//! A repository on disk: the `.oxy` directory, one workspace, the operation
//! log, and the working-copy change (spec §12, §13.1).
//!
//! Not yet implemented from the spec: signatures and identities (the author
//! is `ObjectRef::ZERO`), packs, checkpoints, multiple workspaces, remotes,
//! and resolving conflicts by editing markers.

use crate::diff::{ranges, split_lines, text_edits};
use crate::hash::{hash_object, ChangeHash, ObjectRef, ObjectType};
use crate::ids::{ChangeId, NodeId, WorkspaceId};
use crate::objects::{Blob, Change, ChangeKind, Edit, Hlc, Mode, NodeKind, OpRef, TreeOp};
use crate::oplog::{Op, View, SNAPSHOT_SUFFIX};
use crate::state::{FileContent, Snapshot, State};
use crate::store::{Store, StoreError};
use crate::tree::OpKey;
use std::collections::{BTreeMap, BTreeSet, HashMap};
use std::fs;
use std::io::Write;
use std::path::{Path, PathBuf};

pub const OXY_DIR: &str = ".oxy";
pub const FORMAT_LINE: &str = "oxy repository format 1\n";
const BINARY_SNIFF: usize = 8 * 1024;

#[derive(Debug, thiserror::Error)]
pub enum RepoError {
    #[error("io: {0}")]
    Io(#[from] std::io::Error),
    #[error(transparent)]
    Store(#[from] StoreError),
    #[error(transparent)]
    Object(#[from] crate::objects::ObjectError),
    #[error(transparent)]
    State(#[from] crate::state::StateError),
    #[error("{0}")]
    Msg(String),
}

pub type Result<T> = std::result::Result<T, RepoError>;

fn fail<T>(s: impl Into<String>) -> Result<T> {
    Err(RepoError::Msg(s.into()))
}

/// Repository-local settings (`.oxy/config`, `key = value` lines).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Config {
    pub author_name: String,
    pub author_email: String,
    pub bookmark: String,
}

impl Config {
    fn default_for_user() -> Config {
        let user = std::env::var("USER").unwrap_or_else(|_| "unknown".into());
        Config {
            author_name: std::env::var("OXY_AUTHOR_NAME").unwrap_or_else(|_| user.clone()),
            author_email: std::env::var("OXY_AUTHOR_EMAIL").unwrap_or_else(|_| format!("{user}@localhost")),
            bookmark: "main".into(),
        }
    }

    fn load(path: &Path) -> Result<Config> {
        let mut c = Config::default_for_user();
        for line in fs::read_to_string(path)?.lines() {
            let line = line.trim();
            if line.is_empty() || line.starts_with('#') {
                continue;
            }
            let Some((k, v)) = line.split_once('=') else { continue };
            let v = v.trim().trim_matches('"').to_string();
            match k.trim() {
                "author.name" => c.author_name = v,
                "author.email" => c.author_email = v,
                "workspace.bookmark" => c.bookmark = v,
                _ => {}
            }
        }
        Ok(c)
    }

    fn save(&self, path: &Path) -> Result<()> {
        let text = format!(
            "author.name = \"{}\"\nauthor.email = \"{}\"\nworkspace.bookmark = \"{}\"\n",
            self.author_name, self.author_email, self.bookmark
        );
        write_atomic(path, text.as_bytes())
    }
}

fn write_atomic(path: &Path, data: &[u8]) -> Result<()> {
    let tmp = path.with_extension("tmp");
    {
        let mut f = fs::File::create(&tmp)?;
        f.write_all(data)?;
        f.sync_all()?;
    }
    fs::rename(&tmp, path)?;
    Ok(())
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ChangeStatus {
    Added,
    Modified,
    Removed,
    ModeChanged,
    /// The file is conflicted in the base state and was edited in the working copy.
    ConflictEdited,
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct PathStatus {
    pub path: String,
    pub status: ChangeStatus,
}

/// Result of snapshotting the working copy.
pub struct SnapshotResult {
    pub wc_hash: ChangeHash,
    pub wc: Change,
    /// The base state (closure of the working-copy change's dependencies).
    pub base: State,
    pub base_snapshot: Snapshot,
    pub statuses: Vec<PathStatus>,
    /// Whether the snapshot rewrote the working-copy change.
    pub changed: bool,
}

pub struct LogEntry {
    pub hash: ChangeHash,
    pub change: Change,
    pub is_working_copy: bool,
    pub is_head: bool,
}

struct FsEntry {
    kind: NodeKind,
    exec: bool,
    content: Vec<u8>,
}

pub struct Repo {
    root: PathBuf,
    oxy: PathBuf,
    store: Store,
    workspace: WorkspaceId,
    pub config: Config,
}

pub fn is_binary(content: &[u8]) -> bool {
    content[..content.len().min(BINARY_SNIFF)].contains(&0)
}

impl Repo {
    // ------------------------------------------------------------ lifecycle

    pub fn init(root: &Path) -> Result<Repo> {
        let root = root.canonicalize().unwrap_or_else(|_| root.to_path_buf());
        let oxy = root.join(OXY_DIR);
        if oxy.exists() {
            return fail(format!("{} is already an oxy repository", root.display()));
        }
        fs::create_dir_all(oxy.join("ops"))?;
        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;
        let config = Config::default_for_user();
        config.save(&oxy.join("config"))?;
        let workspace = WorkspaceId::random();
        write_atomic(&oxy.join("workspace"), workspace.to_hex().as_bytes())?;
        let store = Store::open(oxy.join("objects"))?;
        let repo = Repo { root, oxy, store, workspace, config };

        let wc = repo.new_working_copy(vec![], "");
        let wc_hash = repo.store.put_change(&wc)?;
        let mut view = View::default();
        view.bookmarks.insert(repo.config.bookmark.clone(), vec![]);
        view.workspaces.insert(workspace, wc_hash);
        repo.record_op(&[], "oxy init", view)?;
        Ok(repo)
    }

    /// Open the repository containing `start` (searching upwards).
    pub fn open(start: &Path) -> Result<Repo> {
        let start = start.canonicalize()?;
        let mut dir: Option<&Path> = Some(&start);
        while let Some(d) = dir {
            let oxy = d.join(OXY_DIR);
            if oxy.is_dir() {
                let format = fs::read_to_string(oxy.join("format"))?;
                if format != FORMAT_LINE {
                    return fail(format!("unsupported repository format: {}", format.trim()));
                }
                let config = Config::load(&oxy.join("config"))?;
                let workspace = WorkspaceId::from_hex(fs::read_to_string(oxy.join("workspace"))?.trim())
                    .ok_or_else(|| RepoError::Msg("corrupt .oxy/workspace".into()))?;
                let store = Store::open(oxy.join("objects"))?;
                return Ok(Repo { root: d.to_path_buf(), oxy, store, workspace, config });
            }
            dir = d.parent();
        }
        fail(format!("no oxy repository found at or above {}", start.display()))
    }

    pub fn root(&self) -> &Path {
        &self.root
    }
    pub fn store(&self) -> &Store {
        &self.store
    }
    pub fn workspace(&self) -> WorkspaceId {
        self.workspace
    }

    fn new_working_copy(&self, deps: Vec<ChangeHash>, message: &str) -> Change {
        let mut c = Change {
            change_id: ChangeId::random(),
            deps,
            author: ObjectRef::ZERO,
            hlc: Hlc::now(),
            message: message.into(),
            tree_ops: vec![],
            edits: vec![],
            kind: ChangeKind::WorkingCopy,
        };
        c.normalize();
        c
    }

    // ------------------------------------------------------------ operation log

    pub fn head_op(&self) -> Result<(ObjectRef, Op)> {
        let hex = fs::read_to_string(self.oxy.join("ops").join("head"))?;
        let r = ObjectRef::from_hex(hex.trim()).ok_or_else(|| RepoError::Msg("corrupt .oxy/ops/head".into()))?;
        let op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;
        Ok((r, op))
    }

    pub fn view(&self) -> Result<View> {
        Ok(self.head_op()?.1.view)
    }

    fn record_op(&self, parents: &[ObjectRef], command: &str, view: View) -> Result<ObjectRef> {
        let op = Op { parents: parents.to_vec(), hlc: Hlc::now(), command: command.into(), view };
        let r = self.store.put(ObjectType::Op, &op.encode())?;
        write_atomic(&self.oxy.join("ops").join("head"), r.to_hex().as_bytes())?;
        Ok(r)
    }

    pub fn op_log(&self) -> Result<Vec<(ObjectRef, Op)>> {
        let mut out = Vec::new();
        let (mut r, mut op) = self.head_op()?;
        loop {
            let next = op.parents.first().copied();
            out.push((r, op));
            match next {
                Some(p) => {
                    r = p;
                    op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;
                }
                None => break,
            }
        }
        Ok(out)
    }

    /// Undo the last user command (spec §12.1). Operations that only recorded
    /// a working-copy snapshot are skipped, since the files are still on disk
    /// and the next snapshot recreates them.
    pub fn undo(&self) -> Result<Op> {
        let (_, mut op) = self.head_op()?;
        while op.is_snapshot() {
            let Some(parent) = op.parents.first() else { break };
            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        }
        let Some(parent) = op.parents.first() else {
            return fail("nothing to undo");
        };
        let parent_op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        write_atomic(&self.oxy.join("ops").join("head"), parent.to_hex().as_bytes())?;
        Ok(parent_op)
    }

    /// The last operation that was not a snapshot.
    pub fn last_command(&self) -> Result<Op> {
        let (_, mut op) = self.head_op()?;
        while op.is_snapshot() {
            let Some(parent) = op.parents.first() else { break };
            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        }
        Ok(op)
    }

    // ------------------------------------------------------------ states

    /// Load the dependency closure of `heads` from the store.
    pub fn load_state(&self, heads: &[ChangeHash]) -> Result<State> {
        let mut state = State::new();
        let mut stack: Vec<ChangeHash> = heads.to_vec();
        let mut seen: BTreeSet<ChangeHash> = BTreeSet::new();
        while let Some(h) = stack.pop() {
            if !seen.insert(h) {
                continue;
            }
            let c = self.store.get_change(&h)?;
            stack.extend(c.deps.iter().copied());
            state.add_unchecked(c);
        }
        state.validate()?;
        Ok(state)
    }

    pub fn working_copy(&self) -> Result<(ChangeHash, Change)> {
        let view = self.view()?;
        let h = *view
            .workspaces
            .get(&self.workspace)
            .ok_or_else(|| RepoError::Msg("this workspace is not in the current view".into()))?;
        Ok((h, self.store.get_change(&h)?))
    }

    pub fn bookmark_heads(&self) -> Result<Vec<ChangeHash>> {
        Ok(self.view()?.bookmarks.get(&self.config.bookmark).cloned().unwrap_or_default())
    }

    // ------------------------------------------------------------ blobs

    fn blob_for(content: &[u8]) -> Blob {
        Blob {
            length: content.len() as u64,
            chunks: crate::chunk::chunks(content).into_iter().map(|c| hash_object(ObjectType::Chunk, c)).collect(),
        }
    }

    pub fn blob_ref(content: &[u8]) -> ObjectRef {
        Self::blob_for(content).hash()
    }

    pub fn store_blob(&self, content: &[u8]) -> Result<ObjectRef> {
        for c in crate::chunk::chunks(content) {
            self.store.put_chunk(c)?;
        }
        Ok(self.store.put(ObjectType::Blob, &Self::blob_for(content).encode())?)
    }

    pub fn read_blob(&self, r: &ObjectRef) -> Result<Vec<u8>> {
        let blob = Blob::decode(&self.store.get_typed(r, ObjectType::Blob)?)?;
        let mut out = Vec::with_capacity(blob.length as usize);
        for c in &blob.chunks {
            out.extend(self.store.get_typed(c, ObjectType::Chunk)?);
        }
        Ok(out)
    }

    // ------------------------------------------------------------ working copy

    fn walk_working_copy(&self) -> Result<BTreeMap<String, FsEntry>> {
        let mut wb = ignore::WalkBuilder::new(&self.root);
        wb.hidden(false)
            .git_ignore(false)
            .git_global(false)
            .git_exclude(false)
            .require_git(false)
            .follow_links(false)
            .add_custom_ignore_filename(".oxyignore");
        wb.filter_entry(|e| e.file_name() != OXY_DIR);
        let mut out = BTreeMap::new();
        for entry in wb.build() {
            let entry = entry.map_err(|e| RepoError::Msg(e.to_string()))?;
            let path = entry.path();
            if path == self.root {
                continue;
            }
            let rel = path.strip_prefix(&self.root).unwrap();
            let rel: String = rel.components().map(|c| c.as_os_str().to_string_lossy().to_string()).collect::<Vec<_>>().join("/");
            let Some(ft) = entry.file_type() else { continue };
            if ft.is_dir() {
                continue;
            }
            if ft.is_symlink() {
                let target = fs::read_link(path)?;
                out.insert(rel, FsEntry { kind: NodeKind::Symlink, exec: false, content: target.to_string_lossy().as_bytes().to_vec() });
            } else if ft.is_file() {
                let exec = is_executable(&entry.metadata().map_err(|e| RepoError::Msg(e.to_string()))?);
                out.insert(rel, FsEntry { kind: NodeKind::File, exec, content: fs::read(path)? });
            }
        }
        Ok(out)
    }

    /// Snapshot the working copy into the working-copy change (spec §12.3).
    pub fn snapshot(&self, command: &str) -> Result<SnapshotResult> {
        let (op_ref, op) = self.head_op()?;
        let (old_hash, old_wc) = self.working_copy()?;
        let base = self.load_state(&old_wc.deps)?;
        let base_snapshot = base.materialize();
        let fs_entries = self.walk_working_copy()?;

        // Reuse the NodeIds the previous working-copy version assigned to new
        // paths, so an unchanged working copy hashes identically (spec §12.3).
        let reuse = added_node_paths(&old_wc, &base_snapshot);
        let mut b = ChangeBuilder::new(&base, &base_snapshot, reuse);
        for (path, fs_entry) in &fs_entries {
            match base_snapshot.files.get(path) {
                None => b.add_path(self, path, fs_entry)?,
                Some(expected) => b.update_path(self, path, fs_entry, expected)?,
            }
        }
        for (path, expected) in &base_snapshot.files {
            if fs_entries.contains_key(path) {
                continue;
            }
            let still_needed = expected.kind == NodeKind::Dir && fs_entries.keys().any(|p| p.starts_with(&format!("{path}/")));
            if !still_needed {
                b.remove_path(path, expected);
            }
        }

        let mut wc = Change {
            change_id: old_wc.change_id,
            deps: vec![],
            author: ObjectRef::ZERO,
            hlc: old_wc.hlc,
            message: old_wc.message.clone(),
            tree_ops: b.tree_ops,
            edits: b.edits,
            kind: ChangeKind::WorkingCopy,
        };
        let base_heads = base.maximal(&old_wc.deps);
        let mut deps: BTreeSet<ChangeHash> = base_heads.into_iter().collect();
        deps.extend(referenced_changes(&wc, &base));
        wc.deps = deps.into_iter().collect();
        wc.normalize();

        let mut statuses = b.statuses;
        statuses.sort_by(|a, b| a.path.cmp(&b.path));
        // Empty snapshot: hash the candidate before storing; only record an op on change.
        let new_hash = wc.hash();
        let changed = new_hash != old_hash;
        if changed {
            self.store.put_change(&wc)?;
            let mut view = op.view.clone();
            view.workspaces.insert(self.workspace, new_hash);
            self.record_op(&[op_ref], &format!("{command}{SNAPSHOT_SUFFIX}"), view)?;
        }
        Ok(SnapshotResult { wc_hash: new_hash, wc, base, base_snapshot, statuses, changed })
    }

    /// Turn the working-copy change into a normal change on the bookmark (spec §12.3).
    pub fn commit(&self, message: &str, extra_deps: &[ChangeHash]) -> Result<ChangeHash> {
        let snap = self.snapshot("oxy commit")?;
        if snap.wc.tree_ops.is_empty() && snap.wc.edits.is_empty() {
            return fail("nothing to commit: the working copy matches its base");
        }
        if snap.statuses.iter().any(|s| s.status == ChangeStatus::ConflictEdited) {
            return fail("a conflicted file was edited; resolving conflicts is not implemented yet");
        }
        if message.trim().is_empty() {
            return fail("a commit message is required");
        }
        let (op_ref, op) = self.head_op()?;
        let mut deps: BTreeSet<ChangeHash> = referenced_changes(&snap.wc, &snap.base);
        for d in extra_deps {
            if !snap.base.contains(d) {
                return fail(format!("--depends-on {d}: not in the working copy's base state"));
            }
            deps.insert(*d);
        }
        let mut change = Change {
            change_id: snap.wc.change_id,
            deps: deps.into_iter().collect(),
            author: ObjectRef::ZERO,
            hlc: Hlc::now(),
            message: message.trim_end().to_string(),
            tree_ops: snap.wc.tree_ops.clone(),
            edits: snap.wc.edits.clone(),
            kind: ChangeKind::Normal,
        };
        change.normalize();
        let hash = self.store.put_change(&change)?;

        // New bookmark heads: maximal elements of old heads plus the new change.
        let old_heads = op.view.bookmarks.get(&self.config.bookmark).cloned().unwrap_or_default();
        let mut with_new: Vec<ChangeHash> = old_heads.clone();
        with_new.push(hash);
        let mut st = self.load_state(&with_new)?;
        st.add(change)?;
        let new_heads = st.maximal(&with_new);

        let wc = self.new_working_copy(new_heads.clone(), "");
        let wc_hash = self.store.put_change(&wc)?;
        let mut view = op.view.clone();
        view.bookmarks.insert(self.config.bookmark.clone(), new_heads);
        view.workspaces.insert(self.workspace, wc_hash);
        self.record_op(&[op_ref], &format!("oxy commit -m {message:?}"), view)?;
        Ok(hash)
    }

    /// Move the working copy to the state whose heads are `heads` (spec §12.3):
    /// the working directory is rewritten to that state and a fresh
    /// working-copy change is started on it. The bookmark does not move.
    pub fn checkout(&self, heads: &[ChangeHash], discard: bool, command: &str) -> Result<CheckoutReport> {
        let snap = self.snapshot(command)?;
        if !discard && (!snap.wc.tree_ops.is_empty() || !snap.wc.edits.is_empty()) {
            return fail("the working copy has changes; commit them first or pass --discard");
        }
        let target_state = self.load_state(heads)?;
        let heads = target_state.maximal(heads);
        let target = target_state.materialize();
        let current = self.walk_working_copy()?;
        let mut report = CheckoutReport::default();

        // Remove tracked paths that the target does not have.
        let mut dirs_to_prune: BTreeSet<PathBuf> = BTreeSet::new();
        for path in current.keys() {
            if !target.files.contains_key(path) {
                let full = self.safe_path(path)?;
                fs::remove_file(&full)?;
                report.removed += 1;
                if let Some(parent) = full.parent() {
                    dirs_to_prune.insert(parent.to_path_buf());
                }
            }
        }
        // Write target files that differ.
        for (path, f) in &target.files {
            match &f.content {
                FileContent::Dir => continue,
                FileContent::Text { bytes, .. } => {
                    let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && &c.content == bytes && c.exec == f.mode.exec);
                    if !same {
                        self.write_file(path, bytes, f.mode.exec)?;
                        report.written += 1;
                    }
                }
                FileContent::Opaque { blobs } => {
                    let Some(blob) = blobs.first() else { continue };
                    let bytes = self.read_blob(blob)?;
                    if f.kind == NodeKind::Symlink {
                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::Symlink && c.content == bytes);
                        if !same {
                            self.write_symlink(path, &bytes)?;
                            report.written += 1;
                        }
                    } else {
                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && c.content == bytes && c.exec == f.mode.exec);
                        if !same {
                            self.write_file(path, &bytes, f.mode.exec)?;
                            report.written += 1;
                        }
                    }
                    if blobs.len() > 1 {
                        for (i, b) in blobs.iter().enumerate().skip(1) {
                            self.write_file(&format!("{path}.oxy-conflict-{}", i + 1), &self.read_blob(b)?, f.mode.exec)?;
                        }
                    }
                }
            }
        }
        // Prune directories left empty, deepest first.
        for d in dirs_to_prune.iter().rev() {
            let mut d = d.clone();
            while d != self.root && fs::read_dir(&d).map(|mut i| i.next().is_none()).unwrap_or(false) {
                fs::remove_dir(&d)?;
                let Some(p) = d.parent() else { break };
                d = p.to_path_buf();
            }
        }

        let (op_ref, op) = self.head_op()?;
        let wc = self.new_working_copy(heads, "");
        let wc_hash = self.store.put_change(&wc)?;
        let mut view = op.view.clone();
        view.workspaces.insert(self.workspace, wc_hash);
        self.record_op(&[op_ref], command, view)?;
        report.conflicted = target.is_conflicted();
        Ok(report)
    }

    /// The absolute path for a repository path, refusing anything that would
    /// escape the workspace or write through a symlink (spec §7.7).
    fn safe_path(&self, rel: &str) -> Result<PathBuf> {
        let mut full = self.root.clone();
        let comps: Vec<&str> = rel.split('/').collect();
        for (i, comp) in comps.iter().enumerate() {
            if comp.is_empty() || *comp == "." || *comp == ".." || comp.contains('\\') {
                return fail(format!("refusing unsafe path {rel:?}"));
            }
            if i == 0 && *comp == OXY_DIR {
                return fail(format!("refusing to write inside {OXY_DIR}: {rel:?}"));
            }
            if i + 1 < comps.len() {
                full.push(comp);
                if let Ok(m) = fs::symlink_metadata(&full) {
                    if m.file_type().is_symlink() {
                        return fail(format!("refusing to write through symlink {}", full.display()));
                    }
                }
            } else {
                full.push(comp);
            }
        }
        Ok(full)
    }

    fn write_file(&self, rel: &str, bytes: &[u8], exec: bool) -> Result<()> {
        let full = self.safe_path(rel)?;
        if let Some(parent) = full.parent() {
            fs::create_dir_all(parent)?;
        }
        if fs::symlink_metadata(&full).is_ok_and(|m| m.file_type().is_symlink() || m.is_dir()) {
            remove_any(&full)?;
        }
        fs::write(&full, bytes)?;
        set_executable(&full, exec)?;
        Ok(())
    }

    fn write_symlink(&self, rel: &str, target: &[u8]) -> Result<()> {
        let full = self.safe_path(rel)?;
        if let Some(parent) = full.parent() {
            fs::create_dir_all(parent)?;
        }
        if fs::symlink_metadata(&full).is_ok() {
            remove_any(&full)?;
        }
        #[cfg(unix)]
        {
            std::os::unix::fs::symlink(String::from_utf8_lossy(target).as_ref(), &full)?;
            Ok(())
        }
        #[cfg(not(unix))]
        {
            // Spec §7.7: without symlink support, write the target as a plain file.
            fs::write(&full, target)?;
            Ok(())
        }
    }

    /// Changes reachable from the bookmark and the working copy, newest first.
    pub fn log(&self) -> Result<Vec<LogEntry>> {
        let (wc_hash, _) = self.working_copy()?;
        let mut heads = self.bookmark_heads()?;
        heads.push(wc_hash);
        let state = self.load_state(&heads)?;
        let head_set: BTreeSet<ChangeHash> = self.bookmark_heads()?.into_iter().collect();
        let mut entries: Vec<LogEntry> = state
            .changes()
            .map(|(h, c)| LogEntry { hash: *h, change: c.clone(), is_working_copy: *h == wc_hash, is_head: head_set.contains(h) })
            .collect();
        entries.sort_by(|a, b| b.change.hlc.cmp(&a.change.hlc).then(b.hash.cmp(&a.hash)));
        Ok(entries)
    }

    /// Resolve a change by ChangeId prefix, `#hash` prefix, `@` (working copy), or bookmark.
    pub fn resolve_change(&self, spec: &str) -> Result<ChangeHash> {
        if spec == "@" {
            return Ok(self.working_copy()?.0);
        }
        if spec.is_empty() || spec == "#" {
            return fail("empty change specifier");
        }
        let entries = self.log()?;
        let matches: Vec<&LogEntry> = if let Some(hp) = spec.strip_prefix('#') {
            entries.iter().filter(|e| e.hash.starts_with_hex(hp)).collect()
        } else {
            entries.iter().filter(|e| e.change.change_id.starts_with_hex(spec)).collect()
        };
        match matches.len() {
            1 => Ok(matches[0].hash),
            0 => fail(format!("no change matches {spec:?}")),
            _ => {
                let ids: BTreeSet<ChangeId> = matches.iter().map(|e| e.change.change_id).collect();
                if ids.len() == 1 {
                    fail(format!("change {spec} is divergent: {} variants", matches.len()))
                } else {
                    fail(format!("{spec:?} is ambiguous"))
                }
            }
        }
    }

    /// Human-readable description of what a change does, with line content.
    pub fn describe_change(&self, hash: &ChangeHash) -> Result<String> {
        let change = self.store.get_change(hash)?;
        let base = self.load_state(&change.deps)?;
        let base_snapshot = base.materialize();
        Ok(render_change(&change, &base, &base_snapshot))
    }
}

#[derive(Debug, Default, Clone, PartialEq, Eq)]
pub struct CheckoutReport {
    pub written: usize,
    pub removed: usize,
    pub conflicted: bool,
}

fn remove_any(path: &Path) -> std::io::Result<()> {
    let m = fs::symlink_metadata(path)?;
    if m.is_dir() { fs::remove_dir_all(path) } else { fs::remove_file(path) }
}

#[cfg(unix)]
fn set_executable(path: &Path, exec: bool) -> std::io::Result<()> {
    use std::os::unix::fs::PermissionsExt;
    let mut perms = fs::metadata(path)?.permissions();
    let mode = perms.mode();
    let want = if exec { mode | 0o111 } else { mode & !0o111 };
    if want != mode {
        perms.set_mode(want);
        fs::set_permissions(path, perms)?;
    }
    Ok(())
}
#[cfg(not(unix))]
fn set_executable(_path: &Path, _exec: bool) -> std::io::Result<()> {
    Ok(())
}

#[cfg(unix)]
fn is_executable(m: &fs::Metadata) -> bool {
    use std::os::unix::fs::PermissionsExt;
    m.permissions().mode() & 0o111 != 0
}
#[cfg(not(unix))]
fn is_executable(_m: &fs::Metadata) -> bool {
    false
}

fn op_ref(k: OpKey) -> OpRef {
    OpRef { change: k.0, index: k.1 }
}

fn split_path(path: &str) -> (&str, &str) {
    match path.rfind('/') {
        Some(i) => (&path[..i], &path[i + 1..]),
        None => ("", path),
    }
}

/// Builds the tree ops and edits of a working-copy change against a base.
struct ChangeBuilder<'a> {
    base: &'a State,
    base_snapshot: &'a Snapshot,
    tree_ops: Vec<TreeOp>,
    edits: Vec<Edit>,
    statuses: Vec<PathStatus>,
    dir_nodes: HashMap<String, NodeId>,
    reuse: HashMap<String, (NodeId, NodeKind)>,
}

impl<'a> ChangeBuilder<'a> {
    fn new(base: &'a State, base_snapshot: &'a Snapshot, reuse: HashMap<String, (NodeId, NodeKind)>) -> Self {
        let mut dir_nodes: HashMap<String, NodeId> = HashMap::new();
        dir_nodes.insert(String::new(), NodeId::ROOT);
        for (p, f) in &base_snapshot.files {
            if f.kind == NodeKind::Dir {
                dir_nodes.insert(p.clone(), f.node);
            }
        }
        ChangeBuilder { base, base_snapshot, tree_ops: vec![], edits: vec![], statuses: vec![], dir_nodes, reuse }
    }

    fn reused_node(&self, path: &str, kind: NodeKind) -> Option<NodeId> {
        self.reuse.get(path).filter(|(_, k)| *k == kind).map(|(n, _)| *n)
    }

    fn ensure_dir(&mut self, path: &str) -> NodeId {
        if let Some(n) = self.dir_nodes.get(path) {
            return *n;
        }
        let mut parent = NodeId::ROOT;
        let mut prefix = String::new();
        for comp in path.split('/') {
            if !prefix.is_empty() {
                prefix.push('/');
            }
            prefix.push_str(comp);
            parent = match self.dir_nodes.get(&prefix) {
                Some(n) => *n,
                None => {
                    let node = self.reused_node(&prefix, NodeKind::Dir).unwrap_or_else(NodeId::random);
                    self.tree_ops.push(TreeOp::AddNode { node, kind: NodeKind::Dir, mode: Mode::default(), parent, name: comp.to_string() });
                    self.dir_nodes.insert(prefix.clone(), node);
                    node
                }
            };
        }
        parent
    }

    fn add_path(&mut self, repo: &Repo, path: &str, e: &FsEntry) -> Result<()> {
        let (dir, name) = split_path(path);
        let parent = self.ensure_dir(dir);
        let node = self.reused_node(path, e.kind).unwrap_or_else(NodeId::random);
        let opaque = e.kind == NodeKind::Symlink || is_binary(&e.content);
        self.tree_ops.push(TreeOp::AddNode { node, kind: e.kind, mode: Mode { exec: e.exec, opaque }, parent, name: name.to_string() });
        if opaque {
            let blob = repo.store_blob(&e.content)?;
            self.edits.push(Edit::Replace { node, old: None, new: Some(blob) });
        } else if !e.content.is_empty() {
            self.edits.push(Edit::Insert {
                node,
                after: crate::objects::AtomRef::Start,
                before: crate::objects::AtomRef::End,
                lines: split_lines(&e.content).iter().map(|l| l.to_vec()).collect(),
            });
        }
        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Added });
        Ok(())
    }

    fn remove_path(&mut self, path: &str, expected: &crate::state::FileState) {
        let entry = &self.base_snapshot.tree.entries[path];
        self.tree_ops.push(TreeOp::RemoveNode { node: expected.node, placement: op_ref(entry.placement) });
        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Removed });
    }

    fn update_path(&mut self, repo: &Repo, path: &str, e: &FsEntry, expected: &crate::state::FileState) -> Result<()> {
        if expected.kind != e.kind {
            self.remove_path(path, expected);
            self.statuses.pop();
            self.add_path(repo, path, e)?;
            self.statuses.pop();
            self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Modified });
            return Ok(());
        }
        let entry = &self.base_snapshot.tree.entries[path];
        let node = expected.node;
        let mode_atom = entry.mode_atom.map(op_ref);
        let mut status: Option<ChangeStatus> = None;
        match &expected.content {
            FileContent::Dir => {}
            FileContent::Text { bytes, materialized } => {
                if materialized.is_conflicted() {
                    if bytes != &e.content {
                        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::ConflictEdited });
                    }
                    return Ok(());
                }
                if bytes != &e.content {
                    if is_binary(&e.content) {
                        // Text → opaque (spec §7.5).
                        if let Some(old) = mode_atom {
                            self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: true } });
                        }
                        let live: Vec<_> = repo_live_keys(self.base, &node);
                        if !live.is_empty() {
                            self.edits.push(Edit::Delete { node, atoms: ranges(&live) });
                        }
                        let blob = repo.store_blob(&e.content)?;
                        self.edits.push(Edit::Replace { node, old: None, new: Some(blob) });
                        status = Some(ChangeStatus::Modified);
                    } else {
                        let old = self.base.live_lines(&node);
                        let edits = text_edits(node, &old, &e.content);
                        if !edits.is_empty() {
                            self.edits.extend(edits);
                            status = Some(ChangeStatus::Modified);
                        }
                    }
                }
                let switched_to_opaque = status == Some(ChangeStatus::Modified) && is_binary(&e.content);
                if !switched_to_opaque && e.exec != expected.mode.exec {
                    if let Some(old) = mode_atom {
                        self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: false } });
                        status.get_or_insert(ChangeStatus::ModeChanged);
                    }
                }
            }
            FileContent::Opaque { blobs } => {
                let new_ref = Repo::blob_ref(&e.content);
                if blobs.len() > 1 {
                    if !blobs.contains(&new_ref) {
                        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::ConflictEdited });
                    }
                    return Ok(());
                }
                let current = blobs.first().copied();
                if current != Some(new_ref) {
                    if e.kind == NodeKind::File && !is_binary(&e.content) {
                        // Opaque → text (spec §7.5).
                        if let Some(old) = mode_atom {
                            self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: false } });
                        }
                        self.edits.push(Edit::Replace { node, old: current, new: None });
                        if !e.content.is_empty() {
                            self.edits.push(Edit::Insert {
                                node,
                                after: crate::objects::AtomRef::Start,
                                before: crate::objects::AtomRef::End,
                                lines: split_lines(&e.content).iter().map(|l| l.to_vec()).collect(),
                            });
                        }
                    } else {
                        let blob = repo.store_blob(&e.content)?;
                        self.edits.push(Edit::Replace { node, old: current, new: Some(blob) });
                    }
                    status = Some(ChangeStatus::Modified);
                } else if e.kind == NodeKind::File && e.exec != expected.mode.exec {
                    if let Some(old) = mode_atom {
                        self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: true } });
                        status = Some(ChangeStatus::ModeChanged);
                    }
                }
            }
        }
        if let Some(s) = status {
            self.statuses.push(PathStatus { path: path.to_string(), status: s });
        }
        Ok(())
    }
}

fn repo_live_keys(base: &State, node: &NodeId) -> Vec<crate::graph::AtomKey> {
    base.live_lines(node).into_iter().map(|(k, _)| k).collect()
}

/// The changes a change's scope references (spec §8.1): introducers of every
/// atom, placement, and mode it touches, and of every node it operates on.
pub fn referenced_changes(change: &Change, base: &State) -> BTreeSet<ChangeHash> {
    let mut out = BTreeSet::new();
    let opref = |r: &OpRef, out: &mut BTreeSet<ChangeHash>| {
        if !r.change.is_zero() {
            out.insert(r.change);
        }
    };
    let mut nodes: Vec<NodeId> = Vec::new();
    for op in &change.tree_ops {
        match op {
            TreeOp::AddNode { parent, .. } => nodes.push(*parent),
            TreeOp::RemoveNode { node, placement } => {
                nodes.push(*node);
                opref(placement, &mut out);
            }
            TreeOp::Move { node, old, parent, .. } => {
                nodes.push(*node);
                nodes.push(*parent);
                opref(old, &mut out);
            }
            TreeOp::SetMode { node, old, .. } => {
                nodes.push(*node);
                opref(old, &mut out);
            }
        }
    }
    for e in &change.edits {
        nodes.push(e.node());
        match e {
            Edit::Insert { after, before, .. } => {
                for r in [after, before] {
                    if let crate::objects::AtomRef::Atom { change, .. } = r {
                        if !change.is_zero() {
                            out.insert(*change);
                        }
                    }
                }
            }
            Edit::Delete { atoms, .. } => {
                for r in atoms {
                    if !r.change.is_zero() {
                        out.insert(r.change);
                    }
                }
            }
            Edit::Replace { .. } => {}
        }
    }
    for n in nodes {
        if let Some(h) = base.tree().introducer(&n) {
            out.insert(h);
        }
    }
    out
}

/// Paths of the nodes a change adds on top of `base_snapshot`.
pub fn added_node_paths(change: &Change, base_snapshot: &Snapshot) -> HashMap<String, (NodeId, NodeKind)> {
    let by_node = base_snapshot.tree.by_node();
    let mut new_names: HashMap<NodeId, (NodeId, String, NodeKind)> = HashMap::new();
    for op in &change.tree_ops {
        if let TreeOp::AddNode { node, parent, name, kind, .. } = op {
            new_names.insert(*node, (*parent, name.clone(), *kind));
        }
    }
    let mut out = HashMap::new();
    for (node, (_, _, kind)) in &new_names {
        if let Some(path) = path_of_node(node, &by_node, &new_names) {
            out.insert(path, (*node, *kind));
        }
    }
    out
}

fn path_of_node(
    n: &NodeId,
    by_node: &HashMap<NodeId, &crate::tree::TreeEntry>,
    new_names: &HashMap<NodeId, (NodeId, String, NodeKind)>,
) -> Option<String> {
    if let Some(e) = by_node.get(n) {
        return Some(e.path.clone());
    }
    let mut parts = Vec::new();
    let mut cur = *n;
    loop {
        if cur.is_root() {
            break;
        }
        if let Some(e) = by_node.get(&cur) {
            if !e.path.is_empty() {
                parts.push(e.path.clone());
            }
            break;
        }
        let (parent, name, _) = new_names.get(&cur)?;
        parts.push(name.clone());
        cur = *parent;
    }
    parts.reverse();
    Some(parts.join("/"))
}

/// Render a change's operations with line content, using `base` for deleted lines.
pub fn render_change(change: &Change, base: &State, base_snapshot: &Snapshot) -> String {
    let by_node = base_snapshot.tree.by_node();
    let mut new_names: HashMap<NodeId, (NodeId, String, NodeKind)> = HashMap::new();
    for op in &change.tree_ops {
        if let TreeOp::AddNode { node, parent, name, kind, .. } = op {
            new_names.insert(*node, (*parent, name.clone(), *kind));
        }
    }
    let path_of = |n: &NodeId| -> String { path_of_node(n, &by_node, &new_names).unwrap_or_else(|| format!("<node {}>", n.short(8))) };

    let mut out = String::new();
    for op in &change.tree_ops {
        match op {
            TreeOp::AddNode { node, kind, mode, .. } => {
                out.push_str(&format!("A {} ({:?}{}{})\n", path_of(node), kind, if mode.exec { ", exec" } else { "" }, if mode.opaque { ", opaque" } else { "" }));
            }
            TreeOp::RemoveNode { node, .. } => out.push_str(&format!("D {}\n", path_of(node))),
            TreeOp::Move { node, name, .. } => out.push_str(&format!("R {} -> {}\n", path_of(node), name)),
            TreeOp::SetMode { node, mode, .. } => {
                out.push_str(&format!("M {} mode: exec={} opaque={}\n", path_of(node), mode.exec, mode.opaque));
            }
        }
    }
    let mut last_node: Option<NodeId> = None;
    for e in &change.edits {
        let n = e.node();
        if last_node != Some(n) {
            out.push_str(&format!("--- {}\n", path_of(&n)));
            last_node = Some(n);
        }
        match e {
            Edit::Insert { lines, .. } => {
                for l in lines {
                    out.push('+');
                    out.push_str(&String::from_utf8_lossy(l));
                    if !l.ends_with(b"\n") {
                        out.push('\n');
                    }
                }
            }
            Edit::Delete { atoms, .. } => {
                for r in atoms {
                    for i in r.from..r.to {
                        let content = base.file(&n).and_then(|g| g.content(&(r.change, i))).unwrap_or(b"<unknown>\n");
                        out.push('-');
                        out.push_str(&String::from_utf8_lossy(content));
                        if !content.ends_with(b"\n") {
                            out.push('\n');
                        }
                    }
                }
            }
            Edit::Replace { old, new, .. } => {
                out.push_str(&format!(
                    "  opaque content {} -> {}\n",
                    old.map(|o| o.short(12)).unwrap_or_else(|| "none".into()),
                    new.map(|o| o.short(12)).unwrap_or_else(|| "none".into())
                ));
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    fn write(root: &Path, rel: &str, content: &[u8]) {
        let p = root.join(rel);
        fs::create_dir_all(p.parent().unwrap()).unwrap();
        fs::write(p, content).unwrap();
    }

    fn statuses(s: &SnapshotResult) -> Vec<(String, ChangeStatus)> {
        s.statuses.iter().map(|p| (p.path.clone(), p.status)).collect()
    }

    #[test]
    fn init_snapshot_commit_log_undo() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        assert!(Repo::init(root).is_err());
        let ops = repo.op_log().unwrap();
        assert_eq!(ops.len(), 1);
        assert_eq!(ops[0].1.command, "oxy init");

        // Empty working copy: snapshot records no operation (spec §12.3).
        let s = repo.snapshot("oxy status").unwrap();
        assert!(!s.changed);
        assert_eq!(repo.op_log().unwrap().len(), 1);

        write(root, "src/main.rs", b"fn main() {}\n");
        write(root, "README.md", b"# Hello\n");
        write(root, ".oxyignore", b"/target\n");
        write(root, "target/junk.o", b"\0\0\0");
        let s = repo.snapshot("oxy status").unwrap();
        assert!(s.changed);
        assert_eq!(
            statuses(&s),
            vec![
                (".oxyignore".into(), ChangeStatus::Added),
                ("README.md".into(), ChangeStatus::Added),
                ("src/main.rs".into(), ChangeStatus::Added),
            ]
        );
        assert_eq!(repo.op_log().unwrap().len(), 2);
        // Snapshotting again with nothing changed records no op.
        let s2 = repo.snapshot("oxy status").unwrap();
        assert!(!s2.changed);
        assert_eq!(s2.wc_hash, s.wc_hash);
        assert_eq!(repo.op_log().unwrap().len(), 2);

        let h1 = repo.commit("Initial import", &[]).unwrap();
        let c1 = repo.store().get_change(&h1).unwrap();
        assert_eq!(c1.kind, ChangeKind::Normal);
        assert!(c1.deps.is_empty(), "first change has nothing to depend on");
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);
        let (wc_hash, wc) = repo.working_copy().unwrap();
        assert_eq!(wc.deps, vec![h1]);
        assert!(wc.edits.is_empty());
        assert!(repo.commit("nothing", &[]).is_err());

        // Modify one file, remove another, add a binary file.
        write(root, "src/main.rs", b"fn main() {\n    println!(\"hi\");\n}\n");
        fs::remove_file(root.join("README.md")).unwrap();
        write(root, "logo.png", b"\x89PNG\0\0\x01");
        let s = repo.snapshot("oxy status").unwrap();
        assert_eq!(
            statuses(&s),
            vec![
                ("README.md".into(), ChangeStatus::Removed),
                ("logo.png".into(), ChangeStatus::Added),
                ("src/main.rs".into(), ChangeStatus::Modified),
            ]
        );
        assert_ne!(s.wc_hash, wc_hash);
        // The rewritten working copy keeps its ChangeId and depends on h1.
        assert_eq!(s.wc.change_id, wc.change_id);
        assert!(s.wc.deps.contains(&h1));

        let h2 = repo.commit("Second", &[]).unwrap();
        let c2 = repo.store().get_change(&h2).unwrap();
        assert_eq!(c2.deps, vec![h1], "everything it touches was introduced by h1");
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

        // The materialized head state matches the working copy.
        let st = repo.load_state(&[h2]).unwrap();
        let snap = st.materialize();
        assert!(!snap.is_conflicted());
        assert_eq!(snap.files.keys().cloned().collect::<Vec<_>>(), [".oxyignore", "logo.png", "src", "src/main.rs"]);
        assert!(matches!(&snap.files["src/main.rs"].content, FileContent::Text { bytes, .. } if bytes == b"fn main() {\n    println!(\"hi\");\n}\n"));
        assert!(snap.files["logo.png"].mode.opaque);
        if let FileContent::Opaque { blobs } = &snap.files["logo.png"].content {
            assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\x89PNG\0\0\x01");
        } else {
            panic!("logo should be opaque");
        }

        // Log: newest first, working copy included.
        let log = repo.log().unwrap();
        assert_eq!(log.len(), 3);
        assert!(log[0].is_working_copy);
        assert_eq!(log[1].hash, h2);
        assert!(log[1].is_head);
        assert_eq!(log[2].hash, h1);
        let d = repo.describe_change(&h2).unwrap();
        assert!(d.contains("D README.md"), "{d}");
        assert!(d.contains("+    println!(\"hi\");"), "{d}");
        assert!(d.contains("-fn main() {}"), "{d}");

        // Resolution by prefix.
        assert_eq!(repo.resolve_change(&c2.change_id.short(6)).unwrap(), h2);
        assert_eq!(repo.resolve_change(&format!("#{}", h1.short(8))).unwrap(), h1);
        assert!(repo.resolve_change("zzzz").is_err());

        // Undo the commit: bookmark and working copy go back.
        repo.undo().unwrap();
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);
        let s = repo.snapshot("oxy status").unwrap();
        assert!(!s.changed, "files on disk still match the pre-commit working copy");
        assert_eq!(s.statuses.len(), 3);
    }

    #[test]
    fn checkout_moves_the_working_copy() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"one\n");
        write(root, "sub/deep/b.txt", b"b\n");
        let h1 = repo.commit("first", &[]).unwrap();
        write(root, "a.txt", b"two\n");
        fs::remove_file(root.join("sub/deep/b.txt")).unwrap();
        write(root, "bin.dat", &[0, 1, 2, 3]);
        let h2 = repo.commit("second", &[]).unwrap();

        let r = repo.checkout(&[h1], false, "oxy checkout").unwrap();
        assert_eq!(r, CheckoutReport { written: 2, removed: 1, conflicted: false });
        assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"one\n");
        assert_eq!(fs::read(root.join("sub/deep/b.txt")).unwrap(), b"b\n");
        assert!(!root.join("bin.dat").exists());
        let (_, wc) = repo.working_copy().unwrap();
        assert_eq!(wc.deps, vec![h1]);
        assert!(!repo.snapshot("status").unwrap().changed, "checkout leaves a clean working copy");
        // The bookmark still points at h2.
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

        // Dirty working copy refuses without --discard.
        write(root, "a.txt", b"dirty\n");
        assert!(repo.checkout(&[h2], false, "oxy checkout").is_err());
        let r = repo.checkout(&[h2], true, "oxy checkout --discard").unwrap();
        assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"two\n");
        assert_eq!(fs::read(root.join("bin.dat")).unwrap(), [0, 1, 2, 3]);
        assert!(!root.join("sub").exists(), "empty directories are pruned");
        assert_eq!(r.removed, 1);
        assert!(!repo.snapshot("status").unwrap().changed);

        // Refuses to write through a symlinked directory.
        #[cfg(unix)]
        {
            fs::remove_dir_all(root.join("sub")).ok();
            std::os::unix::fs::symlink("/tmp", root.join("sub")).unwrap();
            assert!(repo.checkout(&[h1], true, "oxy checkout").is_err());
        }
    }

    #[test]
    fn large_files_are_chunked_and_read_back() {
        let dir = tempfile::tempdir().unwrap();
        let repo = Repo::init(dir.path()).unwrap();
        let mut big = vec![0u8; 700 * 1024];
        for (i, b) in big.iter_mut().enumerate() {
            *b = (i as u32).wrapping_mul(2654435761).to_le_bytes()[0];
        }
        let r = repo.store_blob(&big).unwrap();
        let blob = Blob::decode(&repo.store().get_typed(&r, ObjectType::Blob).unwrap()).unwrap();
        assert!(blob.chunks.len() >= 3, "{}", blob.chunks.len());
        assert_eq!(repo.read_blob(&r).unwrap(), big);
        assert_eq!(Repo::blob_ref(&big), r);
    }

    #[test]
    fn undo_skips_snapshot_operations() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"a\n");
        let h1 = repo.commit("a", &[]).unwrap();
        // A later command snapshots new edits on top of the commit.
        write(root, "b.txt", b"b\n");
        let s = repo.snapshot("oxy status").unwrap();
        assert!(s.changed);
        assert!(repo.head_op().unwrap().1.is_snapshot());
        assert_eq!(repo.last_command().unwrap().command, "oxy commit -m \"a\"");
        // Undo must undo the commit, not the snapshot.
        repo.undo().unwrap();
        assert_eq!(repo.bookmark_heads().unwrap(), vec![]);
        let s = repo.snapshot("oxy status").unwrap();
        let paths: Vec<_> = s.statuses.iter().map(|p| p.path.as_str()).collect();
        assert_eq!(paths, ["a.txt", "b.txt"], "both files are back in the working copy");
        assert!(repo.store().get_change(&h1).unwrap().deps.is_empty());
        // Only snapshots remain above `init`, so there is nothing left to undo.
        assert_eq!(repo.last_command().unwrap().command, "oxy init");
        assert!(repo.undo().is_err());
    }

    #[test]
    fn independent_changes_commute_and_make_multiple_heads() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"a\n");
        let h1 = repo.commit("a", &[]).unwrap();
        write(root, "b.txt", b"b\n");
        let h2 = repo.commit("b", &[]).unwrap();
        let c2 = repo.store().get_change(&h2).unwrap();
        assert!(c2.deps.is_empty(), "b.txt touches nothing from h1");
        let mut heads = repo.bookmark_heads().unwrap();
        heads.sort();
        let mut want = vec![h1, h2];
        want.sort();
        assert_eq!(heads, want);
        // Editing a.txt depends on h1 only.
        write(root, "a.txt", b"a\na2\n");
        let h3 = repo.commit("a2", &[]).unwrap();
        assert_eq!(repo.store().get_change(&h3).unwrap().deps, vec![h1]);
        let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();
        assert_eq!(heads, [h2, h3].into_iter().collect());
        // Explicit dependency.
        write(root, "c.txt", b"c\n");
        let h4 = repo.commit("c", &[h2]).unwrap();
        assert_eq!(repo.store().get_change(&h4).unwrap().deps, vec![h2]);
    }

    #[test]
    fn mode_change_and_text_binary_switch() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "run.sh", b"#!/bin/sh\n");
        repo.commit("add script", &[]).unwrap();
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            fs::set_permissions(root.join("run.sh"), fs::Permissions::from_mode(0o755)).unwrap();
            let s = repo.snapshot("status").unwrap();
            assert_eq!(statuses(&s), vec![("run.sh".into(), ChangeStatus::ModeChanged)]);
            let h = repo.commit("exec", &[]).unwrap();
            let snap = repo.load_state(&[h]).unwrap().materialize();
            assert!(snap.files["run.sh"].mode.exec);
        }
        // Text → binary → text.
        write(root, "run.sh", b"\0binary");
        let h = repo.commit("binary", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(snap.files["run.sh"].mode.opaque);
        write(root, "run.sh", b"text again\n");
        let h = repo.commit("text", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(!snap.files["run.sh"].mode.opaque);
        assert!(matches!(&snap.files["run.sh"].content, FileContent::Text { bytes, .. } if bytes == b"text again\n"));
        assert!(!snap.is_conflicted());
    }
}