xbp_cli/cli/

auto_commit.rs

use colored::Colorize;
use dialoguer::{theme::ColorfulTheme, Confirm, Input};
use std::cell::Cell;
use std::collections::BTreeSet;
use std::io::IsTerminal;
use std::path::{Path, PathBuf};
use tokio::process::Command;

use crate::commands::service::load_xbp_config_with_root;
use crate::config::SshConfig;
use crate::utils::command_exists;

thread_local! {
    static CLI_EXPLICIT_PUSH: Cell<bool> = const { Cell::new(false) };
}

/// Record `--push` from the root CLI or a leaf command such as `xbp commit --push`.
pub fn set_explicit_push(push: bool) {
    if push {
        CLI_EXPLICIT_PUSH.with(|flag| flag.set(true));
    }
}

pub fn explicit_push_requested() -> bool {
    CLI_EXPLICIT_PUSH.with(|flag| flag.get())
}

pub fn reset_explicit_push() {
    CLI_EXPLICIT_PUSH.with(|flag| flag.set(false));
}

pub async fn should_push_after_auto_commit(request_push: bool) -> bool {
    if request_push || explicit_push_requested() {
        return true;
    }

    load_xbp_config_with_root()
        .await
        .map(|(_, config)| config.auto_push_on_commit_enabled())
        .unwrap_or(true)
}

pub struct AutoCommitRequest<'a> {
    pub project_root: &'a Path,
    pub paths: Vec<PathBuf>,
    pub message: String,
    pub action_label: &'a str,
    /// Force push after commit regardless of config (used by release workflows).
    pub push: bool,
}

pub enum AutoCommitResult {
    Committed(AutoCommitOutcome),
    Skipped(String),
}

pub struct AutoCommitOutcome {
    pub repo_name: String,
    pub repo_root: PathBuf,
    pub branch: Option<String>,
    pub commit_sha: String,
    pub short_sha: String,
    pub message: String,
    pub committed_files: Vec<String>,
}

pub struct PushOutcome {
    pub remote: String,
    pub branch: String,
    pub rebased: bool,
    /// Unpushed history was rewritten to drop GitHub-oversized blobs before push.
    pub rewritten_for_large_files: bool,
}

/// GitHub pre-receive hard limit for a single blob (100 MiB).
pub const GITHUB_MAX_FILE_BYTES: u64 = 100 * 1024 * 1024;

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct OversizedPath {
    pub path: String,
    pub size_bytes: u64,
}

pub async fn commit_paths(request: AutoCommitRequest<'_>) -> Result<AutoCommitResult, String> {
    if !command_exists("git") {
        return Ok(AutoCommitResult::Skipped(
            "Git is not installed on this machine.".to_string(),
        ));
    }

    // Always operate from the git toplevel. Nested xbp project roots (e.g.
    // packages/athena-js with its own .xbp/) resolve show-toplevel to the monorepo,
    // and `git diff --cached --name-only` returns paths relative to that toplevel —
    // not relative to the nested package cwd. Using those monorepo pathspecs with
    // cwd=package then fails: pathspec 'packages/foo/bar' did not match.
    let repo_root = match git_output(request.project_root, &["rev-parse", "--show-toplevel"]).await
    {
        Ok(root) => PathBuf::from(root.trim()),
        Err(_) => {
            return Ok(AutoCommitResult::Skipped(
                "Current project is not inside a git repository.".to_string(),
            ));
        }
    };

    let normalized_paths =
        normalize_commit_paths(&repo_root, request.project_root, &request.paths);
    if normalized_paths.is_empty() {
        return Ok(AutoCommitResult::Skipped(
            "No generated or updated files were provided for auto-commit.".to_string(),
        ));
    }

    let mut add_args = vec!["add".to_string(), "--all".to_string(), "--".to_string()];
    add_args.extend(normalized_paths.iter().cloned());
    git_output_owned(&repo_root, add_args).await?;

    // Never ship blobs GitHub will reject; leave them local/unstaged.
    let excluded = unstage_github_oversized_paths(&repo_root).await?;
    if !excluded.is_empty() {
        print_oversized_excluded(&excluded, "auto-commit staging");
    }

    let mut diff_args = vec![
        "diff".to_string(),
        "--cached".to_string(),
        "--name-only".to_string(),
        "--".to_string(),
    ];
    diff_args.extend(normalized_paths.iter().cloned());
    let committed_files = git_output_owned(&repo_root, diff_args)
        .await?
        .lines()
        .map(str::trim)
        .filter(|line| !line.is_empty())
        .map(|line| line.replace('\\', "/"))
        .collect::<Vec<_>>();

    if committed_files.is_empty() {
        if !excluded.is_empty() {
            return Ok(AutoCommitResult::Skipped(format!(
                "Only GitHub-oversized files were staged ({}). Left unstaged: {}.",
                format_oversized_list(&excluded),
                excluded
                    .iter()
                    .map(|item| item.path.as_str())
                    .collect::<Vec<_>>()
                    .join(", ")
            )));
        }
        return Ok(AutoCommitResult::Skipped(
            "Target files did not produce any staged git diff.".to_string(),
        ));
    }

    ensure_git_commit_identity(&repo_root).await?;

    // Pathspec commit: only these files land in the commit, even if other paths
    // (e.g. leftover staged `.xbp/deployments/*`) were already in the index.
    // Pathspecs and cwd both use repo_root so monorepo-relative names match.
    if let Err(error) =
        commit_with_optional_hook_retry(&repo_root, &request.message, &committed_files).await
    {
        return Err(format_git_commit_failure(&repo_root, &error).await);
    }

    let commit_sha = git_output(&repo_root, &["rev-parse", "HEAD"]).await?;
    let short_sha = git_output(&repo_root, &["rev-parse", "--short", "HEAD"]).await?;
    let branch = git_output(&repo_root, &["rev-parse", "--abbrev-ref", "HEAD"])
        .await
        .ok()
        .filter(|value| !value.is_empty() && value != "HEAD");

    let outcome = AutoCommitOutcome {
        repo_name: repo_name(&repo_root),
        repo_root: repo_root.clone(),
        branch,
        commit_sha,
        short_sha,
        message: request.message,
        committed_files,
    };

    print_commit_summary(request.action_label, &outcome);

    let mut pushed = false;
    if should_push_after_auto_commit(request.push).await {
        match push_current_branch(&repo_root).await {
            Ok(Some(push_outcome)) => {
                print_push_summary(&push_outcome);
                pushed = true;
            }
            Ok(None) => {}
            Err(error) => {
                return Err(format!(
                    "Created local commit {} but push failed: {}",
                    outcome.short_sha, error
                ));
            }
        }
    }

    // Match `xbp commit`: fire Discord commit webhook for auto-commits too.
    {
        let subject = outcome
            .message
            .lines()
            .next()
            .unwrap_or(outcome.message.as_str())
            .trim();
        let xbp_config = crate::strategies::DeploymentConfig::load_xbp_config(None)
            .await
            .ok();
        crate::commands::discord_notify::notify_discord_for_project(
            &outcome.repo_root,
            xbp_config.as_ref(),
            None,
            crate::commands::discord_notify::commit_notification(
                &outcome.short_sha,
                subject,
                outcome.branch.as_deref(),
                pushed,
            ),
        )
        .await;
    }

    Ok(AutoCommitResult::Committed(outcome))
}

pub async fn push_current_branch(project_root: &Path) -> Result<Option<PushOutcome>, String> {
    let branch = git_output(project_root, &["rev-parse", "--abbrev-ref", "HEAD"])
        .await
        .ok()
        .filter(|value| !value.is_empty() && value != "HEAD");
    push_current_branch_with_name(project_root, branch.as_deref()).await
}

pub async fn push_current_branch_with_name(
    project_root: &Path,
    branch: Option<&str>,
) -> Result<Option<PushOutcome>, String> {
    if !command_exists("git") {
        return Ok(None);
    }

    let Some(branch) = branch
        .map(str::trim)
        .filter(|value| !value.is_empty() && *value != "HEAD")
        .map(ToOwned::to_owned)
    else {
        return Ok(None);
    };

    let remote = resolve_push_remote(project_root, &branch).await?;
    let mut rebased = false;
    let mut rewritten_for_large_files = false;

    // Proactive integrate when behind/diverged. Avoids:
    // - non-fast-forward push rejection
    // - plain `git pull` abort under `pull.ff=only`
    // Dirty worktrees are stashed inside `pull_rebase`.
    if remote_branch_has_unmerged_commits(project_root, &remote, &branch).await? {
        println!(
            "{} {}",
            "Branch behind remote".bright_yellow().bold(),
            format!("rebasing onto {}/{} before push...", remote, branch).bright_white()
        );
        pull_rebase(project_root, &remote, &branch)
            .await
            .map_err(|rebase_error| {
                format!(
                    "`{branch}` is behind `{remote}/{branch}` and auto-rebase failed: {rebase_error}. Resolve conflicts, then `git push`."
                )
            })?;
        rebased = true;
    }

    // Drop oversize blobs from *unpushed* commits before GitHub rejects the push.
    if rewrite_unpushed_history_without_oversized(project_root, &remote, &branch)
        .await?
        .rewritten
    {
        rewritten_for_large_files = true;
    }

    match attempt_push(project_root, &remote, &branch).await {
        Ok(()) => {}
        Err(push_error) if is_github_large_file_push_error(&push_error) => {
            // Last resort: rewrite then retry once (covers races / missed scans).
            if rewrite_unpushed_history_without_oversized(project_root, &remote, &branch)
                .await?
                .rewritten
            {
                rewritten_for_large_files = true;
                attempt_push(project_root, &remote, &branch)
                    .await
                    .map_err(|retry_error| {
                        summarize_git_push_error(&remote, &branch, &push_error, &retry_error)
                    })?;
            } else {
                return Err(summarize_git_push_error(
                    &remote,
                    &branch,
                    &push_error,
                    &push_error,
                ));
            }
        }
        Err(push_error) if is_non_fast_forward_push_error(&push_error) => {
            println!(
                "{} {}",
                "Branch behind remote".bright_yellow().bold(),
                format!("rebasing onto {}/{} then retrying push...", remote, branch)
                    .bright_white()
            );
            pull_rebase(project_root, &remote, &branch)
                .await
                .map_err(|rebase_error| {
                    format!(
                        "`{branch}` is behind `{remote}/{branch}` and auto-rebase failed: {rebase_error}. Resolve conflicts, then `git push`."
                    )
                })?;
            rebased = true;
            if rewrite_unpushed_history_without_oversized(project_root, &remote, &branch)
                .await?
                .rewritten
            {
                rewritten_for_large_files = true;
            }
            attempt_push(project_root, &remote, &branch)
                .await
                .map_err(|retry_error| {
                    summarize_git_push_error(&remote, &branch, &push_error, &retry_error)
                })?;
        }
        Err(push_error) => {
            return Err(summarize_git_push_error(
                &remote,
                &branch,
                &push_error,
                &push_error,
            ));
        }
    }

    Ok(Some(PushOutcome {
        remote,
        branch,
        rebased,
        rewritten_for_large_files,
    }))
}

/// Fetch and report whether `{remote}/{branch}` has commits not in HEAD.
async fn remote_branch_has_unmerged_commits(
    project_root: &Path,
    remote: &str,
    branch: &str,
) -> Result<bool, String> {
    let _ = git_output(project_root, &["fetch", remote, branch]).await;
    let remote_ref = format!("{remote}/{branch}");

    // Missing remote-tracking ref → nothing to integrate yet.
    if git_output(
        project_root,
        &["rev-parse", "--verify", "--quiet", &remote_ref],
    )
    .await
    .is_err()
    {
        return Ok(false);
    }

    let count = git_output(
        project_root,
        &["rev-list", "--count", &format!("HEAD..{remote_ref}")],
    )
    .await
    .unwrap_or_else(|_| "0".to_string());
    Ok(count.trim().parse::<usize>().unwrap_or(0) > 0)
}

/// Sync current branch with its remote (stash-safe rebase when needed) and push.
///
/// Intended for the standalone `xbp push` command and other "just ship commits" flows.
pub async fn sync_and_push_current_branch(project_root: &Path) -> Result<Option<PushOutcome>, String> {
    push_current_branch(project_root).await
}

/// Rebase the current branch onto its remote counterpart, detecting remote/branch dynamically.
pub async fn pull_rebase_current_branch(project_root: &Path) -> Result<Option<PushOutcome>, String> {
    if !command_exists("git") {
        return Ok(None);
    }

    let branch = git_output(project_root, &["rev-parse", "--abbrev-ref", "HEAD"])
        .await
        .ok()
        .filter(|value| !value.is_empty() && value != "HEAD");
    let Some(branch) = branch else {
        return Ok(None);
    };

    let remote = resolve_push_remote(project_root, &branch).await?;
    println!(
        "{} {}",
        "Rebasing".bright_cyan().bold(),
        format!("onto {}/{}...", remote, branch).bright_white()
    );
    pull_rebase(project_root, &remote, &branch).await?;
    Ok(Some(PushOutcome {
        remote,
        branch,
        rebased: true,
        rewritten_for_large_files: false,
    }))
}

pub fn print_skip(action_label: &str, reason: &str) {
    println!(
        "{} {} {}",
        "Auto-commit".bright_yellow().bold(),
        format!("skipped for {}", action_label).bright_white(),
        format!("({})", reason).dimmed()
    );
}

pub fn print_push_summary(outcome: &PushOutcome) {
    let target = format!("{}/{}", outcome.remote, outcome.branch);
    let mut notes = Vec::new();
    if outcome.rebased {
        notes.push("after auto-rebase");
    }
    if outcome.rewritten_for_large_files {
        notes.push("rewrote unpushed history without oversized blobs");
    }
    if notes.is_empty() {
        println!(
            "{} {}",
            "Pushed".bright_green().bold(),
            target.bright_white()
        );
    } else {
        println!(
            "{} {} {}",
            "Pushed".bright_green().bold(),
            target.bright_white(),
            format!("({})", notes.join("; ")).dimmed()
        );
    }
}

struct RewriteOutcome {
    rewritten: bool,
}

/// Soft-reset unpushed commits onto `{remote}/{branch}` and recommit without blobs
/// at or above [`GITHUB_MAX_FILE_BYTES`]. Local oversized files stay in the worktree.
async fn rewrite_unpushed_history_without_oversized(
    project_root: &Path,
    remote: &str,
    branch: &str,
) -> Result<RewriteOutcome, String> {
    let remote_ref = format!("{remote}/{branch}");
    if git_output(
        project_root,
        &["rev-parse", "--verify", "--quiet", &remote_ref],
    )
    .await
    .is_err()
    {
        return Ok(RewriteOutcome { rewritten: false });
    }

    let ahead = git_output(
        project_root,
        &["rev-list", "--count", &format!("{remote_ref}..HEAD")],
    )
    .await
    .unwrap_or_else(|_| "0".to_string())
    .trim()
    .parse::<usize>()
    .unwrap_or(0);
    if ahead == 0 {
        return Ok(RewriteOutcome { rewritten: false });
    }

    let oversized = find_oversized_blobs_in_range(project_root, &format!("{remote_ref}..HEAD")).await?;
    if oversized.is_empty() {
        return Ok(RewriteOutcome { rewritten: false });
    }

    let merge_count = git_output(
        project_root,
        &[
            "rev-list",
            "--count",
            "--merges",
            &format!("{remote_ref}..HEAD"),
        ],
    )
    .await
    .unwrap_or_else(|_| "0".to_string())
    .trim()
    .parse::<usize>()
    .unwrap_or(0);
    if merge_count > 0 {
        return Err(format!(
            "Unpushed history contains oversized files ({}) and {} merge commit(s). \
XBP will not auto-rewrite merges. Soft-reset onto `{remote_ref}`, drop oversized blobs, then recommit/push.",
            format_oversized_list(&oversized),
            merge_count
        ));
    }

    let subjects = git_output(
        project_root,
        &[
            "log",
            "--reverse",
            "--pretty=format:%s",
            &format!("{remote_ref}..HEAD"),
        ],
    )
    .await
    .unwrap_or_default();

    println!(
        "{} {}",
        "Large files".bright_yellow().bold(),
        format!(
            "unpushed history has {} over GitHub's 100 MiB limit — rewriting {} commit(s) without those blobs...",
            format_oversized_list(&oversized),
            ahead
        )
        .bright_white()
    );

    git_output(project_root, &["reset", "--soft", &remote_ref]).await?;

    let excluded = unstage_github_oversized_paths(project_root).await?;
    // Also restore index entries for paths known oversized from history even if the
    // worktree copy was deleted / not present for size checks.
    for item in &oversized {
        let _ = git_output(project_root, &["restore", "--staged", "--", &item.path]).await;
    }

    let staged = git_output(project_root, &["diff", "--cached", "--name-only"])
        .await
        .unwrap_or_default();
    if staged.trim().is_empty() {
        println!(
            "{} {}",
            "Large files".bright_yellow().bold(),
            "after excluding oversized blobs there is nothing left to recommit; \
local oversize files remain unstaged."
                .bright_white()
        );
        return Ok(RewriteOutcome { rewritten: true });
    }

    let mut message = String::from("chore: rewrite unpushed commits without oversized blobs\n\n");
    message.push_str("Dropped files at or above GitHub's 100 MiB limit:\n");
    for item in excluded.iter().chain(oversized.iter()) {
        message.push_str(&format!(
            "  - {} ({})\n",
            item.path,
            format_byte_size(item.size_bytes)
        ));
    }
    if !subjects.trim().is_empty() {
        message.push_str("\nOriginal unpushed subjects:\n");
        for subject in subjects.lines().map(str::trim).filter(|s| !s.is_empty()) {
            message.push_str(&format!("  - {subject}\n"));
        }
    }

    // Pathspec-less commit of everything still staged (only safe content remains).
    ensure_git_commit_identity(project_root).await?;
    let message_path =
        std::env::temp_dir().join(format!("xbp-large-file-rewrite-{}.txt", std::process::id()));
    std::fs::write(&message_path, &message).map_err(|e| {
        format!(
            "Failed to write temporary rewrite commit message {}: {e}",
            message_path.display()
        )
    })?;
    let commit_result = git_output(
        project_root,
        &[
            "commit",
            "--no-verify",
            "--file",
            &message_path.to_string_lossy(),
        ],
    )
    .await;
    let _ = std::fs::remove_file(&message_path);
    commit_result?;

    println!(
        "{} {}",
        "Rewrote".bright_green().bold(),
        format!(
            "unpushed history without oversized blobs ({})",
            format_oversized_list(
                &excluded
                    .into_iter()
                    .chain(oversized.into_iter())
                    .collect::<Vec<_>>()
            )
        )
        .bright_white()
    );

    Ok(RewriteOutcome { rewritten: true })
}

/// Unstage any index entries whose blob is ≥ GitHub's limit. Worktree copies stay put.
pub async fn unstage_github_oversized_paths(
    project_root: &Path,
) -> Result<Vec<OversizedPath>, String> {
    let oversized = find_oversized_staged_paths(project_root).await?;
    for item in &oversized {
        git_output(project_root, &["restore", "--staged", "--", &item.path]).await?;
        println!(
            "{} {} {}",
            "Keeping oversized path unstaged:".bright_black(),
            item.path.bright_white(),
            format!("({})", format_byte_size(item.size_bytes)).dimmed()
        );
    }
    Ok(oversized)
}

async fn find_oversized_staged_paths(project_root: &Path) -> Result<Vec<OversizedPath>, String> {
    let names = git_output(
        project_root,
        &["diff", "--cached", "--name-only", "--diff-filter=dAMCR"],
    )
    .await
    .unwrap_or_default();

    let mut found = Vec::new();
    for name in names.lines().map(str::trim).filter(|n| !n.is_empty()) {
        let path = name.replace('\\', "/");
        if let Some(size) = blob_size_in_index(project_root, &path).await? {
            if size >= GITHUB_MAX_FILE_BYTES {
                found.push(OversizedPath {
                    path,
                    size_bytes: size,
                });
            }
        }
    }
    found.sort_by(|a, b| a.path.cmp(&b.path));
    found.dedup_by(|a, b| a.path == b.path);
    Ok(found)
}

async fn blob_size_in_index(project_root: &Path, path: &str) -> Result<Option<u64>, String> {
    // Prefer worktree size when present (matches what would be pushed for normal adds).
    let worktree = project_root.join(path);
    if let Ok(meta) = std::fs::metadata(&worktree) {
        if meta.is_file() {
            return Ok(Some(meta.len()));
        }
    }

    let oid = match git_output(project_root, &["rev-parse", &format!(":{path}")]).await {
        Ok(value) => value,
        Err(_) => return Ok(None),
    };
    let size = git_output(project_root, &["cat-file", "-s", oid.trim()])
        .await?
        .trim()
        .parse::<u64>()
        .map_err(|e| format!("Invalid blob size for `{path}`: {e}"))?;
    Ok(Some(size))
}

async fn find_oversized_blobs_in_range(
    project_root: &Path,
    range: &str,
) -> Result<Vec<OversizedPath>, String> {
    let objects = git_output(project_root, &["rev-list", "--objects", range])
        .await
        .unwrap_or_default();

    let mut by_path: std::collections::BTreeMap<String, u64> = std::collections::BTreeMap::new();
    for line in objects.lines() {
        let mut parts = line.split_whitespace();
        let Some(oid) = parts.next() else {
            continue;
        };
        let Some(path) = parts.next() else {
            continue;
        };
        let path = path.replace('\\', "/");
        let obj_type = match git_output(project_root, &["cat-file", "-t", oid]).await {
            Ok(value) => value,
            Err(_) => continue,
        };
        if obj_type.trim() != "blob" {
            continue;
        }
        let size = match git_output(project_root, &["cat-file", "-s", oid]).await {
            Ok(value) => value.trim().parse::<u64>().unwrap_or(0),
            Err(_) => continue,
        };
        if size >= GITHUB_MAX_FILE_BYTES {
            by_path
                .entry(path)
                .and_modify(|existing| *existing = (*existing).max(size))
                .or_insert(size);
        }
    }

    Ok(by_path
        .into_iter()
        .map(|(path, size_bytes)| OversizedPath { path, size_bytes })
        .collect())
}

fn format_byte_size(bytes: u64) -> String {
    const MIB: f64 = 1024.0 * 1024.0;
    if bytes >= 1024 * 1024 {
        format!("{:.2} MiB", bytes as f64 / MIB)
    } else if bytes >= 1024 {
        format!("{:.1} KiB", bytes as f64 / 1024.0)
    } else {
        format!("{bytes} B")
    }
}

fn format_oversized_list(items: &[OversizedPath]) -> String {
    if items.is_empty() {
        return "(none)".to_string();
    }
    items
        .iter()
        .map(|item| format!("{} {}", item.path, format_byte_size(item.size_bytes)))
        .collect::<Vec<_>>()
        .join(", ")
}

fn print_oversized_excluded(items: &[OversizedPath], context: &str) {
    println!(
        "{} {}",
        "Large files".bright_yellow().bold(),
        format!(
            "excluded from {context} (GitHub max 100 MiB): {}",
            format_oversized_list(items)
        )
        .bright_white()
    );
}

async fn attempt_push(project_root: &Path, remote: &str, branch: &str) -> Result<(), String> {
    match git_output(project_root, &["push"]).await {
        Ok(_) => Ok(()),
        Err(push_error) => {
            // No upstream yet, or default push.refspecs not set — set upstream and push.
            git_output(project_root, &["push", "-u", remote, branch])
                .await
                .map(|_| ())
                .map_err(|fallback_error| format!("{push_error}\n{fallback_error}"))
        }
    }
}

const AUTO_REBASE_STASH_MESSAGE: &str = "xbp auto-rebase: temporary stash";

async fn pull_rebase(project_root: &Path, remote: &str, branch: &str) -> Result<(), String> {
    // Fetch first so rebase uses current remote tips even if the branch has no upstream yet.
    let _ = git_output(project_root, &["fetch", remote, branch]).await;

    // Version bumps and other auto-commits often run with unrelated WIP still dirty.
    // `git pull --rebase` refuses dirty trees; stash around the rebase, then restore.
    let stashed = stash_if_worktree_dirty(project_root).await?;

    let rebase_result = git_output(project_root, &["pull", "--rebase", remote, branch])
        .await
        .map(|_| ())
        .map_err(|error| enrich_rebase_error(&error));

    let restore_result = if stashed {
        restore_auto_rebase_stash(project_root).await
    } else {
        Ok(())
    };

    match (rebase_result, restore_result) {
        (Ok(()), Ok(())) => Ok(()),
        (Ok(()), Err(restore_error)) => Err(format!(
            "Rebase onto `{remote}/{branch}` succeeded, but restoring the temporary stash failed: {restore_error}. \
Look for a stash named `{AUTO_REBASE_STASH_MESSAGE}` (`git stash list`) and run `git stash pop`."
        )),
        (Err(rebase_error), Ok(())) => Err(rebase_error),
        (Err(rebase_error), Err(restore_error)) => Err(format!(
            "{rebase_error}; also failed to restore temporary stash: {restore_error}. \
Look for a stash named `{AUTO_REBASE_STASH_MESSAGE}` (`git stash list`)."
        )),
    }
}

async fn worktree_is_dirty(project_root: &Path) -> Result<bool, String> {
    let status = git_output(project_root, &["status", "--porcelain"]).await?;
    Ok(!status.trim().is_empty())
}

/// Stash dirty tracked/untracked files so rebase can run. Returns whether a stash was created.
async fn stash_if_worktree_dirty(project_root: &Path) -> Result<bool, String> {
    if !worktree_is_dirty(project_root).await? {
        return Ok(false);
    }

    println!(
        "{} {}",
        "Dirty worktree".bright_yellow().bold(),
        "stashing unstaged/untracked WIP for auto-rebase...".bright_white()
    );

    let stash_output = git_output(
        project_root,
        &[
            "stash",
            "push",
            "--include-untracked",
            "-m",
            AUTO_REBASE_STASH_MESSAGE,
        ],
    )
    .await;

    match stash_output {
        Ok(output) if is_nothing_to_stash_message(&output) => Ok(false),
        Ok(_) => Ok(true),
        Err(error) if is_nothing_to_stash_message(&error) => Ok(false),
        Err(error) => Err(format!(
            "Failed to stash dirty worktree before auto-rebase: {error}"
        )),
    }
}

async fn restore_auto_rebase_stash(project_root: &Path) -> Result<(), String> {
    // Avoid popping into the middle of a conflicted rebase.
    if rebase_in_progress(project_root).await {
        return Err(format!(
            "rebase still in progress; temporary stash `{AUTO_REBASE_STASH_MESSAGE}` was left applied in the stash list"
        ));
    }

    match git_output(project_root, &["stash", "pop"]).await {
        Ok(_) => {
            println!(
                "{} {}",
                "Restored".bright_green().bold(),
                "temporary auto-rebase stash".bright_white()
            );
            Ok(())
        }
        Err(error) => Err(error),
    }
}

async fn rebase_in_progress(project_root: &Path) -> bool {
    // `git rev-parse --verify` exits non-zero when the path is missing.
    git_output(project_root, &["rev-parse", "--verify", "REBASE_HEAD"])
        .await
        .is_ok()
        || git_output(
            project_root,
            &["rev-parse", "--git-path", "rebase-merge"],
        )
        .await
        .ok()
        .map(|path| {
            let p = project_root.join(path.trim());
            // When given an absolute path from --git-path, join may still work as absolute on Windows.
            std::path::Path::new(path.trim()).exists() || p.exists()
        })
        .unwrap_or(false)
        || git_output(project_root, &["rev-parse", "--git-path", "rebase-apply"])
            .await
            .ok()
            .map(|path| {
                let p = project_root.join(path.trim());
                std::path::Path::new(path.trim()).exists() || p.exists()
            })
            .unwrap_or(false)
}

fn is_nothing_to_stash_message(message: &str) -> bool {
    let lowered = message.to_ascii_lowercase();
    lowered.contains("no local changes to save") || lowered.contains("no changes to save")
}

fn is_dirty_worktree_rebase_error(error: &str) -> bool {
    let lowered = error.to_ascii_lowercase();
    (lowered.contains("cannot pull with rebase") || lowered.contains("cannot rebase"))
        && (lowered.contains("unstaged changes")
            || lowered.contains("uncommitted changes")
            || lowered.contains("your index contains uncommitted changes")
            || lowered.contains("please commit or stash"))
}

fn enrich_rebase_error(error: &str) -> String {
    if is_dirty_worktree_rebase_error(error) {
        format!(
            "{error}. Dirty worktree blocked rebase even after stash attempt; \
commit or stash unrelated WIP, then `git pull --rebase` and `git push`."
        )
    } else {
        error.to_string()
    }
}

/// Resolve the remote used for push/pull for `branch`.
///
/// Order: configured branch remote → upstream remote name → `origin` if present → first remote.
pub async fn resolve_push_remote(project_root: &Path, branch: &str) -> Result<String, String> {
    if let Ok(configured) = git_output(
        project_root,
        &["config", "--get", &format!("branch.{branch}.remote")],
    )
    .await
    {
        let trimmed = configured.trim();
        if !trimmed.is_empty() {
            return Ok(trimmed.to_string());
        }
    }

    if let Ok(upstream) = git_output(
        project_root,
        &[
            "rev-parse",
            "--abbrev-ref",
            "--symbolic-full-name",
            "@{upstream}",
        ],
    )
    .await
    {
        if let Some(remote) = split_remote_branch(upstream.trim()).map(|(remote, _)| remote) {
            return Ok(remote);
        }
    }

    let remotes = git_output(project_root, &["remote"]).await.unwrap_or_default();
    let remote_names = remotes
        .lines()
        .map(str::trim)
        .filter(|line| !line.is_empty())
        .map(ToOwned::to_owned)
        .collect::<Vec<_>>();

    if remote_names.iter().any(|name| name == "origin") {
        return Ok("origin".to_string());
    }

    remote_names.into_iter().next().ok_or_else(|| {
        "No git remotes are configured for this repository. Add one with `git remote add <name> <url>`."
            .to_string()
    })
}

fn split_remote_branch(upstream: &str) -> Option<(String, String)> {
    let (remote, branch) = upstream.split_once('/')?;
    let remote = remote.trim();
    let branch = branch.trim();
    if remote.is_empty() || branch.is_empty() {
        return None;
    }
    Some((remote.to_string(), branch.to_string()))
}

fn is_github_large_file_push_error(error: &str) -> bool {
    let corpus = error.to_ascii_lowercase();
    corpus.contains("gh001")
        || corpus.contains("large files detected")
        || corpus.contains("exceeds github's file size limit")
        || corpus.contains("this exceeds github's file size limit")
        || (corpus.contains("file ") && corpus.contains("mb") && corpus.contains("file size limit"))
        || corpus.contains("git-lfs.github.com")
}

fn is_non_fast_forward_push_error(error: &str) -> bool {
    let corpus = error.to_ascii_lowercase();
    // GH001 / pre-receive large-file rejections also say "rejected" + "failed to push";
    // never treat those as "behind remote".
    if is_github_large_file_push_error(&corpus) {
        return false;
    }
    if corpus.contains("remote rejected") && !corpus.contains("non-fast-forward") {
        // Other pre-receive hooks (secrets, LFS, rulesets) — not a rebase problem.
        if !corpus.contains("tip of your current branch is behind")
            && !corpus.contains("fetch first")
        {
            return false;
        }
    }
    corpus.contains("non-fast-forward")
        || corpus.contains("tip of your current branch is behind")
        || (corpus.contains("failed to push some refs")
            && (corpus.contains("behind")
                || corpus.contains("non-fast-forward")
                || corpus.contains("fetch first")
                || (corpus.contains("rejected")
                    && !corpus.contains("remote rejected")
                    && !corpus.contains("pre-receive hook declined"))))
}

fn print_commit_summary(action_label: &str, outcome: &AutoCommitOutcome) {
    let branch = outcome
        .branch
        .as_deref()
        .map(|value| format!(" on {}", value.bright_blue()))
        .unwrap_or_default();
    let files = if outcome.committed_files.is_empty() {
        "(none)".dimmed().to_string()
    } else {
        outcome
            .committed_files
            .iter()
            .map(|value| value.bright_white().to_string())
            .collect::<Vec<_>>()
            .join(", ")
    };

    println!(
        "{} {}{}",
        "Auto-commit".bright_green().bold(),
        format!("created for {}", action_label).bright_white(),
        branch
    );
    println!(
        "  {} {} {}",
        "Repo".bright_cyan().bold(),
        outcome.repo_name.bright_white().bold(),
        format!("({})", outcome.repo_root.display()).dimmed()
    );
    println!(
        "  {} {} {}",
        "Commit".bright_cyan().bold(),
        outcome.short_sha.bright_green().bold(),
        format!("({})", outcome.commit_sha).dimmed()
    );
    println!(
        "  {} {}",
        "Message".bright_cyan().bold(),
        outcome.message.bright_magenta()
    );
    println!("  {} {}", "Files".bright_cyan().bold(), files);
}

async fn git_output(project_root: &Path, args: &[&str]) -> Result<String, String> {
    let owned_args = args
        .iter()
        .map(|value| value.to_string())
        .collect::<Vec<_>>();
    git_output_owned(project_root, owned_args).await
}

async fn git_output_owned(project_root: &Path, args: Vec<String>) -> Result<String, String> {
    let output = Command::new("git")
        .current_dir(project_root)
        .args(&args)
        .output()
        .await
        .map_err(|e| format!("Failed to run `git {}`: {}", args.join(" "), e))?;

    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
        let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
        // husky / pre-commit often print diagnostics on stdout.
        let detail = [stderr, stdout]
            .into_iter()
            .filter(|s| !s.is_empty())
            .collect::<Vec<_>>()
            .join("\n");
        if detail.is_empty() {
            return Err(format!(
                "`git {}` failed with status {}",
                args.join(" "),
                output.status
            ));
        }
        return Err(format!("`git {}` failed: {}", args.join(" "), detail));
    }

    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
}

async fn commit_with_optional_hook_retry(
    project_root: &Path,
    message: &str,
    committed_files: &[String],
) -> Result<(), String> {
    match run_commit_with_pathspec(project_root, message, committed_files, false).await {
        Ok(_) => Ok(()),
        Err(error) => {
            let hook_failure = is_commit_hook_failure(&error);
            if !hook_failure {
                return Err(error);
            }

            // XBP-generated commits (.xbp/** only) should never be blocked by
            // repo lint/test hooks (husky + ultracite scanning the whole tree, etc.).
            if is_xbp_managed_commit(committed_files) {
                println!(
                    "{} {}",
                    "Hooks".bright_yellow().bold(),
                    "failed on XBP-managed files only — retrying with hooks disabled (--no-verify)."
                        .bright_white()
                );
                return run_commit_with_pathspec(project_root, message, committed_files, true).await;
            }

            if is_missing_lefthook_error(&error)
                || is_husky_or_pre_commit_hook_error(&error)
            {
                if std::io::stdin().is_terminal() {
                    let prompt = if is_missing_lefthook_error(&error) {
                        "Commit hooks failed to resolve lefthook. Retry once with hooks disabled?"
                    } else {
                        "Pre-commit / husky hooks failed. Retry this XBP commit with hooks disabled?"
                    };
                    let retry = Confirm::with_theme(&ColorfulTheme::default())
                        .with_prompt(prompt)
                        .default(true)
                        .interact()
                        .map_err(|e| format!("Failed to read retry choice: {}", e))?;
                    if retry {
                        println!(
                            "{} {}",
                            "Hooks".bright_yellow().bold(),
                            "disabled for this commit (--no-verify, HUSKY=0, LEFTHOOK=0)."
                                .bright_white()
                        );
                        return run_commit_with_pathspec(
                            project_root,
                            message,
                            committed_files,
                            true,
                        )
                        .await;
                    }
                } else {
                    // Non-interactive automation: soft-skip hooks for husky failures
                    // so CI-like agent runs can still land XBP config commits.
                    println!(
                        "{} {}",
                        "Hooks".bright_yellow().bold(),
                        "failed in non-interactive mode — retrying with hooks disabled."
                            .bright_white()
                    );
                    return run_commit_with_pathspec(project_root, message, committed_files, true)
                        .await;
                }
            }

            Err(error)
        }
    }
}

/// Commit only `committed_files` (pathspec), never the full index.
async fn run_commit_with_pathspec(
    project_root: &Path,
    message: &str,
    committed_files: &[String],
    no_verify: bool,
) -> Result<(), String> {
    if committed_files.is_empty() {
        return Err("No paths provided for pathspec commit.".to_string());
    }

    let mut args = Vec::new();
    if no_verify {
        args.push("commit".to_string());
        args.push("--no-verify".to_string());
    } else {
        args.push("commit".to_string());
    }
    args.push("-m".to_string());
    args.push(message.to_string());
    args.push("--".to_string());
    args.extend(committed_files.iter().cloned());

    let mut command = Command::new("git");
    command.current_dir(project_root).args(&args);
    if no_verify {
        // husky v8/v9 and lefthook both honor these env flags.
        command.env("HUSKY", "0").env("LEFTHOOK", "0");
    }

    let output = command.output().await.map_err(|e| {
        format!(
            "Failed to run `git commit{} -m … -- <paths>`: {}",
            if no_verify { " --no-verify" } else { "" },
            e
        )
    })?;

    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
        let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
        let detail = [stderr, stdout]
            .into_iter()
            .filter(|s| !s.is_empty())
            .collect::<Vec<_>>()
            .join("\n");
        if detail.is_empty() {
            return Err(format!(
                "`git commit{} -m …` failed with status {}",
                if no_verify { " --no-verify" } else { "" },
                output.status
            ));
        }
        return Err(format!(
            "`git commit{} -m …` failed: {}",
            if no_verify { " --no-verify" } else { "" },
            detail
        ));
    }

    Ok(())
}

/// Paths produced by XBP tooling that are safe to commit without project lint hooks.
fn is_xbp_managed_commit(committed_files: &[String]) -> bool {
    !committed_files.is_empty()
        && committed_files.iter().all(|path| {
            let normalized = path.replace('\\', "/");
            normalized == ".xbp"
                || normalized.starts_with(".xbp/")
                || crate::utils::is_xbp_project_config_filename(&normalized)
                || normalized == "pnpm-workspace.yaml"
                || normalized == "package.json"
                || normalized.ends_with("/package.json")
                || normalized.ends_with("/pnpm-workspace.yaml")
        })
}

fn is_commit_hook_failure(error: &str) -> bool {
    let lower = error.to_ascii_lowercase();
    lower.contains("pre-commit")
        || lower.contains("husky")
        || lower.contains("lefthook")
        || lower.contains("hook")
        || lower.contains("ultracite")
        || lower.contains("lint-staged")
        || lower.contains("hook exited")
        || lower.contains("script failed")
}

fn is_husky_or_pre_commit_hook_error(error: &str) -> bool {
    let lower = error.to_ascii_lowercase();
    lower.contains("husky")
        || lower.contains("pre-commit")
        || lower.contains("ultracite")
        || lower.contains("lint-staged")
        || (lower.contains("hook") && lower.contains("failed"))
}

async fn ensure_git_commit_identity(project_root: &Path) -> Result<(), String> {
    let current_name = git_output(project_root, &["config", "--get", "user.name"])
        .await
        .ok()
        .map(|value| value.trim().to_string())
        .filter(|value| !value.is_empty());
    let current_email = git_output(project_root, &["config", "--get", "user.email"])
        .await
        .ok()
        .map(|value| value.trim().to_string())
        .filter(|value| !value.is_empty());

    if current_name.is_some() && current_email.is_some() {
        return Ok(());
    }

    let suggested = SshConfig::load()
        .ok()
        .and_then(|config| config.cli_auth)
        .and_then(|auth| match (auth.user_name, auth.user_email) {
            (Some(name), Some(email)) if !name.trim().is_empty() && !email.trim().is_empty() => {
                Some((name, email))
            }
            _ => None,
        });

    if !std::io::stdin().is_terminal() {
        return Err(identity_setup_hint(
            current_name.as_deref(),
            current_email.as_deref(),
            suggested
                .as_ref()
                .map(|(name, email)| (name.as_str(), email.as_str())),
        ));
    }

    let prefill_name = suggested
        .as_ref()
        .map(|(name, _)| name.clone())
        .or_else(|| current_name.clone())
        .unwrap_or_default();
    let prefill_email = suggested
        .as_ref()
        .map(|(_, email)| email.clone())
        .or_else(|| current_email.clone())
        .unwrap_or_default();

    let mut configured_name = current_name;
    let mut configured_email = current_email;

    if configured_name.is_none() {
        let name: String = Input::with_theme(&ColorfulTheme::default())
            .with_prompt("Git commit author name")
            .with_initial_text(prefill_name)
            .interact_text()
            .map_err(|e| format!("Failed to read git author name: {}", e))?;
        let trimmed = name.trim().to_string();
        if trimmed.is_empty() {
            return Err("Git commit author name cannot be empty.".to_string());
        }
        git_output(project_root, &["config", "user.name", trimmed.as_str()]).await?;
        configured_name = Some(trimmed);
    }

    if configured_email.is_none() {
        let email: String = Input::with_theme(&ColorfulTheme::default())
            .with_prompt("Git commit author email")
            .with_initial_text(prefill_email)
            .interact_text()
            .map_err(|e| format!("Failed to read git author email: {}", e))?;
        let trimmed = email.trim().to_string();
        if trimmed.is_empty() {
            return Err("Git commit author email cannot be empty.".to_string());
        }
        git_output(project_root, &["config", "user.email", trimmed.as_str()]).await?;
        configured_email = Some(trimmed);
    }

    if configured_name.is_some() && configured_email.is_some() {
        Ok(())
    } else {
        Err("Git commit identity is still incomplete after prompting.".to_string())
    }
}

async fn format_git_commit_failure(project_root: &Path, error: &str) -> String {
    if is_missing_git_identity_error(error) {
        let suggested = SshConfig::load()
            .ok()
            .and_then(|config| config.cli_auth)
            .and_then(|auth| match (auth.user_name, auth.user_email) {
                (Some(name), Some(email))
                    if !name.trim().is_empty() && !email.trim().is_empty() =>
                {
                    Some((name, email))
                }
                _ => None,
            });

        return identity_setup_hint(
            git_output(project_root, &["config", "--get", "user.name"])
                .await
                .ok()
                .as_deref(),
            git_output(project_root, &["config", "--get", "user.email"])
                .await
                .ok()
                .as_deref(),
            suggested
                .as_ref()
                .map(|(name, email)| (name.as_str(), email.as_str())),
        );
    }

    if is_missing_lefthook_error(error) {
        return format!(
            "The commit hook tried to load lefthook from the current repo but the module was missing.\n\
Run `pnpm install` or `npm install` in the repo that owns the hook, or fix the hook path so it resolves from the current checkout.\n\
If you want to keep moving, rerun the commit with hooks disabled by setting `LEFTHOOK=0` / `HUSKY=0` or `git commit --no-verify`.\n\
Raw error: {error}"
        );
    }

    if is_husky_or_pre_commit_hook_error(error) {
        let husky_hint = if project_root.join(".husky").is_dir() {
            "\nThis repo has a `.husky/` pre-commit hook. Common blockers: broken shebang order, \
`pnpm test` on every commit, or formatters (ultracite/biome) scanning the whole tree."
        } else {
            ""
        };
        return format!(
            "Git commit was blocked by a pre-commit hook (husky/lefthook/lint).\n\
XBP-only commits under `.xbp/` are retried automatically with hooks disabled.\n\
To fix hooks: inspect `.husky/pre-commit`, ensure the shebang is the first line, and avoid running full-repo `pnpm test` / format on unrelated paths.\n\
Workaround: `HUSKY=0 git commit --no-verify` (or `LEFTHOOK=0`).{husky_hint}\n\
Raw error: {error}"
        );
    }

    format!("Git commit failed: {}", error)
}

fn identity_setup_hint(
    current_name: Option<&str>,
    current_email: Option<&str>,
    suggested: Option<(&str, &str)>,
) -> String {
    let mut lines = vec![
        "Git blocked the commit because your author identity is not configured in this environment."
            .to_string(),
    ];
    if current_name.is_none() {
        lines.push("Missing `user.name`.".to_string());
    }
    if current_email.is_none() {
        lines.push("Missing `user.email`.".to_string());
    }
    if let Some((name, email)) = suggested {
        lines.push(format!(
            "XBP found a likely identity to prefill: {} <{}>",
            name, email
        ));
        lines.push(format!("Run `git config --local user.name \"{}\"`", name));
        lines.push(format!("Run `git config --local user.email \"{}\"`", email));
    } else {
        lines.push("Set them with `git config --global user.name \"Floris\"` and `git config --global user.email \"you@example.com\"`."
            .to_string());
        lines.push(
            "Use `--global` for all repos, or omit it for the current repo only.".to_string(),
        );
    }
    lines.join("\n")
}

fn is_missing_git_identity_error(error: &str) -> bool {
    error.contains("Author identity unknown")
        || error.contains("empty ident name")
        || error.contains("Please tell me who you are")
}

fn is_missing_lefthook_error(error: &str) -> bool {
    let lower = error.to_ascii_lowercase();
    (lower.contains("lefthook") && lower.contains("module not found"))
        || (lower.contains("lefthook") && lower.contains("cannot find module"))
}

/// Normalize paths for `git add`/`git commit` pathspecs.
///
/// Pathspecs must be relative to the **git repository root** (toplevel), because
/// git reports cached names that way and pathspecs are resolved from the command
/// cwd — which we always set to the toplevel in [`commit_paths`].
///
/// `project_root` may be a nested xbp package (e.g. `packages/athena-js`). Relative
/// paths from version bump/release are interpreted relative to that project root
/// first, then rewritten under the monorepo root.
fn normalize_commit_paths(
    repo_root: &Path,
    project_root: &Path,
    paths: &[PathBuf],
) -> Vec<String> {
    let mut deduped = BTreeSet::new();

    let nested_prefix = strip_project_root_prefix(repo_root, project_root)
        .or_else(|| {
            project_root
                .strip_prefix(repo_root)
                .ok()
                .map(|p| p.to_path_buf())
        })
        .map(|p| p.to_string_lossy().replace('\\', "/"))
        .map(|s| s.trim_matches('/').to_string())
        .filter(|s| !s.is_empty() && s != ".");

    for path in paths {
        if path.as_os_str().is_empty() {
            continue;
        }

        let Some(rendered) =
            path_to_repo_relative_pathspec(repo_root, project_root, nested_prefix.as_deref(), path)
        else {
            continue;
        };

        let trimmed = rendered.trim();
        if !trimmed.is_empty() && trimmed != "." {
            deduped.insert(trimmed.to_string());
        }
    }

    deduped.into_iter().collect()
}

fn path_to_repo_relative_pathspec(
    repo_root: &Path,
    project_root: &Path,
    nested_prefix: Option<&str>,
    path: &Path,
) -> Option<String> {
    // 1) Absolute path under the git toplevel.
    if path.is_absolute() {
        if let Ok(relative) = path.strip_prefix(repo_root) {
            return Some(relative.to_string_lossy().replace('\\', "/"));
        }
        if let Some(relative) = strip_project_root_prefix(repo_root, path) {
            return Some(relative.to_string_lossy().replace('\\', "/"));
        }
        // Absolute under nested project root → prefix with monorepo-relative package path.
        if let Ok(relative) = path.strip_prefix(project_root) {
            return Some(join_nested_prefix(
                nested_prefix,
                &relative.to_string_lossy().replace('\\', "/"),
            ));
        }
        if let Some(relative) = strip_project_root_prefix(project_root, path) {
            return Some(join_nested_prefix(
                nested_prefix,
                &relative.to_string_lossy().replace('\\', "/"),
            ));
        }
        // Last resort: keep as-is (may still work if already monorepo-relative absolute).
        return Some(path.to_string_lossy().replace('\\', "/"));
    }

    let relative = path.to_string_lossy().replace('\\', "/");
    let relative = relative.trim_start_matches("./");
    if relative.is_empty() || relative == "." {
        return None;
    }

    // 2) Nested xbp package: treat bare relative paths as package-local
    // (package.json → packages/athena-js/package.json). Prefer this over a
    // same-named monorepo-root file when project_root is nested.
    if let Some(prefix) = nested_prefix {
        if relative == prefix || relative.starts_with(&format!("{prefix}/")) {
            return Some(relative.to_string());
        }
        return Some(join_nested_prefix(Some(prefix), relative));
    }

    // 3) Plain relative path (repo-root project).
    Some(relative.to_string())
}

fn join_nested_prefix(nested_prefix: Option<&str>, relative: &str) -> String {
    let relative = relative.trim_start_matches('/');
    match nested_prefix {
        Some(prefix) if !relative.is_empty() => format!("{prefix}/{relative}"),
        Some(prefix) => prefix.to_string(),
        None => relative.to_string(),
    }
}

fn strip_project_root_prefix(project_root: &Path, path: &Path) -> Option<PathBuf> {
    let root = project_root
        .to_string_lossy()
        .replace('\\', "/")
        .trim_end_matches('/')
        .to_string();
    let candidate = path.to_string_lossy().replace('\\', "/");

    if candidate.len() <= root.len() {
        return None;
    }

    let (prefix, suffix) = candidate.split_at(root.len());
    if prefix.eq_ignore_ascii_case(&root) && suffix.starts_with('/') {
        return Some(PathBuf::from(suffix.trim_start_matches('/')));
    }

    None
}

pub fn summarize_git_push_error(
    remote: &str,
    branch: &str,
    primary_error: &str,
    fallback_error: &str,
) -> String {
    let corpus = format!("{primary_error}\n{fallback_error}");
    let corpus_lower = corpus.to_ascii_lowercase();

    // Prefer the *retry* (fallback) error when it is a large-file rejection even if the
    // first attempt was non-fast-forward — otherwise GH001 is masked as "behind remote".
    if is_github_large_file_push_error(&corpus_lower) {
        return summarize_github_large_file_error(primary_error, fallback_error);
    }

    if is_non_fast_forward_push_error(&corpus_lower) {
        return format!(
            "`{branch}` is behind `{remote}/{branch}`. Run `git pull --rebase {remote} {branch}`, then `git push`."
        );
    }

    if corpus_lower.contains("authentication failed")
        || corpus_lower.contains("could not read username")
        || corpus_lower.contains("403")
        || corpus_lower.contains("401")
    {
        return "Git authentication failed while pushing. Refresh your GitHub credentials and try again."
            .to_string();
    }

    let lines = dedupe_git_error_lines(primary_error, fallback_error);
    lines
        .into_iter()
        .last()
        .unwrap_or_else(|| "git push failed".to_string())
}

fn summarize_github_large_file_error(primary_error: &str, fallback_error: &str) -> String {
    let lines = dedupe_git_error_lines(primary_error, fallback_error);
    let detail = lines
        .iter()
        .find(|line| {
            let lower = line.to_ascii_lowercase();
            lower.contains("file ")
                && (lower.contains("mb") || lower.contains("exceeds") || lower.contains("gh001"))
        })
        .cloned()
        .or_else(|| lines.last().cloned())
        .unwrap_or_else(|| "GitHub rejected a blob over 100 MiB".to_string());

    format!(
        "GitHub rejected the push because a file exceeds the 100 MiB limit ({detail}). \
XBP auto-excludes oversized files from new commits and rewrites *unpushed* history when possible. \
If this persists, remove the blob from unpushed commits (`git reset --soft origin/<branch>`, unstage the file, recommit) or use Git LFS."
    )
}

fn dedupe_git_error_lines(primary_error: &str, fallback_error: &str) -> Vec<String> {
    let mut seen = BTreeSet::new();
    let mut lines = Vec::new();

    for line in primary_error.lines().chain(fallback_error.lines()) {
        let trimmed = line.trim();
        if trimmed.is_empty() || trimmed.starts_with("hint:") {
            continue;
        }
        let key = trimmed.to_ascii_lowercase();
        if seen.insert(key) {
            lines.push(trimmed.to_string());
        }
    }

    lines
}

fn repo_name(path: &Path) -> String {
    path.file_name()
        .and_then(|value| value.to_str())
        .filter(|value| !value.trim().is_empty())
        .unwrap_or("repository")
        .to_string()
}

#[cfg(test)]
mod tests {
    use super::{
        enrich_rebase_error, explicit_push_requested, is_commit_hook_failure,
        is_dirty_worktree_rebase_error, is_github_large_file_push_error,
        is_husky_or_pre_commit_hook_error, is_missing_git_identity_error,
        is_missing_lefthook_error, is_nothing_to_stash_message, is_non_fast_forward_push_error,
        is_xbp_managed_commit, normalize_commit_paths, reset_explicit_push, set_explicit_push,
        split_remote_branch, summarize_git_push_error,
    };
    use std::path::{Path, PathBuf};

    #[test]
    fn xbp_managed_commit_detects_config_only_paths() {
        assert!(is_xbp_managed_commit(&[".xbp/xbp.yaml".to_string()]));
        assert!(is_xbp_managed_commit(&[
            ".xbp/xbp.yaml".to_string(),
            "package.json".to_string(),
            "pnpm-workspace.yaml".to_string(),
        ]));
        assert!(!is_xbp_managed_commit(&[
            ".xbp/xbp.yaml".to_string(),
            "src/app.ts".to_string(),
        ]));
        assert!(!is_xbp_managed_commit(&[]));
    }

    #[test]
    fn detects_husky_pre_commit_failures() {
        assert!(is_commit_hook_failure(
            "husky - pre-commit script failed (code 1)"
        ));
        assert!(is_husky_or_pre_commit_hook_error(
            "`git commit -m chore` failed: husky - pre-commit script failed (code 1)"
        ));
        assert!(is_commit_hook_failure(
            "Ultracite found issues that could not be auto-fixed."
        ));
    }

    #[test]
    fn normalizes_commit_paths_relative_to_project_root() {
        let repo_root = Path::new("C:/repo");
        let project_root = Path::new("C:/repo");
        let paths = vec![
            PathBuf::from("C:/repo/.xbp/xbp.yaml"),
            PathBuf::from("C:/repo/.xbp/xbp.yaml"),
            PathBuf::from("CHANGELOG.md"),
        ];

        let normalized = normalize_commit_paths(repo_root, project_root, &paths);

        assert_eq!(
            normalized,
            vec![".xbp/xbp.yaml".to_string(), "CHANGELOG.md".to_string()]
        );
    }

    #[test]
    fn normalizes_nested_package_paths_to_monorepo_relative_pathspecs() {
        // Reproduces: xbp version bump from packages/athena-js with nearest .xbp config
        // producing pathspecs packages/athena-js/* while git cwd was the package dir.
        let repo_root = Path::new("C:/repo");
        let project_root = Path::new("C:/repo/packages/athena-js");
        let paths = vec![
            PathBuf::from("C:/repo/packages/athena-js/package.json"),
            PathBuf::from("package.json"),
            PathBuf::from(".xbp/xbp.yaml"),
            PathBuf::from("README.md"),
            PathBuf::from("package-lock.json"),
        ];

        let normalized = normalize_commit_paths(repo_root, project_root, &paths);

        assert_eq!(
            normalized,
            vec![
                "packages/athena-js/.xbp/xbp.yaml".to_string(),
                "packages/athena-js/README.md".to_string(),
                "packages/athena-js/package-lock.json".to_string(),
                "packages/athena-js/package.json".to_string(),
            ]
        );
    }

    #[test]
    fn keeps_already_monorepo_relative_nested_paths() {
        let repo_root = Path::new("C:/repo");
        let project_root = Path::new("C:/repo/packages/athena-js");
        let paths = vec![PathBuf::from("packages/athena-js/package.json")];

        let normalized = normalize_commit_paths(repo_root, project_root, &paths);

        assert_eq!(
            normalized,
            vec!["packages/athena-js/package.json".to_string()]
        );
    }

    #[test]
    fn detects_missing_git_identity_errors() {
        assert!(is_missing_git_identity_error(
            "Author identity unknown\n*** Please tell me who you are."
        ));
    }

    #[test]
    fn detects_lefthook_module_errors() {
        assert!(is_missing_lefthook_error(
            "Error: Cannot find module 'C:\\\\repo\\\\node_modules\\\\lefthook\\\\bin\\\\index.js'"
        ));
    }

    #[test]
    fn summarizes_non_fast_forward_push_errors_without_git_hints() {
        let primary = "! [rejected] main -> main (non-fast-forward)";
        let fallback = r#"error: failed to push some refs to 'https://github.com/xylex-group/xbp.git'
hint: Updates were rejected because the tip of your current branch is behind
hint: its remote counterpart. If you want to integrate the remote changes,
hint: use 'git pull' before pushing again."#;

        let summary = summarize_git_push_error("origin", "main", primary, fallback);

        assert!(summary.contains("behind `origin/main`"));
        assert!(summary.contains("git pull --rebase origin main"));
        assert!(!summary.contains("hint:"));
        assert!(!summary.contains("git push -u origin main"));
    }

    #[test]
    fn summarizes_behind_errors_with_detected_remote_name() {
        let primary = "! [rejected] cleanup-sql -> cleanup-sql (non-fast-forward)";
        let fallback = "error: failed to push some refs to 'https://github.com/acme/speedrun-formations.git'";

        let summary = summarize_git_push_error("origin", "cleanup-sql", primary, fallback);

        assert!(summary.contains("cleanup-sql"));
        assert!(summary.contains("git pull --rebase origin cleanup-sql"));
    }

    #[test]
    fn detects_dirty_worktree_rebase_errors() {
        assert!(is_dirty_worktree_rebase_error(
            "error: cannot pull with rebase: You have unstaged changes.\nerror: Please commit or stash them."
        ));
        assert!(is_dirty_worktree_rebase_error(
            "`git pull --rebase origin main` failed: error: cannot pull with rebase: You have unstaged changes."
        ));
        assert!(!is_dirty_worktree_rebase_error(
            "CONFLICT (content): Merge conflict in Cargo.toml"
        ));
        assert!(is_nothing_to_stash_message("No local changes to save"));
        let enriched = enrich_rebase_error(
            "error: cannot pull with rebase: You have unstaged changes.",
        );
        assert!(enriched.contains("Dirty worktree blocked rebase"));
    }

    #[test]
    fn detects_non_fast_forward_push_errors() {
        assert!(is_non_fast_forward_push_error(
            "! [rejected] main -> main (non-fast-forward)"
        ));
        assert!(is_non_fast_forward_push_error(
            "failed to push some refs\ntip of your current branch is behind"
        ));
        assert!(!is_non_fast_forward_push_error(
            "authentication failed for 'https://github.com/acme/repo.git'"
        ));
        // GitHub large-file pre-receive must NOT look like "behind remote".
        let gh001 = r#"remote: error: File foundry/instagram.db is 132.42 MB; this exceeds GitHub's file size limit of 100.00 MB
remote: error: GH001: Large files detected. You may want to try Git Large File Storage - https://git-lfs.github.com.
! [remote rejected] main -> main (pre-receive hook declined)
error: failed to push some refs to 'https://github.com/acme/repo.git'"#;
        assert!(is_github_large_file_push_error(gh001));
        assert!(!is_non_fast_forward_push_error(gh001));
        let summary = summarize_git_push_error("origin", "main", gh001, gh001);
        assert!(summary.to_ascii_lowercase().contains("100 mib"));
        assert!(!summary.contains("behind `origin/main`"));
    }

    #[test]
    fn summarize_prefers_large_file_error_after_non_fast_forward() {
        let primary = "! [rejected] main -> main (non-fast-forward)";
        let fallback = r#"remote: error: File foundry/instagram.db is 132.42 MB; this exceeds GitHub's file size limit of 100.00 MB
remote: error: GH001: Large files detected.
! [remote rejected] main -> main (pre-receive hook declined)
error: failed to push some refs"#;
        let summary = summarize_git_push_error("origin", "main", primary, fallback);
        assert!(summary.to_ascii_lowercase().contains("100 mib") || summary.contains("GH001") || summary.contains("instagram.db"));
        assert!(!summary.contains("behind `origin/main`"));
    }

    #[test]
    fn explicit_push_flag_tracks_cli_override() {
        reset_explicit_push();
        assert!(!explicit_push_requested());
        set_explicit_push(true);
        assert!(explicit_push_requested());
        reset_explicit_push();
        assert!(!explicit_push_requested());
    }

    #[test]
    fn splits_upstream_into_remote_and_branch() {
        assert_eq!(
            split_remote_branch("origin/cleanup-sql"),
            Some(("origin".to_string(), "cleanup-sql".to_string()))
        );
        assert_eq!(
            split_remote_branch("upstream/feature/foo"),
            Some(("upstream".to_string(), "feature/foo".to_string()))
        );
        assert_eq!(split_remote_branch("origin"), None);
    }
}