#!/usr/bin/env zsh
gitpi() {
    local CI=true
    # --- KONFIGURATION ---
    local CONFIG_PATH="$HOME/.config/gitpi"
    local CONFIG_FILE="$CONFIG_PATH/config.gitpi"
    local REMOTE_NAME="gitpi"  # Wie der Remote Server heißen soll (statt 'origin')
    local LOCAL_SCRIPT="${ZSH_CONFIG_DIR:-$HOME/.config/zsh}/fox/gitpi/gitpi-deploy"
    local CF_TOKEN="${HARBOR_CLOUDFLARE_TOKEN:-${GITPI_CLOUDFLARE_TOKEN:-}}"

    # --- DNS & CLOUDFLARE HELPERS ---
    _gitpi_get_truth_ip() {
        # Nutzt dig (DNS) statt ping (weniger Parsing-Fehler)
        dig +short lgbtcuties.duckdns.org | tail -n1
    }

    # Helper für MD5 (Kompatibel mit Mac und Linux)
    _gitpi_md5() {
        if command -v md5sum >/dev/null; then
            md5sum "$1" | awk '{print $1}'
        else
            md5 -q "$1" # Mac Fallback
        fi
    }

    _gitpi_wizard() {
        local CFG_FILE=".gitpideploy"
        echo "🧙 GITPI DEPLOYMENT WIZARD"
        echo "---------------------------"

        local mode=$(echo "app\nstatic\nsync\nbin" | fzf --prompt="🛠️  Wähle Modus: " --height=15%)
        [[ -z "$mode" ]] && return

        echo "# 🥧 GITPI SYSTEM CONFIG" > "$CFG_FILE"
        echo "[GITPI]" >> "$CFG_FILE"
        echo "MODE=$mode" >> "$CFG_FILE"

        case "$mode" in
            app|static)
                local raw_domains=$(_gitpi_cf_api "GET" "zones" | python3 -c "import sys, json; [print(z['name']) for z in json.load(sys.stdin).get('result', [])]")
                local base_domain=$(echo "$raw_domains" | fzf --prompt="Wähle Basis-Domain: ")
                vared -p "🔤 Subdomain: " -c sub
                echo "DOMAIN=${sub}.${base_domain}" >> "$CFG_FILE"
                if [[ "$mode" == "app" ]]; then
                    echo "🔌 Port-Check auf dem Server..."
                    command ssh -q "$GITPI_TARGET" "ss -tulpn | grep LISTEN | awk '{print \$4}' | cut -d: -f2 | sort -nu | xargs"
                    vared -p "🔌 App Port: " -c port
                    vared -p "🚀 Start Command: " -c start_cmd
                    echo "PORT=${port:-3000}" >> "$CFG_FILE"
                    echo "START_CMD=${start_cmd:-npm start}" >> "$CFG_FILE"
                fi
                ;;
            bin)
                if [[ -f "package.json" ]]; then
                    echo "📦 package.json erkannt! Binaries werden automatisch verlinkt."
                    # Wir brauchen keinen BIN_NAME, das Script holt sich alle aus der package.json
                    # Wir setzen den Installer direkt auf auto/npm
                elif [[ -f "setup.py" || -f "pyproject.toml" ]]; then
                    echo "🐍 Python-Projekt erkannt! Pip übernimmt das automatische Linking."
                else
                    vared -p "📛 Name der Binary (für den Link): " -c bin_name
                    echo "BIN_NAME=${bin_name:-$REPO_NAME}" >> "$CFG_FILE"
                    
                    echo "🛠️  Spezieller Installer? (Lass leer für auto: npm/pip/bash)"
                    vared -p "Installer: " -c installer
                    [[ -n "$installer" ]] && echo "INSTALLER=$installer" >> "$CFG_FILE"
                fi
                ;;
            sync)
                vared -p "📂 Ziel-Pfad (~/my-config): " -c target_dir
                echo "TARGET_DIR=$target_dir" >> "$CFG_FILE"
                echo "OWNER_USER=pi" >> "$CFG_FILE"
                ;;
        esac

        echo -e "\n# 🔐 APP ENVIRONMENT (Wird als .env geladen)" >> "$CFG_FILE"
        echo "[ENV]" >> "$CFG_FILE"
        echo "NODE_ENV=production" >> "$CFG_FILE"

        echo "\n✅ .gitpideploy erstellt!"
    }

    # shellcheck disable=SC2317
    _gitpi_analytics() {
        echo "🥧 GITPI PULSE: Diagnose & System Health"
        echo "---------------------------------------------------"
        
        # 0. Lokale Konfiguration
        if [[ -z "$GITPI_TARGET" || -z "$GITPI_USER" ]]; then
            echo "❌ Lokale Config fehlt! Breche ab."
            echo "💡 Bitte führe erst 'gitpi config' aus."
            return 1
        fi

        # 1. Self-Healing: Deploy Script Check
        local r_md5=$(ssh -q "$GITPI_TARGET" "md5sum /usr/local/bin/gitpi-deploy 2>/dev/null | awk '{print \$1}'")
        local l_md5=$(_gitpi_md5 "$LOCAL_SCRIPT")
        
        if [[ "$r_md5" != "$l_md5" ]]; then
            echo "⚠️  Server deploy-script out of sync. Auto-repairing..."
            _gitpi_logic_upload_deploy_script
            echo "  ✅ Deploy script updated."
        else
            echo "✅ System: Deploy script is up to date."
        fi

        # 2. Self-Healing: CI-Hook Check
        if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
            local hook_path="/home/${GITPI_USER}/${REPO_NAME}.git/hooks/post-receive"
            
            # HIER WAR DER FEHLER: command ssh und ${GITPI_USER}@ hinzugefügt!
            local hook_exists=$(command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "test -f $hook_path && echo 'yes' || echo 'no'")
            
            if [[ "$hook_exists" != "yes" ]]; then
                echo "⚠️  CI-Hook missing on server! Auto-repairing..."
                command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "mkdir -p ~/${REPO_NAME}.git && cd ~/${REPO_NAME}.git && git init -q --bare -b main && mkdir -p hooks && ln -sf ~/gitpi-ci-hook.sh hooks/post-receive"
                echo "  ✅ CI-Hook linked."
            else
                echo "✅ System: CI-Hook is active."
            fi
        fi

        # 3. Cloudflare Global Check
        if ! ssh -q "$GITPI_TARGET" "sudo test -f /etc/letsencrypt/cloudflare.ini"; then
            echo "❌ System: Cloudflare Credentials (/etc/letsencrypt/cloudflare.ini) fehlen!"
            echo "   Ohne diese Datei wird die automatische SSL-Zertifikatserstellung fehlschlagen."
        else
            echo "✅ System: Cloudflare Credentials bereit."
        fi

        # 4. Projekt-Spezifische Diagnose
        if [[ -f ".gitpideploy" ]]; then
            local mode=$(grep "MODE=" .gitpideploy | cut -d= -f2 | tr -d \'\" | xargs)
            echo -e "\n📦 [Project: $REPO_NAME | Mode: $mode]"
            
            if [[ "$mode" == "app" ]]; then
                local domain=$(grep "DOMAIN=" .gitpideploy | cut -d= -f2)
                local port=$(grep "PORT=" .gitpideploy | cut -d= -f2)
                local service="gitpi-$REPO_NAME"

                # --- App Health: Service ---
                if ssh -q "$GITPI_TARGET" "systemctl is-active --quiet $service"; then
                    echo "  ✅ Service '$service' is running."
                else
                    echo "  ❌ Service '$service' is DOWN."
                fi

                # --- App Health: Port Listener (aus doctor geklaut) ---
                if [[ -n "$port" ]]; then
                    if ssh -q "$GITPI_TARGET" "ss -tulpn | grep -q ':$port '"; then
                        echo "  ✅ App lauscht erfolgreich auf Port $port."
                    else
                        echo "  ⚠️  Port $port ist inaktiv! Die App scheint intern gecrasht zu sein."
                        echo -n "  🚀 Soll ich einen CI-Rebuild triggern? (y/n) "
                        read -q "ans" && { echo ""; gitpi trigger-ci; } || echo ""
                    fi
                fi

                # --- App Health: Secrets ---
                if ssh -q "$GITPI_TARGET" "[ -f /srv/gitpi/$REPO_NAME/.env ]"; then
                    echo "  ✅ Manual .env found in production."
                else
                    echo "  ⚠️  No manual .env found (Run 'gitpi env' if needed)."
                fi

                # --- App Health: DNS & SSL ---
                if [[ -n "$domain" ]]; then
                    # DNS Mismatch (aus doctor geklaut)
                    local truth_ip=$(_gitpi_get_truth_ip)
                    local current_ip=$(dig +short "$domain" | tail -n1)
                    
                    if [[ "$current_ip" != "$truth_ip" ]]; then
                        echo "  ⚠️  DNS Mismatch! (Domain zeigt auf $current_ip, sollte $truth_ip sein)"
                        echo -n "  🌐 Soll ich den DNS-Record bei Cloudflare fixen? (y/n) "
                        read -q "ans" && { echo ""; gitpi dns; } || echo ""
                    else
                        echo "  ✅ DNS routing correctly ($current_ip)."
                    fi

                    # SSL Expiry
                    local expiry=$(ssh -q "$GITPI_TARGET" "sudo openssl x509 -enddate -noout -in /etc/letsencrypt/live/$domain/fullchain.pem 2>/dev/null | cut -d= -f2")
                    [[ -n "$expiry" ]] && echo "  🌐 SSL Certificate valid until: $expiry"
                fi
                
            elif [[ "$mode" == "bin" ]]; then
                # --- Bin-Package Checks ---
                if ssh -q "$GITPI_TARGET" "[ -d /srv/gitpi/$REPO_NAME ]"; then
                    echo "  ✅ Registry: Package source is available on server."
                else
                    echo "  ⚪ Registry: Package not yet pushed to server."
                fi
            fi
        fi

        # 5. CI Pipeline Status
        echo -e "\n📊 [CI/CD Pipeline Status]"
        local log_tail=$(ssh -q "$GITPI_TARGET" "tail -n 1 ~/ci-logs/$REPO_NAME.log 2>/dev/null")
        if [[ "$log_tail" == *"SUCCESS"* ]]; then
            echo "  ✅ Last Run: Passed"
        elif [[ "$log_tail" == *"FAILED"* ]]; then
            echo "  ❌ Last Run: FAILED"
        else
            echo "  ⚪ Last Run: No logs found."
        fi
        
        echo "  📝 Snippet:"
        command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "tail -n 3 ~/ci-logs/${REPO_NAME}.log 2>/dev/null | sed 's/^/     /' || echo '     No logs yet.'"
        
        echo "---------------------------------------------------"
    }

    # --- ANALYTIC HELPERS ---
    #_gitpi_check_remote() {
    #    echo "📡 [Remote System]"
    #    local r_md5=$(ssh "$GITPI_TARGET" "md5sum /usr/local/bin/gitpi-deploy 2>/dev/null | awk '{print \$1}'")
    #    local l_md5=$(_gitpi_md5 "$LOCAL_SCRIPT")
    #    
    #    if [[ "$r_md5" == "$l_md5" ]]; then
    #        echo "  ✅ Deploy script is up to date."
    #    else
    #        echo "  ⚠️  Deploy script mismatch! Run 'gitpi install' to fix."
    #    fi
    #}

    # --- INTERNAL LOGIC WRAPPERS ---
    _gitpi_logic_install_server() {
        echo "👤 Setting up User, SSH, and Cloudflare..."
        # 1. Check: Existiert das Deploy-Script lokal?
            local LOCAL_SCRIPT="${ZSH_CONFIG_DIR:-$HOME/.config/zsh}/fox/gitpi/gitpi-deploy"
            if [ ! -f "$LOCAL_SCRIPT" ]; then
                echo "❌ Fehler: Dein lokales Deploy-Script fehlt unter:"
                echo "   $LOCAL_SCRIPT"
                return 1
            fi

            # 2. Admin Login Daten
            echo "🔧 Richte den Raspberry Pi initial ein..."
            echo "Info: Ich brauche jetzt einen Admin-User (z.B. 'pi' oder 'root') auf dem Zielgerät."
            vared -p "👤 Admin-Username auf dem Pi: " -c ADMIN_USER
            [[ -z "$ADMIN_USER" ]] && return 1

            # 3. SSH Key finden (für den Git User)
            local PUB_KEY_FILE=""
            [[ -f "$HOME/.ssh/id_ed25519.pub" ]] && PUB_KEY_FILE="$HOME/.ssh/id_ed25519.pub"
            [[ -z "$PUB_KEY_FILE" && -f "$HOME/.ssh/id_rsa.pub" ]] && PUB_KEY_FILE="$HOME/.ssh/id_rsa.pub"
            
            if [[ -z "$PUB_KEY_FILE" ]]; then 
                echo "❌ Kein SSH-Key gefunden! Bitte erst 'ssh-keygen' ausführen."
                return 1
            fi
            # Key Inhalt lesen
            local PUB_KEY_CONTENT=$(cat "$PUB_KEY_FILE")

            echo "☕ Verbinde als ${ADMIN_USER}@${GITPI_TARGET}..."

            # --- SCHRITT A: SYSTEM SETUP (Pakete, User, Ordner) ---
            # STEP 1: SETUP & INI
            command ssh -t "${ADMIN_USER}@${GITPI_TARGET}" "bash -s" <<EOF
                TARGET_USER="$GITPI_USER"
                command ssh_KEY="$PUB_KEY_CONTENT"
                CF_TOKEN="$CF_TOKEN"

                echo "📦 1. Fixe Apt & Installiere Pakete..."
                sudo dpkg --configure -a || true
                sudo apt --fix-broken install -y || true
                sudo apt-get update -qq
                sudo apt-get install -y git nodejs npm nginx certbot python3-certbot-dns-cloudflare acl rsync -qq

                echo "👤 2. User Setup (\$TARGET_USER)..."
                if ! id "\$TARGET_USER" &>/dev/null; then
                    sudo adduser --disabled-password --gecos "" "\$TARGET_USER"
                fi
                sudo usermod -aG www-data "\$TARGET_USER"

                echo "🔑 3. SSH Configuration..."
                sudo mkdir -p "/home/\$TARGET_USER/.ssh"
                if ! sudo grep -qF "\$SSH_KEY" "/home/\$TARGET_USER/.ssh/authorized_keys" 2>/dev/null; then
                    echo "\$SSH_KEY" | sudo tee -a "/home/\$TARGET_USER/.ssh/authorized_keys" > /dev/null
                fi
                sudo chown -R "\$TARGET_USER:\$TARGET_USER" "/home/\$TARGET_USER/.ssh"
                sudo chmod 700 "/home/\$TARGET_USER/.ssh"
                sudo chmod 600 "/home/\$TARGET_USER/.ssh/authorized_keys"

                echo "☁️  4. Cloudflare Credentials speichern..."
                sudo mkdir -p /etc/letsencrypt
                echo "dns_cloudflare_api_token = \$CF_TOKEN" | sudo tee /etc/letsencrypt/cloudflare.ini > /dev/null
                sudo chmod 600 /etc/letsencrypt/cloudflare.ini
EOF

            if [ $? -ne 0 ]; then echo "❌ Setup abgebrochen."; return 1; fi

            # --- SCHRITT B: SCRIPT UPLOAD (Der sichere Weg) ---
            echo "🚀 4. Lade gitpi-deploy hoch..."
            # Wir pipen den Inhalt. Das verhindert Syntax-Fehler durch Variablen-Expansion!
            cat "$LOCAL_SCRIPT" | command ssh "${ADMIN_USER}@${GITPI_TARGET}" "sudo tee /usr/local/bin/gitpi-deploy > /dev/null && sudo chmod +x /usr/local/bin/gitpi-deploy"

            # --- SCHRITT C: SUDOERS FIX ---
            echo "🛡️  5. Konfiguriere Sudo-Rechte..."
            command ssh "${ADMIN_USER}@${GITPI_TARGET}" "bash -s" <<EOF
                echo "$GITPI_USER ALL=(root) NOPASSWD: /usr/local/bin/gitpi-deploy" | sudo tee /etc/sudoers.d/010_gitpi-deploy > /dev/null
                sudo chmod 440 /etc/sudoers.d/010_gitpi-deploy
                echo "✅ Fertig! Server ist bereit."
EOF
            echo "🎉 Installation erfolgreich abgeschlossen."
    }

    _gitpi_logic_install_ci_system() {
        echo "🔧 Installiere das verbesserte CI-System auf dem Pi..."

        command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "cat > ~/gitpi-ci-hook.sh" <<'EOF'
#!/bin/bash
# --- GITPI SERVER SIDE CI (V3 - Smart & Quiet) ---

read oldrev newrev refname

if [ "$newrev" = "0000000000000000000000000000000000000000" ]; then
    echo "👋 Branch gelöscht. CI wird übersprungen."
    exit 0
fi

REPO_DIR=$(pwd)
REPO_NAME=$(basename "$REPO_DIR" .git)
BUILD_DIR="$HOME/ci-builds/$REPO_NAME"
LOG_DIR="$HOME/ci-logs"
LOG_FILE="$LOG_DIR/$REPO_NAME.log"

mkdir -p "$BUILD_DIR" "$LOG_DIR"

echo "🤖 GitPi CI gestartet für: $REPO_NAME"

# 1. Stummer Checkout ohne "detached HEAD" Spam!
git -c advice.detachedHead=false --work-tree="$BUILD_DIR" --git-dir="$REPO_DIR" checkout -q -f "$newrev"

if [ $? -ne 0 ]; then
    echo "❌ CRITICAL: Checkout fehlgeschlagen!"
    exit 1
fi

cd "$BUILD_DIR" || exit 1

echo "--- BUILD REPORT: $(date) ---" > "$LOG_FILE"
echo "Commit: ${newrev:0:7} | Branch: $refname" >> "$LOG_FILE"

RET=0

# 2. Test-Erkennung & Ausführung
if [ -f ".gitpitest" ]; then
    echo "🧪 Führe Custom .gitpitest aus..."
    chmod +x .gitpitest
    ./.gitpitest > /tmp/ci-run.log 2>&1
    RET=$?
elif [ -f "package.json" ]; then
    echo "📦 Node.js erkannt. Teste..."
    if [ ! -d "node_modules" ]; then npm install > /dev/null 2>&1; fi
    npm test > /tmp/ci-run.log 2>&1
    RET=$?
    
    # NEU: Fange fehlende oder Dummy-Tests ab!
    if [ $RET -ne 0 ] && grep -iqE "no test specified|missing script: .test." /tmp/ci-run.log; then
        echo "⚠️  Warnung: Kein Custom-Test in package.json definiert. Ignoriere..."
        echo "⚠️  Skipped: No test specified in package.json" > /tmp/ci-run.log
        RET=0
    fi
elif [ -f "requirements.txt" ]; then
    echo "🐍 Python erkannt..."
    pip install -r requirements.txt > /dev/null 2>&1
    pytest > /tmp/ci-run.log 2>&1
    RET=$?
else
    echo "⚪ Keine Tests gefunden." > /tmp/ci-run.log
    RET=0
fi

cat /tmp/ci-run.log >> "$LOG_FILE"

if [ $RET -eq 0 ]; then
    echo "✅ CI PASSED"
    
    # --- DEPLOY TRIGGER ---
    if [ -f "$BUILD_DIR/.gitpideploy" ]; then
        echo "🚀 Starte Deployment..."
        sudo /usr/local/bin/gitpi-deploy "$REPO_NAME" "$BUILD_DIR" >> "$LOG_FILE" 2>&1
        
        if [ $? -eq 0 ]; then
             echo "✅ DEPLOY SUCCESS"
        else
             echo "❌ DEPLOY FAILED"
        fi
    fi
else
    echo "❌ FAILED (Exit Code: $RET)" >> "$LOG_FILE"
    echo "❌ CI FAILED! Check 'gitpi ci-status'"
fi
EOF
        command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "chmod +x ~/gitpi-ci-hook.sh"
        echo "✅ CI-System aktualisiert."
    }

    _gitpi_logic_upload_deploy_script() {
        echo "🚀 Uploading gitpi-deploy script..."
        
        # 1. Admin-User abfragen und speichern
        if [[ -z "$GITPI_ADMIN" ]]; then
            echo "💡 Um das System-Skript zu updaten, brauche ich deinen Admin-Account."
            vared -p "👤 Admin-Username auf dem Pi (z.B. pi): " -c GITPI_ADMIN
            [[ -z "$GITPI_ADMIN" ]] && { echo "❌ Abbruch."; return 1; }
            echo "GITPI_ADMIN=${GITPI_ADMIN}" >> "$CONFIG_FILE"
        fi

        # 2. Upload ins eigene Home-Verzeichnis (verhindert Rechte-Konflikte in /tmp)
        command scp -q "$LOCAL_SCRIPT" "${GITPI_ADMIN}@${GITPI_TARGET}:~/gitpi-deploy-tmp"
        
        # 3. Echtes SSH: Verschieben, ausführbar machen und chown auf root
        command ssh -t -q "${GITPI_ADMIN}@${GITPI_TARGET}" "sudo mv ~/gitpi-deploy-tmp /usr/local/bin/gitpi-deploy && sudo chmod +x /usr/local/bin/gitpi-deploy && sudo chown root:root /usr/local/bin/gitpi-deploy"
    }


    _gitpi_cf_api() {
        local method=$1 endpoint=$2 data=$3
        # WICHTIG: -t erzwingt PTY für sudo Passwortabfrage im Doctor Mode, falls nötig
        command ssh -t "$GITPI_TARGET" "bash -s" <<EOF 2>/dev/null
        if [ ! -f /etc/letsencrypt/cloudflare.ini ]; then exit 1; fi
        # Wir versuchen den Token zu lesen. Falls sudo passwort braucht, scheitert das im script mode oft.
        # Besser: Wir gehen davon aus, dass der User Rechte hat oder NOPASSWD für diesen Pfad bräuchte.
        # Für den Doctor Test lesen wir die Datei direkt via cat falls möglich.
        TOKEN=\$(sudo cat /etc/letsencrypt/cloudflare.ini 2>/dev/null | grep 'dns_cloudflare_api_token' | cut -d= -f2 | tr -d ' ')
        
        if [ -z "\$TOKEN" ]; then exit 1; fi

        curl -s -X $method "https://api.cloudflare.com/client/v4/$endpoint" \
             -H "Authorization: Bearer \$TOKEN" \
             -H "Content-Type: application/json" \
             ${data:+--data '$data'}
EOF
    }

    # Hilfsfunktion: Standard .gitignore erstellen
    _ensure_gitignore() {
        if [ -f ".gitignore" ]; then
            return 0
        fi
        
        echo "🛡️  Keine .gitignore gefunden. Erstelle Standard-Sicherheitsliste..."
        cat <<EOF > .gitignore
# --- OS & IDE ---
.DS_Store
Thumbs.db
.vscode/
.idea/
*.swp

# --- Dependencies & Builds ---
node_modules/
dist/
build/
venv/
.venv/
__pycache__/
*.pyc

# --- Security & Logs ---
.env
*.log
*.bak
EOF
    }
    
    # Hilfsfunktion: Config laden
    _load_config() {
        mkdir -p "$CONFIG_PATH"
        if [ -f "$CONFIG_FILE" ]; then
            source "$CONFIG_FILE"
        fi
    }

    # --- 1. SETUP BEFEHL (Config speichern) ---
    if [[ "$1" == "config" ]]; then
        shift
        while [[ "$#" -gt 0 ]]; do
            case $1 in
                --setuser) GITPI_USER="$2"; shift ;;
                --settarget) GITPI_TARGET="$2"; shift ;;
                --bin-manager) GITPI_BIN_MANAGER="$2"; shift ;; # npm, pnpm, pip, yarn...
                *) echo "❌ Unbekannte Option: $1"; return 1 ;;
            esac
            shift
        done
        echo "GITPI_USER=${GITPI_USER}" > "$CONFIG_FILE"
        echo "GITPI_TARGET=${GITPI_TARGET}" >> "$CONFIG_FILE"
        [[ -n "$GITPI_BIN_MANAGER" ]] && echo "GITPI_BIN_MANAGER=${GITPI_BIN_MANAGER}" >> "$CONFIG_FILE"
        return 0
    fi

    # Config laden & prüfen
    _load_config
    if [[ -z "$GITPI_USER" || -z "$GITPI_TARGET" ]]; then
        echo "❌ Keine Config gefunden! Bitte erst ausführen:"
        echo "   gitpi config --setuser <user> --settarget <ssh-host>"
        return 1
    fi

    # Standard-Variablen für Git-Operationen
    local CURRENT_BRANCH=$(git branch --show-current 2>/dev/null)
    local REPO_NAME=$(basename "$PWD")
    local REMOTE_URI="${GITPI_USER}@${GITPI_TARGET}:/home/${GITPI_USER}/${REPO_NAME}.git"

    # --- 2. HAUPTLOGIK ---
    case "$1" in
        init)
            _ensure_gitignore

            if [[ ! -f ".gitpideploy" ]]; then
                _gitpi_wizard
            fi
            
            # Lese Modus (Immun gegen Quotes)
            local mode=$(grep "MODE=" .gitpideploy | cut -d= -f2 | tr -d \'\" | xargs)
            
            # 1. DNS Check (NUR für Web-Apps!)
            if [[ "$mode" == "app" || "$mode" == "static" ]]; then
                local domain=$(grep "DOMAIN=" .gitpideploy | cut -d= -f2 | tr -d \'\" | xargs)
                if [[ -n "$domain" ]]; then
                    local current_ip=$(dig +short "$domain" | tail -n1)
                    local truth_ip=$(_gitpi_get_truth_ip)
                    if [[ -n "$current_ip" && "$current_ip" != "$truth_ip" ]]; then
                        echo "⚠️  DNS Mismatch! Domain zeigt auf $current_ip, Truth ist $truth_ip."
                        echo -n "Möchtest du 'gitpi dns' jetzt ausführen? (y/n) "
                        read -q "ans" && { echo ""; gitpi dns; } || echo ""
                    fi
                fi
            else
                echo "📦 Mode '$mode' erkannt. Überspringe DNS-Check."
            fi

            # 2. Erstellt das Repo auf dem Server und verknüpft es lokal
            echo "🏗️  Erstelle Bare-Repo auf ${GITPI_TARGET}..."
            command ssh -q "${GITPI_USER}@${GITPI_TARGET}" "mkdir -p ~/${REPO_NAME}.git && cd ~/${REPO_NAME}.git && git init -q --bare -b main && mkdir -p hooks && ln -sf ~/gitpi-ci-hook.sh hooks/post-receive"
            
            # 3. Lokal initialisieren falls nötig
            if [ ! -d ".git" ]; then
                git init -q -b main
                git add .
                git commit -q -m "Initial commit via gitpi"
            fi
            
            if git remote | grep -q "^${REMOTE_NAME}$"; then
                echo "⚠️  Remote '${REMOTE_NAME}' existiert bereits. Überspringe Verknüpfung."
            else
                git remote add "${REMOTE_NAME}" "$REMOTE_URI"
                echo "🔗 Remote '${REMOTE_NAME}' verknüpft."
            fi
            
            # 4. Initialer Push (Registriert das Paket auf dem Pi)
            echo "🚀 Initial Push zu ${REMOTE_NAME}..."
            git push -u "${REMOTE_NAME}" HEAD

            # 5. Lokales Dev-Linking für Binaries
            if [[ "$mode" == "bin" ]]; then
                echo -e "\n🎉 Paket wurde erfolgreich auf dem Pi registriert!"
                echo -n "🛠️  Möchtest du das Tool lokal für die Entwicklung verlinken? (y/n) "
                read -q "ans" && {
                    echo "\n🔗 Starte lokales Linking..."
                    if [[ -f "package.json" ]]; then
                        npm link
                        echo "✅ NPM Link erstellt."
                    elif [[ -f "setup.py" || -f "pyproject.toml" ]]; then
                        pip install -e .
                        echo "✅ PIP Editable Link erstellt."
                    else
                        echo "⚠️  Kein natives Format gefunden. Bitte manuell verlinken."
                    fi
                } || echo ""
            fi
            ;;

        status|check|doctor|pulse)
            _gitpi_analytics
            ;;

        install)
            # GitPi als lokaler Package Manager
            # Aufruf: gitpi install <repo-name>
            local pkg_name="$2"
            if [[ -z "$pkg_name" ]]; then
                echo "❌ Bitte Paketnamen angeben: gitpi install <name>"
                return 1
            fi

            local PKG_DIR="$HOME/.local/share/gitpi/packages/$pkg_name"
            local BIN_DIR="$HOME/.local/share/gitpi/bin"
            local CLONE_URI="${GITPI_USER}@${GITPI_TARGET}:/home/${GITPI_USER}/${pkg_name}.git"

            echo "📦 Installing GitPi Package: $pkg_name..."
            mkdir -p "$BIN_DIR" "$PKG_DIR"

            # 1. Source vom Server holen oder updaten
            if [[ -d "$PKG_DIR/.git" ]]; then
                echo "🔄 Updating existing package..."
                git -C "$PKG_DIR" pull origin main --quiet 2>/dev/null || git -C "$PKG_DIR" pull origin master --quiet
            else
                echo "📥 Fetching from $GITPI_TARGET..."
                git clone --quiet "$CLONE_URI" "$PKG_DIR" || { echo "❌ Package not found on server."; return 1; }
            fi

            cd "$PKG_DIR" || return 1

            # 2. Modus aus der geladenen .gitpideploy lesen
            local mode="bin"
            if [[ -f ".gitpideploy" ]]; then
                mode=$(grep "MODE=" .gitpideploy | cut -d= -f2 | tr -d \'\" | xargs)
            fi

            if [[ "$mode" != "bin" ]]; then
                echo "⚠️  Dieses Projekt ist kein BIN-Paket (Mode: $mode). Code wurde in $PKG_DIR gespeichert, aber nicht verlinkt."
                return 0
            fi

            # 3. Lokale Link-Logik (Spiegelbild vom Server-Script)
            if [[ -f "package.json" ]]; then
                echo "🛠️  Running npm install..."
                npm install --production --quiet
                
                echo "🔗 Linking Node binaries..."
                node -e "const j=require('./package.json').bin; const b=typeof j==='string'?{['$pkg_name']:j}:(j||{}); Object.keys(b).forEach(k=>console.log(k+':'+b[k]))" | while read -r entry; do
                    local name="${entry%%:*}"
                    local ppath="${entry#*:}"
                    echo $PATH
                    command ln -sf "$PKG_DIR/$ppath" "$BIN_DIR/$name"
                    command chmod +x "$PKG_DIR/$ppath"
                    echo "  ✅ Linked: $name -> $BIN_DIR/$name"
                done

            elif [[ -f "setup.py" || -f "pyproject.toml" ]]; then
                echo "🐍 Running pip install editable..."
                # --break-system-packages ist bei neuen Python-Versionen oft nötig, 
                # wenn man in den User-Space installiert, ohne venv.
                pip install --user --no-cache-dir --break-system-packages -e . 2>/dev/null || \
                pip install --user --no-cache-dir -e . 2>/dev/null
                echo "  ✅ Installed via pip."
                echo "  💡 (Pip Binaries liegen meist unter ~/.local/bin)"
            else
                echo "⚠️  Kein natives Paketformat (package.json/setup.py) gefunden."
                echo "  💡 Du kannst manuell verlinken, der Code liegt in: $PKG_DIR"
            fi

            echo "\n🎉 Installation von $pkg_name abgeschlossen."
            
            # 4. PATH Warnung (nur wenn nötig)
            if [[ ":$PATH:" != *":$BIN_DIR:"* ]]; then
                echo "⚠️  WICHTIG: Füge folgenden Pfad zu deiner .zshrc oder .bashrc hinzu:"
                echo "    export PATH=\"\$HOME/.local/share/gitpi/bin:\$PATH\""
            fi
            
            # Wir springen zurück, wo der User vorher war
            cd - > /dev/null
            ;;

        push)
            # Pusht explizit zum 'gitpi' Remote
            echo "⬆️  Pushing ${CURRENT_BRANCH} to ${REMOTE_NAME}..."
            git push -u "${REMOTE_NAME}" "${CURRENT_BRANCH}"
            ;;

        pull)
            # Pullt explizit vom 'gitpi' Remote
            echo "⬇️  Pulling ${CURRENT_BRANCH} from ${REMOTE_NAME}..."
            git pull "${REMOTE_NAME}" "${CURRENT_BRANCH}"
            ;;
        dns)
            local ip=$(_gitpi_get_truth_ip)
            echo "🎯 Truth IP: $ip"
            
            # Domain Liste via CF API
            local domains=$(_gitpi_cf_api "GET" "zones" | python3 -c "import sys, json; [print(z['name']) for z in json.load(sys.stdin)['result']]")
            local base_domain=$(echo "$domains" | fzf --prompt="Select Zone: ")
            
            vared -p "Subdomain: " -c sub
            local full_dom="${sub}.${base_domain}"
            
            echo "🌐 Creating A-Record for $full_dom..."
            local zone_id=$(_gitpi_cf_api "GET" "zones?name=$base_domain" | python3 -c "import sys, json; print(json.load(sys.stdin)['result'][0]['id'])")
            
            _gitpi_cf_api "POST" "zones/$zone_id/dns_records" "{\"type\":\"A\",\"name\":\"$sub\",\"content\":\"$ip\",\"ttl\":1,\"proxied\":false}"
            ;;

        env)
            local REMOTE_PATH="/home/${GITPI_USER}/ci-builds/${REPO_NAME}/.env"
            local TMP_ENV="/tmp/gitpi_${REPO_NAME}_env"
            
            echo "🔍 Checking for .env on remote..."
            
            # Check if file exists on remote
            if command ssh "${GITPI_USER}@${GITPI_TARGET}" "[ -f $REMOTE_PATH ]"; then
                echo "📥 Downloading existing .env..."
                scp -q "${GITPI_USER}@${GITPI_TARGET}:$REMOTE_PATH" "$TMP_ENV"
            else
                echo "✨ No .env found on server. Creating a new one..."
                touch "$TMP_ENV"
            fi

            # --- EDITOR SELECTION (Fixed Syntax) ---
            local EDITOR_CMD="micro"
            if ! command -v micro &>/dev/null; then
                if [[ -n "$EDITOR" ]]; then
                    EDITOR_CMD="$EDITOR"
                else
                    EDITOR_CMD="nano"
                fi
            fi

            # Open Editor
            $EDITOR_CMD "$TMP_ENV"

            # Check if user actually saved/wrote something
            if [[ -f "$TMP_ENV" ]]; then
                echo "📤 Uploading .env to server..."
                # Verzeichnis sicherstellen und hochladen
                command ssh "${GITPI_USER}@${GITPI_TARGET}" "mkdir -p /home/${GITPI_USER}/ci-builds/${REPO_NAME}"
                scp -q "$TMP_ENV" "${GITPI_USER}@${GITPI_TARGET}:$REMOTE_PATH"
                
                if [[ $? -eq 0 ]]; then
                    echo "✅ .env updated successfully on remote."
                    echo "💡 Note: Run 'gitpi trigger-ci' to apply changes."
                else
                    echo "❌ Upload failed."
                fi
                rm -f "$TMP_ENV"
            else
                echo "🚫 Edit cancelled or file missing."
            fi
            ;;

        trigger-ci)
            local HEAD_SHA=$(git rev-parse HEAD)
            # Falls HEAD detached ist oder Fehler wirft, Fallback
            if [ -z "$HEAD_SHA" ]; then echo "❌ Kein Commit gefunden."; return 1; fi

            local FULL_REF="refs/heads/${CURRENT_BRANCH}"
            local OLD_SHA="0000000000000000000000000000000000000000"

            echo "🔄 Triggere manuelle CI auf ${GITPI_TARGET}..."
            echo "   Repo:   ${REPO_NAME}"
            echo "   Commit: ${HEAD_SHA:0:7}"
            echo "   Branch: ${CURRENT_BRANCH}"

            # WICHTIG: Wir müssen erst in das Bare-Repo wechseln (cd), 
            # damit das Script weiß, wo es ist.
            command ssh "${GITPI_USER}@${GITPI_TARGET}" "cd ~/${REPO_NAME}.git && echo '${OLD_SHA} ${HEAD_SHA} ${FULL_REF}' | ~/gitpi-ci-hook.sh"
            ;;

        ci-status)
            echo "📊 Hole CI-Bericht vom Server..."
            command ssh "${GITPI_USER}@${GITPI_TARGET}" "cat ~/ci-logs/${REPO_NAME}.log 2>/dev/null || echo 'Kein Bericht gefunden.'"
            ;;

        install-ci-system)
            _gitpi_logic_install_ci_system
            ;;
        
        clone)
            # Cloned ein Repo und nennt den Remote direkt 'gitpi'
            if [ -z "$2" ]; then
                echo "❌ Bitte Repo-Namen angeben: gitpi clone <name>"
                return 1
            fi
            local CLONE_URI="${GITPI_USER}@${GITPI_TARGET}:/home/${GITPI_USER}/$2.git"
            echo "📥 Cloning $2..."
            git clone -o "${REMOTE_NAME}" "$CLONE_URI"
            ;;

        list)
            # Listet alle Ordner mit .git Endung auf dem Server
            echo "📂 Repositories auf ${GITPI_TARGET}:"
            command ssh "${GITPI_USER}@${GITPI_TARGET}" "ls -d *.git"
            ;;

        backup)
             # Zieht eine Kopie des Bare-Repos via SCP
             local BACKUP_DIR="$HOME/gitpi-backups"
             local DATESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")
             
             mkdir -p "$BACKUP_DIR"
             echo "📦 Starte Backup für '$REPO_NAME'..."
             
             scp -r -q "${GITPI_USER}@${GITPI_TARGET}:/home/${GITPI_USER}/${REPO_NAME}.git" "${BACKUP_DIR}/${REPO_NAME}_${DATESTAMP}.git"
             
             if [ $? -eq 0 ]; then
                 echo "✅ Backup gespeichert in: $BACKUP_DIR"
             else
                 echo "❌ Backup fehlgeschlagen!"
             fi
             ;;

        install-server)
            _gitpi_logic_install_server
            ;;

        generate-config)
            local CFG_FILE=".gitpideploy"
            
            echo "🧙 Zaubere eine .gitpideploy Konfiguration..."

            # 1. Modus Auswahl
            local DEFAULT_MODE="app"
            [ -f "index.html" ] && DEFAULT_MODE="static"
            
            echo ""
            echo "1) 📱 APP    (NodeJS, Python - mit Systemd & Domain)"
            echo "2) 🎨 STATIC (HTML/JS - Nginx Webserver)"
            echo "3) 📂 SYNC   (Dotfiles/Configs - Kopiert Dateien in Zielordner)"
            
            printf "Welcher Modus? [${DEFAULT_MODE}]: "
            read -r MODE_INPUT
            local MODE=${MODE_INPUT:-$DEFAULT_MODE}
            
            # Mapping
            if [[ "$MODE" == "1" ]]; then MODE="app"; fi
            if [[ "$MODE" == "2" ]]; then MODE="static"; fi
            if [[ "$MODE" == "3" ]]; then MODE="sync"; fi

            # Initiale Datei schreiben
            echo "[GITPI]" > "$CFG_FILE"
            echo "MODE=$MODE" >> "$CFG_FILE"

            # --- ZWEIG A: WEB (App & Static) ---
            if [[ "$MODE" == "app" || "$MODE" == "static" ]]; then
                # Domain
                printf "🌐 Domain (z.B. app.meine-domain.de): "
                read -r DOMAIN
                if [[ -n "$DOMAIN" ]]; then echo "DOMAIN=$DOMAIN" >> "$CFG_FILE"; fi
                
                # Email
                printf "📧 Email für SSL (Enter für Standard): "
                read -r EMAIL_INPUT
                if [[ -n "$EMAIL_INPUT" ]]; then echo "EMAIL=$EMAIL_INPUT" >> "$CFG_FILE"; fi

                # App-Spezifisch
                if [[ "$MODE" == "app" ]]; then
                    printf "🔌 Port (Intern, z.B. 3000): "
                    read -r PORT
                    echo "PORT=${PORT:-3000}" >> "$CFG_FILE"
                    
                    local DEF_CMD="npm start"
                    [ -f "main.py" ] && DEF_CMD="python3 main.py"
                    printf "🚀 Start Command [${DEF_CMD}]: "
                    read -r START_CMD
                    echo "START_CMD=${START_CMD:-$DEF_CMD}" >> "$CFG_FILE"
                fi
            fi

            # --- ZWEIG B: SYNC ---
            if [[ "$MODE" == "sync" ]]; then
                printf "📂 Ziel-Pfad auf Server (z.B. ~/.config/myapp): "
                read -r TARGET_DIR
                echo "TARGET_DIR=${TARGET_DIR}" >> "$CFG_FILE"

                printf "👤 Owner User (meist 'pi' oder 'root'): "
                read -r OWNER_USER
                echo "OWNER_USER=${OWNER_USER:-pi}" >> "$CFG_FILE"
                
                printf "🔧 Post-Deploy Command (z.B. 'systemctl reload x'): "
                read -r POST_CMD
                if [[ -n "$POST_CMD" ]]; then echo "POST_DEPLOY_CMD=$POST_CMD" >> "$CFG_FILE"; fi
            fi

            # --- ENV VARIABLEN (Für alle Modi) ---
            echo ""
            echo "🔐 Umgebungsvariablen (Secrets/Configs) hinzufügen?"
            echo "   (Drücke Enter ohne Eingabe um fertigzustellen)"
            
            local FIRST_ENV=true
            
            while true; do
                printf "   Key (z.B. DB_HOST): "
                read -r ENV_KEY
                if [[ -z "$ENV_KEY" ]]; then break; fi
                
                printf "   Value: "
                read -r ENV_VAL
                
                if [[ "$FIRST_ENV" == "true" ]]; then
                    echo "" >> "$CFG_FILE"
                    echo "[ENV]" >> "$CFG_FILE"
                    FIRST_ENV=false
                fi
                echo "$ENV_KEY=$ENV_VAL" >> "$CFG_FILE"
            done

            echo ""
            echo "✅ .gitpideploy ($MODE) wurde erstellt!"
            cat "$CFG_FILE"
            ;;

        help|--help|-h)
            # Hilfetext definieren
            local HELP_TEXT=$(cat <<EOF
# 🥧 gitpi - Pi Cloud System

Ein vollständiges **Git-Server**, **CI/CD** und **Deployment** System in einem Script.

## 🚀 Erste Schritte & Setup
  \`gitpi config --setuser <user> --settarget <host>\`
      Speichert Server-Adresse (z.B. user 'git', host 'meow').
  \`gitpi install-server\`
      Richtet den Pi komplett ein (User, SSH, Sudoers).
  \`gitpi install-ci-system\`
      Aktualisiert die CI/CD-Logik auf dem Server (bei Updates).

## 📂 Projekt Management
  \`gitpi init\`
      Verwandelt den aktuellen Ordner in ein GitPi-Projekt.
      Erstellt Remote-Repo, verknüpft CI-Hooks und pusht.
  \`gitpi clone <name>\`
      Cloned ein Repo vom Server.
  \`gitpi backup\`
      Zieht ein komplettes Backup des Repos auf deinen Laptop.
  \`gitpi install <name>\`
      Zieht ein Package (MODE=bin) vom Pi und installiert es
      lokal auf deinem Rechner (in ~/.local/share/gitpi/bin).

## ⚡ Workflow
  \`gitpi push\`
      Pusht Code, **startet Tests** und **deployt** bei Erfolg.
      Option: \`gitpi push --no-test\` (Überspringt Tests).
  \`gitpi pull\`
      Holt Änderungen vom Server.
  \`gitpi status / log / commit ...\`
      Alle anderen Befehle werden direkt an Git weitergeleitet.
  \`gitpi trigger-ci\`
      Startet die CI/CD Pipeline für den aktuellen Commit erneut manuell
      (ohne git push).

## 📡 Observability (Dashboard)
  \`gitpi ls\` (oder \`services\`)
      Zeigt das **Live-Dashboard** aller Apps & Configs auf dem Pi.
      Status, Restart-Counts und Logs interaktiv abrufbar.
  \`gitpi ci-status\`
      Zeigt das Log des letzten CI-Durchlaufs für das aktuelle Repo.

---

## ⚙️ Deployment Konfiguration (.gitpideploy)
Erstelle eine Datei **.gitpideploy** im Root deines Projekts.

### Modus A: App (NodeJS, Python Services)
Startet deine App automatisch als Systemd Service.
\`\`\`ini
MODE="app"
INSTALL_CMD="npm ci"
START_CMD="node server.js"
PORT=3000
ENV_MEIN_KEY="geheim"
\`\`\`

### Modus B: Sync (Dotfiles, Configs)
Kopiert Dateien an einen Zielort (z.B. Home-Dir oder /etc).
\`\`\`ini
MODE="sync"
# Tilde (~) wird automatisch zum Home des OWNER_USER
TARGET_DIR="~/.config/zsh"
OWNER_USER="pi"
OWNER_GROUP="pi"
POST_DEPLOY_CMD="echo 'Config updated!'"
\`\`\`

### Modus C: Binary / Package Manager
Stellt dein Skript oder CLI-Tool systemweit bereit.
\`\`\`ini
MODE="bin"
BIN_NAME="mein-tool"
\`\`\`

EOF
            )

            # Ausgabe mit Glow (falls installiert) oder pur
            if command -v glow &> /dev/null; then
                echo "$HELP_TEXT" | glow
            else
                echo "$HELP_TEXT"
            fi
            ;;

        *)
            # Fallback: Alle anderen Befehle (status, log, checkout) direkt an Git weitergeben
            git "$@"
            ;;
    esac
}

if [[ "${(%):-%N}" == "$0" ]]; then
    gitpi "$@"
fi
