kono-wt 1.9.0

//! Command handlers (spec §7). Each module implements one subcommand; this
//! module provides the shared repository session setup and query resolution.

pub mod checkout;
pub mod complete;
pub mod completions;
pub mod config_cmd;
pub mod drop;
pub mod init;
pub mod issue;
pub mod list;
pub mod new;
pub mod path;
pub mod pr;
#[cfg(feature = "pr")]
pub mod pr_open;
pub mod prune;
pub mod remove;
pub mod root;
pub mod shell_init;
pub mod staleness;
pub mod status_cmd;
pub mod switch;
pub mod sync;

use std::path::{Path, PathBuf};

use crate::config::{Config, SubmoduleInit};
use crate::cx::Cx;
use crate::error::{Error, Result};
use crate::git::cli::GitCli;
use crate::git::discover::Repo;
use crate::hooks::{HookContext, HookRunner};
use crate::model::Worktree;
use crate::query::{self, Resolved};
use crate::worktree::{CreatedWorktree, HookOutcome, Workspace, WorkspaceParts, build_worktrees};

// Path/template helpers shared with the service layer, re-exported so command
// modules keep their historical import paths.
pub(crate) use crate::worktree::{resolve_target, rollback_worktree, same_path};

/// A discovered repository plus its resolved configuration, set up once per
/// repo-scoped command.
pub(crate) struct Session {
    /// The discovered repository (gix handle).
    pub(crate) repo: Repo,
    /// The primary worktree root (or bare repo path).
    pub(crate) primary_root: PathBuf,
    /// The merged configuration.
    pub(crate) config: Config,
}

impl Session {
    /// The borrowed parts view the worktree service functions take.
    pub(crate) fn parts<'a>(&'a self, env: &'a crate::cx::Env) -> WorkspaceParts<'a> {
        WorkspaceParts {
            repo: &self.repo,
            config: &self.config,
            root: &self.primary_root,
            env,
        }
    }
}

/// Discovers the repository from the context's working directory, resolves the
/// primary root via `git rev-parse`, and loads the merged configuration.
pub(crate) fn open_session(cx: &Cx, git: &dyn GitCli) -> Result<Session> {
    let ws = Workspace::discover(&cx.cwd, &cx.env, git)?;
    let (repo, primary_root, config) = ws.into_session_parts();
    Ok(Session {
        repo,
        primary_root,
        config,
    })
}

/// The outcome of resolving a query in a command handler.
pub(crate) enum Resolution {
    /// A unique worktree (its index).
    Found(usize),
    /// Ambiguous; candidates were listed to stderr (exit code `3`).
    Ambiguous,
    /// No match (the caller maps this to [`Error::NotFound`]).
    NotFound,
}

/// Resolves a query. On ambiguity at an interactive terminal (stderr is a TTY)
/// the TUI picker opens, pre-filtered to the query, and the chosen worktree is
/// returned; otherwise the candidate list is printed to stderr (exit code `3`).
/// Spec §7.
pub(crate) fn resolve_query(cx: &mut Cx, worktrees: &[Worktree], query: &str) -> Resolution {
    #[cfg(feature = "tui")]
    return resolve_query_with(cx, worktrees, query, |cx, q| {
        crate::tui::run_tui(cx, Some(q))
    });
    // Without the TUI there is no interactive picker; the erroring picker
    // routes ambiguity to the candidate listing (exit code 3).
    #[cfg(not(feature = "tui"))]
    resolve_query_with(cx, worktrees, query, |_, _| {
        Err(Error::operation("no interactive picker in this build"))
    })
}

/// [`resolve_query`] with an injectable picker, so the TTY fallback is testable
/// without a real terminal. `picker` returns the chosen worktree path, `None`
/// on cancel, or an error.
fn resolve_query_with(
    cx: &mut Cx,
    worktrees: &[Worktree],
    query: &str,
    picker: impl FnOnce(&mut Cx, &str) -> Result<Option<PathBuf>>,
) -> Resolution {
    match query::resolve(worktrees, query) {
        Resolved::One(index) => Resolution::Found(index),
        Resolved::Ambiguous(indices) => {
            if cx.err.is_tty() {
                match picker(cx, query) {
                    // Map the chosen path back to an index in the caller's slice.
                    // A miss (path not in this set) or a cancel emits nothing and
                    // falls through to `Ambiguous` (exit 3, no `cd`).
                    Ok(Some(path)) => worktrees
                        .iter()
                        .position(|w| same_path(&w.path, &path))
                        .map_or(Resolution::Ambiguous, Resolution::Found),
                    Ok(None) => Resolution::Ambiguous,
                    Err(_) => list_candidates(cx, worktrees, query, &indices),
                }
            } else {
                list_candidates(cx, worktrees, query, &indices)
            }
        }
        Resolved::NotFound => Resolution::NotFound,
    }
}

/// Prints the ambiguous-query candidate list to stderr and returns
/// [`Resolution::Ambiguous`].
fn list_candidates(
    cx: &mut Cx,
    worktrees: &[Worktree],
    query: &str,
    indices: &[usize],
) -> Resolution {
    let _ = cx
        .err
        .line(&format!("query {query:?} is ambiguous; candidates:"));
    for &index in indices {
        let _ = cx
            .err
            .line(&format!("  {}", candidate_label(&worktrees[index])));
    }
    Resolution::Ambiguous
}

/// A human label for a worktree in candidate/diagnostic lists.
pub(crate) fn candidate_label(worktree: &Worktree) -> String {
    match &worktree.branch {
        Some(branch) => branch.clone(),
        None => worktree.path.display().to_string(),
    }
}

/// Echoes `prompt` on stderr followed by the answer `-y`/`--yes` supplies, so a
/// non-interactive run still shows what was auto-accepted. Returns `true` when
/// [`Cx::assume_yes`] is set, in which case stdin is never read.
fn auto_yes(cx: &mut Cx, prompt: &str) -> Result<bool> {
    if !cx.assume_yes {
        return Ok(false);
    }
    cx.err.line(&format!("{prompt}y (--yes)"))?;
    Ok(true)
}

/// Prompts on stderr and reads a yes/no confirmation (default no). `--yes`
/// answers it without reading stdin.
pub(crate) fn confirm(cx: &mut Cx, prompt: &str) -> Result<bool> {
    if auto_yes(cx, prompt)? {
        return Ok(true);
    }
    cx.err.text(prompt)?;
    cx.err.flush()?;
    let line = cx.input.read_line()?;
    let answer = line.trim().to_ascii_lowercase();
    Ok(answer == "y" || answer == "yes")
}

/// Prompts on stderr and reads a yes/no confirmation (default *yes*): an empty
/// line or EOF counts as yes, so only an explicit `n`/`no` declines. Callers must
/// gate this on an interactive terminal or on `--yes` — a non-interactive EOF
/// would otherwise silently accept.
pub(crate) fn confirm_default_yes(cx: &mut Cx, prompt: &str) -> Result<bool> {
    if auto_yes(cx, prompt)? {
        return Ok(true);
    }
    cx.err.text(prompt)?;
    cx.err.flush()?;
    let line = cx.input.read_line()?;
    let answer = line.trim().to_ascii_lowercase();
    Ok(answer != "n" && answer != "no")
}

/// A three-way answer to the stale-base prompt (issue #56): update the base,
/// proceed off it as-is, or cancel.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub(crate) enum Choice {
    /// Update the base (fast-forward it to its upstream) before proceeding.
    Update,
    /// Proceed off the base as-is.
    Proceed,
    /// Abort the operation.
    Cancel,
}

/// Prompts on stderr for an update/proceed/cancel choice (issue #56). Anything
/// other than an explicit update/proceed — including an empty line or EOF — is
/// `Cancel`, so a non-interactive run defaults to the safe choice.
///
/// `--yes` answers [`Update`](Choice::Update): updating the base is the
/// affirmative reply to "the base is behind; update it?", and it is what lets a
/// scripted `wt new` proceed at all — without a flag the EOF would `Cancel`.
pub(crate) fn choose(cx: &mut Cx, prompt: &str) -> Result<Choice> {
    if cx.assume_yes {
        cx.err.line(&format!("{prompt}u (--yes)"))?;
        return Ok(Choice::Update);
    }
    cx.err.text(prompt)?;
    cx.err.flush()?;
    let line = cx.input.read_line()?;
    Ok(match line.trim().to_ascii_lowercase().as_str() {
        "u" | "update" => Choice::Update,
        "p" | "proceed" => Choice::Proceed,
        _ => Choice::Cancel,
    })
}

/// Initializes git submodules in `dir` when enabled, after a worktree is created
/// or a branch is checked out (issue #50). `flag_override` is the resolved
/// `--init-submodules`/`--no-init-submodules` choice and wins over `policy`;
/// without a flag, `policy` decides — only `[submodules] init = "always"` runs
/// here (`prompt`/`never` are skips, so this is the non-interactive fallback for
/// the [`Prompt`](SubmoduleInit::Prompt) default). Disabled is the common case
/// and costs nothing — no `git` runs. A failure is non-fatal: the worktree
/// already exists, so it is surfaced as a warning rather than propagated.
pub(crate) fn maybe_init_submodules(
    cx: &mut Cx,
    git: &dyn GitCli,
    dir: &Path,
    policy: SubmoduleInit,
    flag_override: Option<bool>,
    seed: bool,
) -> Result<()> {
    let enabled = flag_override.unwrap_or(matches!(policy, SubmoduleInit::Always));
    if !enabled {
        return Ok(());
    }
    let pending = crate::git::submodule::uninitialized(git, dir)?;
    if pending.is_empty() {
        return Ok(());
    }
    init_submodules(cx, git, dir, pending.len(), seed);
    Ok(())
}

/// Initializes git submodules in `dir`, prompting first at an interactive
/// terminal when the policy is left at its [`Prompt`](SubmoduleInit::Prompt)
/// default (no `--init-submodules`/`--no-init-submodules` flag). An explicit flag
/// or an `always`/`never` policy decides without a prompt, deferring to
/// [`maybe_init_submodules`]. `prompt` is the caller's interactivity gate (the
/// CLI passes `true`; the TUI passes `false` and handles its own modal), so a
/// prompt only fires for `prompt && stderr.is_tty()`. `--yes` answers it too —
/// the prompt defaults to yes, so a scripted `wt new -y` initializes submodules
/// where a bare non-interactive `wt new` leaves them alone. Non-fatal throughout.
pub(crate) fn maybe_init_submodules_interactive(
    cx: &mut Cx,
    git: &dyn GitCli,
    dir: &Path,
    policy: SubmoduleInit,
    flag_override: Option<bool>,
    prompt: bool,
    seed: bool,
) -> Result<()> {
    // An explicit flag or an always/never policy decides without asking.
    if flag_override.is_some() || !matches!(policy, SubmoduleInit::Prompt) {
        return maybe_init_submodules(cx, git, dir, policy, flag_override, seed);
    }
    // The Prompt default: ask interactively, or take `--yes` as the answer;
    // otherwise leave them be.
    if !(cx.assume_yes || (prompt && cx.err.is_tty())) {
        return Ok(());
    }
    let pending = crate::git::submodule::uninitialized(git, dir)?;
    if pending.is_empty() {
        return Ok(());
    }
    let ask = format!(
        "repository has {} uninitialized submodule(s); initialize recursively (`git submodule update --init --recursive`)? [Y/n] ",
        pending.len()
    );
    if confirm_default_yes(cx, &ask)? {
        init_submodules(cx, git, dir, pending.len(), seed);
    }
    Ok(())
}

/// Initializes the submodules in `dir`, logging a heads-up on stderr first
/// (never stdout — the `cd` path must stay clean) since a submodule clone can
/// block for a while. A failure is surfaced as a warning, not an error.
///
/// `seed` enables populating from the repository's own local object stores
/// before the stock pass; it cannot change the result, only the cost. When it
/// does work, the heads-up says so, because "initializing 200 submodule(s)…"
/// followed by an instant return is otherwise surprising.
fn init_submodules(cx: &mut Cx, git: &dyn GitCli, dir: &Path, count: usize, seed: bool) {
    let _ = cx.err.line(&format!("initializing {count} submodule(s)…"));
    let (report, result) = crate::git::submodule::populate(git, dir, seed);
    if !report.seeded.is_empty() {
        let _ = cx.err.line(&format!(
            "seeded {} submodule(s) from local object stores",
            report.seeded.len()
        ));
    }
    if let Err(e) = result {
        let _ = cx
            .err
            .line(&format!("warning: failed to initialize submodules: {e}"));
    }
}

/// Builds the [`Worktree`] row for `target` (for `--json` results).
pub(crate) fn build_target_row(cx: &Cx, target: &Path) -> Result<Worktree> {
    let git = cx.git.clone();
    let repo = Repo::discover(&cx.cwd)?;
    let worktrees = build_worktrees(&repo, git.as_ref())?;
    worktrees
        .into_iter()
        .find(|w| same_path(&w.path, target))
        .ok_or_else(|| Error::operation("created worktree not found"))
}

/// Logs the copy step's outcome to stderr at `-v` (spec §8: copied files and
/// files skipped because the target already exists are silent by default and
/// logged at verbose).
pub(crate) fn log_copy_outcome(cx: &mut Cx, outcome: &crate::copy::CopyOutcome) {
    if cx.verbose == 0 {
        return;
    }
    for path in &outcome.copied {
        let _ = cx.err.line(&format!("copied {}", path.display()));
    }
    for path in &outcome.skipped_existing {
        let _ = cx
            .err
            .line(&format!("skipped (target exists) {}", path.display()));
    }
}

/// How a navigation command hands its worktree back to the user (spec §5/§7).
pub(crate) struct Nav<'a> {
    /// Emit the worktree as a JSON row on stdout instead of a path.
    pub(crate) json: bool,
    /// Do not hand the path to the shell wrapper; report on stderr instead.
    pub(crate) no_switch: bool,
    /// The stderr note describing what happened, e.g. `"created worktree at"`.
    pub(crate) note: &'a str,
    /// The `--start` command to run inside the worktree, if any (issue #89).
    pub(crate) start: Option<&'a str>,
}

/// Finishes a navigation command: emits the result and, with `--start`, runs the
/// user's command inside the fully initialized worktree (issue #89).
///
/// Without `--start` this is [`emit_worktree`] verbatim. With it, stdout belongs
/// to the started command — it inherits `wt`'s stdio so an interactive tool gets a
/// real terminal — so the path cannot be printed there. It travels to the shell
/// wrapper through `$WT_CD_FILE` instead; see [`hand_path_to_shell`].
///
/// The path is handed over *before* the command runs, so a command that fails, or
/// that the user interrupts, still leaves the shell in the new worktree. The
/// command's exit code becomes `wt`'s.
///
/// `--start` and `--json` are mutually exclusive at the `clap` layer, so a
/// `Nav` never has both.
pub(crate) fn finish_worktree(
    cx: &mut Cx,
    runner: &dyn HookRunner,
    target: &Path,
    hook_ctx: &HookContext,
    nav: Nav<'_>,
) -> Result<u8> {
    let Some(command) = nav.start else {
        return emit_worktree(cx, target, nav.json, nav.no_switch, nav.note);
    };
    if !nav.no_switch {
        hand_path_to_shell(cx, target)?;
    }
    cx.err.line(&format!("{} {}", nav.note, target.display()))?;
    crate::hooks::run_start(runner, command, hook_ctx)
}

/// Reports the non-fatal outcomes of a completed creation: the copy step and
/// the `post_create` hook.
///
/// The hook already ran inside the service, where a failure is a warning rather
/// than a rollback (spec §8). Shared by `wt new` and `wt issue` so both report
/// the same way.
pub(crate) fn report_created(cx: &mut Cx, created: &CreatedWorktree) -> Result<()> {
    log_copy_outcome(cx, &created.copy);
    match &created.post_create {
        HookOutcome::ExitedNonZero(code) => {
            cx.err.line(&format!(
                "warning: post_create hook exited with status {code}"
            ))?;
        }
        HookOutcome::Failed(error) => {
            cx.err
                .line(&format!("warning: post_create hook failed: {error}"))?;
        }
        HookOutcome::Skipped | HookOutcome::Succeeded => {}
    }
    Ok(())
}

/// Writes `target` to the file named by `$WT_CD_FILE` so the shell wrapper can
/// `cd` there once `wt` exits (issue #89).
///
/// `wt` cannot change its parent shell's directory, which is why the wrapper
/// normally captures the path from stdout. Under `--start` stdout is the started
/// command's, so the wrapper passes a temp file instead. Nothing is written when
/// the variable is unset — `wt` was invoked without shell integration, and running
/// the command in the worktree is all a bare binary can do.
///
/// The exception is a *stale* wrapper: one that does not know `--start` still
/// captures stdout, which we detect as "stdout is not a terminal but stderr is".
/// That would silently swallow the command's output, so say so.
fn hand_path_to_shell(cx: &mut Cx, target: &Path) -> Result<()> {
    match cx.env.get("WT_CD_FILE").filter(|p| !p.is_empty()) {
        Some(cd_file) => Ok(std::fs::write(
            cd_file,
            target.to_string_lossy().as_bytes(),
        )?),
        None => {
            if cx.err.is_tty() && !cx.out.is_tty() {
                cx.err.line(
                    "warning: --start cannot return you to the worktree; your shell \
                     integration predates it. Re-run `wt shell-init <shell>`.",
                )?;
            }
            Ok(())
        }
    }
}

/// Emits a navigation result: JSON object, the bare path (for `cd`), or a stderr
/// note when `--no-switch` (spec §5/§7).
fn emit_worktree(
    cx: &mut Cx,
    target: &Path,
    json: bool,
    no_switch: bool,
    note: &str,
) -> Result<u8> {
    if json {
        let row = build_target_row(cx, target)?;
        cx.out.line(&row.to_json_line()?)?;
    } else if no_switch {
        cx.err.line(&format!("{note} {}", target.display()))?;
    } else {
        cx.out.line(&target.to_string_lossy())?;
    }
    Ok(0)
}

#[cfg(test)]
mod tests {
    use super::{Nav, Resolution, finish_worktree, resolve_query_with};
    use crate::cx::Stream;
    use crate::error::Result;
    use crate::hooks::{HookContext, HookRunner};
    use crate::model::Worktree;
    use crate::testutil::{SharedBuf, test_cx};
    use std::path::{Path, PathBuf};
    use std::sync::Mutex;

    /// A runner that records the command it was handed and returns a fixed code.
    struct FakeRunner {
        code: i32,
        last: Mutex<Option<String>>,
    }
    impl FakeRunner {
        fn new(code: i32) -> Self {
            Self {
                code,
                last: Mutex::new(None),
            }
        }
    }
    impl HookRunner for FakeRunner {
        fn run(&self, command: &str, _ctx: &HookContext) -> Result<i32> {
            *self.last.lock().unwrap() = Some(command.to_string());
            Ok(self.code)
        }
    }

    fn hook_ctx(dir: &Path) -> HookContext {
        HookContext {
            worktree_path: dir.to_path_buf(),
            branch: "feat/x".into(),
            repo_root: dir.to_path_buf(),
            base_ref: None,
            pr_number: None,
        }
    }

    /// Without `--start`, the path goes to stdout for the shell wrapper to `cd`.
    #[test]
    fn finish_worktree_without_start_prints_the_path() {
        let mut t = test_cx(&[], "/work");
        let target = PathBuf::from("/work/wt");
        let code = finish_worktree(
            &mut t.cx,
            &FakeRunner::new(0),
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: false,
                note: "created worktree at",
                start: None,
            },
        )
        .unwrap();
        assert_eq!(code, 0);
        assert_eq!(t.out.contents(), "/work/wt\n");
        assert!(t.err.contents().is_empty());
    }

    /// `--no-switch` reports on stderr and leaves stdout clean.
    #[test]
    fn finish_worktree_without_start_honors_no_switch() {
        let mut t = test_cx(&[], "/work");
        let target = PathBuf::from("/work/wt");
        finish_worktree(
            &mut t.cx,
            &FakeRunner::new(0),
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: true,
                note: "created worktree at",
                start: None,
            },
        )
        .unwrap();
        assert!(t.out.contents().is_empty());
        assert_eq!(t.err.contents(), "created worktree at /work/wt\n");
    }

    /// With `--start`, stdout belongs to the command: the path travels through
    /// `$WT_CD_FILE` and the command's exit code becomes `wt`'s.
    #[test]
    fn finish_worktree_with_start_writes_the_cd_file_and_propagates_the_code() {
        let dir = tempfile::tempdir().unwrap();
        let cd_file = dir.path().join("cd");
        let mut t = test_cx(&[("WT_CD_FILE", cd_file.to_str().unwrap())], "/work");
        let target = dir.path().to_path_buf();

        let runner = FakeRunner::new(3);
        let code = finish_worktree(
            &mut t.cx,
            &runner,
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: false,
                note: "created worktree at",
                start: Some("claude"),
            },
        )
        .unwrap();

        assert_eq!(code, 3);
        assert_eq!(runner.last.lock().unwrap().as_deref(), Some("claude"));
        assert_eq!(
            std::fs::read_to_string(&cd_file).unwrap(),
            target.to_string_lossy()
        );
        assert!(t.out.contents().is_empty(), "stdout is the command's");
        assert!(t.err.contents().contains("created worktree at"));
    }

    /// The cd file is written *before* the command runs, so a command that fails
    /// (or that the user interrupts) still leaves the shell in the worktree.
    #[test]
    fn finish_worktree_hands_over_the_path_even_when_the_command_fails() {
        let dir = tempfile::tempdir().unwrap();
        let cd_file = dir.path().join("cd");
        let mut t = test_cx(&[("WT_CD_FILE", cd_file.to_str().unwrap())], "/work");
        let target = dir.path().to_path_buf();
        let code = finish_worktree(
            &mut t.cx,
            &FakeRunner::new(1),
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: false,
                note: "created worktree at",
                start: Some("false"),
            },
        )
        .unwrap();
        assert_eq!(code, 1);
        assert!(cd_file.exists());
    }

    /// `--start --no-switch` runs the command but does not move the shell.
    #[test]
    fn finish_worktree_with_start_and_no_switch_skips_the_cd_file() {
        let dir = tempfile::tempdir().unwrap();
        let cd_file = dir.path().join("cd");
        let mut t = test_cx(&[("WT_CD_FILE", cd_file.to_str().unwrap())], "/work");
        let target = dir.path().to_path_buf();
        let runner = FakeRunner::new(0);
        finish_worktree(
            &mut t.cx,
            &runner,
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: true,
                note: "created worktree at",
                start: Some("echo hi"),
            },
        )
        .unwrap();
        assert!(!cd_file.exists());
        assert_eq!(runner.last.lock().unwrap().as_deref(), Some("echo hi"));
    }

    /// No `$WT_CD_FILE` and no terminal on stdout means a shell wrapper captured
    /// it but does not know `--start`. Warn rather than silently swallow output.
    #[test]
    fn finish_worktree_warns_when_the_shell_wrapper_is_stale() {
        let err = SharedBuf::new();
        let mut t = test_cx(&[], "/work");
        t.cx.err = Stream::new(Box::new(err.clone()), true); // stderr is a TTY
        let target = PathBuf::from("/work/wt");
        finish_worktree(
            &mut t.cx,
            &FakeRunner::new(0),
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: false,
                note: "created worktree at",
                start: Some("claude"),
            },
        )
        .unwrap();
        assert!(
            err.contents().contains("wt shell-init"),
            "{}",
            err.contents()
        );
    }

    /// Run straight from a terminal (no shell integration at all), there is nothing
    /// to warn about: running the command in the worktree is all `wt` can do.
    #[test]
    fn finish_worktree_is_quiet_without_shell_integration_on_a_tty() {
        let out = SharedBuf::new();
        let err = SharedBuf::new();
        let mut t = test_cx(&[], "/work");
        t.cx.out = Stream::new(Box::new(out.clone()), true);
        t.cx.err = Stream::new(Box::new(err.clone()), true);
        let target = PathBuf::from("/work/wt");
        finish_worktree(
            &mut t.cx,
            &FakeRunner::new(0),
            &target,
            &hook_ctx(&target),
            Nav {
                json: false,
                no_switch: false,
                note: "created worktree at",
                start: Some("claude"),
            },
        )
        .unwrap();
        assert!(!err.contents().contains("shell-init"), "{}", err.contents());
    }

    /// A worktree row carrying a branch (and its slug), as the resolver matches on.
    fn wt(branch: &str) -> Worktree {
        let slug = branch.replace('/', "-");
        let mut w = Worktree::new(PathBuf::from(format!("/r/{slug}")));
        w.branch = Some(branch.to_string());
        w.slug = Some(slug);
        w
    }

    fn worktrees() -> Vec<Worktree> {
        vec![wt("main"), wt("feature/login"), wt("feature/logout")]
    }

    /// Wires a [`crate::testutil::TestCx`] whose stderr reports the given TTY
    /// status, returning the cx and a handle to read what was written to stderr.
    fn cx_with_err_tty(is_tty: bool) -> (crate::testutil::TestCx, SharedBuf) {
        let mut t = test_cx(&[], "/work");
        let err = SharedBuf::new();
        t.cx.err = Stream::new(Box::new(err.clone()), is_tty);
        (t, err)
    }

    #[test]
    fn unique_match_is_found() {
        let (mut t, _err) = cx_with_err_tty(false);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "main", |_, _| {
            panic!("picker must not run for a unique match")
        });
        assert!(matches!(r, Resolution::Found(0)));
    }

    #[test]
    fn no_match_is_not_found() {
        let (mut t, _err) = cx_with_err_tty(true);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "zzz", |_, _| {
            panic!("picker must not run when nothing matches")
        });
        assert!(matches!(r, Resolution::NotFound));
    }

    #[test]
    fn non_tty_ambiguous_lists_candidates() {
        let (mut t, err) = cx_with_err_tty(false);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "feature/log", |_, _| {
            panic!("picker must not run when stderr is not a TTY")
        });
        assert!(matches!(r, Resolution::Ambiguous));
        let out = err.contents();
        assert!(out.contains("ambiguous"));
        assert!(out.contains("feature/login"));
        assert!(out.contains("feature/logout"));
    }

    #[test]
    fn tty_picker_selection_maps_to_index() {
        let (mut t, err) = cx_with_err_tty(true);
        let wts = worktrees();
        let chosen = wts[2].path.clone();
        let r = resolve_query_with(&mut t.cx, &wts, "feature/log", move |_, q| {
            assert_eq!(q, "feature/log");
            Ok(Some(chosen))
        });
        assert!(matches!(r, Resolution::Found(2)));
        // The picker showed the choices; no candidate list is printed.
        assert!(err.contents().is_empty());
    }

    #[test]
    fn tty_picker_cancel_is_ambiguous_without_output() {
        let (mut t, err) = cx_with_err_tty(true);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "feature/log", |_, _| Ok(None));
        assert!(matches!(r, Resolution::Ambiguous));
        assert!(err.contents().is_empty());
    }

    #[test]
    fn tty_picker_error_falls_back_to_listing() {
        let (mut t, err) = cx_with_err_tty(true);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "feature/log", |_, _| {
            Err(crate::error::Error::operation("boom"))
        });
        assert!(matches!(r, Resolution::Ambiguous));
        assert!(err.contents().contains("ambiguous"));
        assert!(err.contents().contains("feature/login"));
    }

    #[test]
    fn tty_picker_unknown_path_is_ambiguous() {
        let (mut t, err) = cx_with_err_tty(true);
        let r = resolve_query_with(&mut t.cx, &worktrees(), "feature/log", |_, _| {
            Ok(Some(PathBuf::from("/somewhere/else")))
        });
        assert!(matches!(r, Resolution::Ambiguous));
        assert!(err.contents().is_empty());
    }

    #[test]
    fn confirm_default_yes_treats_empty_as_yes() {
        use crate::commands::confirm_default_yes;
        use crate::testutil::CannedInput;
        let cases = [
            ("", true),
            ("y", true),
            ("yes", true),
            ("anything", true),
            ("n", false),
            ("N", false),
            ("no", false),
        ];
        for (answer, expected) in cases {
            let mut t = test_cx(&[], "/work");
            t.cx.input = Box::new(CannedInput::new(&[answer]));
            assert_eq!(
                confirm_default_yes(&mut t.cx, "? ").unwrap(),
                expected,
                "answer {answer:?}"
            );
        }
    }

    /// `--yes` answers the prompt affirmatively *without consuming stdin*: the
    /// canned "n" must still be queued afterwards. A prompt helper that read the
    /// line and then ignored it would desynchronize every subsequent prompt.
    #[test]
    fn assume_yes_answers_prompts_without_reading_stdin() {
        use crate::commands::{Choice, choose, confirm, confirm_default_yes};
        use crate::testutil::CannedInput;

        let mut t = test_cx(&[], "/work");
        t.cx.assume_yes = true;
        t.cx.input = Box::new(CannedInput::new(&["n", "n", "c"]));

        assert!(confirm(&mut t.cx, "remove? ").unwrap());
        assert!(confirm_default_yes(&mut t.cx, "init? ").unwrap());
        assert_eq!(choose(&mut t.cx, "stale? ").unwrap(), Choice::Update);

        // None of the three canned answers were consumed.
        assert_eq!(t.cx.input.read_line().unwrap(), "n\n");

        // Each prompt is still echoed, with the answer `--yes` supplied.
        let err = t.err.contents();
        assert!(err.contains("remove? y (--yes)"), "{err}");
        assert!(err.contains("init? y (--yes)"), "{err}");
        assert!(err.contains("stale? u (--yes)"), "{err}");
    }

    #[test]
    fn choose_maps_answers_and_defaults_to_cancel() {
        use crate::commands::{Choice, choose};
        use crate::testutil::CannedInput;
        let cases = [
            ("update", Choice::Update),
            ("u", Choice::Update),
            ("proceed", Choice::Proceed),
            ("p", Choice::Proceed),
            ("", Choice::Cancel),
            ("nonsense", Choice::Cancel),
        ];
        for (answer, expected) in cases {
            let mut t = test_cx(&[], "/work");
            t.cx.input = Box::new(CannedInput::new(&[answer]));
            assert_eq!(choose(&mut t.cx, "? ").unwrap(), expected);
        }
    }

    mod submodules {
        use super::cx_with_err_tty;
        use crate::commands::{maybe_init_submodules, maybe_init_submodules_interactive};
        use crate::config::SubmoduleInit;
        use crate::git::cli::{GitCli, GitOutput, RealGit};
        use crate::git::submodule::uninitialized;
        use crate::testutil::{CannedInput, TestRepo};
        use std::path::Path;

        /// A repo with one submodule deinitialized, so it reports as uninitialized
        /// but `update --init` can reuse `.git/modules` (no file-protocol clone).
        fn repo_with_uninitialized_submodule() -> TestRepo {
            let repo = TestRepo::init();
            repo.add_submodule("libs/sub");
            repo.deinit_submodule("libs/sub");
            repo
        }

        fn is_initialized(repo: &TestRepo) -> bool {
            repo.root().join("libs/sub/sub.txt").exists()
        }

        #[test]
        fn disabled_policy_is_a_noop() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Never,
                None,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            assert!(err.contents().is_empty());
        }

        #[test]
        fn always_policy_initializes() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Always,
                None,
                true,
            )
            .unwrap();
            assert!(is_initialized(&repo));
            assert!(uninitialized(&RealGit, repo.root()).unwrap().is_empty());
            assert!(err.contents().contains("initializing 1 submodule"));
        }

        #[test]
        fn flag_override_forces_init_over_never() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, _err) = cx_with_err_tty(true);
            maybe_init_submodules(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Never,
                Some(true),
                true,
            )
            .unwrap();
            assert!(is_initialized(&repo));
        }

        #[test]
        fn flag_override_forces_skip_over_always() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, _err) = cx_with_err_tty(true);
            maybe_init_submodules(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Always,
                Some(false),
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
        }

        #[test]
        fn enabled_with_no_submodules_is_a_noop() {
            let repo = TestRepo::init();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Always,
                None,
                true,
            )
            .unwrap();
            assert!(err.contents().is_empty());
        }

        /// A `git` whose `submodule status` reports one uninitialized submodule but
        /// whose `submodule update` (routed through `run`) fails.
        struct StatusOkUpdateFails;
        impl GitCli for StatusOkUpdateFails {
            fn run_raw(&self, _repo: &Path, _args: &[&str]) -> crate::error::Result<GitOutput> {
                Ok(GitOutput {
                    success: true,
                    stdout: "-deadbeef libs/sub\n".into(),
                    stderr: String::new(),
                })
            }
            fn run(&self, _repo: &Path, _args: &[&str]) -> crate::error::Result<String> {
                Err(crate::error::Error::operation("boom"))
            }
        }

        #[test]
        fn prompt_default_yes_empty_initializes() {
            // The Prompt default at a TTY asks, and an empty answer (the default)
            // initializes (issue #50).
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            t.cx.input = Box::new(CannedInput::new(&[""]));
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                None,
                true,
                true,
            )
            .unwrap();
            assert!(is_initialized(&repo));
            assert!(err.contents().contains("uninitialized submodule"));
        }

        #[test]
        fn prompt_no_leaves_uninitialized() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            t.cx.input = Box::new(CannedInput::new(&["n"]));
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                None,
                true,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            // The prompt was shown, but nothing was initialized.
            assert!(err.contents().contains("uninitialized submodule"));
            assert!(!err.contents().contains("initializing"));
        }

        #[test]
        fn prompt_with_no_submodules_does_not_ask() {
            let repo = TestRepo::init();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                None,
                true,
                true,
            )
            .unwrap();
            assert!(err.contents().is_empty());
        }

        #[test]
        fn prompt_non_tty_is_a_silent_skip() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(false);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                None,
                true,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            assert!(err.contents().is_empty());
        }

        #[test]
        fn prompt_false_gate_skips_even_at_a_tty() {
            // The TUI passes `prompt = false` and drives its own modal; the inline
            // helper must not prompt or init.
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                None,
                false,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            assert!(err.contents().is_empty());
        }

        #[test]
        fn flag_skip_overrides_prompt_without_asking() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                Some(false),
                true,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            assert!(err.contents().is_empty());
        }

        #[test]
        fn flag_init_overrides_prompt_without_asking() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Prompt,
                Some(true),
                true,
                true,
            )
            .unwrap();
            assert!(is_initialized(&repo));
            // Initialized directly, with no `[Y/n]` prompt.
            assert!(err.contents().contains("initializing"));
            assert!(!err.contents().contains("uninitialized submodule"));
        }

        #[test]
        fn never_policy_does_not_ask_at_a_tty() {
            let repo = repo_with_uninitialized_submodule();
            let (mut t, err) = cx_with_err_tty(true);
            maybe_init_submodules_interactive(
                &mut t.cx,
                &RealGit,
                repo.root(),
                SubmoduleInit::Never,
                None,
                true,
                true,
            )
            .unwrap();
            assert!(!is_initialized(&repo));
            assert!(err.contents().is_empty());
        }

        #[test]
        fn update_failure_is_non_fatal_and_warns() {
            let (mut t, err) = cx_with_err_tty(true);
            // Returns Ok despite the failed update; the error is surfaced as a warning.
            maybe_init_submodules(
                &mut t.cx,
                &StatusOkUpdateFails,
                Path::new("/work"),
                SubmoduleInit::Always,
                None,
                true,
            )
            .unwrap();
            let out = err.contents();
            assert!(out.contains("initializing 1 submodule"));
            assert!(out.contains("warning: failed to initialize submodules"));
            assert!(out.contains("boom"));
        }
    }
}