gitmaster_flash.py

#!/usr/bin/env python3
"""gitmaster_flash — fast terminal (TUI) overview of every Git repo below the
current directory, so you can tidy up many repos quickly.

Green = clean and in sync with the configured remote; red/yellow = needs
attention (modified/deleted/untracked files, merge conflicts, stashes, commits
ahead/behind). Problem repos sort to the top.

Keys (all shown in the footer, nothing to memorize; case-insensitive — f == F):
  ↑/↓   select a repo
  →     expand (shows files with M/D/U/C and stashes)
  ←     collapse
  ⏎     quit and cd into the repo in your terminal
        (needs the shell wrapper `gmf` from gmf.zsh — a child process cannot
        change the parent shell's working directory)
  F/…   open the repo in a configured app (see config.json)
  C     commit helper: suggests what to commit and what to .gitignore
  P     safely push the current branch to the private sync remote
  L     safely fast-forward the current branch from the private sync remote
  G     guarded GitHub push (preview + typed confirmation; branch only, no tags)
  H     explain the Git safety rules
  U     apply the latest stash (git stash pop, with confirmation)
  S     view the latest stash as a diff (read-only, scrollable)
  D     drop the latest stash (git stash drop, with confirmation)
  R     reload everything incl. `git fetch --all` (shows progress)
  Q     quit

Non-interactive: with --list / --json (or no TTY) it prints the overview as text
or JSON (machine-readable). Exit code 1 if any repo needs attention.

Two machines: `--diff HOST` compares this machine's repos with another one over
ssh and prints only the differences (read-only, never changes anything). The only
requirement is that `ssh HOST` works — gitmaster_flash does NOT need to be
installed there: the script is piped over stdin, so both sides always run the
exact same version. Remotes live in .git/config and are never carried by git
itself, so they drift silently between machines — that is what this finds.

Try it risk-free: `gitmaster_flash.py --demo` builds a throwaway sandbox of fake
repos in every state and opens the UI on it (also used for the README screenshots).

Config: ~/.config/gitmaster_flash/config.json (created on first run). Configurable:
app keys, the sync-remote match, scan exclusions, and UI language (en/de).
"""

from __future__ import annotations

import argparse
import concurrent.futures
import curses
import hashlib
import json
import os
import posixpath
import shlex
import stat
import subprocess
import sys
import tempfile
import unicodedata
import urllib.parse
from dataclasses import dataclass, field
from pathlib import Path

__version__ = "0.9.2"

CONFIG_PATH = Path.home() / ".config" / "gitmaster_flash" / "config.json"

# Defaults; die geschriebene config.json darf einzelne Schlüssel überschreiben.
# Bewusst generisch gehalten: eigene Editoren/Remote-Namen setzt man in der Config.
DEFAULT_CONFIG = {
    # Taste -> App zum Öffnen des Repo-Ordners (macOS `open -a`). Die Taste
    # erscheint automatisch im Footer ("E Editor"). Beispiel für weitere:
    #   "Z": {"name": "Zed", "path": "/Applications/Zed.app"}   (freie Taste waehlen)
    "apps": {
        "E": {"name": "Editor", "path": "/Applications/Visual Studio Code.app"},
    },
    # Woran der Sync-Remote erkannt wird: Remote-Name ODER Host in der URL.
    "sync_remote_names": ["origin"],
    "sync_remote_hosts": [],
    # Ordner, in die der Repo-Scan gar nicht erst hineinschaut (Tempo).
    "skip_dirs": ["node_modules", "Library", ".Trash", "venv", ".venv", "__pycache__"],
    # UI-Sprache: "en", "de" oder null = automatisch aus $LANG (Fallback en).
    "lang": None,
    # Timeout in Sekunden für einzelne git-Aufrufe (fetch darf länger).
    "git_timeout": 10,
    "fetch_timeout": 30,
}

# Muster für die Commit-Hilfe: Dateien, die typischerweise in .gitignore gehören.
# (basename_oder_teil, ist_verzeichnis, gitignore_zeile)
IGNORE_RULES = [
    ("node_modules", True, "node_modules/"),
    ("__pycache__", True, "__pycache__/"),
    (".venv", True, ".venv/"),
    ("venv", True, "venv/"),
    ("dist", True, "dist/"),
    ("build", True, "build/"),
    (".idea", True, ".idea/"),
    (".pytest_cache", True, ".pytest_cache/"),
    (".mypy_cache", True, ".mypy_cache/"),
    (".ruff_cache", True, ".ruff_cache/"),
    (".DS_Store", False, ".DS_Store"),
    ("Thumbs.db", False, "Thumbs.db"),
    (".env", False, ".env"),
]
IGNORE_SUFFIXES = {".pyc": "*.pyc", ".log": "*.log", ".tmp": "*.tmp"}


# ---------------------------------------------------------------------------
# i18n — kleine Übersetzungsschicht (Englisch = Basis, Deutsch optional)
# ---------------------------------------------------------------------------

UI_LANG = "en"  # von main() gesetzt; Tests nutzen die englische Basis.

TR = {
    # Fortschritt / Kopf
    "reading": {"en": "Reading repos", "de": "Lese Repos"},
    "fetching": {"en": "Fetching from remote", "de": "Hole Stand vom Remote (fetch)"},
    "hdr_repos": {"en": "repos", "de": "Repos"},
    # --diff (two machines)
    "diff_here": {"en": "here", "de": "hier"},
    "diff_same": {"en": "No differences to {h}.", "de": "Kein Unterschied zu {h}."},
    "diff_need_host": {"en": "--diff needs a host, e.g. --diff mymac",
                       "de": "--diff braucht einen Host, z.B. --diff meinmac"},
    "diff_ssh_failed": {"en": "Cannot reach {h}: {e}", "de": "{h} nicht erreichbar: {e}"},
    "diff_version": {
        "en": "! version differs: {a} {va} vs {b} {vb} — compare with care",
        "de": "! Version verschieden: {a} {va} vs. {b} {vb} — Vergleich mit Vorsicht lesen"},
    # {m}/{a}/{b} kommen vorformatiert aus _loc(): "hier" bleibt nackt,
    # Hostnamen bekommen "auf"/"on" — deshalb steht die Praeposition NICHT im Text.
    "diff_on": {"en": "on {m}", "de": "auf {m}"},
    "diff_only_on": {"en": "only {m}: {rel}", "de": "nur {m}: {rel}"},
    "diff_remote_missing": {
        "en": "DRIFT  {rel}: remote '{r}' only {m} (git never transfers remotes)",
        "de": "DRIFT  {rel}: Remote '{r}' nur {m} (Git uebertraegt Remotes nie)"},
    "diff_remote_state": {
        "en": "DRIFT  {rel}: {r} is {aa} ahead/{ab} behind {a}, {ba}/{bb} {b}",
        "de": "DRIFT  {rel}: {r} {a} {aa} voraus/{ab} zurueck, {b} {ba}/{bb}"},
    "diff_sync_even": {
        "en": "SYNC   {rel}: {r} {aa} ahead/{ab} behind on both machines",
        "de": "SYNC   {rel}: {r} auf beiden Rechnern {aa} voraus/{ab} zurueck"},
    "diff_branch": {"en": "local  {rel}: [{ba}] {a}, [{bb}] {b}",
                    "de": "lokal  {rel}: [{ba}] {a}, [{bb}] {b}"},
    "diff_dirty": {"en": "local  {rel}: {n} changed/new file(s) {m}",
                   "de": "lokal  {rel}: {n} geaenderte/neue Datei(en) {m}"},
    "diff_repo_field": {
        "en": "DRIFT  {rel}: {field} is {va} {a}, {vb} {b}",
        "de": "DRIFT  {rel}: {field} {a}={va}, {b}={vb}"},
    "diff_remote_security": {
        "en": "DRIFT  {rel}: security/endpoint identity for {r} differs",
        "de": "DRIFT  {rel}: Sicherheit/Ziel-Identität für {r} unterscheidet sich"},
    "hdr_review": {"en": "{n} to review", "de": "{n} zu prüfen"},
    "hdr_clean": {"en": "all clean ✔", "de": "alles sauber ✔"},
    # Repo-Zeile
    "clean_synced": {"en": "✔ clean & synced", "de": "✔ sauber & synchron"},
    "no_sync_remote": {"en": "no sync remote", "de": "kein Sync-Remote"},
    "branch_not_on": {"en": "branch '{b}' not on {r}", "de": "Branch '{b}' nicht auf {r}"},
    "detached": {"en": "detached HEAD", "de": "detached HEAD"},
    "error_prefix": {"en": "ERROR: {e}", "de": "FEHLER: {e}"},
    "conflict_n": {"en": "conflict:{n}", "de": "Konflikt:{n}"},
    # Detailzeilen
    "conflict_label": {"en": "C=conflict ", "de": "C=Konflikt "},
    "stash_row_hint": {"en": "(U pop · S preview · D drop)",
                       "de": "(U anwenden · S Vorschau · D verwerfen)"},
    "no_changes": {"en": "(no changes)", "de": "(keine Änderungen)"},
    # Footer
    "f1": {"en": " ↑/↓ select · → expand · ← collapse · ⏎ cd & quit · P sync push · L sync pull",
           "de": " ↑/↓ wählen · → aufklappen · ← zuklappen · ⏎ cd & Exit · P Sync-Push · L Sync-Pull"},
    "f2": {"en": " {apps} · C commit · U stash pop · R fetch all · G GitHub push",
           "de": " {apps} · C Commit · U Stash pop · R fetch all · G GitHub-Push"},
    "f3": {"en": " Q quit · S stash preview · D stash drop · H Git help",
           "de": " Q Beenden · S Stash-Vorschau · D Stash verwerfen · H Git-Hilfe"},
    "yesno": {"en": "  (Y/N)", "de": "  (J/N)"},
    # Apps
    "app_not_found": {"en": "App not found: {p} (edit config.json)",
                      "de": "App nicht gefunden: {p} (config.json anpassen)"},
    "app_opened": {"en": "Opened {name}: {rel}", "de": "{name} geöffnet: {rel}"},
    "app_open_failed": {"en": "Failed to open {name}: {e}",
                        "de": "{name} öffnen fehlgeschlagen: {e}"},
    "cd_hint": {"en": "(Tip: install the `gmf` shell wrapper from gmf.zsh, "
                      "then you land there automatically.)",
                "de": "(Tipp: Shell-Wrapper `gmf` aus gmf.zsh installieren, "
                      "dann landet man automatisch dort.)"},
    # Stash
    "no_stash": {"en": "No stash in this repo.", "de": "Kein Stash in diesem Repo."},
    "resolve_conflicts_first": {
        "en": "Resolve the merge conflicts first (open the repo with an app key), "
              "then press U again.",
        "de": "Erst die Merge-Konflikte auflösen (App-Taste öffnet das Repo), "
              "dann erneut U drücken."},
    "confirm_pop": {"en": "Apply latest stash in '{rel}' (git stash pop)?",
                    "de": "Neuesten Stash in '{rel}' anwenden (git stash pop)?"},
    "cancelled": {"en": "Cancelled.", "de": "Abgebrochen."},
    "stash_applied": {"en": "Stash applied in {rel}.", "de": "Stash angewendet in {rel}."},
    "stash_conflict": {
        "en": "Stash created {n} merge conflict(s) — the stash is kept. "
              "Open the repo with an app key and resolve.",
        "de": "Stash erzeugte {n} Merge-Konflikt(e) — Stash bleibt erhalten. "
              "Repo mit einer App-Taste öffnen und auflösen."},
    "stash_pop_failed": {"en": "stash pop failed: {e}", "de": "stash pop fehlgeschlagen: {e}"},
    "empty_diff": {"en": "(empty diff)", "de": "(leerer Diff)"},
    "stash_preview_failed": {"en": "Stash preview failed: {e}",
                              "de": "Stash-Vorschau fehlgeschlagen: {e}"},
    "stash_preview_empty": {
        "en": "(stash exists, but Git produced no displayable patch)",
        "de": "(Stash vorhanden, aber Git erzeugte keinen darstellbaren Patch)"},
    "stash_preview_title": {"en": "Stash preview · {rel} · {s}",
                            "de": "Stash-Vorschau · {rel} · {s}"},
    "confirm_drop": {"en": "Drop latest stash in '{rel}' PERMANENTLY "
                           "(git stash drop)? Cannot be undone.",
                     "de": "Neuesten Stash in '{rel}' ENDGÜLTIG verwerfen "
                           "(git stash drop)? Nicht rückgängig machbar."},
    "drop_cancelled": {"en": "Cancelled — stash kept.",
                       "de": "Abgebrochen — Stash bleibt erhalten."},
    "stash_dropped": {"en": "Stash dropped in {rel}.", "de": "Stash verworfen in {rel}."},
    "stash_drop_failed": {"en": "stash drop failed: {e}",
                          "de": "stash drop fehlgeschlagen: {e}"},
    # Pager
    "pager_footer": {"en": " ↑/↓ scroll · Q/Esc close · line {a}-{b} / {n}",
                     "de": " ↑/↓ scrollen · Q/Esc schließen · Zeile {a}-{b} / {n}"},
    # Commit-Hilfe
    "commit_title": {"en": "Commit helper · {rel} — review, then ⏎",
                     "de": "Commit-Hilfe · {rel} — Vorschlag prüfen, dann ⏎"},
    "to_gitignore": {"en": "→ .gitignore ({p})", "de": "→ .gitignore ({p})"},
    "do_commit": {"en": "✔ commit", "de": "✔ committen"},
    "do_skip": {"en": "✘ skip", "de": "✘ auslassen"},
    "commit_footer": {"en": " ␣ commit on/off · i gitignore on/off · ⏎ next · Esc cancel",
                      "de": " ␣ committen an/aus · i gitignore an/aus · ⏎ weiter · Esc abbrechen"},
    "commit_cancelled": {"en": "Commit helper cancelled.", "de": "Commit-Hilfe abgebrochen."},
    "nothing_selected": {"en": "Nothing selected.", "de": "Nichts ausgewählt."},
    "commit_in": {"en": "Commit in {rel}", "de": "Commit in {rel}"},
    "new_in_gitignore": {"en": "New in .gitignore:", "de": "Neu in .gitignore:"},
    "to_commit_n": {"en": "To commit: {n} file(s)", "de": "Zu committen: {n} Datei(en)"},
    "recent_msgs": {"en": "Recent commit messages (style reference):",
                    "de": "Letzte Commit-Messages (Stil-Vorlage):"},
    "commit_msg_prompt": {"en": "Commit message: ", "de": "Commit-Message: "},
    "empty_msg": {"en": "Empty message — cancelled.", "de": "Leere Message — abgebrochen."},
    "git_add_failed": {"en": "git add failed: {e}", "de": "git add fehlgeschlagen: {e}"},
    "commit_failed": {"en": "Commit failed: {e}", "de": "Commit fehlgeschlagen: {e}"},
    "commit_conflicts": {
        "en": "Commit helper is blocked while merge conflicts exist.",
        "de": "Die Commit-Hilfe ist gesperrt, solange Merge-Konflikte bestehen."},
    "committed_in": {"en": "Committed in {rel}.", "de": "Committet in {rel}."},
    "confirm_push": {"en": "Push {n} commit(s) to {r} now?",
                     "de": "Jetzt {n} Commit(s) zu {r} pushen?"},
    "committed_pushed": {"en": "Committed & pushed ({r}).", "de": "Committet & gepusht ({r})."},
    "push_failed": {"en": "Push failed (Git exit code {code}).",
                    "de": "Push fehlgeschlagen (Git-Exit-Code {code})."},
    "pull_failed": {"en": "Fast-forward failed (Git exit code {code}).",
                    "de": "Fast-forward fehlgeschlagen (Git-Exit-Code {code})."},
    "nothing_to_commit": {"en": "Nothing to commit in this repo.",
                          "de": "Nichts zu committen in diesem Repo."},
    # Sichere Push-/Pull-Hilfe
    "no_sync_for_action": {"en": "No sync remote is configured for this repository.",
                           "de": "Für dieses Repo ist kein Sync-Remote konfiguriert."},
    "public_simple_block": {
        "en": "The sync remote is public. Use G for the guarded GitHub preview.",
        "de": "Der Sync-Remote ist öffentlich. Nutze G für die geschützte GitHub-Vorschau."},
    "transfer_fetch_failed": {"en": "Fetch from {r} failed (Git exit code {code}).",
                              "de": "Fetch von {r} fehlgeschlagen (Git-Exit-Code {code})."},
    "transfer_inspect_failed": {
        "en": "Git could not inspect the branch safely; no transfer was attempted.",
        "de": "Git konnte den Branch nicht sicher prüfen; es wurde nichts übertragen."},
    "remote_url_mismatch": {
        "en": "{r} has multiple or differing fetch/push targets; transfer is blocked.",
        "de": "{r} hat mehrere oder abweichende Fetch-/Push-Ziele; Transfer ist gesperrt."},
    "transfer_changed": {
        "en": "Branch, files, index, remote, or target changed after approval; review again.",
        "de": "Branch, Dateien, Index, Remote oder Ziel änderten sich nach der Freigabe; erneut prüfen."},
    "transfer_dirty": {"en": "Working tree is not clean — commit, ignore, or stash first.",
                       "de": "Arbeitsbaum ist nicht sauber — erst committen, ignorieren oder stashen."},
    "transfer_detached": {"en": "Detached HEAD — use the terminal for this special case.",
                          "de": "Detached HEAD — diesen Sonderfall im Terminal bearbeiten."},
    "transfer_missing": {"en": "Branch '{b}' does not exist on {r}; creating remote branches is blocked here.",
                         "de": "Branch '{b}' existiert nicht auf {r}; neue Remote-Branches sind hier gesperrt."},
    "transfer_divergent": {"en": "Local and {r} have diverged ({a} ahead, {b} behind); no automatic reconciliation.",
                           "de": "Lokal und {r} sind divergiert ({a} voraus, {b} zurück); kein automatischer Abgleich."},
    "transfer_behind": {"en": "Local branch is {n} commit(s) behind {r}; pull first.",
                        "de": "Der lokale Branch ist {n} Commit(s) hinter {r}; zuerst pullen."},
    "nothing_to_push": {"en": "Nothing to push to {r}.", "de": "Nichts zu {r} zu pushen."},
    "nothing_to_pull": {"en": "Nothing to pull from {r}.", "de": "Nichts von {r} zu pullen."},
    "confirm_sync_push": {"en": "Push {n} commit(s) to the private sync remote {r}?",
                          "de": "{n} Commit(s) zum privaten Sync-Remote {r} pushen?"},
    "confirm_sync_pull": {"en": "Fast-forward {n} commit(s) from the private sync remote {r}?",
                          "de": "{n} Commit(s) per Fast-forward vom privaten Sync-Remote {r} holen?"},
    "sync_pushed": {"en": "Pushed current branch to {r} (no tags).",
                    "de": "Aktuellen Branch zu {r} gepusht (keine Tags)."},
    "sync_pulled": {"en": "Fast-forwarded current branch from {r}.",
                    "de": "Aktuellen Branch per Fast-forward von {r} geholt."},
    "no_github": {"en": "No GitHub remote in this repository.",
                  "de": "Dieses Repo hat keinen GitHub-Remote."},
    "many_github": {"en": "Several GitHub remotes ({names}); use the terminal to choose deliberately.",
                    "de": "Mehrere GitHub-Remotes ({names}); bitte im Terminal bewusst auswählen."},
    "github_preview": {"en": "GitHub push preview · {rel} → {r}/{b}",
                       "de": "GitHub-Push-Vorschau · {rel} → {r}/{b}"},
    "github_type": {"en": "Type '{phrase}' to publish this branch only: ",
                    "de": "Zum Veröffentlichen nur dieses Branches '{phrase}' eingeben: "},
    "github_cancelled": {"en": "GitHub push cancelled — nothing was published.",
                         "de": "GitHub-Push abgebrochen — nichts wurde veröffentlicht."},
    "github_pushed": {"en": "Published current branch to {r}; no tags were sent.",
                      "de": "Aktuellen Branch zu {r} veröffentlicht; keine Tags übertragen."},
    "github_changed": {"en": "Remote or outgoing files changed after the preview; review again.",
                       "de": "Remote oder ausgehende Dateien änderten sich nach der Vorschau; bitte erneut prüfen."},
    "preview_branch_only": {
        "en": "Branch only: approved OID + target lease, no tags or new remote branch.",
        "de": "Nur Branch: freigegebene OID + Ziel-Lease, keine Tags/neuen Remote-Branches."},
    "preview_privacy": {
        "en": "Review every outgoing commit and file name; this is not an automatic privacy approval.",
        "de": "Jeden ausgehenden Commit und Dateinamen prüfen; dies ist keine automatische Privacy-Freigabe."},
    "outgoing_commits": {"en": "Outgoing commits:", "de": "Ausgehende Commits:"},
    "changed_files": {"en": "Changed files:", "de": "Geänderte Dateien:"},
    "none_label": {"en": "(none)", "de": "(keine)"},
    "git_help_title": {"en": "Safe Git actions", "de": "Sichere Git-Aktionen"},
    "git_help_body": {
        "en": "P  Push only the current branch to the private sync remote.\n"
              "   Requires a clean tree, fetches first, and rejects behind/divergent history.\n\n"
              "L  Pull only from the private sync remote by fast-forward.\n"
              "   Never merges or rebases and refuses dirty/divergent repositories.\n\n"
              "G  Guarded GitHub push. Shows outgoing commits and file names first.\n"
              "   Requires typing PUSH <remote>; pins source and target OIDs and sends no tags.\n"
              "   New or unrelated GitHub branches remain terminal-only special cases.\n\n"
              "R  Fetches all remotes in all repositories; it does not change working trees.",
        "de": "P  Nur den aktuellen Branch zum privaten Sync-Remote pushen.\n"
              "   Verlangt einen sauberen Tree, fetcht zuerst und blockiert Rückstand/Divergenz.\n\n"
              "L  Nur per Fast-forward vom privaten Sync-Remote holen.\n"
              "   Führt nie Merge oder Rebase aus und verweigert dirty/divergente Repos.\n\n"
              "G  Geschützter GitHub-Push mit Vorschau von Commits und Dateinamen.\n"
              "   Verlangt PUSH <Remote>; pinnt Quell-/Ziel-OID und sendet keine Tags.\n"
              "   Neue oder unverbundene GitHub-Branches bleiben Terminal-Sonderfälle.\n\n"
              "R  Fetcht alle Remotes aller Repos; Working Trees bleiben unverändert."},
    # main
    "not_a_dir": {"en": "Not a directory: {p}", "de": "Kein Ordner: {p}"},
    "git_timeout": {"en": "git timeout", "de": "git-Timeout"},
    "demo_built": {"en": "Demo sandbox: {p}\n(fake repos; delete the folder when done)",
                   "de": "Demo-Sandbox: {p}\n(Fake-Repos; Ordner danach löschen)"},
}


def t(key: str, **kw) -> str:
    entry = TR.get(key, {})
    s = entry.get(UI_LANG) or entry.get("en") or key
    return s.format(**kw) if kw else s


def resolve_lang(cfg: dict, override: str | None = None) -> str:
    if override in ("en", "de"):
        return override
    v = (cfg.get("lang") or "").lower()
    if v in ("en", "de"):
        return v
    env = (os.environ.get("LC_ALL") or os.environ.get("LANG") or "").lower()
    return "de" if env.startswith("de") else "en"


# ---------------------------------------------------------------------------
# Konfiguration
# ---------------------------------------------------------------------------

def load_config() -> dict:
    """Config laden; fehlt sie, mit Defaults anlegen (selbsterklärender Start)."""
    cfg = json.loads(json.dumps(DEFAULT_CONFIG))  # tiefe Kopie
    if CONFIG_PATH.exists():
        try:
            cfg.update(json.loads(CONFIG_PATH.read_text()))
        except (json.JSONDecodeError, OSError) as exc:
            print(f"Warning: cannot read {CONFIG_PATH} ({exc}) — using defaults.",
                  file=sys.stderr)
    else:
        CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True)
        CONFIG_PATH.write_text(json.dumps(DEFAULT_CONFIG, indent=2, ensure_ascii=False) + "\n")
    # App-Tasten intern immer groß (Tastendruck wird ebenfalls großgezogen).
    cfg["apps"] = {k.upper(): v for k, v in cfg.get("apps", {}).items()}
    return cfg


# ---------------------------------------------------------------------------
# Git-Datensammlung (reine Logik, testbar)
# ---------------------------------------------------------------------------

@dataclass
class RepoStatus:
    path: Path
    rel: str                      # Pfad relativ zum Scan-Start (Anzeigename)
    branch: str = "?"
    remote: str | None = None     # Name des erkannten Sync-Remotes (z.B. origin)
    remote_state: str = "ok"      # ok | no-remote | no-branch | detached | error
    ahead: int = 0
    behind: int = 0
    # Zusatz-Info: Stand gegenüber dem *konfigurierten Upstream*, falls das ein
    # ANDERER Remote als der Sync-Remote ist (typisch: github). So werden Commits
    # sichtbar, die zwar auf dem Sync-Remote, aber nie z.B. zu GitHub gepusht wurden.
    upstream: str | None = None   # z.B. "github/main"
    upstream_ahead: int = 0
    upstream_behind: int = 0
    remotes: list = field(default_factory=list)  # RemoteStatus, GitHub immer zuletzt
    modified: int = 0
    deleted: int = 0
    untracked: int = 0
    conflicts: int = 0            # ungemergte Dateien (Merge-Konflikt, z.B. nach stash pop)
    files: list = field(default_factory=list)   # [(Buchstabe M/D/U/C, Pfad), ...]
    stashes: list = field(default_factory=list)  # ["stash@{0} WIP ...", ...]
    error: str = ""

    @property
    def dirty(self) -> bool:
        return bool(self.modified or self.deleted or self.untracked or self.conflicts)

    @property
    def clean_and_synced(self) -> bool:
        return (not self.dirty and not self.stashes and self.ahead == 0
                and self.behind == 0 and self.remote_state == "ok")

    def severity(self) -> int:
        """Sortierschlüssel: Problematisches nach oben."""
        if self.error:
            return 0
        if self.dirty or self.stashes:
            return 1
        if self.ahead or self.behind:
            return 2
        if self.remote_state != "ok":
            return 3
        return 4


@dataclass
class RemoteStatus:
    """Anzeigezustand eines Remotes für den aktuellen Branch.

    URLs bleiben absichtlich aus UI/JSON heraus. `public` wird ausschließlich aus
    der URL-Klasse abgeleitet; dadurch kann auch ein Remote namens `origin`
    verständlich und mit der GitHub-Sicherheitsstufe behandelt werden.
    """

    name: str
    public: bool = False
    mixed_public: bool = False
    is_sync: bool = False
    branch_exists: bool = False
    ahead: int = 0
    behind: int = 0
    fetch_fingerprint: str = ""
    push_fingerprints: list[str] = field(default_factory=list)
    target_mismatch: bool = False
    multiple_pushurls: bool = False

    @property
    def transfer_safe(self) -> bool:
        return not (self.mixed_public or self.target_mismatch or self.multiple_pushurls)

    def badge(self) -> str:
        arrows = ""
        if self.ahead:
            arrows += f"↑{self.ahead}"
        if self.behind:
            arrows += f"↓{self.behind}"
        if not self.branch_exists:
            arrows = "?"
        return f"{arrows} {self.name}" if arrows else self.name


@dataclass
class TransferCheck:
    """Deterministischer Preflight für genau einen Branch und einen Remote."""

    reason: str
    ahead: int = 0
    behind: int = 0
    remote_ref: str = ""
    commits: list[str] = field(default_factory=list)
    files: list[str] = field(default_factory=list)
    branch: str = ""
    head_oid: str = ""
    index_oid: str = ""
    worktree_fingerprint: str = ""
    fetch_fingerprint: str = ""
    push_fingerprint: str = ""
    target_oid: str = ""

    @property
    def ready(self) -> bool:
        return self.reason == "ready"

    def approval_signature(self) -> tuple:
        return (self.branch, self.head_oid, self.index_oid, self.worktree_fingerprint,
                self.fetch_fingerprint, self.push_fingerprint, self.target_oid,
                tuple(self.commits), tuple(self.files), self.ahead, self.behind)


@dataclass(frozen=True)
class RemoteTarget:
    host: str
    repo_id: str
    fingerprint: str


@dataclass
class RemoteConfig:
    name: str
    fetch_urls: list[str]
    push_urls: list[str]
    fetch_targets: list[RemoteTarget]
    push_targets: list[RemoteTarget]

    @property
    def transfer_safe(self) -> bool:
        return (len(self.fetch_targets) == 1 and len(self.push_targets) == 1
                and self.fetch_targets[0] == self.push_targets[0])


# Zwei-Buchstaben-Codes, die einen ungemergten Zustand (Merge-Konflikt) bedeuten.
# git status meldet solche Dateien z.B. nach einem `stash pop` mit Konflikt.
UNMERGED_CODES = {"DD", "AU", "UD", "UA", "DU", "AA", "UU"}


def parse_porcelain(output: str) -> tuple[int, int, int, int, list]:
    """NUL-getrenntes ``git status --porcelain=v1 -z`` auswerten.

    -> (modified, deleted, untracked, conflicts, dateien).
    Vereinfachung fürs Auge: Konflikt = C, Untracked = U, Gelöschtes = D, jede
    andere Änderung (modified/added/renamed/…) = M. Konflikte werden ZUERST
    geprüft, sonst würde z.B. `UD` fälschlich als Löschung zählen.

    ``-z`` ist für die Commit-Hilfe entscheidend: Ohne diese Option setzt Git
    Pfade mit Umlauten oder Steuerzeichen in Anführungszeichen und maskiert sie.
    Diese Anzeigeform ist kein gültiger Pfad für ein späteres ``git add``.
    Rename-/Copy-Einträge besitzen bei ``-z`` ein zweites Feld mit dem alten
    Namen; für Anzeige und Staging brauchen wir den ersten, neuen Namen.
    """
    m = d = u = c = 0
    files = []
    fields = output.split("\0")
    i = 0
    while i < len(fields):
        record = fields[i]
        i += 1
        if not record:
            continue
        xy, path = record[:2], record[3:]
        if "R" in xy or "C" in xy:
            # Bei -z folgt nach dem Zielpfad noch der Quellpfad.
            i += 1
        if xy in UNMERGED_CODES:
            c += 1
            files.append(("C", path))
        elif xy == "??":
            u += 1
            files.append(("U", path))
        elif "D" in xy:
            d += 1
            files.append(("D", path))
        else:
            m += 1
            files.append(("M", path))
    return m, d, u, c, files


def suggested_ignore(path: str) -> str | None:
    """Liefert die passende .gitignore-Zeile, wenn die Datei typischer Müll ist."""
    parts = path.rstrip("/").split("/")
    basename = parts[-1]
    for name, is_dir, pattern in IGNORE_RULES:
        if is_dir and name in parts:
            return pattern
        if not is_dir and basename == name:
            return pattern
    for suffix, pattern in IGNORE_SUFFIXES.items():
        if basename.endswith(suffix):
            return pattern
    return None


class CommitSafetyError(RuntimeError):
    pass


def _path_signature(path: Path) -> tuple | None:
    try:
        info = path.lstat()
    except FileNotFoundError:
        return None
    return (info.st_dev, info.st_ino, stat.S_IFMT(info.st_mode), info.st_mode,
            info.st_size, info.st_mtime_ns)


def update_gitignore_atomic(repo: Path, patterns: list[str]) -> bool:
    """Append unique rules without following symlinks or overwriting a raced target."""
    repo = repo.resolve()
    target = repo / ".gitignore"
    before = _path_signature(target)
    existing_text = ""
    if before is not None:
        info = target.lstat()
        if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode):
            raise CommitSafetyError("target is not a regular file")
        flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0)
        try:
            fd = os.open(target, flags)
        except OSError as e:
            raise CommitSafetyError(str(e)) from e
        try:
            with os.fdopen(fd, "r") as f:
                existing_text = f.read()
        except (OSError, UnicodeError) as e:
            raise CommitSafetyError(str(e)) from e
    existing = set(existing_text.splitlines())
    new_lines = [pattern for pattern in patterns if pattern not in existing]
    if not new_lines:
        return False
    updated = existing_text
    if updated and not updated.endswith("\n"):
        updated += "\n"
    updated += "\n".join(new_lines) + "\n"

    fd, tmp_name = tempfile.mkstemp(prefix=".gitignore.gmf.", dir=repo)
    tmp = Path(tmp_name)
    try:
        mode = stat.S_IMODE(target.lstat().st_mode) if before is not None else 0o644
        os.fchmod(fd, mode)
        with os.fdopen(fd, "w") as f:
            f.write(updated)
            f.flush()
            os.fsync(f.fileno())
        if _path_signature(target) != before:
            raise CommitSafetyError("target changed during update")
        os.replace(tmp, target)
    finally:
        try:
            tmp.unlink()
        except FileNotFoundError:
            pass
    return True


def _real_index_signature(repo: Path, timeout: int) -> tuple | None:
    index_r = _required_git(repo, "rev-parse", "--git-path", "index", timeout=timeout)
    index = Path(index_r.stdout.strip())
    if not index.is_absolute():
        index = repo / index
    signature = _path_signature(index)
    if signature is None:
        return None
    try:
        content_hash = hashlib.sha256(index.read_bytes()).hexdigest()
    except OSError as e:
        raise CommitSafetyError("cannot read Git index: %s" % e) from e
    return signature + (content_hash,)


def has_unmerged_entries(repo: Path, timeout: int) -> bool:
    diff = _required_git(repo, "diff", "--name-only", "--diff-filter=U", "-z",
                         timeout=timeout)
    index = _required_git(repo, "ls-files", "-u", "-z", timeout=timeout)
    return bool(diff.stdout or index.stdout)


def commit_selected(repo: Path, paths: list[str], message: str, timeout: int) -> subprocess.CompletedProcess:
    """Commit exactly paths through a temporary index; preserve the user's index bytes."""
    if not paths:
        raise CommitSafetyError("no approved paths")
    if has_unmerged_entries(repo, timeout):
        raise CommitSafetyError("merge conflicts exist")
    real_before = _real_index_signature(repo, timeout)
    approved = set(paths)
    with tempfile.TemporaryDirectory(prefix="gmf-index-") as temp:
        index_path = str(Path(temp) / "index")
        env = dict(os.environ, GIT_INDEX_FILE=index_path)
        _required_git(repo, "read-tree", "HEAD", timeout=timeout, env=env)
        staged = run_git(repo, "add", "--", *paths, timeout=timeout, env=env)
        if staged.returncode != 0:
            return staged
        names = _required_git(repo, "diff", "--cached", "--name-only", "-z", "--",
                              timeout=timeout, env=env)
        actual = {path for path in names.stdout.split("\0") if path}
        if actual != approved:
            raise CommitSafetyError("temporary index differs from approved paths")
        tree_before = _required_git(repo, "write-tree", timeout=timeout, env=env).stdout.strip()
        if has_unmerged_entries(repo, timeout):
            raise CommitSafetyError("merge conflicts appeared before commit")
        if _real_index_signature(repo, timeout) != real_before:
            raise CommitSafetyError("Git index changed during approval")
        # Stage once more and compare the complete tree to catch worktree races.
        _required_git(repo, "add", "--", *paths, timeout=timeout, env=env)
        tree_after = _required_git(repo, "write-tree", timeout=timeout, env=env).stdout.strip()
        if tree_after != tree_before:
            raise CommitSafetyError("approved files changed during commit preparation")
        result = run_git(repo, "commit", "-m", message, timeout=timeout, env=env)
    if _real_index_signature(repo, timeout) != real_before:
        raise CommitSafetyError("Git changed the real index unexpectedly")
    return result


def stash_preview(repo: Path, timeout: int) -> tuple[bool, str]:
    """Return a complete stash patch, including untracked and binary contents."""
    r = run_git(repo, "stash", "show", "-p", "--binary", "--include-untracked",
                "stash@{0}", timeout=timeout)
    if r.returncode != 0:
        detail = (r.stderr or "Git exit %d" % r.returncode).strip()[:240]
        return False, detail
    return True, r.stdout


def run_git(repo: Path, *args: str, timeout: int = 10,
            env: dict | None = None) -> subprocess.CompletedProcess:
    return subprocess.run(
        ["git", "-C", str(repo), *args],
        capture_output=True, text=True, timeout=timeout, env=env,
    )


class GitReadError(RuntimeError):
    pass


def _required_git(repo: Path, *args: str, timeout: int = 10,
                  env: dict | None = None) -> subprocess.CompletedProcess:
    r = run_git(repo, *args, timeout=timeout, env=env)
    if r.returncode != 0:
        raise GitReadError("git %s failed (exit %d)" % (args[0], r.returncode))
    return r


def find_repos(root: Path, skip_dirs: list[str]) -> list[Path]:
    """Alle Git-Repos unterhalb von root finden.

    In ein gefundenes Repo wird nicht weiter hinabgestiegen (verschachtelte
    Repos wären ohnehin Submodule o.ä. und verlangsamen den Scan nur).
    """
    skip = set(skip_dirs)
    repos: list[Path] = []
    for dirpath, dirnames, filenames in os.walk(root):
        # .git kann Ordner (normales Repo) oder Datei (Worktree/Submodul) sein.
        if ".git" in dirnames or ".git" in filenames:
            repos.append(Path(dirpath))
            dirnames[:] = []
            continue
        dirnames[:] = [d for d in dirnames if d not in skip and d != ".git"]
    return sorted(repos)


def _normal_host(host: str) -> str:
    host = host.strip().rstrip(".").lower()
    try:
        return host.encode("idna").decode("ascii")
    except UnicodeError:
        return host


def canonical_remote_target(url: str, repo: Path | None = None) -> RemoteTarget:
    """Credential-free host/repository identity for URL, SCP, and local syntax."""
    raw = url.strip()
    host = "local"
    port = None
    path = raw
    if "://" not in raw and ":" in raw and not raw.startswith(("/", "./", "../", "~")):
        hostpart, path = raw.split(":", 1)
        if "/" not in hostpart:
            host = _normal_host(hostpart.rsplit("@", 1)[-1])
    elif urllib.parse.urlsplit(raw).scheme:
        parsed = urllib.parse.urlsplit(raw)
        if parsed.scheme == "file":
            path = urllib.parse.unquote(parsed.path)
        else:
            host = _normal_host(parsed.hostname or "")
            port = parsed.port
            path = urllib.parse.unquote(parsed.path)
    if host == "local":
        local = Path(path).expanduser()
        if not local.is_absolute() and repo is not None:
            local = repo / local
        repo_id = str(local.resolve(strict=False))
        canonical = "local:" + repo_id
    else:
        repo_id = posixpath.normpath("/" + path.lstrip("/"))
        if repo_id.endswith(".git"):
            repo_id = repo_id[:-4]
        default_port = ((raw.startswith("ssh://") and port == 22)
                        or (raw.startswith("https://") and port == 443)
                        or (raw.startswith("http://") and port == 80))
        authority = host if not port or default_port else f"{host}:{port}"
        canonical = authority + ":" + repo_id
    fingerprint = hashlib.sha256(canonical.encode("utf-8")).hexdigest()[:20]
    return RemoteTarget(host, repo_id, fingerprint)


def read_remote_configs(repo: Path, cfg: dict) -> dict[str, RemoteConfig]:
    """Read every effective fetch/push target; any Git read error is fatal."""
    t_ = cfg["git_timeout"]
    names_r = _required_git(repo, "remote", timeout=t_)
    result = {}
    for name in [line for line in names_r.stdout.splitlines() if line]:
        fetch_r = _required_git(repo, "remote", "get-url", "--all", "--", name,
                                timeout=t_)
        push_r = _required_git(repo, "remote", "get-url", "--push", "--all", "--", name,
                               timeout=t_)
        fetch_urls = [line for line in fetch_r.stdout.splitlines() if line]
        push_urls = [line for line in push_r.stdout.splitlines() if line]
        if not fetch_urls or not push_urls:
            raise GitReadError("remote target is empty")
        result[name] = RemoteConfig(
            name, fetch_urls, push_urls,
            [canonical_remote_target(url, repo) for url in fetch_urls],
            [canonical_remote_target(url, repo) for url in push_urls],
        )
    return result


def detect_sync_remote(repo: Path, cfg: dict,
                       configs: dict[str, RemoteConfig] | None = None) -> str | None:
    """Sync remote by configured name, then by exact normalized hostname."""
    configs = configs if configs is not None else read_remote_configs(repo, cfg)
    for name in cfg["sync_remote_names"]:
        if name in configs:
            return name
    wanted = {_normal_host(host) for host in cfg["sync_remote_hosts"]}
    for name, remote in configs.items():
        if any(target.host in wanted for target in remote.fetch_targets + remote.push_targets):
            return name
    return None


def remote_urls(repo: Path, cfg: dict) -> dict[str, list[str]]:
    """Compatibility helper: all effective URLs, while reads remain fail-closed."""
    return {name: list(dict.fromkeys(remote.fetch_urls + remote.push_urls))
            for name, remote in read_remote_configs(repo, cfg).items()}


def is_github_url(url: str) -> bool:
    """Only an exact github.com host receives the public-push classification."""
    return canonical_remote_target(url).host == "github.com"


def collect_remote_statuses(repo: Path, branch: str, sync_remote: str | None,
                            cfg: dict,
                            configs: dict[str, RemoteConfig] | None = None) -> list[RemoteStatus]:
    """Alle Remotes samt Branch-Delta lesen; öffentliche Remotes immer zuletzt."""
    states: list[RemoteStatus] = []
    configs = configs if configs is not None else read_remote_configs(repo, cfg)
    for name, remote in configs.items():
        targets = remote.fetch_targets + remote.push_targets
        public_classes = {target.host == "github.com" for target in targets}
        state = RemoteStatus(
            name=name,
            public=True in public_classes,
            mixed_public=len(public_classes) > 1,
            is_sync=name == sync_remote,
            fetch_fingerprint=(remote.fetch_targets[0].fingerprint
                               if len(remote.fetch_targets) == 1 else ""),
            push_fingerprints=[target.fingerprint for target in remote.push_targets],
            target_mismatch=not remote.transfer_safe,
            multiple_pushurls=len(remote.push_targets) != 1,
        )
        if branch not in ("?", "(detached)"):
            ref = f"refs/remotes/{name}/{branch}"
            r = run_git(repo, "show-ref", "--verify", "--quiet", ref,
                        timeout=cfg["git_timeout"])
            if r.returncode not in (0, 1):
                raise GitReadError("git show-ref failed (exit %d)" % r.returncode)
            state.branch_exists = r.returncode == 0
            if state.branch_exists:
                r = _required_git(repo, "rev-list", "--left-right", "--count",
                                  f"HEAD...{ref}", timeout=cfg["git_timeout"])
                values = r.stdout.split()
                if len(values) != 2:
                    raise GitReadError("git rev-list returned malformed output")
                state.ahead, state.behind = map(int, values)
        states.append(state)
    # Sync-Remote zuerst; GitHub unabhängig vom tatsächlichen Namen ganz rechts.
    states.sort(key=lambda r: (r.public, not r.is_sync, r.name.lower()))
    return states


def inspect_transfer(repo: Path, remote: str, branch: str, action: str,
                     timeout: int = 10) -> TransferCheck:
    """Prüft Push/Pull, ohne etwas zu verändern.

    Bewusst eng: sauberer Tree, vorhandener Remote-Branch und verwandte,
    fast-forward-fähige History. Neue Branches und Divergenzen gehören ins
    Terminal, wo der Mensch den Sonderfall ausdrücklich auflöst.
    """
    if branch in ("?", "(detached)"):
        return TransferCheck("detached")
    cfg = {**DEFAULT_CONFIG, "git_timeout": timeout}
    try:
        configs = read_remote_configs(repo, cfg)
        remote_cfg = configs.get(remote)
        if remote_cfg is None or not remote_cfg.transfer_safe:
            return TransferCheck("remote-unsafe")
        branch_r = _required_git(repo, "symbolic-ref", "--short", "-q", "HEAD",
                                 timeout=timeout)
        current_branch = branch_r.stdout.strip()
        if current_branch != branch:
            return TransferCheck("inspect-failed")
        head = _required_git(repo, "rev-parse", "--verify", "HEAD", timeout=timeout).stdout.strip()
        index_oid = _required_git(repo, "write-tree", timeout=timeout).stdout.strip()
        dirty = _required_git(repo, "status", "--porcelain=v1", "-z", timeout=timeout)
    except (GitReadError, ValueError):
        return TransferCheck("inspect-failed")
    worktree_fingerprint = hashlib.sha256(dirty.stdout.encode("utf-8")).hexdigest()
    if dirty.stdout:
        return TransferCheck("dirty")
    ref = f"refs/remotes/{remote}/{branch}"
    exists = run_git(repo, "show-ref", "--verify", "--quiet", ref, timeout=timeout)
    if exists.returncode == 1:
        return TransferCheck("missing-branch", remote_ref=ref)
    if exists.returncode != 0:
        return TransferCheck("inspect-failed", remote_ref=ref)
    try:
        target_oid = _required_git(repo, "rev-parse", "--verify", ref,
                                   timeout=timeout).stdout.strip()
    except GitReadError:
        return TransferCheck("inspect-failed", remote_ref=ref)
    delta = run_git(repo, "rev-list", "--left-right", "--count",
                    f"{head}...{target_oid}", timeout=timeout)
    if delta.returncode != 0 or len(delta.stdout.split()) != 2:
        return TransferCheck("inspect-failed", remote_ref=ref)
    ahead_s, behind_s = delta.stdout.split()
    ahead, behind = int(ahead_s), int(behind_s)
    if ahead and behind:
        return TransferCheck("divergent", ahead=ahead, behind=behind, remote_ref=ref)
    if action == "push":
        if behind:
            return TransferCheck("behind", ahead=ahead, behind=behind, remote_ref=ref)
        if not ahead:
            return TransferCheck("nothing-push", remote_ref=ref)
        commits_r = run_git(repo, "log", "--oneline", "--no-decorate",
                            f"{target_oid}..{head}", timeout=timeout)
        files_r = run_git(repo, "diff", "--name-status", f"{target_oid}..{head}",
                          timeout=timeout)
        if commits_r.returncode != 0 or files_r.returncode != 0:
            return TransferCheck("inspect-failed", ahead, behind, ref)
        return TransferCheck(
            "ready", ahead=ahead, behind=behind, remote_ref=ref,
            commits=[line for line in commits_r.stdout.splitlines() if line.strip()],
            files=[line for line in files_r.stdout.splitlines() if line.strip()],
            branch=current_branch, head_oid=head, index_oid=index_oid,
            worktree_fingerprint=worktree_fingerprint,
            fetch_fingerprint=remote_cfg.fetch_targets[0].fingerprint,
            push_fingerprint=remote_cfg.push_targets[0].fingerprint,
            target_oid=target_oid,
        )
    if action == "pull":
        if ahead:
            return TransferCheck("nothing-pull", ahead, behind, ref)
        if not behind:
            return TransferCheck("nothing-pull", remote_ref=ref)
        return TransferCheck(
            "ready", ahead=ahead, behind=behind, remote_ref=ref,
            branch=current_branch, head_oid=head, index_oid=index_oid,
            worktree_fingerprint=worktree_fingerprint,
            fetch_fingerprint=remote_cfg.fetch_targets[0].fingerprint,
            push_fingerprint=remote_cfg.push_targets[0].fingerprint,
            target_oid=target_oid,
        )
    raise ValueError(f"unknown transfer action: {action}")


def safe_push_args(remote: str, branch: str, source_oid: str,
                   target_oid: str) -> tuple[str, ...]:
    """Push approved OID only, leased to the approved target OID, without tags."""
    lease = f"--force-with-lease=refs/heads/{branch}:{target_oid}"
    return ("push", "--porcelain", "--no-follow-tags", lease, "--", remote,
            f"{source_oid}:refs/heads/{branch}")


def safe_pull_args(target_oid: str) -> tuple[str, ...]:
    """Pull ohne Fetch-Konfigurationsmagie: nur lokaler Fast-forward-Merge."""
    return ("merge", "--ff-only", "--", target_oid)


def upstream_delta(repo: Path, sync_remote: str | None,
                   cfg: dict) -> tuple[str | None, int, int]:
    """Stand gegenüber dem konfigurierten Upstream, WENN dieser ein anderer
    Remote als der Sync-Remote ist (typisch: github).

    -> (upstream_ref oder None, ahead, behind). None, wenn kein (fremder) Upstream
    gesetzt ist oder dessen Tracking-Ref fehlt. Basis ist der letzte fetch-Stand
    dieses Remotes (wir fetchen hier NICHT übers Netz nach — wie in einem Editor).
    """
    t_ = cfg["git_timeout"]
    r = run_git(repo, "rev-parse", "--abbrev-ref", "@{upstream}", timeout=t_)
    if r.returncode != 0:
        return None, 0, 0
    up = r.stdout.strip()                 # z.B. "github/main"
    up_remote = up.split("/", 1)[0]
    if not up or up_remote == sync_remote:
        return None, 0, 0                 # kein Upstream oder == Sync-Remote (schon gezeigt)
    r = run_git(repo, "rev-list", "--left-right", "--count", f"HEAD...{up}", timeout=t_)
    if r.returncode != 0:
        return None, 0, 0                 # Tracking-Ref (noch) nicht lokal vorhanden
    ahead, behind = r.stdout.split()
    return up, int(ahead), int(behind)


def collect_status(repo: Path, root: Path, cfg: dict, fetch: bool = False) -> RepoStatus:
    """Kompletten Zustand eines Repos einsammeln (läuft parallel in Threads)."""
    rel = str(repo.relative_to(root)) if repo != root else repo.name
    # macOS liefert Dateinamen je nach Herkunft in NFD ("ö" = "o" + kombinierender
    # Punkt = 2 Codepoints) oder NFC (1 Codepoint). Fuer die Anzeige zaehlt aber die
    # Zahl der Terminal-Zellen: bei NFD verrechnet sich len() und die Spalten hinter
    # dem Namen verrutschen. rel ist reiner Anzeigename (der echte Pfad steht in
    # st.path), deshalb hier auf NFC normalisieren — das haelt zugleich die
    # --json-Ausgabe ueber Macs hinweg vergleichbar.
    rel = unicodedata.normalize("NFC", rel)
    st = RepoStatus(path=repo, rel=rel)
    t_ = cfg["git_timeout"]
    try:
        # Branch (oder detached HEAD)
        r = run_git(repo, "symbolic-ref", "--short", "-q", "HEAD", timeout=t_)
        if r.returncode == 0:
            st.branch = r.stdout.strip()
        else:
            _required_git(repo, "rev-parse", "--verify", "HEAD", timeout=t_)
            st.branch = "(detached)"
            st.remote_state = "detached"

        # Arbeitsverzeichnis-Zustand
        r = _required_git(repo, "status", "--porcelain=v1", "-z", timeout=t_)
        st.modified, st.deleted, st.untracked, st.conflicts, st.files = parse_porcelain(
            r.stdout)

        # Stashes (leicht zu übersehen — deshalb deutlich anzeigen)
        r = _required_git(repo, "stash", "list", "--format=%gd %gs", timeout=t_)
        st.stashes = [l for l in r.stdout.splitlines() if l.strip()]

        # Vergleich mit ALLEN Remotes (auf Basis des letzten fetch-Stands).
        configs = read_remote_configs(repo, cfg)
        st.remote = detect_sync_remote(repo, cfg, configs)
        if fetch:
            # R aktualisiert nicht nur alle Repos, sondern je Repo auch alle Remotes.
            # Fetch verändert weder Branch noch Working Tree.
            fetched = run_git(repo, "fetch", "--all", "--prune", "--quiet",
                              timeout=cfg["fetch_timeout"])
            if fetched.returncode != 0:
                st.error = t("transfer_fetch_failed", r="--all",
                             code=fetched.returncode)
                st.remote_state = "error"
                return st
            configs = read_remote_configs(repo, cfg)
        st.remotes = collect_remote_statuses(repo, st.branch, st.remote, cfg, configs)
        if st.remote is None:
            if st.remote_state != "detached":
                st.remote_state = "no-remote"
            st.upstream, st.upstream_ahead, st.upstream_behind = upstream_delta(
                repo, None, cfg)
            return st
        if st.remote_state == "detached":
            return st
        sync = next((remote for remote in st.remotes if remote.is_sync), None)
        if sync is None or not sync.branch_exists:
            st.remote_state = "no-branch"
            return st
        st.ahead, st.behind = sync.ahead, sync.behind

        # Zusatz: Stand gegenüber einem fremden Upstream (z.B. github).
        st.upstream, st.upstream_ahead, st.upstream_behind = upstream_delta(
            repo, st.remote, cfg)
    except subprocess.TimeoutExpired:
        st.error = t("git_timeout")
        st.remote_state = "error"
    except Exception as exc:  # Ein kaputtes Repo darf die Übersicht nicht killen.
        st.error = str(exc)
        st.remote_state = "error"
    return st


def collect_all(root: Path, cfg: dict, fetch: bool = False,
                progress=None) -> list[RepoStatus]:
    """Alle Repos parallel einsammeln; optional Fortschritts-Callback (done, total)."""
    repos = find_repos(root, cfg["skip_dirs"])
    results: list[RepoStatus] = []
    with concurrent.futures.ThreadPoolExecutor(max_workers=12) as pool:
        futures = [pool.submit(collect_status, r, root, cfg, fetch) for r in repos]
        for done, fut in enumerate(concurrent.futures.as_completed(futures), 1):
            results.append(fut.result())
            if progress:
                progress(done, len(repos))
    results.sort(key=lambda s: (s.severity(), s.rel.lower()))
    return results


# ---------------------------------------------------------------------------
# Nicht-interaktive Ausgabe (--list / --json / kein TTY)
# ---------------------------------------------------------------------------

def status_dict(st: RepoStatus) -> dict:
    return {
        "path": str(st.path), "rel": st.rel, "branch": st.branch,
        "remote": st.remote, "remote_state": st.remote_state,
        "ahead": st.ahead, "behind": st.behind,
        "upstream": st.upstream,
        "upstream_ahead": st.upstream_ahead, "upstream_behind": st.upstream_behind,
        "remotes": [
            {"name": r.name, "public": r.public, "mixed_public": r.mixed_public,
             "sync": r.is_sync,
             "branch_exists": r.branch_exists, "ahead": r.ahead, "behind": r.behind,
             "fetch_fingerprint": r.fetch_fingerprint,
             "push_fingerprints": r.push_fingerprints,
             "target_mismatch": r.target_mismatch,
             "multiple_pushurls": r.multiple_pushurls}
            for r in st.remotes
        ],
        "modified": st.modified, "deleted": st.deleted, "untracked": st.untracked,
        "conflicts": st.conflicts,
        "stashes": len(st.stashes), "clean_and_synced": st.clean_and_synced,
        "error": st.error,
    }


# --- Comparing two machines (--diff) ---------------------------------------
# Why this exists: remotes live in .git/config and git NEVER transfers them. Clone a
# repo on machine A, add a `github` remote there, and machine B simply doesn't have it
# — so a pending push is invisible on B. Same for branches you don't have checked out.
# Nothing warns you; you have to look. This makes looking a one-liner.
#
# The remote side runs THIS script via `ssh HOST python3 - --json <root>`, i.e. piped
# over stdin. Two nice consequences: gitmaster_flash needs no installation there, and
# both sides always run the identical version (no drift to reason about). The remote
# only needs python3 + git.


def _remote_root(local_root: Path, spec_path: str | None) -> str:
    """Which directory to scan on the other machine.

    `HOST:/some/path` wins. Otherwise: if the local root sits under $HOME, use the same
    path relative to the REMOTE $HOME (home dirs differ — /Users/anna/git vs
    /home/bob/git). Only if it is outside $HOME do we reuse the absolute path."""
    if spec_path:
        return spec_path
    home = Path.home()
    try:
        relative = str(local_root.relative_to(home))
        return "~" if relative == "." else "~/" + relative
    except ValueError:
        return str(local_root)


def fetch_remote_status(host: str, root: str, *, fetch: bool) -> dict:
    """Run this very script on `host` over ssh and return its --json output."""
    remote_args = ["python3", "-", "--json"]
    if fetch:
        remote_args.append("--fetch")
    remote_args.append(root)
    # ssh passes one remote command string to the remote shell. Quote every argv
    # element here; root remains exactly one argument even with spaces/metacharacters.
    inner = shlex.join(remote_args)
    try:
        with open(os.path.abspath(__file__), "rb") as fh:
            r = subprocess.run(
                ["ssh", "-o", "ConnectTimeout=10", "-o", "BatchMode=yes", host, inner],
                stdin=fh, capture_output=True, text=True, timeout=300)
    except (OSError, subprocess.SubprocessError) as e:
        raise RuntimeError(t("diff_ssh_failed", h=host, e=str(e)[:100]))
    if r.returncode != 0 or not (r.stdout or "").strip():
        last = [l for l in (r.stderr or "").strip().splitlines() if l.strip()]
        raise RuntimeError(t("diff_ssh_failed", h=host,
                             e=(last[-1][:120] if last else "no output")))
    try:
        return json.loads(r.stdout)
    except json.JSONDecodeError:
        raise RuntimeError(t("diff_ssh_failed", h=host, e="unreadable JSON"))


def _remotes_by_name(repo: dict) -> dict:
    return {x["name"]: x for x in (repo.get("remotes") or [])}


def _loc(name: str) -> str:
    """Ortsangabe fuer die Diff-Zeilen: Hostnamen bekommen eine Praeposition
    ("auf mymac"/"on mymac"), die eigene Maschine bleibt nackt — "auf hier" ist
    kein Deutsch, "hier" schon."""
    return name if name == t("diff_here") else t("diff_on", m=name)


def diff_status(here: dict, there: dict, here_name: str, there_name: str) -> list:
    """Compare two --json payloads -> list of difference lines. Pure -> testable.

    The split matters more than the comparison: `DRIFT` = should be identical but
    isn't (actionable); `SYNC` = both machines agree but sit ahead/behind the sync
    remote (invisible in a pure two-machine diff, yet exactly the number you care
    about); `local` = explainable (different branch checked out, dirty working
    tree). A report that lists everything gets ignored."""
    out = []
    if here.get("version") != there.get("version"):
        out.append(t("diff_version", a=here_name, va=here.get("version"),
                     b=there_name, vb=there.get("version")))
    here_at, there_at = _loc(here_name), _loc(there_name)
    ra = {r["rel"]: r for r in here.get("repos", [])}
    rb = {r["rel"]: r for r in there.get("repos", [])}
    for rel in sorted(set(ra) - set(rb)):
        out.append(t("diff_only_on", rel=rel, m=here_at))
    for rel in sorted(set(rb) - set(ra)):
        out.append(t("diff_only_on", rel=rel, m=there_at))

    for rel in sorted(set(ra) & set(rb)):
        x, y = ra[rel], rb[rel]
        xr, yr = _remotes_by_name(x), _remotes_by_name(y)
        for name, mine, other in ((here_at, xr, yr), (there_at, yr, xr)):
            for rn in sorted(set(mine) - set(other)):
                out.append(t("diff_remote_missing", rel=rel, r=rn, m=name))
        # Sync-Remote zuerst: sein Stand ist die interessantere Zahl als z.B. github.
        for rn in sorted(set(xr) & set(yr),
                         key=lambda n: (not (xr[n].get("sync") or yr[n].get("sync")), n)):
            pa, pb = xr[rn], yr[rn]
            security_fields = ("public", "mixed_public", "sync", "branch_exists",
                               "fetch_fingerprint", "push_fingerprints",
                               "target_mismatch", "multiple_pushurls")
            if tuple(pa.get(k) for k in security_fields) != tuple(
                    pb.get(k) for k in security_fields):
                out.append(t("diff_remote_security", rel=rel, r=rn))
            sa = (pa.get("ahead"), pa.get("behind"))
            sb = (pb.get("ahead"), pb.get("behind"))
            if sa != sb:
                out.append(t("diff_remote_state", rel=rel, r=rn,
                             a=here_at, aa=pa.get("ahead"), ab=pa.get("behind"),
                             b=there_at, ba=pb.get("ahead"), bb=pb.get("behind")))
            elif ((pa.get("sync") or pb.get("sync"))
                  and (pa.get("ahead") or pa.get("behind"))):
                # Beide Rechner gleichauf, aber gemeinsam neben dem Sync-Remote:
                # im reinen Zwei-Rechner-Vergleich unsichtbar, trotzdem Handlungsbedarf.
                out.append(t("diff_sync_even", rel=rel, r=rn,
                             aa=pa.get("ahead"), ab=pa.get("behind")))
        if x.get("branch") != y.get("branch"):
            out.append(t("diff_branch", rel=rel, a=here_at, ba=x.get("branch"),
                         b=there_at, bb=y.get("branch")))
        for field_name in ("error", "conflicts", "stashes", "remote_state"):
            va, vb = x.get(field_name), y.get(field_name)
            if va != vb:
                out.append(t("diff_repo_field", rel=rel, field=field_name,
                             a=here_at, va=va, b=there_at, vb=vb))
        for name, r in ((here_at, x), (there_at, y)):
            n = (r.get("modified") or 0) + (r.get("untracked") or 0) + (r.get("deleted") or 0)
            if n:
                out.append(t("diff_dirty", rel=rel, m=name, n=n))
    return [terminal_text(line) for line in out]


def run_diff(spec: str, root: Path, cfg: dict, *, fetch: bool, as_json: bool) -> int:
    """--diff HOST[:PATH]: compare this machine with `HOST`. Read-only."""
    host, _, path = spec.partition(":")
    if not host:
        print(t("diff_need_host"), file=sys.stderr)
        return 2
    try:
        there = fetch_remote_status(host, _remote_root(root, path or None), fetch=fetch)
    except RuntimeError as e:
        print(str(e), file=sys.stderr)
        return 2
    here = {"version": __version__, "root": str(root),
            "repos": [status_dict(s) for s in collect_all(root, cfg, fetch=fetch)]}
    lines = diff_status(here, there, t("diff_here"), host)
    if as_json:
        print(json.dumps({"here": here.get("version"), "host": host,
                          "differences": lines}, indent=2, ensure_ascii=False))
    else:
        print("\n".join(lines) if lines else t("diff_same", h=host))
    return 1 if lines else 0


def print_list(statuses: list[RepoStatus], root: Path | None = None) -> None:
    green, red, yellow, cyan, reset = (
        "\033[32m", "\033[31m", "\033[33m", "\033[36m", "\033[0m")
    # Kopfzeile wie in der TUI: Version + Wurzel. Genau dieser Text landet in einer
    # umgeleiteten Datei, die man spaeter gegen die eines anderen Macs diffed —
    # ohne Version haelt man einen Versionsunterschied fuer einen Repo-Unterschied.
    print(f"gitmaster_flash {__version__}"
          + (f" · {terminal_text(root)}" if root else "")
          + f" · {len(statuses)} {t('hdr_repos')}")
    for st in statuses:
        remote_bits = []
        for remote in st.remotes:
            color = cyan if remote.public else (
                red if remote.behind else yellow if remote.ahead else green)
            remote_bits.append(f"{color}{terminal_text(remote.badge())}{reset}")
        badge_txt = ("  " + "  ".join(remote_bits)) if remote_bits else ""
        if st.clean_and_synced:
            print(f"{green}✔ {terminal_text(st.rel)}{reset}{badge_txt}")
            continue
        bits = []
        if st.error:
            bits.append(f"{red}{terminal_text(t('error_prefix', e=st.error))}{reset}")
        if st.conflicts:
            bits.append(f"{red}{t('conflict_n', n=st.conflicts)}{reset}")
        if st.modified:
            bits.append(f"{red}M:{st.modified}{reset}")
        if st.deleted:
            bits.append(f"{red}D:{st.deleted}{reset}")
        if st.untracked:
            bits.append(f"{red}U:{st.untracked}{reset}")
        if st.stashes:
            bits.append(f"{yellow}Stash:{len(st.stashes)}{reset}")
        if st.remote_state == "no-remote":
            bits.append(f"{yellow}{t('no_sync_remote')}{reset}")
        elif st.remote_state == "no-branch":
            bits.append(f"{yellow}{t('branch_not_on', b=st.branch, r=st.remote)}{reset}")
        bits.extend(remote_bits)
        print(f"{red}✘{reset} {terminal_text(st.rel)}  {' '.join(bits)}")


# ---------------------------------------------------------------------------
# TUI
# ---------------------------------------------------------------------------

# Farb-Paar-Nummern
C_GREEN, C_RED, C_YELLOW, C_DIM, C_SEL, C_CYAN = 1, 2, 3, 4, 5, 6


def terminal_text(value) -> str:
    """Neutralize terminal controls while preserving the raw value for Git operations."""
    out = []
    for ch in str(value):
        code = ord(ch)
        if ch == "\n":
            out.append("\\n")
        elif ch == "\r":
            out.append("\\r")
        elif ch == "\t":
            out.append("\\t")
        elif code == 0x1B:
            out.append("\\x1b")
        elif code < 0x20 or 0x7F <= code <= 0x9F:
            out.append("\\x%02x" % code if code <= 0xFF else "\\u%04x" % code)
        else:
            out.append(ch)
    return "".join(out)


WIDE_TERMINAL_SYMBOLS = {"⏎", "⚑", "✔", "⚠"}


def cell_width(text: str) -> int:
    width = 0
    for ch in text:
        if unicodedata.combining(ch) or ch in ("\ufe0e", "\ufe0f"):
            continue
        if ch in WIDE_TERMINAL_SYMBOLS or unicodedata.east_asian_width(ch) in ("W", "F"):
            width += 2
        else:
            width += 1
    return width


def truncate_cells(text: str, limit: int) -> str:
    if limit <= 0:
        return ""
    out = []
    used = 0
    for ch in text:
        char_width = cell_width(ch)
        if used + char_width > limit:
            break
        out.append(ch)
        used += char_width
    return "".join(out)


def pad_cells(text: str, width: int) -> str:
    text = truncate_cells(terminal_text(text), max(0, width))
    return text + " " * max(0, width - cell_width(text))


def safe_addstr(win, y, x, text, attr=0):
    """addstr, das am Bildschirmrand nicht crasht."""
    h, w = win.getmaxyx()
    if y < 0 or y >= h or x >= w:
        return
    text = terminal_text(text)
    try:
        win.addstr(y, x, truncate_cells(text, w - x - 1), attr)
    except curses.error:
        pass


class TUI:
    def __init__(self, stdscr, root: Path, cfg: dict, cd_file: str | None):
        self.scr = stdscr
        self.root = root
        self.cfg = cfg
        self.cd_file = cd_file
        self.statuses: list[RepoStatus] = []
        self.selected = 0
        self.offset = 0            # Scroll-Position
        self.expanded: set[str] = set()   # rel-Pfade der aufgeklappten Repos
        self.message = ""          # Feedback-Zeile über dem Footer

    # -- Datenbeschaffung ---------------------------------------------------

    def reload(self, fetch: bool = False):
        label = t("fetching") if fetch else t("reading")

        def progress(done, total):
            self.scr.erase()
            safe_addstr(self.scr, 1, 2, f"{label} … {done}/{total}",
                        curses.color_pair(C_YELLOW))
            self.scr.refresh()

        progress(0, 0)
        self.statuses = collect_all(self.root, self.cfg, fetch, progress)
        self.selected = min(self.selected, max(0, len(self.statuses) - 1))

    def refresh_one(self, st: RepoStatus):
        """Nur ein Repo neu einlesen (nach commit/stash), Sortierung beibehalten."""
        new = collect_status(st.path, self.root, self.cfg)
        idx = self.statuses.index(st)
        self.statuses[idx] = new
        return new

    # -- Zeichnen -----------------------------------------------------------

    def build_rows(self):
        """Sichtbare Zeilen: pro Repo eine Zeile, aufgeklappt + Datei-/Stash-Zeilen."""
        rows = []  # (art, repo_index, ...) — art: 'repo' | 'file' | 'stash' | 'empty'
        for i, st in enumerate(self.statuses):
            rows.append(("repo", i))
            if st.rel in self.expanded:
                for code, path in st.files:
                    rows.append(("file", i, code, path))
                for stash in st.stashes:
                    rows.append(("stash", i, stash))
                if not st.files and not st.stashes:
                    rows.append(("empty", i))
        return rows

    def draw_repo_line(self, y, st: RepoStatus, is_selected: bool):
        sel = curses.A_REVERSE if is_selected else 0
        arrow = "▼" if st.rel in self.expanded else "▶"
        x = 1
        safe_addstr(self.scr, y, x, f"{arrow} ", sel)
        x += 2
        name = st.rel
        safe_addstr(self.scr, y, x, name, sel | curses.A_BOLD)
        x += cell_width(terminal_text(name)) + 2

        def part(text, pair):
            nonlocal x
            safe_addstr(self.scr, y, x, text, sel | curses.color_pair(pair))
            x += cell_width(terminal_text(text)) + 1

        if st.error:
            part(t("error_prefix", e=st.error), C_RED)
            return
        if st.clean_and_synced:
            part(t("clean_synced"), C_GREEN)
        else:
            if st.conflicts:
                part("⚠" + t("conflict_n", n=st.conflicts), C_RED)
            if st.modified:
                part(f"M:{st.modified}", C_RED)
            if st.deleted:
                part(f"D:{st.deleted}", C_RED)
            if st.untracked:
                part(f"U:{st.untracked}", C_RED)
            if st.stashes:
                part(f"⚑Stash:{len(st.stashes)}", C_YELLOW)
            if st.remote_state == "no-remote":
                part(t("no_sync_remote"), C_YELLOW)
            elif st.remote_state == "no-branch":
                part(t("branch_not_on", b=st.branch, r=st.remote), C_YELLOW)
            elif st.remote_state == "detached":
                part(t("detached"), C_YELLOW)
        # Branch steht VOR den Remotes, damit ein GitHub-Remote garantiert ganz
        # rechts bleibt. Auch synchrone Remotes werden immer angezeigt.
        part(f"[{st.branch}]", C_DIM)
        for remote in st.remotes:
            if remote.public:
                pair = C_CYAN
            elif remote.behind:
                pair = C_RED
            elif remote.ahead:
                pair = C_YELLOW
            elif remote.is_sync:
                pair = C_GREEN
            else:
                pair = C_DIM
            part(remote.badge(), pair)

    def draw(self):
        self.scr.erase()
        h, w = self.scr.getmaxyx()
        dirty = sum(1 for s in self.statuses if not s.clean_and_synced)
        tail = t("hdr_review", n=dirty) if dirty else t("hdr_clean")
        # Version mit in die Kopfzeile: Wer zwei Ausgaben von verschiedenen Macs
        # vergleicht, muss sehen, ob dieselbe Fassung dahintersteckt — sonst haelt man
        # einen Versionsunterschied fuer einen echten Repo-Unterschied. Auch eine
        # LAUFENDE Instanz zeigt den Code von ihrem Start: nach einem Sync im
        # Hintergrund vergleicht man sonst unbemerkt zwei Staende.
        head = (f" gitmaster_flash {__version__} · {self.root} · "
                f"{len(self.statuses)} {t('hdr_repos')} · {tail}")
        safe_addstr(self.scr, 0, 0, head.ljust(w - 1), curses.A_BOLD)

        rows = self.build_rows()
        # Zeile des ausgewählten Repos finden, damit sie sichtbar bleibt
        sel_row = next((i for i, r in enumerate(rows)
                        if r[0] == "repo" and r[1] == self.selected), 0)
        body_h = h - 5  # Kopf + Feedback + 3 Footerzeilen
        if sel_row < self.offset:
            self.offset = sel_row
        if sel_row >= self.offset + body_h:
            self.offset = sel_row - body_h + 1

        y = 1
        for row in rows[self.offset:self.offset + body_h]:
            kind = row[0]
            if kind == "repo":
                self.draw_repo_line(y, self.statuses[row[1]], row[1] == self.selected)
            elif kind == "file":
                code, path = row[2], row[3]
                pair = {"M": C_RED, "D": C_RED, "U": C_YELLOW, "C": C_RED}[code]
                label = t("conflict_label") if code == "C" else ""
                safe_addstr(self.scr, y, 5, f"{code}  {label}{path}",
                            curses.color_pair(pair))
            elif kind == "stash":
                safe_addstr(self.scr, y, 5, f"⚑  {row[2]}   {t('stash_row_hint')}",
                            curses.color_pair(C_YELLOW))
            elif kind == "empty":
                safe_addstr(self.scr, y, 5, t("no_changes"), curses.color_pair(C_DIM))
            y += 1

        safe_addstr(self.scr, h - 4, 1, self.message, curses.color_pair(C_YELLOW))
        # Footer dreizeilig, damit auch in schmalen Fenstern nichts abgeschnitten wird.
        # Alle Tastenkürzel groß geschrieben; sie sind bewusst redundant sichtbar.
        app_hints = " · ".join(f"{key.upper()} {app['name']}"
                               for key, app in self.cfg["apps"].items())
        footer_dim = curses.color_pair(C_DIM) | curses.A_REVERSE
        safe_addstr(self.scr, h - 3, 0, t("f1").ljust(w - 1), footer_dim)
        safe_addstr(self.scr, h - 2, 0, t("f2", apps=app_hints).ljust(w - 1), footer_dim)
        safe_addstr(self.scr, h - 1, 0, t("f3").ljust(w - 1), footer_dim)
        self.scr.refresh()

    # -- Dialog-Helfer ------------------------------------------------------

    def confirm(self, question: str) -> bool:
        h, w = self.scr.getmaxyx()
        safe_addstr(self.scr, h - 4, 1, (question + t("yesno")).ljust(w - 2),
                    curses.color_pair(C_YELLOW) | curses.A_BOLD)
        self.scr.refresh()
        while True:
            ch = self.scr.getch()
            if ch in (ord("j"), ord("J"), ord("y"), ord("Y")):
                return True
            if ch in (ord("n"), ord("N"), 27):
                return False

    def prompt_line(self, y: int, prompt: str) -> str | None:
        """Einzeilige Texteingabe; Esc bricht ab, ⏎ bestätigt."""
        buf: list[str] = []
        while True:
            h, w = self.scr.getmaxyx()
            safe_addstr(self.scr, y, 1, (prompt + "".join(buf)).ljust(w - 2),
                        curses.A_BOLD)
            cursor_x = 1 + cell_width(terminal_text(prompt + "".join(buf)))
            self.scr.move(min(y, h - 1), min(cursor_x, max(0, w - 2)))
            self.scr.refresh()
            ch = self.scr.get_wch()
            if ch in ("\n", "\r"):
                return "".join(buf).strip()
            if ch == "\x1b":  # Esc
                return None
            if ch in ("\x7f", "\b") or ch == curses.KEY_BACKSPACE:
                if buf:
                    buf.pop()
            elif isinstance(ch, str) and ch.isprintable():
                buf.append(ch)

    # -- Aktionen -----------------------------------------------------------

    def current(self) -> RepoStatus | None:
        return self.statuses[self.selected] if self.statuses else None

    def action_open_app(self, key: str):
        st = self.current()
        app = self.cfg["apps"].get(key)
        if not st or not app:
            return
        if not Path(app["path"]).exists():
            self.message = t("app_not_found", p=app["path"])
            return
        # `open -a <App> <Ordner>` öffnet den Repo-Ordner in der App. Fehler (z.B.
        # App kann Ordner nicht öffnen) sichtbar machen, statt still zu schlucken.
        r = subprocess.run(["open", "-a", app["path"], str(st.path)],
                           capture_output=True, text=True)
        if r.returncode == 0:
            self.message = t("app_opened", name=app["name"], rel=st.rel)
        else:
            self.message = t("app_open_failed", name=app["name"], e=r.stderr.strip()[:120])

    def action_cd_and_quit(self) -> bool:
        st = self.current()
        if not st:
            return False
        if self.cd_file:
            Path(self.cd_file).write_text(str(st.path))
        else:
            # Ohne Wrapper können wir das cwd der Shell nicht ändern — Hinweis geben.
            print(f"\ncd {st.path}")
            print(t("cd_hint"))
        return True

    def action_stash_pop(self):
        st = self.current()
        if not st or not st.stashes:
            self.message = t("no_stash")
            return
        # Auf einen bereits konfliktbehafteten Baum lässt sich nicht poppen
        # (git: „konnte Index nicht schreiben"). Erst die Konflikte auflösen.
        if st.conflicts:
            self.message = t("resolve_conflicts_first")
            return
        if not self.confirm(t("confirm_pop", rel=st.rel)):
            self.message = t("cancelled")
            return
        r = run_git(st.path, "stash", "pop", timeout=self.cfg["git_timeout"])
        new = self.refresh_one(st)
        if r.returncode == 0:
            self.message = t("stash_applied", rel=st.rel)
        elif new.conflicts:
            # Git hat den Stash mit Konfliktmarkern eingespielt und ihn ABSICHTLICH
            # behalten — nichts geht verloren. Konflikte müssen von Hand gelöst werden.
            self.message = t("stash_conflict", n=new.conflicts)
        else:
            self.message = t("stash_pop_failed", e=r.stderr.strip()[:120])

    def action_stash_show(self):
        """Neuesten Stash als Diff anzeigen (read-only), scrollbar. Für den
        Fall redundanter Alt-Stashes: erst schauen, dann entscheiden."""
        st = self.current()
        if not st or not st.stashes:
            self.message = t("no_stash")
            return
        ok, preview = stash_preview(st.path, self.cfg["git_timeout"])
        if not ok:
            text = t("stash_preview_failed", e=preview)
        else:
            text = preview or t("stash_preview_empty")
        title = t("stash_preview_title", rel=st.rel, s=st.stashes[0])
        self.show_pager(title, text.splitlines())

    def action_stash_drop(self):
        """Neuesten Stash endgültig verwerfen (destruktiv -> Rückfrage)."""
        st = self.current()
        if not st or not st.stashes:
            self.message = t("no_stash")
            return
        if not self.confirm(t("confirm_drop", rel=st.rel)):
            self.message = t("drop_cancelled")
            return
        r = run_git(st.path, "stash", "drop", "stash@{0}",
                    timeout=self.cfg["git_timeout"])
        if r.returncode == 0:
            self.message = t("stash_dropped", rel=st.rel)
        else:
            self.message = t("stash_drop_failed", e=r.stderr.strip()[:120])
        self.refresh_one(st)

    def show_pager(self, title: str, lines: list[str]):
        """Einfacher scrollbarer Textbetrachter (↑/↓/PgUp/PgDn, q/Esc schließt)."""
        top = 0
        while True:
            self.scr.erase()
            h, w = self.scr.getmaxyx()
            safe_addstr(self.scr, 0, 0, (" " + title).ljust(w - 1), curses.A_BOLD)
            body_h = h - 2
            for y, line in enumerate(lines[top:top + body_h], start=1):
                # Diff-Zeilen leicht einfärben: + grün, - rot, @@ gelb.
                pair = 0
                if line.startswith("+") and not line.startswith("+++"):
                    pair = curses.color_pair(C_GREEN)
                elif line.startswith("-") and not line.startswith("---"):
                    pair = curses.color_pair(C_RED)
                elif line.startswith("@@"):
                    pair = curses.color_pair(C_YELLOW)
                safe_addstr(self.scr, y, 0, line, pair)
            a = top + 1
            b = min(len(lines), top + body_h)
            safe_addstr(self.scr, h - 1, 0,
                        t("pager_footer", a=a, b=b, n=len(lines)).ljust(w - 1),
                        curses.color_pair(C_DIM) | curses.A_REVERSE)
            self.scr.refresh()
            ch = self.scr.getch()
            if ch in (ord("q"), ord("Q"), 27):
                return
            elif ch == curses.KEY_UP:
                top = max(0, top - 1)
            elif ch == curses.KEY_DOWN:
                top = min(max(0, len(lines) - body_h), top + 1)
            elif ch == curses.KEY_NPAGE:
                top = min(max(0, len(lines) - body_h), top + body_h)
            elif ch == curses.KEY_PPAGE:
                top = max(0, top - body_h)

    # -- Sichere Push-/Pull-Aktionen ---------------------------------------

    @staticmethod
    def _remote(st: RepoStatus, name: str | None) -> RemoteStatus | None:
        return next((remote for remote in st.remotes if remote.name == name), None)

    def _fetch_remote(self, st: RepoStatus, remote: str) -> RepoStatus | None:
        r = run_git(st.path, "fetch", "--prune", "--quiet", "--", remote,
                    timeout=self.cfg["fetch_timeout"])
        if r.returncode != 0:
            self.message = t("transfer_fetch_failed", r=remote,
                             code=r.returncode)
            return None
        return self.refresh_one(st)

    def _transfer_message(self, check: TransferCheck, remote: str,
                          branch: str) -> str:
        if check.reason == "dirty":
            return t("transfer_dirty")
        if check.reason == "detached":
            return t("transfer_detached")
        if check.reason == "inspect-failed":
            return t("transfer_inspect_failed")
        if check.reason == "remote-unsafe":
            return t("remote_url_mismatch", r=remote)
        if check.reason == "missing-branch":
            return t("transfer_missing", b=branch, r=remote)
        if check.reason == "divergent":
            return t("transfer_divergent", r=remote, a=check.ahead, b=check.behind)
        if check.reason == "behind":
            return t("transfer_behind", n=check.behind, r=remote)
        if check.reason == "nothing-push":
            return t("nothing_to_push", r=remote)
        if check.reason == "nothing-pull":
            return t("nothing_to_pull", r=remote)
        return check.reason

    def action_sync_push(self):
        """Einfacher Push ausschließlich zum nichtöffentlichen Sync-Remote."""
        st = self.current()
        if not st or not st.remote:
            self.message = t("no_sync_for_action")
            return
        remote = self._remote(st, st.remote)
        if not remote:
            self.message = t("no_sync_for_action")
            return
        if not remote.transfer_safe:
            self.message = t("remote_url_mismatch", r=remote.name)
            return
        if remote.public:
            self.message = t("public_simple_block")
            return
        fresh = self._fetch_remote(st, remote.name)
        if not fresh:
            return
        check = inspect_transfer(fresh.path, remote.name, fresh.branch, "push",
                                 self.cfg["git_timeout"])
        if not check.ready:
            self.message = self._transfer_message(check, remote.name, fresh.branch)
            return
        if not self.confirm(t("confirm_sync_push", n=check.ahead, r=remote.name)):
            self.message = t("cancelled")
            return
        newest = self._fetch_remote(fresh, remote.name)
        if not newest:
            return
        final = inspect_transfer(newest.path, remote.name, newest.branch, "push",
                                 self.cfg["git_timeout"])
        if not final.ready or final.approval_signature() != check.approval_signature():
            self.message = t("transfer_changed")
            return
        r = run_git(newest.path, *safe_push_args(
                        remote.name, check.branch, check.head_oid, check.target_oid),
                    timeout=self.cfg["fetch_timeout"])
        self.refresh_one(newest)
        if r.returncode == 0:
            self.message = t("sync_pushed", r=remote.name)
        else:
            self.message = t("push_failed", code=r.returncode)

    def action_sync_pull(self):
        """Einfacher Pull = Fetch + lokaler --ff-only-Merge vom privaten Sync."""
        st = self.current()
        if not st or not st.remote:
            self.message = t("no_sync_for_action")
            return
        remote = self._remote(st, st.remote)
        if not remote:
            self.message = t("no_sync_for_action")
            return
        if not remote.transfer_safe:
            self.message = t("remote_url_mismatch", r=remote.name)
            return
        if remote.public:
            self.message = t("public_simple_block")
            return
        fresh = self._fetch_remote(st, remote.name)
        if not fresh:
            return
        check = inspect_transfer(fresh.path, remote.name, fresh.branch, "pull",
                                 self.cfg["git_timeout"])
        if not check.ready:
            self.message = self._transfer_message(check, remote.name, fresh.branch)
            return
        if not self.confirm(t("confirm_sync_pull", n=check.behind, r=remote.name)):
            self.message = t("cancelled")
            return
        newest = self._fetch_remote(fresh, remote.name)
        if not newest:
            return
        final = inspect_transfer(newest.path, remote.name, newest.branch, "pull",
                                 self.cfg["git_timeout"])
        if not final.ready or final.approval_signature() != check.approval_signature():
            self.message = t("transfer_changed")
            return
        r = run_git(newest.path, *safe_pull_args(check.target_oid),
                    timeout=self.cfg["git_timeout"])
        self.refresh_one(newest)
        if r.returncode == 0:
            self.message = t("sync_pulled", r=remote.name)
        else:
            self.message = t("pull_failed", code=r.returncode)

    def action_github_push(self):
        """Öffentlicher Push nur nach Vorschau + ausgeschriebener Bestätigung."""
        st = self.current()
        if not st:
            return
        public = [remote for remote in st.remotes if remote.public]
        if not public:
            self.message = t("no_github")
            return
        if len(public) != 1:
            self.message = t("many_github", names=", ".join(r.name for r in public))
            return
        remote = public[0]
        if not remote.transfer_safe:
            self.message = t("remote_url_mismatch", r=remote.name)
            return
        fresh = self._fetch_remote(st, remote.name)
        if not fresh:
            return
        check = inspect_transfer(fresh.path, remote.name, fresh.branch, "push",
                                 self.cfg["git_timeout"])
        if not check.ready:
            self.message = self._transfer_message(check, remote.name, fresh.branch)
            return

        lines = [
            t("preview_branch_only"),
            t("preview_privacy"),
            "",
            t("outgoing_commits"),
            *(check.commits or [t("none_label")]),
            "",
            t("changed_files"),
            *(check.files or [t("none_label")]),
        ]
        self.show_pager(t("github_preview", rel=fresh.rel, r=remote.name,
                          b=fresh.branch), lines)
        self.draw()
        phrase = f"PUSH {remote.name}"
        h, _ = self.scr.getmaxyx()
        typed = self.prompt_line(h - 4, t("github_type", phrase=phrase))
        if typed != phrase:
            self.message = t("github_cancelled")
            return

        # Unmittelbar vor dem öffentlichen Push erneut fetchen. Ändert sich der
        # ausgehende Satz seit der Vorschau, wird nicht mit veralteter Freigabe gepusht.
        newest = self._fetch_remote(fresh, remote.name)
        if not newest:
            return
        final = inspect_transfer(newest.path, remote.name, newest.branch, "push",
                                 self.cfg["git_timeout"])
        if (not final.ready
                or final.approval_signature() != check.approval_signature()):
            self.message = t("github_changed")
            return
        r = run_git(newest.path, *safe_push_args(
                        remote.name, check.branch, check.head_oid, check.target_oid),
                    timeout=self.cfg["fetch_timeout"])
        self.refresh_one(newest)
        if r.returncode == 0:
            self.message = t("github_pushed", r=remote.name)
        else:
            self.message = t("push_failed", code=r.returncode)

    def action_git_help(self):
        self.show_pager(t("git_help_title"), t("git_help_body").splitlines())

    # -- Commit-Hilfe --------------------------------------------------------

    def action_commit_wizard(self):
        st = self.current()
        if not st:
            return
        if not st.files:
            self.message = t("nothing_to_commit")
            return
        if st.conflicts:
            self.message = t("commit_conflicts")
            return
        # Jede Datei bekommt einen Vorschlag: committen oder gitignoren.
        items = []
        for code, path in st.files:
            pattern = suggested_ignore(path)
            items.append({"code": code, "path": path,
                          "ignore": pattern is not None, "pattern": pattern,
                          "include": pattern is None})
        sel = 0
        off = 0
        while True:
            self.scr.erase()
            h, w = self.scr.getmaxyx()
            safe_addstr(self.scr, 0, 0, (" " + t("commit_title", rel=st.rel)).ljust(w - 1),
                        curses.A_BOLD)
            body_h = h - 4
            if sel < off:
                off = sel
            if sel >= off + body_h:
                off = sel - body_h + 1
            for y, i in enumerate(range(off, min(len(items), off + body_h)), start=1):
                it = items[i]
                mark = curses.A_REVERSE if i == sel else 0
                if it["ignore"]:
                    label, pair = t("to_gitignore", p=it["pattern"]), C_YELLOW
                elif it["include"]:
                    label, pair = t("do_commit"), C_GREEN
                else:
                    label, pair = t("do_skip"), C_DIM
                path_width = max(1, w - 40)
                safe_addstr(self.scr, y, 1,
                            f"{it['code']}  {pad_cells(it['path'], path_width)} {label}",
                            mark | curses.color_pair(pair))
            safe_addstr(self.scr, h - 2, 0, t("commit_footer").ljust(w - 1),
                        curses.color_pair(C_DIM) | curses.A_REVERSE)
            self.scr.refresh()
            ch = self.scr.getch()
            if ch == curses.KEY_UP:
                sel = max(0, sel - 1)
            elif ch == curses.KEY_DOWN:
                sel = min(len(items) - 1, sel + 1)
            elif ch == ord(" "):
                items[sel]["include"] = not items[sel]["include"]
                if items[sel]["include"]:
                    items[sel]["ignore"] = False
            elif ch == ord("i"):
                it = items[sel]
                it["ignore"] = not it["ignore"]
                if it["ignore"]:
                    it["include"] = False
                    it["pattern"] = it["pattern"] or it["path"]
            elif ch in (10, 13, curses.KEY_ENTER):
                if self._commit_step2(st, items):
                    return
            elif ch == 27:
                self.message = t("commit_cancelled")
                return

    def _commit_step2(self, st: RepoStatus, items: list) -> bool:
        """Schritt 2: letzte Commit-Messages zeigen, Message erfragen, ausführen."""
        to_commit = [it["path"] for it in items if it["include"]]
        to_ignore = sorted({it["pattern"] for it in items if it["ignore"] and it["pattern"]})
        if not to_commit and not to_ignore:
            self.message = t("nothing_selected")
            return True
        self.scr.erase()
        h, w = self.scr.getmaxyx()
        safe_addstr(self.scr, 0, 0, (" " + t("commit_in", rel=st.rel)).ljust(w - 1),
                    curses.A_BOLD)
        y = 2
        if to_ignore:
            safe_addstr(self.scr, y, 1, t("new_in_gitignore"), curses.color_pair(C_YELLOW))
            y += 1
            for pat in to_ignore:
                safe_addstr(self.scr, y, 3, pat, curses.color_pair(C_YELLOW))
                y += 1
            y += 1
        safe_addstr(self.scr, y, 1, t("to_commit_n", n=len(to_commit)),
                    curses.color_pair(C_GREEN))
        y += 2
        # Stil-Vorlage: die letzten Commit-Messages des Repos
        r = run_git(st.path, "log", "-5", "--format=%s", timeout=self.cfg["git_timeout"])
        recent = [l for l in r.stdout.splitlines() if l.strip()]
        if recent:
            safe_addstr(self.scr, y, 1, t("recent_msgs"), curses.color_pair(C_DIM))
            y += 1
            for msg in recent:
                safe_addstr(self.scr, y, 3, f"· {msg}", curses.color_pair(C_DIM))
                y += 1
        y += 1
        msg = self.prompt_line(y, t("commit_msg_prompt"))
        if msg is None:
            return False  # Esc -> zurück zur Dateiauswahl
        if not msg:
            self.message = t("empty_msg")
            return True

        # Ausführen: .gitignore atomar ergänzen; exakt freigegebene Pfade über
        # einen temporären Index committen. Der echte Benutzer-Index bleibt erhalten.
        t_ = self.cfg["git_timeout"]
        try:
            ignore_changed = update_gitignore_atomic(st.path, to_ignore) if to_ignore else False
            approved = list(dict.fromkeys(to_commit + ([".gitignore"] if ignore_changed else [])))
            if not approved:
                self.message = t("nothing_selected")
                return True
            r = commit_selected(st.path, approved, msg, t_)
        except (CommitSafetyError, GitReadError, OSError) as e:
            self.message = t("commit_failed", e=str(e)[:120])
            return True
        if r.returncode != 0:
            self.message = t("commit_failed", e=r.stderr.strip()[:120])
            return True
        new = self.refresh_one(st)
        self.message = t("committed_in", rel=st.rel)
        # Nach einem Commit denselben abgesicherten privaten Sync-Push anbieten wie P.
        # Ein öffentlicher `origin` kann dadurch nie über die alte Kurzstrecke rutschen.
        if new.remote and new.behind == 0 and new.ahead > 0:
            self.action_sync_push()
        return True

    # -- Hauptschleife -------------------------------------------------------

    def run(self):
        curses.curs_set(0)
        self.reload()
        while True:
            self.draw()
            ch = self.scr.getch()
            self.message = ""
            st = self.current()
            # Cursor-/Sondertasten zuerst; Buchstaben danach case-insensitiv.
            if ch == curses.KEY_UP:
                self.selected = max(0, self.selected - 1)
                continue
            elif ch == curses.KEY_DOWN:
                self.selected = min(len(self.statuses) - 1, self.selected + 1)
                continue
            elif ch == curses.KEY_RIGHT and st:
                self.expanded.add(st.rel)
                continue
            elif ch == curses.KEY_LEFT and st:
                self.expanded.discard(st.rel)
                continue
            elif ch in (10, 13, curses.KEY_ENTER):
                if self.action_cd_and_quit():
                    return
                continue
            elif ch == 27:  # Esc
                return

            # Buchstaben-Kürzel: groß ODER klein akzeptieren (F wie f).
            try:
                key = chr(ch).upper()
            except ValueError:
                continue
            if key == "Q":
                return
            elif key == "C":
                self.action_commit_wizard()
            elif key == "U":
                self.action_stash_pop()
            elif key == "R":
                self.reload(fetch=True)
            elif key == "P":
                self.action_sync_push()
            elif key == "L":
                self.action_sync_pull()
            elif key == "G":
                self.action_github_push()
            elif key == "H":
                self.action_git_help()
            elif key == "S":
                self.action_stash_show()
            elif key == "D":
                self.action_stash_drop()
            elif key in self.cfg["apps"]:
                self.action_open_app(key)


def init_colors():
    curses.start_color()
    curses.use_default_colors()
    curses.init_pair(C_GREEN, curses.COLOR_GREEN, -1)
    curses.init_pair(C_RED, curses.COLOR_RED, -1)
    curses.init_pair(C_YELLOW, curses.COLOR_YELLOW, -1)
    curses.init_pair(C_DIM, curses.COLOR_WHITE, -1)
    curses.init_pair(C_CYAN, curses.COLOR_CYAN, -1)


# ---------------------------------------------------------------------------
# Demo-Sandbox (für `--demo`, Screenshots und risikofreies Ausprobieren)
# ---------------------------------------------------------------------------

def _dgit(repo: Path, *args: str) -> None:
    """git-Aufruf in der Demo-Sandbox; wirft bei Fehler (Sandbox muss sauber bauen)."""
    subprocess.run(["git", "-C", str(repo), *args], check=True,
                   capture_output=True, text=True)


def _demo_repo(root: Path, name: str, branch: str = "main") -> tuple[Path, Path]:
    """Neues Repo mit eigenem bare-"origin"-Remote + Erst-Commit, gepusht, upstream=origin/<branch>.

    `branch` ist der einzige Branch des Repos — so lassen sich auch Repos mit
    `master`, `develop` oder `feature/...` zeigen, ohne Sonderfälle im Aufrufer.
    """
    bare = root / "_remotes" / f"{name}.git"
    bare.mkdir(parents=True)
    _dgit(bare, "init", "-q", "--bare")
    repo = root / name
    repo.mkdir()
    _dgit(repo, "init", "-q", "-b", branch)
    _dgit(repo, "config", "user.email", "demo@example.invalid")
    _dgit(repo, "config", "user.name", "Demo")
    _dgit(repo, "config", "commit.gpgsign", "false")
    # Globale gitignore/Hooks ausblenden, sonst hängt das Demo-Ergebnis an der
    # Maschine (eine globale .DS_Store-Regel würde z.B. eine Zeile verschlucken).
    _dgit(repo, "config", "core.excludesFile", "/dev/null")
    _dgit(repo, "config", "core.hooksPath", "/dev/null")
    (repo / "README.md").write_text(f"# {name}\n")
    _dgit(repo, "add", "README.md")
    _dgit(repo, "commit", "-qm", "initial commit")
    _dgit(repo, "remote", "add", "origin", str(bare))
    _dgit(repo, "push", "-q", "-u", "origin", branch)
    return repo, bare


def _demo_commit(repo: Path, fname: str, content: str, msg: str) -> None:
    (repo / fname).write_text(content)
    _dgit(repo, "add", fname)
    _dgit(repo, "commit", "-qm", msg)


def _demo_extra_remote(root: Path, repo: Path, remote: str, branch: str = "main",
                       url: str | None = None) -> None:
    """Zweites Remote (z.B. `github`, `backup`) mit aktuellem Stand anlegen.

    Es wird immer gegen ein lokales bare-Repo gepusht (kein Netz). `url` stellt die
    Adresse danach auf eine Beispieladresse um — damit zeigt die Demo z.B. die echte
    GitHub-Sicherheitsklasse, ohne je ins Netz zu gehen.
    """
    bare = root / "_remotes" / f"{repo.name}-{remote}.git"
    bare.mkdir(parents=True)
    _dgit(bare, "init", "-q", "--bare")
    _dgit(repo, "remote", "add", remote, str(bare))
    _dgit(repo, "push", "-q", remote, branch)
    if url:
        _dgit(repo, "remote", "set-url", remote, url)


def _demo_ahead(repo: Path, n: int, branch: str = "main") -> None:
    """n Commits erzeugen, die auf origin fehlen (Repo ist 'voraus')."""
    for i in range(n):
        _demo_commit(repo, "work.txt", f"step {i}\n", f"feat: step {i}")


def _demo_behind(repo: Path, n: int) -> None:
    """n Commits auf origin schieben und lokal zurücksetzen (Repo ist 'zurück')."""
    for i in range(n):
        _demo_commit(repo, "upstream.txt", f"remote step {i}\n", f"chore: remote step {i}")
    _dgit(repo, "push", "-q", "origin", "HEAD")
    _dgit(repo, "reset", "--hard", "-q", f"HEAD~{n}")


def build_demo_sandbox(base: Path) -> Path:
    """Wegwerf-Sandbox mit Fake-Repos in allen Zuständen (Screenshots/Ausprobieren).

    Nutzt lokale bare-Repos als Remotes (kein Netz). Deckt ab: sauber & synchron,
    modified/untracked, ahead/behind/auseinandergelaufen, Merge-Konflikt + Stash, nur
    Stash, kein Sync-Remote, mehrere Remotes (origin/backup/github), Branches abseits
    von main (master, develop, feature/…, release/…) und den 'fremder Upstream'-Hinweis
    (↑n github).
    """
    root = base / "gmf-demo"
    root.mkdir(parents=True, exist_ok=True)

    # 1) sauber & synchron, aber 3 Commits vor 'github' (cyaner Upstream-Badge)
    repo, _ = _demo_repo(root, "webshop-frontend")
    gh = root / "_remotes" / "webshop-frontend-github.git"
    gh.mkdir(parents=True)
    _dgit(gh, "init", "-q", "--bare")
    _dgit(repo, "remote", "add", "github", str(gh))
    _dgit(repo, "push", "-q", "github", "main")               # github/main = Basis
    # Nach dem lokalen Aufbau nur die URL auf eine harmlose Beispieladresse
    # umstellen. So zeigt die Demo die echte GitHub-Sicherheitsklasse, ohne Netz.
    _dgit(repo, "remote", "set-url", "github",
          "https://github.com/example/webshop-frontend.git")
    for i in range(3):
        _demo_commit(repo, "app.js", f"// build {i}\n", f"feat: change {i}")
    _dgit(repo, "push", "-q", "origin", "main")               # origin synchron
    _dgit(repo, "branch", "--set-upstream-to=github/main", "main")

    # 2) modified + untracked
    repo, _ = _demo_repo(root, "api-gateway")
    (repo / "README.md").write_text("# api-gateway\n\nlocal change\n")
    (repo / "server.py").write_text("print('wip')\n")
    (repo / "notes.txt").write_text("todo\n")

    # 3) mehrere untracked (inkl. typischem gitignore-Kandidat)
    repo, _ = _demo_repo(root, "dotfiles")
    (repo / "install.sh").write_text("#!/bin/sh\n")
    (repo / ".DS_Store").write_text("junk\n")
    (repo / "debug.log").write_text("log\n")

    # 4) 2 Commits vor dem Sync-Remote (ungepusht), Baum sauber
    repo, _ = _demo_repo(root, "blog-astro")
    for i in range(2):
        _demo_commit(repo, "post.md", f"# post {i}\n", f"post: entry {i}")

    # 5) 1 Commit hinter dem Sync-Remote
    repo, _ = _demo_repo(root, "invoice-parser")
    _demo_commit(repo, "parser.py", "v2\n", "fix: parsing")
    _dgit(repo, "push", "-q", "origin", "main")               # origin voraus
    _dgit(repo, "reset", "--hard", "-q", "HEAD~1")            # lokal 1 zurück

    # 6) Merge-Konflikt (2 Dateien) + erhaltener Stash
    repo, _ = _demo_repo(root, "ml-experiments")
    _demo_commit(repo, "a.txt", "a-base\n", "add a")
    _demo_commit(repo, "b.txt", "b-base\n", "add b")
    _dgit(repo, "push", "-q", "origin", "main")
    (repo / "a.txt").write_text("a-stash\n")
    (repo / "b.txt").write_text("b-stash\n")
    _dgit(repo, "stash")                                       # Stash: a/b geändert
    (repo / "a.txt").write_text("a-head\n")
    (repo / "b.txt").write_text("b-head\n")
    _dgit(repo, "commit", "-qam", "conflicting change")
    _dgit(repo, "push", "-q", "origin", "main")
    subprocess.run(["git", "-C", str(repo), "stash", "pop"],  # erzeugt Konflikt, behält Stash
                   capture_output=True, text=True)

    # 7) nur ein Stash (Baum sonst sauber)
    repo, _ = _demo_repo(root, "game-jam")
    (repo / "README.md").write_text("# game-jam\n\nunfinished\n")
    _dgit(repo, "stash")

    # 8) sauber & synchron (schlichtes Grün)
    _demo_repo(root, "notes-vault")

    # 10) master statt main, sauber & synchron
    _demo_repo(root, "legacy-cms", branch="master")

    # 11) master + lokale Änderung
    repo, _ = _demo_repo(root, "payroll-tool", branch="master")
    (repo / "README.md").write_text("# payroll-tool\n\nrate table 2026\n")

    # 12) auseinandergelaufen: 1 zurück und 2 voraus
    repo, _ = _demo_repo(root, "site-generator")
    _demo_behind(repo, 1)
    _demo_ahead(repo, 2)

    # 13) eigener Branch 'develop', 3 Commits voraus
    repo, _ = _demo_repo(root, "iot-firmware", branch="develop")
    _demo_ahead(repo, 3)

    # 14) Feature-Branch mit Slash im Namen + untracked
    repo, _ = _demo_repo(root, "data-pipeline", branch="feature/etl-rewrite")
    (repo / "sketch.py").write_text("# draft\n")

    # 15) drei Remotes (origin, backup, github), sauber
    repo, _ = _demo_repo(root, "docs-portal")
    _demo_extra_remote(root, repo, "backup")
    _demo_extra_remote(root, repo, "github",
                       url="https://github.com/example/docs-portal.git")

    # 16) Backup-Remote + 2 Commits zurück
    repo, _ = _demo_repo(root, "photo-sorter")
    _demo_extra_remote(root, repo, "backup")
    _demo_behind(repo, 2)

    # 17) fremder Upstream (github) UND lokale Änderung
    repo, _ = _demo_repo(root, "auth-service")
    _demo_extra_remote(root, repo, "github",
                       url="https://github.com/example/auth-service.git")
    _demo_ahead(repo, 2)
    _dgit(repo, "push", "-q", "origin", "main")
    _dgit(repo, "branch", "--set-upstream-to=github/main", "main")
    (repo / "token.py").write_text("SECRET = None\n")

    # 18) zwei Stashes, Baum sonst sauber
    repo, _ = _demo_repo(root, "recipe-app")
    for i in range(2):
        (repo / "README.md").write_text(f"# recipe-app\n\ndraft {i}\n")
        _dgit(repo, "stash")

    # 19) Release-Branch, sauber & synchron
    _demo_repo(root, "monorepo-sandbox", branch="release/2.1")

    # 20) viele Commits voraus
    repo, _ = _demo_repo(root, "chess-engine")
    _demo_ahead(repo, 5)

    # 21) deutlich zurück
    repo, _ = _demo_repo(root, "portfolio-site")
    _demo_behind(repo, 3)

    # 22) master + Backup-Remote + Stash
    repo, _ = _demo_repo(root, "budget-tracker", branch="master")
    _demo_extra_remote(root, repo, "backup", branch="master")
    (repo / "README.md").write_text("# budget-tracker\n\nwip\n")
    _dgit(repo, "stash")

    # 23) viele untracked Dateien
    repo, _ = _demo_repo(root, "sensor-logs")
    for i in range(4):
        (repo / f"run-{i}.csv").write_text("t,v\n")

    # 24) Konflikt auf master (zweiter Konfliktfall, andere Farbe im Kopf)
    repo, _ = _demo_repo(root, "test-harness", branch="master")
    _demo_commit(repo, "case.txt", "base\n", "add case")
    _dgit(repo, "push", "-q", "origin", "master")
    (repo / "case.txt").write_text("stashed\n")
    _dgit(repo, "stash")
    (repo / "case.txt").write_text("head\n")
    _dgit(repo, "commit", "-qam", "conflicting change")
    _dgit(repo, "push", "-q", "origin", "master")
    subprocess.run(["git", "-C", str(repo), "stash", "pop"],
                   capture_output=True, text=True)

    # 25) Änderung + Stash gleichzeitig
    repo, _ = _demo_repo(root, "vpn-config")
    (repo / "README.md").write_text("# vpn-config\n\nold\n")
    _dgit(repo, "stash")
    (repo / "peers.conf").write_text("[Peer]\n")

    # 26) voraus + untracked
    repo, _ = _demo_repo(root, "cli-toolkit")
    _demo_ahead(repo, 1)
    (repo / "TODO.md").write_text("- ship\n")

    # 27) sauber & synchron auf develop
    _demo_repo(root, "wiki-export", branch="develop")

    # 9) gar kein Remote
    repo = root / "scratchpad"
    repo.mkdir()
    _dgit(repo, "init", "-q", "-b", "main")
    _dgit(repo, "config", "user.email", "demo@example.invalid")
    _dgit(repo, "config", "user.name", "Demo")
    _dgit(repo, "config", "commit.gpgsign", "false")
    _dgit(repo, "config", "core.excludesFile", "/dev/null")
    _dgit(repo, "config", "core.hooksPath", "/dev/null")
    (repo / "idea.md").write_text("# scratch\n")
    _dgit(repo, "add", "idea.md")
    _dgit(repo, "commit", "-qm", "initial commit")

    return root


# ---------------------------------------------------------------------------
# main
# ---------------------------------------------------------------------------

def main(argv: list[str] | None = None) -> int:
    ap = argparse.ArgumentParser(
        description="Fast TUI overview of every Git repo below the current directory.")
    ap.add_argument("root", nargs="?", default=".",
                    help="start directory for the repo scan (default: current dir)")
    ap.add_argument("--list", action="store_true",
                    help="non-interactive colored text list")
    ap.add_argument("--json", action="store_true",
                    help="non-interactive JSON output (machine-readable)")
    ap.add_argument("--fetch", action="store_true",
                    help="`git fetch` each repo before output (with --list/--json)")
    ap.add_argument("--diff", metavar="HOST[:PATH]",
                    help="compare this machine's repos with HOST over ssh and print "
                         "only the differences (read-only). Needs `ssh HOST` to work; "
                         "gitmaster_flash need NOT be installed there. PATH overrides "
                         "the directory scanned on the other side.")
    ap.add_argument("--lang", choices=["en", "de"],
                    help="UI language (overrides config; default: auto from $LANG)")
    ap.add_argument("--demo", action="store_true",
                    help="build a throwaway sandbox of fake repos and run on it")
    ap.add_argument("--cd-file", metavar="FILE",
                    help="(internal, for the gmf wrapper) write the ⏎ target path here")
    ap.add_argument("--version", action="version", version=__version__)
    args = ap.parse_args(argv)

    global UI_LANG

    if args.demo:
        # Demo ignoriert die persönliche Config bewusst: generische Apps + Sprache,
        # damit Screenshots reproduzierbar und neutral sind.
        cfg = json.loads(json.dumps(DEFAULT_CONFIG))
        cfg["apps"] = {k.upper(): v for k, v in cfg["apps"].items()}
        UI_LANG = resolve_lang(cfg, args.lang)
        sandbox = build_demo_sandbox(Path(tempfile.mkdtemp(prefix="gmf-demo-")))
        print(t("demo_built", p=sandbox), file=sys.stderr)
        root = sandbox
    else:
        cfg = load_config()
        UI_LANG = resolve_lang(cfg, args.lang)
        root = Path(args.root).expanduser().resolve()
        if not root.is_dir():
            print(t("not_a_dir", p=root), file=sys.stderr)
            return 1

    if args.diff:
        return run_diff(args.diff, root, cfg, fetch=args.fetch, as_json=args.json)

    if args.list or args.json or not sys.stdout.isatty():
        statuses = collect_all(root, cfg, fetch=args.fetch)
        if args.json:
            # Objekt statt nacktem Array (seit 0.6.0): nur so lassen sich Version und
            # Wurzel mitgeben — beim Vergleich zweier Macs muss erkennbar sein, ob
            # dieselbe Fassung dahintersteht. Die Repos liegen unter "repos".
            print(json.dumps({"version": __version__, "root": str(root),
                              "repos": [status_dict(s) for s in statuses]},
                             indent=2, ensure_ascii=False))
        else:
            print_list(statuses, root)
        # Exit-Code 1, wenn irgendein Repo Aufmerksamkeit braucht (skriptbar).
        return 0 if all(s.clean_and_synced for s in statuses) else 1

    def _run(stdscr):
        init_colors()
        TUI(stdscr, root, cfg, args.cd_file).run()

    curses.wrapper(_run)
    return 0


if __name__ == "__main__":
    sys.exit(main())