_a_name_git_would_refuse() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  write_test_config(dir.path(), base.path());

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "--name", "has space"])
    .assert()
    .failure()
    .stderr(predicate::str::contains("has space"));
}

#[test]
fn commit_prefix_reads_a_branch_written_with_a_custom_pattern() {
  // Issue #417. `worktree.branch_pattern` drives `BranchSpec::branch_name`,
  // so a repo configured with `{type}-{issue}-{desc}` creates
  // `feat-41-foo` and every gwm surface that re-reads the branch has to
  // recognise it. The parser matched a hardcoded `<type>/#<issue>-<desc>`
  // instead, so the branch this very repo told gwm to create came back
  // unreadable: no gitmoji, no issue in the prefix.
  //
  // Slash-less is the point, not an edge case — `-` sits in neither the
  // type charset (`[a-z]+`) nor the issue charset (`\d+`), so the split is
  // unambiguous and there is no reason for it to fail.
  let (dir, _repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[worktree]\nbranch_pattern = \"{type}-{issue}-{desc}\"\n",
  )
  .expect("seed .gwm.toml");

  let mut cmd = Command::cargo_bin("gwm").unwrap();
  cmd
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat-41-foo"]);
  cmd
    .assert()
    .success()
    .stdout(predicate::str::contains(":sparkles: feat(#41):"));
}

#[test]
fn commit_prefix_never_echoes_control_bytes_from_the_branch_pattern() {
  // Codex review on PR #476. `branch_pattern` comes from a repo's `.gwm.toml`
  // and `gwm commit-prefix` does not go through the TOFU trust gate, so
  // running it inside a repo you have not vetted must stay safe. Both errors
  // #417 added quote the pattern, and quoting it raw hands an unvetted config
  // the same terminal escape channel (OSC 52 clipboard write, screen clear)
  // that `branch_pattern_warning` already neutralises.
  let (dir, _repo) = init_repo();
  // OSC 52 clipboard-write shape: ESC ] 52 ; c ; <payload> BEL
  std::fs::write(
    dir.path().join(".gwm.toml"),
    // TOML basic-string escapes: `\u001B` is ESC, `\u0007` is BEL. Written this
    // way rather than as raw bytes because TOML forbids control characters
    // inside a string, and a config that fails to parse would fall back to the
    // default pattern and quietly make this test vacuous.
    "[worktree]\nbranch_pattern = \"{type}/{desc}\\u001B]52;c;cHduZWQ=\\u0007\"\n",
  )
  .expect("seed .gwm.toml");

  // A branch that does not match, so the "does not match this pattern" error
  // fires and quotes the pattern.
  let assert = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "nothing-like-it"])
    .assert()
    .failure();
  let stderr = String::from_utf8_lossy(&assert.get_output().stderr).to_string();
  assert!(
    !stderr.chars().any(|c| c.is_control() && c != '\n'),
    "no control character may reach the terminal: {:?}",
    stderr
  );

  // …and the "carries no {issue}" error, which quotes it too.
  let assert = Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["commit-prefix", "--branch", "feat/x"])
    .assert()
    .failure();
  let stderr = String::from_utf8_lossy(&assert.get_output().stderr).to_string();
  assert!(
    !stderr.chars().any(|c| c.is_control() && c != '\n'),
    "the second error quotes the pattern too: {:?}",
    stderr
  );
}

#[test]
fn pr_falls_back_to_chore_when_the_pattern_carries_no_type() {
  // Codex review on PR #476, second pass. Before #417 the parser either
  // matched or returned `None`, so `unwrap_or_else(|| "chore")` covered every
  // branch with no readable type. #417 let a partial pattern parse and report
  // the segments it *does* carry, which hands `gwm pr` a `Some` holding an
  // empty type — and an empty type selects no `[pr_template.by_type]` entry
  // and renders `{type}` blank. The fallback has to survive the loosening.
  let (dir, repo) = init_repo();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    "[worktree]\nbranch_pattern = \"{issue}-{desc}\"\n\n\
     [pr_template.by_type.chore]\nbody = \"chore body for {desc} (#{issue})\\n\"\n",
  )
  .expect("seed .gwm.toml");
  make_feature_branch_with_commit(&repo, dir.path(), "42-tidy-up", "note.md", "x\n", "🔧 chore: tidy");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("chore body for tidy-up (#42)"));
}

// ---------------------------------------------------------------------
// Issue #477 — `worktree::discover_repo` walks back to the main working
// directory when it lands inside a linked worktree, which is right for
// every command operating on the whole worktree *set* (`list`, `remove`,
// `switch`, `prune`). Commands that instead ask "which branch am I on"
// were reading that handle's HEAD, so from inside a worktree they
// answered with the main checkout's branch.
//
// `gwm commit-prefix` is the one that hurts: the bundled `commit-msg`
// hook calls it, and git invokes that hook with the working directory
// inside the worktree, so committing from a worktree derived the prefix
// from whatever the main checkout happened to be sitting on.
//
// Pre-existing, measured against the published 1.5.0 binary in the issue
// and re-measured against this branch's build before the fix.
// ---------------------------------------------------------------------

/// The reproduction from the issue, as a test. `repo_with_one_worktree`
/// leaves the main checkout on its default branch and the worktree on
/// `feat/#1-wt`; before the fix this errored out saying the *main*
/// branch carried no type to read.
#[test]
fn commit_prefix_reads_the_branch_of_the_worktree_it_runs_in() {
  let (_dir, _base, wt) = repo_with_one_worktree();

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(&wt)
    .args(["commit-prefix", "--unicode"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat(#1):"));
}

/// Same handle, same defect, different symptom: `cmd_pr` falls back to
/// the `chore` template when the branch does not parse, so reading the
/// main checkout's branch surfaced as "no pr_template configured for
/// branch type 'chore'" rather than as a wrong branch name.
#[test]
fn pr_reads_the_branch_of_the_worktree_it_runs_in() {
  let (dir, _base, wt) = repo_with_one_worktree();
  let cfg = dir.path().join(".gwm.toml");
  let mut body = std::fs::read_to_string(&cfg).expect("seeded config");
  body.push_str("\n[pr_template.by_type.feat]\nbody = \"GWM_PROBE head={head} type={type} issue={issue}\\n\"\n");
  std::fs::write(&cfg, body).expect("append a template");

  // Selecting the `feat` entry at all is half the assertion: before the fix
  // the main checkout's branch did not parse, the type fell back to `chore`,
  // and this errored with "no pr_template configured for branch type
  // 'chore'". `{head}` then pins the branch itself, not just its type.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(&wt)
    .args(["pr", "--render"])
    .assert()
    .success()
    .stdout(predicate::str::contains("GWM_PROBE head=feat/#1-wt type=feat issue=1"));
}

/// 🔴 The over-correction guard. Only the *branch* comes from the
/// invoking checkout. `.gwm.toml`, the workdir and `worktree::repo_name`
/// all legitimately want the main repo, and `{repo}` is a legal token in
/// `branch_pattern`, so a fix that discovered from the current directory
/// everywhere would compile the parser with the *worktree directory's*
/// name and stop reading a branch gwm itself wrote.
///
/// Under `{type}/#{issue}-{desc}-{repo}` the worktree directory is named
/// `feat-1-wt` while the repo is not, so the two names cannot be
/// confused: this passes only if the parser was handed the main repo's.
///
/// `{repo}` sits at the end rather than leading the branch because
/// `init_repo` builds on `TempDir`, whose basename starts with `.` on
/// macOS, and git refuses a ref component that does. Inside a component
/// the same character is fine.
#[test]
fn only_the_branch_comes_from_the_worktree_the_repo_name_still_comes_from_the_main_checkout() {
  let (dir, _repo) = init_repo();
  let base = tempfile::TempDir::new().unwrap();
  let repo_name = dir.path().file_name().unwrap().to_string_lossy().to_string();
  std::fs::write(
    dir.path().join(".gwm.toml"),
    format!(
      "[worktree]\nbase = \"{base}\"\n\
       path_pattern = \"{{type}}-{{issue}}-{{desc}}\"\n\
       branch_pattern = \"{{type}}/#{{issue}}-{{desc}}-{{repo}}\"\n",
      base = toml_basic_string(base.path()),
    ),
  )
  .expect("seed .gwm.toml");

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["create", "feat", "1", "wt"])
    .assert()
    .success();
  let wt = base.path().join("feat-1-wt");
  assert!(
    wt.join(".git").exists(),
    "precondition: the worktree exists and is named after `path_pattern`, not the repo"
  );
  assert_ne!(
    repo_name, "feat-1-wt",
    "precondition: the two names differ, or the assertion below proves nothing"
  );

  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(&wt)
    .args(["commit-prefix", "--unicode"])
    .assert()
    .success()
    .stdout(predicate::str::contains("feat(#1):"));
}

/// The sweep the issue asked for ("worth checking whether the same
/// handle is used for anything else that is position-dependent") found a
/// third site with a *different* symptom: `cmd_bootstrap` never resolved
/// a branch at all unless the target came from a fuzzy pattern, so hooks
/// received an empty `{branch}` / `{type}` / `{issue}` rather than the
/// wrong one. Two of its three target paths were affected, measured
/// against this branch's build: no argument (the worktree is the CWD),
/// and an argument that is already a directory. Only the fuzzy path,
/// which reads the branch off the worktree record, was correct.
#[test]
fn bootstrap_gives_hooks_the_branch_of_the_worktree_it_targets() {
  let (dir, _base, wt) = repo_with_one_worktree();
  let cfg = dir.path().join(".gwm.toml");
  let mut body = std::fs::read_to_string(&cfg).expect("seeded config");
  body.push_str(
    "\n[[hooks.post_bootstrap]]\nname = \"probe\"\n\
     run = \"echo GWM_PROBE branch=[{branch}] type=[{type}] issue=[{issue}]\"\n",
  );
  std::fs::write(&cfg, body).expect("append a hook");

  let expected = "GWM_PROBE branch=[feat/#1-wt] type=[feat] issue=[1]";

  // No argument: the worktree is the current directory.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(&wt)
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .arg("bootstrap")
    .assert()
    .success()
    .stdout(predicate::str::contains(expected));

  // An argument that is already a directory, from the main checkout.
  // This one is not about where the command runs: the path was given
  // outright and its branch was simply never looked up.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .arg("bootstrap")
    .arg(&wt)
    .assert()
    .success()
    .stdout(predicate::str::contains(expected));

  // The fuzzy path already worked; it is here so a future change cannot
  // fix the two above by breaking the one that was right.
  Command::cargo_bin("gwm")
    .unwrap()
    .current_dir(dir.path())
    .env("GWM_ALLOW_BOOTSTRAP", "1")
    .args(["bootstrap", "feat-1"])
    .assert()
    .success()
    .stdout(predicate::str::contains(expected));
}