gitpro 0.3.1__py3-none-any.whl

gitpro/setup.py

@@ -0,0 +1,260 @@
+"""Guided, offline configuration: save the TOML, never apply Git or SSH changes."""
+from __future__ import annotations
+
+import json
+import os
+import re
+import shlex
+import stat
+import sys
+from importlib import resources
+from pathlib import Path
+from typing import Callable, Optional, Tuple
+
+from . import config
+from .config import ConfigError, check
+
+Snapshot = Optional[Tuple[bytes, os.stat_result]]
+
+
+def register(sub, common, confirm) -> None:
+    from .args import capability
+    p = sub.add_parser("setup", parents=[common], help="configure identities with a guided terminal wizard")
+    p.add_argument("--write", action="store_true", help="allow saving after interactive review (default: preview only)")
+    p.set_defaults(func=cmd_setup)
+    capability("setup")
+
+
+def _snapshot(path: Path) -> Snapshot:
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    except FileNotFoundError:
+        return None
+    except OSError as e:
+        raise ConfigError(f"cannot open {path}: {e}; setup requires a regular file, not a symlink") from None
+    with os.fdopen(fd, "rb") as f:
+        info = os.fstat(f.fileno())
+        check(stat.S_ISREG(info.st_mode), f"{path}: setup requires a regular file")
+        check(info.st_uid == os.getuid() and not info.st_mode & 0o022,
+              f"{path}: must be owned by you and not group/world-writable")
+        return f.read(), info
+
+
+def _same(before: Snapshot, after: Snapshot) -> bool:
+    if before is None or after is None:
+        return before is after
+    a, b = before[1], after[1]
+    return before[0] == after[0] and (a.st_dev, a.st_ino, a.st_mode, a.st_mtime_ns) == (
+        b.st_dev, b.st_ino, b.st_mode, b.st_mtime_ns)
+
+
+def _save(path: Path, text: str, before: Snapshot) -> Optional[Path]:
+    from . import files
+    path.parent.mkdir(mode=0o700, parents=True, exist_ok=True)
+    lock = path.with_name(path.name + ".setup.lock")
+    try:
+        fd = os.open(lock, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    except FileExistsError:
+        raise ConfigError(f"{lock}: another setup may be saving; check it before retrying") from None
+    os.close(fd)
+    try:
+        check(_same(before, _snapshot(path)), f"{path}: changed during setup; nothing overwritten, run setup again")
+        backup = files._backup(path, before[0]) if before is not None else None
+        check(_same(before, _snapshot(path)), f"{path}: changed while backing up; nothing overwritten")
+        files.atomic_write(path, text.encode("utf-8"), 0o600, follow_symlinks=False,
+                           overwrite=before is not None)
+        return backup
+    finally:
+        lock.unlink()
+
+
+def _block(table: str, values: dict) -> str:
+    return table + "\n" + "".join(f"{k} = {json.dumps(v, ensure_ascii=False)}\n" for k, v in values.items())
+
+
+def _suggestions(home: Path) -> dict:
+    from . import resolve, view
+    result = {}
+    for field in ("name", "email"):
+        r = resolve._git(home, "config", "--global", "--get", "user." + field)
+        if r.returncode == 0:
+            value = r.stdout.strip()
+            if value and not config.CONTROL_RE.search(value):
+                result[field] = value
+        elif r.returncode != 1:
+            view.warn(f"could not suggest {field} from Git config: {r.stderr.strip()}")
+    repo = resolve.is_repo(Path.cwd())
+    if repo:
+        remotes = resolve.remotes(repo)
+        url = remotes.get("origin") or next(iter(remotes.values()), "")
+        host, owner, _ = resolve.parse_url(url)
+        if host and config.HOST_RE.fullmatch(host):
+            result["host"] = host
+        if owner and config.OWNER_RE.fullmatch(owner):
+            result["owners"] = owner
+    return result
+
+
+def _validate(text: str, path: Path, home: Path) -> config.Config:
+    from . import plan
+    cfg = config.loads(text, path, "--config")
+    env = plan.Env(home)
+    targets, _ = plan.build(cfg, env)
+    reserved = [t.path for t in targets] + plan.guard_paths(env) + [home / plan.ALLOWED_SIGNERS]
+    source = path.resolve()
+    for output in reserved:
+        target = output.resolve()
+        check(source != target and source not in target.parents and target not in source.parents,
+              f"config {path} conflicts with managed output {output}; choose another config path")
+    return cfg
+
+
+def cmd_setup(args) -> int:
+    from rich.prompt import Confirm, Prompt
+    from rich.syntax import Syntax
+    from rich.text import Text
+    from . import resolve, view
+
+    check(sys.stdin.isatty() and sys.stdout.isatty(),
+          "setup needs an interactive terminal; run gitpro setup there, or use gitpro init to create an example")
+    resolve.require_git()
+    home = args.home.expanduser().resolve()
+    path = Path(args.config or os.environ.get(config.ENV_VAR) or home / config.USER_CONFIG).expanduser().absolute()
+    before = _snapshot(path)
+    original = before[0].decode("utf-8") if before else ""
+    template = resources.files("gitpro").joinpath("example.toml").read_text(encoding="utf-8")
+    from_example = bool(original) and config._load_toml(original, path) == config._load_toml(template)
+    cfg = config.loads(original, path) if original and not from_example else None
+    _validate(original if cfg is not None else "[default]\n", path, home)
+    text = original if cfg is not None else (
+        "# Created with gitpro setup.\n"
+        "# Reference: https://github.com/Yantrakar/gitpro/blob/main/docs/guide.md\n\n")
+    out = view.console()
+    out.print(Text("gitpro setup", style="bold"))
+    out.print("Configure once, then let Git pick the identity for each remote.")
+    out.print(Text(f"Config: {path}"))
+    out.print("Offline. No keys are created, no accounts are contacted, and no Git/SSH settings are applied.")
+    out.print("Ctrl-C cancels the wizard before you confirm Save.\n")
+    if cfg is not None:
+        out.print("Existing settings and comments will be kept. This wizard adds identities; it does not edit them.")
+        for identity in cfg.identities:
+            scope = ", ".join(identity.owners) or "all owners"
+            out.print(Text(f"  {identity.id}: {identity.name} <{identity.email}> on {identity.host} ({scope})"))
+    elif from_example:
+        out.print("This is the unchanged example template. Saving will replace its placeholders and keep a backup.")
+    suggested = _suggestions(home)
+    if cfg:
+        person_default = cfg.default if cfg.default.email else next(iter(cfg.identities), None)
+        if person_default:
+            suggested.setdefault("name", person_default.name)
+            suggested.setdefault("email", person_default.email)
+
+    def ask(label: str, default: str = "", validate: Optional[Callable[[str], None]] = None) -> str:
+        while True:
+            value = Prompt.ask(Text(label), default=default, show_default=bool(default), console=out).strip()
+            try:
+                config._no_control_chars(value, label)
+                if validate:
+                    validate(value)
+                return value
+            except ConfigError as e:
+                out.print(Text(str(e), style="red"))
+
+    def person() -> dict:
+        name = ask("Commit name", suggested.get("name", ""),
+                   lambda v: check(v and "<" not in v and ">" not in v, "Enter a name without < or >"))
+        email = ask("Commit email", suggested.get("email", ""),
+                    lambda v: config._check_person(config.Default(name=name, email=v), "identity", True))
+        suggested.update(name=name, email=email)
+        return {"name": name, "email": email}
+
+    if cfg is None:
+        out.print("A fallback identity applies to repositories that do not match a host/owner rule.")
+        fallback = person() if Confirm.ask("Set a fallback identity?", default=False, console=out) else {}
+        text += _block("[default]", fallback)
+        cfg = config.loads(text, path)
+
+    ids = {i.id for i in cfg.identities}
+    added = 0
+    while Confirm.ask("Add an identity for a Git host?", default=not added, console=out):
+        while True:
+            proposed_id = "work"
+            n = 2
+            while proposed_id in ids:
+                proposed_id, n = f"work-{n}", n + 1
+            ident = ask("Identity label (for example work or personal)", proposed_id,
+                        lambda v: check(config.ID_RE.fullmatch(v) and v not in ids, "Use a unique identity label"))
+            values = {"id": ident, **person()}
+            host = ask("Git host", suggested.get("host", "github.com"),
+                       lambda v: config._check_host(v, "Git host"))
+            while True:
+                owners = ask("Owners or groups, comma-separated (blank means the entire host)",
+                             suggested.get("owners", "") if host == suggested.get("host") else "",
+                             lambda v: check(all(config.OWNER_RE.fullmatch(s.strip()) for s in v.split(","))
+                                             if v else True, "Enter valid, comma-separated owners or groups"))
+                if owners or Confirm.ask(f"Match EVERY repository on {host}?", default=False, console=out):
+                    break
+            values.update(host=host, owners=list(dict.fromkeys(s.strip() for s in owners.split(",") if s.strip())))
+            public_keys = sorted(p for p in (home / ".ssh").glob("*.pub") if p.is_file())
+            if public_keys:
+                out.print("Existing SSH keys (only public-key filenames are inspected):")
+                for pub in public_keys:
+                    out.print(Text(f"  {pub.with_suffix('')}"))
+
+            def key_path(v: str) -> None:
+                if v:
+                    config._check_path(v, "SSH key")
+                    key = home / v[2:] if v.startswith("~/") else Path(v)
+                    check(not v.endswith(".pub") and key.is_file(), "Choose an existing private-key path, not .pub")
+
+            key = ask("SSH key path (blank keeps your existing authentication)", validate=key_path)
+            if key:
+                values["ssh_key"] = key
+                alias = "gitpro-" + (re.sub(r"[^a-z0-9-]", "-", ident.lower()).strip("-") or "identity")
+                values["ssh_alias"] = ask("SSH alias for this identity", alias,
+                                          lambda v: check(config.HOST_RE.fullmatch(v) and v != host,
+                                                          "Choose an SSH alias different from the Git host"))
+                values["sign"] = Confirm.ask("Sign commits with this SSH key?", default=False, console=out)
+                if values["sign"]:
+                    private = home / key[2:] if key.startswith("~/") else Path(key)
+                    if not Path(str(private) + ".pub").is_file():
+                        out.print("The matching .pub file is missing. Choose a key with a public key to enable signing.")
+                        continue
+            else:
+                values["sign"] = False
+            block = "\n\n" + _block("[[identity]]", values)
+            try:
+                cfg = _validate(text + block, path, home)
+            except ConfigError as e:
+                out.print(Text(f"{e}\nPlease enter this identity again; nothing has been saved.", style="red"))
+                continue
+            text += block
+            ids.add(ident)
+            added += 1
+            break
+    if text == original:
+        view.ok("configuration left unchanged")
+        return 0
+    if cfg.default.email is None and not cfg.identities:
+        view.aborted()
+        return 1
+    _validate(text, path, home)
+    out.print(Text("\nReview the configuration additions" if original and not from_example else
+                        "\nReview your configuration", style="bold"))
+    preview = text[len(original):] if original and not from_example else text
+    out.print(Syntax(preview, "toml", word_wrap=True))
+    if not args.write:
+        out.print("Dry run: nothing saved. Run gitpro setup --write to review and save.")
+        return 0
+    out.print("Only the config file will be saved. Existing config files are backed up first.")
+    if not Confirm.ask("Save this configuration?", default=False, console=out):
+        view.aborted()
+        return 1
+    backup = _save(path, text, before)
+    view.ok(f"saved {path}")
+    if backup:
+        view.step(f"backup: {backup}")
+    extra = " -c " + shlex.quote(str(path))
+    view.step(f"review Git/SSH changes: gitpro plan{extra}")
+    view.step(f"apply them when ready: gitpro apply{extra}")
+    return 0

gitpro/trailers.py

@@ -0,0 +1,218 @@
+"""Trailer policy per identity (`co_authored_by = allow | forbid | require`, `forbid_emails`) and the
+guard's commit-msg entry `hook_message(ctx)`.
+
+Hot path: the commit-msg hook imports this module, so it imports only the standard library and
+gitpro.config at module level (resolve is imported inside hook_message, where guard has loaded it already).
+"""
+from __future__ import annotations
+
+import fnmatch
+import os
+import subprocess
+from dataclasses import dataclass, replace
+from pathlib import Path
+from typing import List, Optional, Sequence, Tuple
+
+from .config import ConfigError
+
+BLOCK = 3                 # guard.BLOCK; not imported, guard is not needed to judge a message
+GIT_TIMEOUT = 5           # guard.GIT_TIMEOUT: every git call inside a hook
+CO_AUTHOR = "co-authored-by"
+VALUES = ("allow", "forbid", "require")
+
+Trailer = Tuple[str, str]
+
+
+@dataclass(frozen=True)
+class Policy:
+    """The trailer policy that applies to one identity, and where each part came from (for messages)."""
+    co_authored_by: str = "allow"            # "allow" | "forbid" | "require"
+    forbid_emails: Tuple[str, ...] = ()
+    who: str = "the [default] identity"      # "identity work-github" | "the [default] identity"
+    table: str = ""                          # "[identity.trailers]" | "[default.trailers]" | "" (built-in allow)
+    emails_table: str = ""                   # the same, for forbid_emails
+
+    def active(self) -> bool:
+        """False when nothing can be a violation (allow and no forbid_emails): no need to read trailers."""
+        return self.co_authored_by != "allow" or bool(self.forbid_emails)
+
+
+def _trailers_of(obj: object) -> object:
+    """An Identity / Default's `trailers`, or obj itself when it already is a Trailers (or None)."""
+    return getattr(obj, "trailers", obj)
+
+
+def policy_for(identity: object, default: object) -> Policy:
+    """identity's [identity.trailers] value, else [default.trailers], else allow / no forbidden emails.
+    identity: config.Identity or None (no identity matched); default: config.Default (or its Trailers)."""
+    it, dt = _trailers_of(identity), _trailers_of(default)
+    who = f"identity {identity.id}" if getattr(identity, "id", None) else "the [default] identity"
+    co, table = "allow", ""
+    for t, name in ((it, "[identity.trailers]"), (dt, "[default.trailers]")):
+        if t is not None and getattr(t, "co_authored_by", None):
+            co, table = t.co_authored_by, name
+            break
+    emails, etable = (), ""
+    for t, name in ((it, "[identity.trailers]"), (dt, "[default.trailers]")):
+        if t is not None and getattr(t, "forbid_emails", None) is not None:
+            emails, etable = tuple(t.forbid_emails), name
+            break
+    return Policy(co, emails, who, table, etable)
+
+
+# ---------------------------------------------------------------- matching
+
+def glob_match(pattern: str, text: str) -> bool:
+    """Case-insensitive glob with `*` and `?`; `[` is always a literal character, never a class:
+    "*[bot]@users.noreply.github.com" matches "dependabot[bot]@users.noreply.github.com" but not
+    "123+scott@users.noreply.github.com"."""
+    return fnmatch.fnmatchcase(text.casefold(), pattern.casefold().replace("[", "[[]"))
+
+
+def email_of(value: str) -> str:
+    """The address in a trailer value "Name <email>", else the value itself."""
+    v = value.strip()
+    lt, gt = v.rfind("<"), v.rfind(">")
+    return v[lt + 1:gt].strip() if 0 <= lt < gt else v
+
+
+def is_co_author(key: str) -> bool:
+    return key.strip().casefold() == CO_AUTHOR
+
+
+def split_lines(text: str) -> List[Trailer]:
+    """(key, value) per "Key: value" line, as `git interpret-trailers --parse` and %(trailers:only,unfold)
+    print them."""
+    out: List[Trailer] = []
+    for line in text.splitlines():
+        key, sep, value = line.partition(":")
+        if sep and key.strip():
+            out.append((key.strip(), value.strip()))
+    return out
+
+
+# ---------------------------------------------------------------- checking
+
+def violations(trailers: Sequence[Trailer], policy: Policy) -> List[Tuple[str, str]]:
+    """(message, fix) per violation of policy by a commit message carrying `trailers`."""
+    out: List[Tuple[str, str]] = []
+    co = [(k, v) for k, v in trailers if is_co_author(k)]
+    for k, v in co:
+        shown = f"{k}: {v}"
+        if policy.co_authored_by == "forbid":
+            out.append((f"{shown} is not allowed for {policy.who} "
+                        f"({policy.table} co_authored_by = \"forbid\")", "remove the trailer from the message"))
+            continue
+        hit = next((g for g in policy.forbid_emails if glob_match(g, email_of(v))), None)
+        if hit is not None:
+            out.append((f"{shown} is not allowed for {policy.who} ({policy.emails_table} forbid_emails has "
+                        f"\"{hit}\")", "remove the trailer from the message"))
+    if policy.co_authored_by == "require" and not co:
+        out.append((f"{policy.who} requires a Co-Authored-By trailer on every commit",
+                    "end the message with a trailer line: Co-Authored-By: Name <email>"))
+    return out
+
+
+def check(trailers: Sequence[Trailer], policy: Policy) -> List[str]:
+    """The violation messages (empty when the trailers satisfy the policy)."""
+    return [m for m, _ in violations(trailers, policy)]
+
+
+# ---------------------------------------------------------------- reading trailers
+
+def _interpret(argv: List[str], stdin: Optional[str] = None) -> List[Trailer]:
+    try:
+        r = subprocess.run(["git", "interpret-trailers", "--parse", "--no-divider", *argv], input=stdin,
+                           capture_output=True, text=True, encoding="utf-8", errors="replace",
+                           timeout=GIT_TIMEOUT, **({} if stdin is not None else {"stdin": subprocess.DEVNULL}))
+    except FileNotFoundError:
+        raise ConfigError("git not found") from None
+    except subprocess.TimeoutExpired:
+        raise ConfigError(f"git interpret-trailers timed out after {GIT_TIMEOUT}s") from None
+    if r.returncode:
+        raise ConfigError(f"git interpret-trailers failed: {r.stderr.strip() or r.returncode}")
+    return split_lines(r.stdout)
+
+
+def parse(file: object) -> List[Trailer]:
+    """The trailers of the commit message in `file`, as git sees them (`git interpret-trailers --parse`:
+    comment lines and a scissors line are ignored, folded values unfolded)."""
+    return _interpret([str(file)])
+
+
+def parse_text(message: str) -> List[Trailer]:
+    """parse() for a message held in a string."""
+    return _interpret([], message)
+
+
+# ---------------------------------------------------------------- commit-msg entry (01 §5.6)
+
+def _quiet_already(ctx) -> bool:
+    """guard's warn-once rule: pre-commit of this git command already printed a fail-open warning."""
+    f, pid = os.environ.get("GITPRO_WARNED_FILE"), os.environ.get("GITPRO_GIT_PID")
+    if not (f and pid and ctx.hook == "commit-msg"):
+        return False
+    try:
+        return Path(f).read_text(encoding="utf-8", errors="replace").strip() == pid
+    except OSError:
+        return False
+
+
+def _in_merge() -> bool:
+    """A merge commit is being made (git merge runs commit-msg too); merges need no Co-Authored-By."""
+    try:
+        r = subprocess.run(["git", "rev-parse", "-q", "--verify", "MERGE_HEAD"], capture_output=True, text=True,
+                           stdin=subprocess.DEVNULL, timeout=GIT_TIMEOUT)
+    except (OSError, subprocess.SubprocessError):
+        return False
+    return r.returncode == 0
+
+
+def _policy(ctx) -> Policy:
+    report = getattr(ctx, "report", None)
+    if report is not None:
+        exp = report.expected
+    else:
+        from . import resolve
+        exp = resolve.expected(Path(ctx.repo), ctx.cfg)
+    return policy_for(exp.match.identity, ctx.cfg.default)
+
+
+def _hook_message(ctx) -> int:
+    if not ctx.args:
+        raise ConfigError("commit-msg called without a message file")
+    policy = _policy(ctx)
+    if not policy.active():
+        return 0
+    if policy.co_authored_by == "require" and _in_merge():
+        policy = replace(policy, co_authored_by="allow")
+        if not policy.active():
+            return 0
+    found = violations(parse(ctx.args[0]), policy)
+    if not found:
+        return 0
+    warn = getattr(getattr(ctx.cfg, "guard", None), "on_mismatch", "block") != "block"
+    for msg, _ in found:
+        ctx.say(("⚠" if warn else "✗") + f" gitpro: {msg}")
+    for fix in dict.fromkeys(f for _, f in found):
+        ctx.say(f"  fix:   {fix}")
+    if warn:
+        ctx.say('  (not blocking: [guard] on_mismatch = "warn")')
+    return BLOCK
+
+
+def hook_message(ctx) -> int:
+    """guard.HOOKS["commit-msg"] entry: BLOCK (3) when the message's trailers break the trailer policy of
+    the repo's identity, else 0. Never raises: any failure is one ⚠ line and 0 (fail open)."""
+    try:
+        return _hook_message(ctx)
+    except KeyboardInterrupt:
+        raise
+    except BaseException as e:   # noqa: BLE001 -- a broken gitpro must never block a commit
+        msg = str(e) if isinstance(e, ConfigError) else (f"{type(e).__name__}: {e}" if str(e) else type(e).__name__)
+        try:
+            if not _quiet_already(ctx):
+                ctx.say(f"⚠ gitpro trailers: {msg}; not blocking")
+        except Exception:   # noqa: BLE001
+            pass
+        return 0

gitpro/tui.py

@@ -0,0 +1,178 @@
+"""Interactive scan --fix (optional: pip install 'gitpro[tui]'): tick the repos to fix, preview, confirm."""
+from __future__ import annotations
+
+from typing import Callable, List, Optional
+
+from rich.syntax import Syntax
+from rich.text import Text
+from textual.app import App, ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import ModalScreen
+from textual.widgets import Button, DataTable, Footer, Header, Label, Static
+
+from .view import plural, who
+
+ON, OFF = "☑", "☐"
+
+
+class Ask(ModalScreen[bool]):
+    BINDINGS = [Binding("y", "answer(True)", "Remove"), Binding("n,escape", "answer(False)", "Cancel")]
+
+    def __init__(self, question: str) -> None:
+        super().__init__()
+        self.question = question
+
+    def compose(self) -> ComposeResult:
+        with Vertical(classes="dialog"):
+            yield Label(self.question)
+            with Horizontal(classes="buttons"):
+                yield Button("Remove", variant="error", id="yes")
+                yield Button("Cancel", id="no")
+
+    def on_button_pressed(self, event: Button.Pressed) -> None:
+        self.dismiss(event.button.id == "yes")
+
+    def action_answer(self, yes: bool) -> None:
+        self.dismiss(yes)
+
+
+class Suggestion(ModalScreen[None]):
+    BINDINGS = [Binding("c", "copy", "Copy"), Binding("escape,q,s", "app.pop_screen", "Close")]
+
+    def __init__(self, toml: str) -> None:
+        super().__init__()
+        self.toml = toml
+
+    def compose(self) -> ComposeResult:
+        with Vertical(classes="dialog"):
+            yield Static("To keep this identity, paste the block into your config and run 'gitpro apply'. "
+                         "The repos it matches then keep it after the fix.\n")
+            yield Static(Syntax(self.toml, "toml", theme="ansi_dark", background_color="default"))
+            yield Footer()
+
+    def action_copy(self) -> None:
+        self.app.copy_to_clipboard(self.toml)
+        self.notify("copied")
+
+
+class ScanApp(App[Optional[List[str]]]):  # not list[str] | None: evaluated at runtime on 3.9
+    TITLE = "gitpro scan"
+    CSS = """
+    #target { padding: 0 1; color: $text-muted; }
+    DataTable { height: 1fr; }
+    #detail { height: auto; max-height: 12; border-top: solid $primary; padding: 0 1; }
+    Ask, Suggestion { align: center middle; }
+    .dialog Static { width: 100%; }
+    .dialog { width: 90%; max-width: 100; height: auto; border: thick $primary; background: $surface; padding: 1 2; }
+    .buttons { height: auto; margin-top: 1; }
+    .buttons Button { margin-right: 2; }
+    """
+    BINDINGS = [
+        Binding("space", "toggle", "Tick"),
+        Binding("a", "toggle_all", "All"),
+        Binding("s", "suggest", "Keep identity"),
+        Binding("enter", "fix", "Fix ticked", priority=True),
+        Binding("q,escape", "quit", "Quit"),
+    ]
+
+    def __init__(self, rep: dict, show: Callable[[str], str]) -> None:
+        super().__init__()
+        self.rep, self.show = rep, show
+        fixable = [r for r in rep["overrides"] if r["fixable"]]
+        # Same order as the plain output: by identity after the fix, then by the identity now, unchanged last.
+        self.rows = sorted(fixable, key=lambda r: (who(r["after"]), who(r["now"]) == who(r["after"]),
+                                                   who(r["now"]), r["short"]))
+        self.ticked = {r["path"] for r in self.rows}
+
+    def compose(self) -> ComposeResult:
+        yield Header()
+        yield Static(id="target")
+        yield DataTable(cursor_type="row", zebra_stripes=True)
+        yield Static(id="detail")
+        yield Footer()
+
+    def on_mount(self) -> None:
+        table = self.query_one(DataTable)
+        table.add_column(" ", key="tick")
+        targets = {who(r["after"]) for r in self.rows}
+        one = len(targets) == 1
+        table.add_columns("repo", "now (yellow: changes)" if one else "now", *([] if one else ["after the fix"]))
+        target = self.query_one("#target", Static)
+        if one:
+            target.update(Text("After the fix they all use ") + Text(targets.pop(), style="bold green"))
+        else:
+            target.display = False
+        for r in self.rows:
+            now, after = who(r["now"]), who(r["after"])
+            cells = [Text(now, style="yellow" if now != after else "dim")]
+            if not one:
+                cells.append(Text("unchanged", style="dim") if now == after else Text(after, style="green"))
+            table.add_row(ON, r["short"], *cells, key=r["path"])
+        self.sub_title = self.counts()
+        table.focus()
+
+    def counts(self) -> str:
+        n = sum(len(r["fixable"]) for r in self.rows if r["path"] in self.ticked)
+        return f"{plural(len(self.ticked), 'repo')} ticked, {plural(n, 'setting')} to remove"
+
+    def current(self) -> dict | None:
+        table = self.query_one(DataTable)
+        return self.rows[table.cursor_row] if self.rows else None
+
+    def on_data_table_row_highlighted(self, event: DataTable.RowHighlighted) -> None:
+        r = self.current()
+        if not r:
+            return
+        text = Text(self.show(r["path"]), style="bold")
+        text.append(f"   {r['owner']}\n", style="dim")
+        for s in r["settings"]:
+            text.append(f"  {s['key']:<11} {s['value']}")
+            text.append("  →  " + s["without"] if s["without"] else "  (kept: nothing else sets it)",
+                        style="green" if s["without"] and s["without"] != s["value"] else "dim")
+            text.append("\n")
+        if self.suggestion(r):
+            text.append("s: keep this identity with a gitpro identity instead", style="dim")
+        self.query_one("#detail", Static).update(text)
+
+    def suggestion(self, r: dict) -> dict | None:
+        return next((s for s in self.rep["suggestions"] if s["email"] == r["now"]["email"]
+                     and r["owner"] in {f"{s['host']}/{o}" for o in s["owners"]}), None)
+
+    def action_toggle(self) -> None:
+        r = self.current()
+        if r:
+            self.ticked ^= {r["path"]}
+            self.query_one(DataTable).update_cell(r["path"], "tick", ON if r["path"] in self.ticked else OFF)
+            self.sub_title = self.counts()
+
+    def action_toggle_all(self) -> None:
+        self.ticked = set() if self.ticked else {r["path"] for r in self.rows}
+        table = self.query_one(DataTable)
+        for r in self.rows:
+            table.update_cell(r["path"], "tick", ON if r["path"] in self.ticked else OFF)
+        self.sub_title = self.counts()
+
+    def action_suggest(self) -> None:
+        r = self.current()
+        s = r and self.suggestion(r)
+        if s:
+            self.push_screen(Suggestion(s["toml"]))
+        else:
+            self.notify("no identity can keep this one: it has no remote gitpro can match", severity="warning")
+
+    def action_fix(self) -> None:
+        if not self.ticked:
+            self.notify("nothing ticked", severity="warning")
+            return
+        n = sum(len(r["fixable"]) for r in self.rows if r["path"] in self.ticked)
+        self.push_screen(Ask(f"Remove {plural(n, 'setting')} from {plural(len(self.ticked), 'repo')}?"),
+                         lambda yes: self.exit(sorted(self.ticked)) if yes else None)
+
+    def action_quit(self) -> None:
+        self.exit(None)
+
+
+def choose(rep: dict, show: Callable[[str], str]) -> list[str] | None:
+    """Paths of the repos to fix, or None if the user quit."""
+    return ScanApp(rep, show).run()