ProSyncStart_V3.1.py

import sys
import os
import argparse
import ntpath
import json
import uuid
import hashlib
import shutil
import tempfile
import threading
import sqlite3
import time
import subprocess
import re
import posixpath
import stat
from datetime import datetime, timezone
from fnmatch import fnmatch
from pathlib import Path
from PySide6.QtWidgets import (
    QApplication, QMainWindow, QWidget, QVBoxLayout, QListWidget, QListWidgetItem,
    QToolBar, QMenu, QHBoxLayout, QPushButton, QProgressBar, QLabel,
    QDialog, QFormLayout, QLineEdit, QComboBox, QCheckBox, QDialogButtonBox,
    QFileDialog, QMessageBox, QSystemTrayIcon, QStyle, QSizePolicy, QSplitter,
    QAbstractItemView,
    QTextEdit, QInputDialog
)
from PySide6.QtCore import Qt, QThread, Signal, QObject, QTimer, QLockFile, QDir, QCoreApplication
from PySide6.QtGui import QAction, QActionGroup, QIcon, QShortcut, QKeySequence

# ProSync Logger
from logger import log_debug, log_info, log_warning, log_error
from schedule_time import next_daily_run, parse_daily_time, resolve_iana_timezone
from prosync_utils import atomic_write_json, atomic_write_text


def _configure_windows_utf8_streams() -> None:
    """Use UTF-8 console streams on Windows without replacing capture objects."""
    if sys.platform != 'win32':
        return

    for stream_name in ("stdout", "stderr"):
        stream = getattr(sys, stream_name, None)
        reconfigure = getattr(stream, "reconfigure", None)
        if reconfigure is None:
            continue
        try:
            reconfigure(encoding="utf-8")
        except (AttributeError, OSError, ValueError):
            # Test runners and embedded hosts may expose non-standard streams.
            # Keeping the existing object intact is safer than replacing it.
            pass


# Windows UTF-8 Fix
_configure_windows_utf8_streams()


def app_base_dir() -> str:
    """Return the runtime directory for local and frozen builds."""
    if getattr(sys, "frozen", False):
        return os.path.dirname(sys.executable)
    return os.path.dirname(os.path.abspath(__file__))


def load_app_icon() -> QIcon:
    """Lädt das Anwendungs-Icon mit Multi-Pfad-Fallback.

    Unterstützt Quelltext-Ausführung, PyInstaller (_MEIPASS) und
    verschiedene Asset-Pfade (assets/app_icon.ico, assets/icon.ico,
    assets/prosync.ico, assets/icon.png, ProSync.ico, ICO.ico, icon.ico).
    """
    base_dir = Path(getattr(sys, "_MEIPASS", Path(__file__).resolve().parent))
    candidates = [
        base_dir / "assets" / "app_icon.ico",
        base_dir / "assets" / "icon.ico",
        base_dir / "assets" / "prosync.ico",
        base_dir / "assets" / "icon.png",
        base_dir / "ProSync.ico",
        base_dir / "ICO.ico",
        base_dir / "icon.ico",
    ]
    for candidate in candidates:
        if candidate.is_file():
            icon = QIcon(str(candidate))
            if not icon.isNull():
                return icon
    return QIcon()


get_app_icon = load_app_icon


WINDOWS_ENV_VAR_PATTERN = re.compile(r"%([^%]+)%")


def normalize_configured_tool_path(base_dir, configured_path):
    """Expand a configured tool path and anchor relative paths at the app root."""
    raw_path = str(configured_path).strip()
    if not raw_path:
        return None

    expanded_raw_path = WINDOWS_ENV_VAR_PATTERN.sub(
        lambda match: os.environ.get(match.group(1), match.group(0)),
        raw_path,
    )
    expanded_path = Path(os.path.expandvars(expanded_raw_path)).expanduser()
    if not expanded_path.is_absolute():
        expanded_path = Path(base_dir).expanduser() / expanded_path
    return expanded_path


def resolve_profiler_launch_path(base_dir, configured_path=""):
    """Resolve the best available ProFiler entrypoint."""
    base_dir = Path(base_dir).expanduser()
    sibling_root = base_dir.parent / "REL-PUB_ProFiler"

    candidates = []
    if configured_path:
        configured = normalize_configured_tool_path(base_dir, configured_path)
        if configured.is_dir():
            candidates.extend([
                configured / "Profiler_Suite_V15.py",
                configured / "ProFiler.exe",
                configured / "dist" / "ProFiler" / "ProFiler.exe",
                configured / "START.bat",
            ])
        else:
            candidates.append(configured)

    candidates.extend([
        base_dir / "Profiler_Suite_V15.py",
        base_dir / "ProFiler.exe",
        base_dir / "START.bat",
        sibling_root / "Profiler_Suite_V15.py",
        sibling_root / "ProFiler.exe",
        sibling_root / "START.bat",
        sibling_root / "dist" / "ProFiler" / "ProFiler.exe",
    ])

    seen = set()
    for candidate in candidates:
        candidate = Path(candidate).expanduser()
        resolved = str(candidate)
        if resolved in seen:
            continue
        seen.add(resolved)
        if candidate.exists():
            return candidate

    return None


def configure_compact_button_accessibility(button, *, name: str, tooltip: str, description: str | None = None) -> None:
    """Keep compact symbol buttons screenreader-friendly without adding permanent labels."""
    button.setToolTip(tooltip)
    button.setStatusTip(tooltip)
    button.setAccessibleName(name)
    button.setAccessibleDescription(description or tooltip)

# Windows Registry Support (Optional)
try:
    import winreg
    HAS_WINREG = True
except ImportError:
    HAS_WINREG = False

# ---------------- CONSTANTS ----------------
DB_CONNECTION_TIMEOUT = 5.0  # Seconds for SQLite database connection timeout
SEARCH_RESULT_LIMIT = 500    # Maximum number of search results
DEFAULT_AUTOSYNC_INTERVAL = 15
DEFAULT_DAILY_TIME = "09:00"
DEFAULT_DAILY_TIMEZONE = "Europe/Berlin"
MAX_QT_TIMER_INTERVAL_MS = 2_147_483_647
MAX_AUTOSYNC_INTERVAL_MINUTES = MAX_QT_TIMER_INTERVAL_MS // (60 * 1000)
PORTABLE_PROFILE_SCHEMA = "prosync-profile-v1"
PORTABLE_PROFILE_APP_VERSION = "3.2"

# FileSyncWorker Progress Percentages
PROGRESS_CHECKPOINT = 10   # WAL checkpoint phase
PROGRESS_PREPARE = 30      # Target directory creation
PROGRESS_COPY = 50         # File copy phase
PROGRESS_VERIFY = 90       # Verification phase
PROGRESS_DONE = 100        # Completion

# Dialog Dimensions
DIALOG_WIDTH = 500         # Default width for ConnectionDialog
DIALOG_HEIGHT = 600        # Default height for ConnectionDialog (increased for safety info)


def default_config_data():
    """Return a fresh default structure for the local configuration file."""
    return {"app": {}, "connections": []}


def portable_path_label(raw_path, fallback):
    """Derive a non-sensitive display label from a local path."""
    value = str(raw_path or "").strip().rstrip("\\/")
    if not value:
        return fallback

    name = ntpath.basename(value) or os.path.basename(value)
    if name:
        return name

    drive, _tail = ntpath.splitdrive(value)
    if drive:
        return f"{drive}\\"
    return fallback


def sync_report_log_path():
    """Return the local report log path used by ProSync."""
    appdata = str(os.environ.get("APPDATA", "") or "").strip()
    base_dir = Path(appdata) if appdata else Path.home()
    if not base_dir.is_absolute():
        base_dir = Path.home()
    reports_dir = base_dir / "ProSync" / "reports"
    return reports_dir / "sync_log.json"


def save_sync_report(report):
    """Persist a sync-run report as JSON and keep the last 100 entries."""
    try:
        reports_dir = sync_report_log_path().parent
        reports_dir.mkdir(parents=True, exist_ok=True)

        log_file = sync_report_log_path()
        if log_file.exists():
            try:
                with open(log_file, "r", encoding="utf-8") as fh:
                    all_reports = json.load(fh)
                if not isinstance(all_reports, list):
                    all_reports = []
            except (json.JSONDecodeError, UnicodeDecodeError, OSError):
                all_reports = []
        else:
            all_reports = []

        all_reports.append(report)
        all_reports = all_reports[-100:]

        atomic_write_json(str(log_file), all_reports, indent=2, ensure_ascii=False)

        log_info(
            f"Sync-Report gespeichert: {report['files_copied']} kopiert, "
            f"{report['files_deleted']} gelöscht, "
            f"{report['bytes_copied']:,} Bytes, "
            f"{report['duration_seconds']}s"
        )
    except Exception as exc:
        log_warning(f"Konnte Sync-Report nicht speichern: {exc}")

# ---------------- DATABASE SAFETY MANAGER ----------------
class DatabaseSafetyManager:
    """
    V3.1 IMPROVED: Option D - Separate handling for folder vs. file connections.

    For FOLDER connections:
    - Critical DBs are auto-excluded
    - User gets warning
    - Suggestion to create FILE connection for DB

    For FILE connections:
    - Enforce one-way for critical DBs
    - Auto-enable WAL checkpoint
    - Prevent two-way sync
    """

    # Database file extensions
    DB_EXTENSIONS = {
        ".sqlite", ".sqlite3", ".db", ".db3",
        ".mdb", ".accdb"  # MS Access
    }

    # MS Access lock files
    ACCESS_LOCK_EXTENSIONS = {
        ".ldb", ".laccdb"
    }

    # MS Access database files
    ACCESS_DB_EXTENSIONS = {
        ".mdb", ".accdb"
    }

    @classmethod
    def is_database_file(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine Datenbank ist (anhand der Dateiendung).

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine bekannte Datenbank-Endung hat
        """
        ext = Path(filepath).suffix.lower()
        return ext in cls.DB_EXTENSIONS

    @classmethod
    def is_access_database(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine MS Access Datenbank ist (.mdb, .accdb).

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine MS Access Datenbank ist
        """
        ext = Path(filepath).suffix.lower()
        return ext in cls.ACCESS_DB_EXTENSIONS

    @classmethod
    def is_access_lock_file(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine MS Access Lock-Datei ist.

        MS Access erstellt .ldb (Access 2003) oder .laccdb (Access 2007+) Lock-Dateien
        wenn eine Datenbank geöffnet ist. Diese sollten nie kopiert werden.

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine MS Access Lock-Datei ist (.ldb, .laccdb)
        """
        ext = Path(filepath).suffix.lower()
        return ext in cls.ACCESS_LOCK_EXTENSIONS

    @classmethod
    def is_sqlite_database(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine SQLite-Datenbank ist (durch Lesen des Headers).

        Liest die ersten 16 Bytes der Datei und prüft auf die SQLite-Magic-Number
        "SQLite format 3". Dies ist zuverlässiger als nur die Dateiendung zu prüfen.

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine gültige SQLite 3 Datenbank ist
        """
        if not os.path.exists(filepath):
            return False
        try:
            with open(filepath, 'rb') as f:
                header = f.read(16)
                return header.startswith(b'SQLite format 3')
        except (OSError, IOError):
            return False

    @classmethod
    def check_wal_mode(cls, db_path: str) -> bool:
        """
        Prüft ob eine SQLite-Datenbank im WAL-Modus läuft.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei

        Returns:
            True wenn die Datenbank im WAL-Modus ist, sonst False
        """
        if not os.path.exists(db_path):
            return False
        # Bugsweep 26 BUG-A1: conn in finally schliessen — bei Exception (z.B. fetchone()[0] auf None)
        # blieb die Connection sonst offen (Handle-Leak auf Nutzer-DB, blockiert spaeteres Kopieren).
        conn = None
        try:
            conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True, timeout=DB_CONNECTION_TIMEOUT)
            cur = conn.cursor()
            cur.execute("PRAGMA journal_mode;")
            row = cur.fetchone()
            return bool(row) and row[0].upper() == "WAL"
        except (sqlite3.Error, OSError):
            return False
        finally:
            if conn is not None:
                conn.close()

    @classmethod
    def scan_directory_for_databases(cls, directory: str) -> list:
        """
        Scannt ein Verzeichnis nach Datenbankdateien und analysiert sie.

        Args:
            directory: Pfad zum zu scannenden Verzeichnis

        Returns:
            Liste von Dicts mit Datenbank-Metadaten (type, wal_mode, size_mb, etc.)
        """
        databases = []
        if not os.path.exists(directory):
            return databases

        try:
            for root, dirs, files in os.walk(directory):
                # Skip hidden and cache directories
                dirs[:] = [d for d in dirs if not d.startswith('.') and d != '__pycache__']

                for file in files:
                    filepath = os.path.join(root, file)
                    if cls.is_database_file(filepath):
                        db_info = cls._analyze_database_file(filepath, directory)
                        databases.append(db_info)

        except Exception as e:
            log_error(f"Error scanning directory: {e}")

        return databases

    @classmethod
    def _analyze_database_file(cls, filepath: str, base_directory: str) -> dict:
        """Analysiert eine einzelne Datenbankdatei und gibt Metadaten zurück."""
        db_info = {
            "path": filepath,
            "name": os.path.basename(filepath),
            "relative_path": os.path.relpath(filepath, base_directory),
            "type": "unknown",
            "wal_mode": False,
            "has_wal_files": False,
            "size_mb": 0,
            "is_critical": False
        }

        # Analyze SQLite databases
        if cls.is_sqlite_database(filepath):
            db_info["type"] = "sqlite"
            db_info["wal_mode"] = cls.check_wal_mode(filepath)
            db_info["has_wal_files"] = (
                os.path.exists(filepath + "-wal") or
                os.path.exists(filepath + "-shm")
            )
            db_info["is_critical"] = db_info["wal_mode"] or db_info["has_wal_files"]

        # Analyze MS Access databases
        elif cls.is_access_database(filepath):
            db_info["type"] = "ms_access"

        # Get file size
        try:
            db_info["size_mb"] = os.path.getsize(filepath) / (1024 * 1024)
        except OSError:
            pass

        return db_info

    @classmethod
    def apply_safe_settings_folder(cls, conn_config: dict, databases: list) -> tuple:
        """
        V3.1 NEW: Apply safe settings for FOLDER connections.

        Strategy:
        - Exclude critical databases from folder sync
        - Keep two-way for all other files
        - Suggest creating FILE connections for excluded DBs

        Returns: (modified_config, warnings_list, excluded_dbs_list, was_changed)
        """
        warnings = []
        excluded_dbs = []
        was_changed = False

        # Filtere kritische Datenbanken (WAL-Modus oder WAL-Dateien vorhanden)
        critical_dbs = [db for db in databases if db.get("is_critical")]

        if critical_dbs:
            # Initialisiere exclude_patterns falls noch nicht vorhanden
            if "exclude_patterns" not in conn_config:
                conn_config["exclude_patterns"] = []

            # Verwende Set für schnellere Duplikatsprüfung
            current_excludes = set(conn_config["exclude_patterns"])

            for db in critical_dbs:
                db_name = db["name"]

                # Schließe die Datenbankdatei selbst aus
                if db_name not in current_excludes:
                    conn_config["exclude_patterns"].append(db_name)
                    current_excludes.add(db_name)
                    was_changed = True

                # Schließe zugehörige WAL-Dateien aus (SQLite Write-Ahead Log)
                # -wal: Write-Ahead Log Datei
                # -shm: Shared Memory Datei
                # -journal: Rollback Journal (für Non-WAL Mode)
                wal_patterns = [
                    db_name + "-wal",
                    db_name + "-shm",
                    db_name + "-journal"
                ]

                for pattern in wal_patterns:
                    if pattern not in current_excludes:
                        conn_config["exclude_patterns"].append(pattern)
                        current_excludes.add(pattern)
                        was_changed = True

                excluded_dbs.append(db)

            # Add general unsafe patterns
            for pattern in ["*.lock", "*.lck", "*.tmp", ".DS_Store", "Thumbs.db",
                          "__pycache__", "*.pyc"]:
                if pattern not in current_excludes:
                    conn_config["exclude_patterns"].append(pattern)
                    current_excludes.add(pattern)
                    was_changed = True

            if excluded_dbs:
                warnings.append(f"⚠ {len(excluded_dbs)} kritische Datenbank(en) ausgeschlossen")
                warnings.append("💡 Erstelle Datei-Verbindungen für einzelne DB-Sync")

                # Speichere Metadaten über ausgeschlossene DBs für spätere Referenz
                # (z.B. um dem User zu zeigen welche DBs ausgeschlossen wurden)
                conn_config["_auto_excluded_dbs"] = [
                    {
                        "name": db["name"],
                        "size_mb": db["size_mb"],
                        "type": db["type"],
                        "wal_mode": db.get("wal_mode", False),
                        "relative_path": db.get("relative_path", db["name"])
                    }
                    for db in excluded_dbs
                ]

        # MS Access lock files
        access_dbs = [db for db in databases if db.get("type") == "ms_access"]
        if access_dbs:
            lock_patterns = ["*.ldb", "*.laccdb"]
            current_excludes = set(conn_config.get("exclude_patterns", []))

            for pattern in lock_patterns:
                if pattern not in current_excludes:
                    if "exclude_patterns" not in conn_config:
                        conn_config["exclude_patterns"] = []
                    conn_config["exclude_patterns"].append(pattern)
                    was_changed = True

            if was_changed:
                warnings.append("✓ MS Access Lock-Dateien ausgeschlossen (.ldb, .laccdb)")

        # Add safety metadata
        if databases:
            conn_config["_safety_analysis"] = {
                "databases_found": len(databases),
                "critical_databases": len(critical_dbs),
                "excluded_databases": len(excluded_dbs),
                "total_db_size_mb": sum(db.get("size_mb", 0) for db in databases),
                "last_check": datetime.now(timezone.utc).isoformat(),
                "auto_configured": True,
                "version": "3.1",
                "connection_type": "folder"
            }

        return (conn_config, warnings, excluded_dbs, was_changed)

    @classmethod
    def apply_safe_settings_file(cls, conn_config: dict) -> tuple:
        """
        V3.1 NEW: Apply safe settings for FILE connections.

        Strategy:
        - Enforce one-way for critical database files
        - Enable WAL checkpoint for SQLite WAL databases
        - Disable auto-sync by default

        Returns: (modified_config, warnings_list, was_changed)
        """
        warnings = []
        was_changed = False

        source_file = conn_config.get("source_file", "")

        if not source_file or not os.path.exists(source_file):
            return (conn_config, warnings, was_changed)

        filename = os.path.basename(source_file)

        # Check if database file
        if cls.is_database_file(source_file):
            db_info = {
                "name": filename,
                "type": "unknown",
                "wal_mode": False,
                "size_mb": 0,
                "is_critical": False
            }

            # Analyze SQLite
            if cls.is_sqlite_database(source_file):
                db_info["type"] = "sqlite"
                db_info["wal_mode"] = cls.check_wal_mode(source_file)
                db_info["is_critical"] = db_info["wal_mode"]

                # Enable checkpoint for WAL databases
                if db_info["wal_mode"]:
                    if not conn_config.get("checkpoint_before_sync"):
                        conn_config["checkpoint_before_sync"] = True
                        warnings.append("✓ WAL-Checkpoint vor Sync aktiviert")
                        was_changed = True

            elif cls.is_access_database(source_file):
                db_info["type"] = "ms_access"

            # Get size
            try:
                db_info["size_mb"] = os.path.getsize(source_file) / (1024 * 1024)
            except OSError:
                pass

            # Enforce one-way for critical databases
            if db_info["is_critical"] or db_info["type"] in ["sqlite", "ms_access"]:
                if conn_config.get("mode") != "one_way":
                    conn_config["mode"] = "one_way"
                    warnings.append("⚠ Modus auf one_way gesetzt (kritische Datenbank)")
                    was_changed = True

                # Disable auto-sync
                if conn_config.get("autosync", {}).get("enabled", False):
                    conn_config["autosync"]["enabled"] = False
                    conn_config["autosync"]["_reason"] = "Manuelle Sync empfohlen für Datenbanken"
                    warnings.append("⚠ Auto-sync deaktiviert (manueller Sync empfohlen)")
                    was_changed = True

            # Add metadata
            conn_config["_file_analysis"] = {
                "filename": filename,
                "type": db_info["type"],
                "size_mb": db_info["size_mb"],
                "wal_mode": db_info.get("wal_mode", False),
                "is_critical": db_info["is_critical"],
                "checkpoint_enabled": conn_config.get("checkpoint_before_sync", False),
                "last_check": datetime.now(timezone.utc).isoformat(),
                "version": "3.1",
                "connection_type": "file"
            }

        return (conn_config, warnings, was_changed)

    @classmethod
    def checkpoint_sqlite_database(cls, db_path: str) -> bool:
        """
        Führt einen WAL-Checkpoint auf einer SQLite-Datenbank aus.

        WAL (Write-Ahead Logging) speichert Änderungen zunächst in einer separaten
        -wal Datei. Ein Checkpoint merged diese Änderungen zurück in die Hauptdatei.
        Dies ist wichtig vor dem Kopieren, um einen konsistenten Zustand zu garantieren.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei

        Returns:
            True wenn erfolgreich, False bei Fehler
        """
        if not os.path.exists(db_path):
            return False

        # Bugsweep 26 BUG-A2: conn in finally schliessen — bei Checkpoint-Fehler (DB gelockt/Rechte)
        # blieb sie sonst offen und das Handle blockierte das anschliessende Kopieren der DB.
        conn = None
        try:
            # Verbinde zur DB mit 30s Timeout (falls gerade gelockt)
            conn = sqlite3.connect(db_path, timeout=30.0)
            checkpoint_result = conn.execute("PRAGMA wal_checkpoint(FULL);").fetchone()
            if checkpoint_result and checkpoint_result[0]:
                log_warning(
                    "⚠ WAL checkpoint incomplete: "
                    f"{checkpoint_result[0]} busy frame(s)"
                )
                return False
            conn.commit()
            log_info(f"✓ WAL checkpoint successful: {os.path.basename(db_path)}")
            return True
        except Exception as e:
            log_warning(f"⚠ WAL checkpoint failed: {e}")
            return False
        finally:
            if conn is not None:
                conn.close()

# ---------------- CONNECTION TYPES (V3.1 NEW) ----------------
class ConnectionType:
    """V3.1 NEW: Connection type constants."""
    FOLDER = "folder"  # Sync entire folder
    FILE = "file"      # Sync single file only
    SFTP = "sftp"      # Sync local folder to SSH/SFTP target


REMOTE_UNSAFE_DATABASE_WARNING = (
    "SFTP-Ziele sind nicht datenbanksicher: WAL-/Lock-Dateien und Remote-"
    "Atomizität können nicht wie bei lokalen Datei-Verbindungen garantiert "
    "werden. Nutze für SQLite/Access lieber eine lokale Datei-Verbindung."
)


def normalize_remote_path(path):
    """Normalize a configured SFTP path without applying local filesystem rules."""
    raw = str(path or "").strip().replace("\\", "/")
    if not raw:
        return ""
    normalized = posixpath.normpath(raw)
    if raw.startswith("/") and not normalized.startswith("/"):
        normalized = "/" + normalized
    return normalized.rstrip("/") or "/"


def join_remote_path(root, rel_path=""):
    """Join remote POSIX path fragments for SFTP operations."""
    root = normalize_remote_path(root)
    rel = str(rel_path or "").replace("\\", "/").strip("/")
    if not rel:
        return root
    return posixpath.join(root, rel)


def sftp_connection_display(conn):
    """Return a secret-free SFTP endpoint label."""
    user = str(conn.get("remote_username", "") or "").strip()
    host = str(conn.get("remote_host", "") or "").strip()
    try:
        port = int(conn.get("remote_port") or 22)
    except (TypeError, ValueError):
        port = 22
    remote = normalize_remote_path(conn.get("target", ""))
    user_prefix = f"{user}@" if user else ""
    port_suffix = f":{port}" if port != 22 else ""
    if not host:
        return remote or "?"
    return f"{user_prefix}{host}{port_suffix}:{remote}"


def validate_sftp_connection(conn):
    """Validate SFTP target configuration and reject unsafe sync modes."""
    source = str(conn.get("source", "") or "").strip()
    target = normalize_remote_path(conn.get("target", ""))
    host = str(conn.get("remote_host", "") or "").strip()
    if not source:
        raise ValueError("SFTP-Quelle fehlt")
    if not os.path.isdir(source):
        raise ValueError(f"SFTP-Quelle ist kein Ordner: {source}")
    if not host:
        raise ValueError("SFTP-Host fehlt")
    if not target:
        raise ValueError("SFTP-Zielpfad fehlt")
    mode = conn.get("mode", "update")
    if mode not in ("mirror", "update", "one_way"):
        raise ValueError("SFTP unterstützt nur mirror, update oder one_way")
    if conn.get("checkpoint_before_sync"):
        raise ValueError(REMOTE_UNSAFE_DATABASE_WARNING)
    return True

# ---------------- AUTOSTART MANAGER ----------------
class AutostartManager:
    """
    Verwaltet den plattformübergreifenden Autostart für ProSync.

    Unter Windows wird der Run-Schlüssel in HKEY_CURRENT_USER genutzt.
    Unter Linux / POSIX wird die XDG Autostart-Spezifikation genutzt
    (~/.config/autostart/prosync.desktop).
    """

    APP_NAME = "ProSync"

    @staticmethod
    def _linux_autostart_path():
        """Gibt den Pfad zur XDG Autostart .desktop-Datei zurück."""
        config_home = os.environ.get("XDG_CONFIG_HOME")
        if not config_home or not config_home.strip():
            config_home = os.path.expanduser("~/.config")
        return os.path.join(config_home, "autostart", f"{AutostartManager.APP_NAME.lower()}.desktop")

    @staticmethod
    def _get_exec_command():
        """Ermittelt den Ausführungsbefehl für den Autostart."""
        if getattr(sys, "frozen", False):
            return f'"{sys.executable}"'
        script_path = os.path.abspath(__file__)
        return f'"{sys.executable}" "{script_path}"'

    @staticmethod
    def set_autostart(enable=True):
        """
        Aktiviert oder deaktiviert den Autostart für ProSync.

        Unter Windows via winreg Registry, unter Linux via XDG Desktop-Entry.

        Args:
            enable: True = Autostart aktivieren, False = deaktivieren

        Returns:
            True bei Erfolg, False bei Fehler
        """
        if sys.platform.startswith("win"):
            if not HAS_WINREG:
                return False
            try:
                key = winreg.OpenKey(
                    winreg.HKEY_CURRENT_USER,
                    r"Software\Microsoft\Windows\CurrentVersion\Run",
                    0,
                    winreg.KEY_SET_VALUE,
                )
                if enable:
                    exe_path = AutostartManager._get_exec_command()
                    winreg.SetValueEx(key, AutostartManager.APP_NAME, 0, winreg.REG_SZ, exe_path)
                else:
                    try:
                        winreg.DeleteValue(key, AutostartManager.APP_NAME)
                    except FileNotFoundError:
                        pass
                winreg.CloseKey(key)
                return True
            except Exception as e:
                log_error(f"Registry Fehler: {e}")
                return False
        elif sys.platform.startswith("linux"):
            try:
                desktop_file = AutostartManager._linux_autostart_path()
                if enable:
                    os.makedirs(os.path.dirname(desktop_file), exist_ok=True)
                    content = (
                        "[Desktop Entry]\n"
                        "Type=Application\n"
                        "Version=1.0\n"
                        f"Name={AutostartManager.APP_NAME}\n"
                        "GenericName=File and Database Synchronization\n"
                        "Comment=Lokale Datei- und Datenbank-Synchronisation\n"
                        f"Exec={AutostartManager._get_exec_command()}\n"
                        "Icon=prosync\n"
                        "Terminal=false\n"
                        "Categories=Utility;FileTools;Qt;\n"
                        f"StartupWMClass={AutostartManager.APP_NAME}\n"
                        "X-GNOME-Autostart-enabled=true\n"
                    )
                    atomic_write_text(desktop_file, content, encoding="utf-8")
                else:
                    if os.path.exists(desktop_file):
                        try:
                            os.remove(desktop_file)
                        except FileNotFoundError:
                            pass
                return True
            except Exception as e:
                log_error(f"Linux Autostart Fehler: {e}")
                return False
        return False

    @staticmethod
    def is_autostart_enabled():
        """
        Prüft ob ProSync im Autostart eingetragen ist (Windows Registry oder Linux XDG).

        Returns:
            True wenn Autostart aktiv, False sonst
        """
        if sys.platform.startswith("win"):
            if not HAS_WINREG:
                return False
            try:
                key = winreg.OpenKey(
                    winreg.HKEY_CURRENT_USER,
                    r"Software\Microsoft\Windows\CurrentVersion\Run",
                    0,
                    winreg.KEY_READ,
                )
                winreg.QueryValueEx(key, AutostartManager.APP_NAME)
                winreg.CloseKey(key)
                return True
            except (FileNotFoundError, OSError):
                return False
        elif sys.platform.startswith("linux"):
            desktop_file = AutostartManager._linux_autostart_path()
            if not os.path.exists(desktop_file):
                return False
            try:
                with open(desktop_file, "r", encoding="utf-8", errors="ignore") as f:
                    content = f.read()
                if "X-GNOME-Autostart-enabled=false" in content:
                    return False
                return True
            except Exception:
                return False
        return False

# ---------------- CONFIG ----------------
class ConfigLoadError(RuntimeError):
    """Raised when an existing configuration cannot be loaded safely."""


class ConfigManager:
    """
    Verwaltet die ProSync-Konfigurationsdatei (JSON).

    Die Konfiguration enthält App-Einstellungen und alle Sync-Verbindungen.
    Automatisches Laden/Speichern bei Änderungen.
    """

    def __init__(self, path):
        """
        Initialisiert den ConfigManager und lädt die Konfiguration.

        Args:
            path: Pfad zur Konfigurationsdatei (ProSync_config.json)
        """
        self.path = path
        self.data = default_config_data()
        self.load()

    def load(self):
        """
        Lädt die Konfiguration aus der JSON-Datei.

        Fehlende Dateien werden neu erstellt. Beschädigte oder schemawidrige
        Dateien bleiben unverändert, erhalten eine Sicherheitskopie und
        blockieren den Start, damit sie nicht still überschrieben werden.
        """
        if os.path.exists(self.path):
            try:
                with open(self.path, "r", encoding="utf-8") as f:
                    loaded = json.load(f)
            except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e:
                self._raise_invalid_config(str(e), cause=e)

            if not isinstance(loaded, dict):
                self._raise_invalid_config(
                    "JSON root must be an object, "
                    f"not {type(loaded).__name__}"
                )
            if "app" in loaded and not isinstance(loaded["app"], dict):
                self._raise_invalid_config("'app' must be a JSON object")
            if "connections" in loaded and not isinstance(loaded["connections"], list):
                self._raise_invalid_config("'connections' must be a JSON array")
            if any(not isinstance(conn, dict) for conn in loaded.get("connections", [])):
                self._raise_invalid_config("every connection must be a JSON object")

            self.data = loaded
            self.data.setdefault("app", {})
            self.data.setdefault("connections", [])
        else:
            self.save()

    def _raise_invalid_config(self, reason, cause=None):
        """Preserve an invalid config and raise instead of overwriting it."""
        original = Path(self.path)
        backup = Path(f"{self.path}.invalid.bak")
        counter = 2
        while backup.exists():
            backup = Path(f"{self.path}.invalid-{counter}.bak")
            counter += 1

        try:
            shutil.copy2(original, backup)
        except OSError as backup_error:
            message = (
                f"Konfiguration ist ungültig und blieb unverändert: {original}. "
                f"Sicherheitskopie fehlgeschlagen: {backup_error}"
            )
            log_error(message)
            raise ConfigLoadError(message) from (cause or backup_error)

        message = (
            f"Konfiguration ist ungültig und wurde nicht überschrieben: {original}. "
            f"Sicherheitskopie: {backup}. Ursache: {reason}"
        )
        log_error(message)
        raise ConfigLoadError(message) from cause

    def save(self):
        """
        Speichert die Konfiguration in die JSON-Datei.

        Erstellt das Verzeichnis falls es nicht existiert.
        """
        atomic_write_json(self.path, self.data, indent=2, ensure_ascii=False)

    def list_connections(self):
        """
        Gibt alle gespeicherten Sync-Verbindungen zurück.

        Returns:
            Liste von Connection-Dicts
        """
        return self.data.get("connections", [])

    def add_or_update_connection(self, conn):
        """
        Fügt eine neue Verbindung hinzu oder aktualisiert eine bestehende.

        Die Verbindung wird anhand der ID identifiziert. Speichert automatisch.

        Args:
            conn: Connection-Dict mit mindestens {"id": "..."}
        """
        conns = self.data.get("connections", [])
        found = False
        for i, c in enumerate(conns):
            if c.get("id") == conn.get("id"):
                conns[i] = conn
                found = True
                break
        if not found:
            conns.append(conn)
        self.data["connections"] = conns
        self.save()

    def remove_connection(self, conn_id):
        """
        Entfernt eine Verbindung anhand der ID.

        Args:
            conn_id: ID der zu entfernenden Verbindung
        """
        self.data["connections"] = [c for c in self.data.get("connections", [])
                                    if c.get("id") != conn_id]
        self.save()

    @staticmethod
    def _portable_path_hints(conn):
        """Build redacted path hints for a portable profile export."""
        conn_type = conn.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            return {
                "source_label": portable_path_label(conn.get("source_file", ""), "Quelldatei"),
                "target_label": portable_path_label(conn.get("target_file", ""), "Zieldatei"),
            }
        if conn_type == ConnectionType.SFTP:
            return {
                "source_label": portable_path_label(conn.get("source", ""), "Quellordner"),
                "target_label": portable_path_label(conn.get("target", ""), "SFTP-Ziel"),
            }

        hints = {
            "source_label": portable_path_label(conn.get("source", ""), "Quellordner"),
            "target_label": portable_path_label(conn.get("target", ""), "Zielordner"),
        }
        if conn.get("indexing"):
            hints["db_label"] = portable_path_label(conn.get("db_path", ""), "Indexdatenbank")
        return hints

    @staticmethod
    def _portable_safety_summary(conn):
        """Reduce local safety metadata to a redacted summary."""
        if "_safety_analysis" in conn and isinstance(conn["_safety_analysis"], dict):
            safety = conn["_safety_analysis"]
            return {
                "kind": "folder",
                "databases_found": int(safety.get("databases_found", 0)),
                "critical_databases": int(safety.get("critical_databases", 0)),
                "excluded_databases": int(safety.get("excluded_databases", 0)),
                "total_db_size_mb": round(float(safety.get("total_db_size_mb", 0)), 2),
            }

        if "_file_analysis" in conn and isinstance(conn["_file_analysis"], dict):
            analysis = conn["_file_analysis"]
            return {
                "kind": "file",
                "type": analysis.get("type", "unknown"),
                "wal_mode": bool(analysis.get("wal_mode", False)),
                "is_critical": bool(analysis.get("is_critical", False)),
                "size_mb": round(float(analysis.get("size_mb", 0)), 2),
            }
        return None

    @staticmethod
    def _portable_report_snapshot():
        """Read the local sync-report log and expose only report-safe metadata."""
        log_file = sync_report_log_path()
        if not log_file.exists():
            return {"count": 0, "latest": None}

        try:
            with open(log_file, "r", encoding="utf-8") as fh:
                reports = json.load(fh)
        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
            return {"count": 0, "latest": None}

        if not isinstance(reports, list):
            return {"count": 0, "latest": None}

        latest = reports[-1] if reports else None
        if not isinstance(latest, dict):
            latest = None

        latest_summary = None
        if latest:
            latest_summary = {
                "connection": latest.get("connection", ""),
                "connection_id": latest.get("connection_id", ""),
                "mode": latest.get("mode", ""),
                "started_at": latest.get("started_at", ""),
                "duration_seconds": latest.get("duration_seconds", 0),
                "files_copied": latest.get("files_copied", 0),
                "files_deleted": latest.get("files_deleted", 0),
                "files_skipped": latest.get("files_skipped", 0),
                "bytes_copied": latest.get("bytes_copied", 0),
                "total_actions": latest.get("total_actions", 0),
            }

        return {"count": len(reports), "latest": latest_summary}

    @staticmethod
    def _portable_autosync(conn):
        """Normalize autosync settings for export without leaking local runtime state."""
        autosync = conn.get("autosync", {})
        if not isinstance(autosync, dict):
            autosync = {}
        interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
        try:
            interval = int(interval)
        except (TypeError, ValueError):
            interval = DEFAULT_AUTOSYNC_INTERVAL

        mode = autosync.get("mode", "interval")
        result = {
            "enabled": bool(autosync.get("enabled", False)),
        }
        if mode == "daily":
            result["mode"] = "daily"
            result["daily_time"] = str(autosync.get("daily_time", DEFAULT_DAILY_TIME))
            result["timezone"] = str(autosync.get("timezone", DEFAULT_DAILY_TIMEZONE))
            if autosync.get("weekdays") is not None:
                wd = autosync["weekdays"]
                if isinstance(wd, (list, set, tuple)):
                    def _wd_key(v):
                        return (0, v) if isinstance(v, int) and not isinstance(v, bool) else (1, str(v))
                    result["weekdays"] = sorted(list(wd), key=_wd_key)
                else:
                    result["weekdays"] = str(wd)
        else:
            result["mode"] = "interval"
            result["interval_minutes"] = max(1, interval)
        return result

    @staticmethod
    def _portable_patterns(conn):
        """Normalize exclude patterns for export to avoid character-wise string splitting."""
        raw_patterns = conn.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            raw_patterns = [raw_patterns]
        elif not isinstance(raw_patterns, (list, tuple)):
            raw_patterns = []
        return [str(pattern) for pattern in raw_patterns if str(pattern).strip()]

    def _build_portable_connection(self, conn):
        """Create one redacted portable connection entry."""
        conn_type = conn.get("type", ConnectionType.FOLDER)
        default_mode = "one_way" if conn_type == ConnectionType.FILE else "mirror"
        if conn_type == ConnectionType.SFTP:
            default_mode = "update"
        portable = {
            "id": conn.get("id", ""),
            "name": conn.get("name", ""),
            "type": conn_type,
            "mode": conn.get("mode", default_mode),
            "exclude_patterns": self._portable_patterns(conn),
            "autosync": self._portable_autosync(conn),
            "path_hints": self._portable_path_hints(conn),
        }

        if conn_type == ConnectionType.FILE:
            portable["checkpoint_before_sync"] = bool(conn.get("checkpoint_before_sync", False))
        elif conn_type == ConnectionType.SFTP:
            portable["conflict_policy"] = "source"
            portable["indexing"] = False
            portable["remote_warning"] = REMOTE_UNSAFE_DATABASE_WARNING
        else:
            portable["conflict_policy"] = conn.get("conflict_policy", "source")
            portable["indexing"] = bool(conn.get("indexing", True))

        safety_summary = self._portable_safety_summary(conn)
        if safety_summary:
            portable["safety_summary"] = safety_summary

        return portable

    def export_portable_profile(self, export_path):
        """Write the redacted exchange format `prosync-profile-v1.json`."""
        payload = {
            "schema": PORTABLE_PROFILE_SCHEMA,
            "exported_at": datetime.now(timezone.utc).isoformat(),
            "exported_from": {
                "app": "ProSync",
                "version": PORTABLE_PROFILE_APP_VERSION,
            },
            "app": {
                "notifications_enabled": bool(
                    self.data.get("app", {}).get("notifications_enabled", True)
                )
            },
            "connections": [
                self._build_portable_connection(conn)
                for conn in self.data.get("connections", [])
                if isinstance(conn, dict)
            ],
            "reports": self._portable_report_snapshot(),
        }

        atomic_write_json(export_path, payload, indent=2, ensure_ascii=False)
        return payload

    def _portable_to_local_connection(self, portable_conn, existing_ids):
        """Convert one portable profile entry back to a local editable connection."""
        if not isinstance(portable_conn, dict):
            raise ValueError("Ungültiger Verbindungs-Eintrag im Austauschformat")

        conn_type = portable_conn.get("type", ConnectionType.FOLDER)
        if conn_type not in (ConnectionType.FOLDER, ConnectionType.FILE, ConnectionType.SFTP):
            conn_type = ConnectionType.FOLDER

        original_id = str(portable_conn.get("id") or uuid.uuid4())
        conn_id = original_id
        renamed = False
        if conn_id in existing_ids:
            conn_id = f"import-{uuid.uuid4().hex[:8]}"
            renamed = True
        existing_ids.add(conn_id)

        autosync = portable_conn.get("autosync", {})
        if not isinstance(autosync, dict):
            autosync = {}
        interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
        try:
            interval = int(interval)
        except (TypeError, ValueError):
            interval = DEFAULT_AUTOSYNC_INTERVAL

        imported_autosync = {
            "enabled": False,
            "_reason": "Pfadzuordnung nach Import erforderlich",
        }
        daily_schedule_reset = False
        if autosync.get("mode") == "daily":
            try:
                daily_time = parse_daily_time(
                    autosync.get("daily_time", DEFAULT_DAILY_TIME)
                ).strftime("%H:%M")
                timezone_name = resolve_iana_timezone(
                    autosync.get("timezone", DEFAULT_DAILY_TIMEZONE)
                ).key
            except (TypeError, ValueError):
                daily_time = DEFAULT_DAILY_TIME
                timezone_name = DEFAULT_DAILY_TIMEZONE
                daily_schedule_reset = True
                imported_autosync["_reason"] = (
                    "Pfadzuordnung nach Import erforderlich; ungültiger täglicher "
                    "Zeitplan wurde auf 09:00 Europe/Berlin zurückgesetzt"
                )
            imported_autosync["mode"] = "daily"
            imported_autosync["daily_time"] = daily_time
            imported_autosync["timezone"] = timezone_name
        else:
            imported_autosync["mode"] = "interval"
            imported_autosync["interval_minutes"] = max(1, interval)

        raw_patterns = portable_conn.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            raw_patterns = [raw_patterns]
        elif not isinstance(raw_patterns, (list, tuple)):
            raw_patterns = []

        default_mode = "one_way" if conn_type == ConnectionType.FILE else "mirror"
        if conn_type == ConnectionType.SFTP:
            default_mode = "update"

        imported_conn = {
            "id": conn_id,
            "name": str(portable_conn.get("name") or "Importierte Aufgabe").strip() or "Importierte Aufgabe",
            "type": conn_type,
            "mode": portable_conn.get("mode", default_mode),
            "exclude_patterns": [
                str(pattern)
                for pattern in raw_patterns
                if str(pattern).strip()
            ],
            "autosync": imported_autosync,
            "_portable_import": {
                "schema": PORTABLE_PROFILE_SCHEMA,
                "imported_at": datetime.now(timezone.utc).isoformat(),
                "original_id": original_id,
                "requires_mapping": True,
                "path_hints": portable_conn.get("path_hints", {}),
                "daily_schedule_reset": daily_schedule_reset,
            },
        }

        safety_summary = portable_conn.get("safety_summary")
        if isinstance(safety_summary, dict):
            imported_conn["_portable_import"]["safety_summary"] = safety_summary

        if conn_type == ConnectionType.FILE:
            imported_conn["source_file"] = ""
            imported_conn["target_file"] = ""
            imported_conn["checkpoint_before_sync"] = bool(
                portable_conn.get("checkpoint_before_sync", False)
            )
        elif conn_type == ConnectionType.SFTP:
            imported_conn["source"] = ""
            imported_conn["target"] = ""
            imported_conn["remote_host"] = ""
            imported_conn["remote_port"] = 22
            imported_conn["remote_username"] = ""
            imported_conn["remote_key_file"] = ""
            imported_conn["indexing"] = False
            imported_conn["conflict_policy"] = "source"
            imported_conn["remote_warning"] = REMOTE_UNSAFE_DATABASE_WARNING
        else:
            imported_conn["source"] = ""
            imported_conn["target"] = ""
            imported_conn["db_path"] = ""
            imported_conn["indexing"] = bool(portable_conn.get("indexing", True))
            imported_conn["conflict_policy"] = portable_conn.get("conflict_policy", "source")

        return imported_conn, renamed

    def import_portable_profile(self, import_path):
        """Import a redacted portable profile without restoring private local paths."""
        # Bugsweep 26 BUG-A4: open() im try (fehlendes open -> ValueError statt rohem OSError).
        try:
            with open(import_path, "r", encoding="utf-8") as fh:
                payload = json.load(fh)
        except (json.JSONDecodeError, OSError, UnicodeDecodeError):
            raise ValueError("Austauschdatei enthält kein gültiges JSON")

        if not isinstance(payload, dict):
            raise ValueError("Austauschdatei muss ein JSON-Objekt enthalten")
        if payload.get("schema") != PORTABLE_PROFILE_SCHEMA:
            raise ValueError("Unbekanntes Austauschformat")

        connections = payload.get("connections", [])
        if not isinstance(connections, list):
            raise ValueError("Austauschdatei enthält keine gültige Verbindungsliste")

        app_settings = payload.get("app", {})
        if not isinstance(self.data.get("app"), dict):
            self.data["app"] = {}
        if isinstance(app_settings, dict) and isinstance(
            app_settings.get("notifications_enabled"), bool
        ):
            self.data["app"]["notifications_enabled"] = app_settings["notifications_enabled"]

        existing_ids = {
            conn.get("id")
            for conn in self.data.get("connections", [])
            if isinstance(conn, dict) and conn.get("id")
        }
        imported = []
        renamed = 0
        normalized_daily_schedules = 0
        for portable_conn in connections:
            local_conn, did_rename = self._portable_to_local_connection(
                portable_conn,
                existing_ids,
            )
            if did_rename:
                renamed += 1
            if local_conn["_portable_import"].get("daily_schedule_reset"):
                normalized_daily_schedules += 1
            imported.append(local_conn)

        self.data["connections"] = self.data.get("connections", []) + imported
        self.save()
        return {
            "imported": len(imported),
            "renamed": renamed,
            "normalized_daily_schedules": normalized_daily_schedules,
        }


class BatchSyncQueue:
    """
    Verwaltet einen deduplizierten Batch-Lauf aus mehreren Verbindungen.

    Die Queue arbeitet Verbindungen in der Auswahl-Reihenfolge ab und
    verhindert doppelte IDs innerhalb desselben Batch-Laufs.
    """

    def __init__(self):
        self.reset()

    def reset(self):
        """Setzt den kompletten Batch-Status zurück."""
        self.pending = []
        self.current = None
        self.completed = []
        self.total = 0

    def start(self, connections):
        """
        Initialisiert einen neuen Batch-Lauf.

        Args:
            connections: Ausgewählte Connection-Dicts

        Returns:
            Deduplizierte Liste der geplanten Verbindungen
        """
        self.reset()
        seen_ids = set()
        for conn in connections:
            conn_id = conn.get("id")
            if not conn_id or conn_id in seen_ids:
                continue
            seen_ids.add(conn_id)
            self.pending.append(conn)
        self.total = len(self.pending)
        return list(self.pending)

    @property
    def active(self):
        """True, solange noch Batch-Arbeit läuft oder aussteht."""
        return self.current is not None or bool(self.pending)

    @property
    def completed_count(self):
        """Anzahl bereits erfolgreich abgearbeiteter Verbindungen."""
        return len(self.completed)

    @property
    def remaining_count(self):
        """Anzahl noch nicht gestarteter Verbindungen."""
        return len(self.pending)

    def next_connection(self):
        """
        Gibt die nächste Verbindung für den Batch-Lauf zurück.

        Returns:
            Connection-Dict oder None wenn nichts mehr aussteht
        """
        if self.current is not None:
            return self.current
        if not self.pending:
            return None
        self.current = self.pending.pop(0)
        return self.current

    def mark_current_finished(self):
        """
        Markiert die aktuelle Batch-Verbindung als erfolgreich abgeschlossen.

        Returns:
            Die abgeschlossene Verbindung oder None
        """
        if self.current is None:
            return None
        finished = self.current
        self.completed.append(finished)
        self.current = None
        return finished

    def cancel_pending(self):
        """
        Verwirft alle noch wartenden Batch-Verbindungen.

        Returns:
            Liste der verworfenen Verbindungen
        """
        skipped = list(self.pending)
        self.pending.clear()
        return skipped

# ---------------- DB ----------------
DDL = """
CREATE TABLE IF NOT EXISTS files(id INTEGER PRIMARY KEY, content_hash TEXT UNIQUE, size INTEGER, mime TEXT, first_seen TEXT);
CREATE TABLE IF NOT EXISTS versions(id INTEGER PRIMARY KEY, file_id INTEGER, name TEXT, path TEXT, mtime TEXT, ctime TEXT, version_index INTEGER, source_side TEXT);
CREATE TABLE IF NOT EXISTS tags(id INTEGER PRIMARY KEY, file_id INTEGER, tag TEXT);
CREATE TABLE IF NOT EXISTS events(id INTEGER PRIMARY KEY, file_id INTEGER, event_type TEXT, details TEXT, ts TEXT);
"""

class ConnectionDB:
    """
    Indexierungs-Datenbank für ProSync-Verbindungen.

    Speichert Dateiversionen, Hashes, Tags und Events für Suchfunktion.
    V3 IMPROVED: WAL checkpoint on close, 30s timeout, busy_timeout.
    """

    def __init__(self, db_path):
        """
        Initialisiert die Indexierungs-Datenbank.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei
        """
        self.db_path = db_path
        os.makedirs(os.path.dirname(db_path) or ".", exist_ok=True)
        # V3 FIX: Added timeout and better isolation
        self.conn = sqlite3.connect(
            db_path,
            check_same_thread=False,
            timeout=30.0  # V3: Prevent immediate lock errors
        )
        self.conn.execute("PRAGMA busy_timeout=30000;")  # V3: 30 second busy timeout
        self.conn.executescript(DDL)
        # Bugsweep 26 BUG-db (KRITISCH): check_same_thread=False erlaubt Cross-Thread-Zugriff
        # (Worker-Thread loggt via _db_log, Main-Thread kann parallel lesen) -> ohne Serialisierung
        # drohen "recursive use of cursors"/Korruption. RLock (reentrant, da log_version->get_file_id).
        self._lock = threading.RLock()

    def close(self):
        """V3 IMPROVED: WAL checkpoint before close."""
        with self._lock:
            if self.conn:
                try:
                    # V3 FIX: Checkpoint WAL to merge changes
                    self.conn.execute("PRAGMA wal_checkpoint(FULL);")
                    self.conn.commit()
                except Exception as e:
                    log_warning(f"Warning: WAL checkpoint failed: {e}")
                finally:
                    self.conn.close()
                    self.conn = None  # Bugsweep 27: Guard damit doppelter close()-Aufruf sauber abbricht

    def get_file_id(self, content_hash, size):
        """
        Gibt die ID einer Datei anhand ihres Hash zurück oder erstellt einen neuen Eintrag.

        Args:
            content_hash: SHA256-Hash der Datei
            size: Größe der Datei in Bytes

        Returns:
            File-ID (Integer)
        """
        with self._lock:
            cur = self.conn.cursor()
            cur.execute("SELECT id FROM files WHERE content_hash=?", (content_hash,))
            row = cur.fetchone()
            if row: return row[0]
            ts = datetime.now(timezone.utc).isoformat()
            cur.execute("INSERT INTO files(content_hash,size,first_seen) VALUES (?,?,?)",
                       (content_hash, size, ts))
            self.conn.commit()
            return cur.lastrowid

    def log_version(self, name, path, mtime, size, content_hash, side):
        """
        Loggt eine neue Dateiversionen in die Datenbank.

        Args:
            name: Dateiname
            path: Pfad zur Datei
            mtime: Modification Time (ISO-Format)
            size: Größe in Bytes
            content_hash: SHA256-Hash
            side: "source" oder "target"

        Returns:
            File-ID (Integer)
        """
        with self._lock:
            fid = self.get_file_id(content_hash, size)
            cur = self.conn.cursor()
            cur.execute("SELECT id, version_index FROM versions WHERE path=? AND mtime=?",
                       (path, mtime))
            if cur.fetchone():
                return fid

            cur.execute("SELECT MAX(version_index) FROM versions WHERE file_id=?", (fid,))
            res = cur.fetchone()
            idx = (res[0] + 1) if res and res[0] else 1

            ctime = datetime.now(timezone.utc).isoformat()
            self.conn.execute(
                "INSERT INTO versions(file_id,name,path,mtime,ctime,version_index,source_side) VALUES (?,?,?,?,?,?,?)",
                (fid, name, path, mtime, ctime, idx, side)
            )
            self.conn.commit()
            return fid

    def add_tag(self, fid, tag):
        """
        Fügt einen Tag zu einer Datei hinzu.

        Args:
            fid: File-ID
            tag: Tag-String
        """
        with self._lock:
            self.conn.execute("INSERT OR IGNORE INTO tags(file_id,tag) VALUES (?,?)", (fid, tag))
            self.conn.commit()

# ---------------- SYNC LOGIC ----------------
def sha256_file(path: str, chunk_size: int = 1024*1024) -> str:
    """
    Berechnet SHA256-Hash einer Datei mit chunk-basiertem Lesen.

    Args:
        path: Pfad zur Datei
        chunk_size: Größe der gelesenen Chunks in Bytes (Standard: 1MB)

    Returns:
        SHA256-Hash als Hexadezimal-String, oder "ERROR" bei Fehler
    """
    h = hashlib.sha256()
    try:
        with open(path, "rb") as f:
            while chunk := f.read(chunk_size):
                h.update(chunk)
    except (OSError, PermissionError) as e:
        log_error(f"Hash error for {path}: {e}")
        return "ERROR"
    return h.hexdigest()

class SyncWalker:
    """V3 IMPROVED: Better pattern matching for excludes."""
    def scan(self, root_path, exclude_patterns=None, *, strict=False):
        """
        Scannt ein Verzeichnis und erstellt einen File-Tree.

        V3 NEW: Unterstützt glob-style Exclude-Patterns.

        Args:
            root_path: Wurzelverzeichnis zum Scannen
            exclude_patterns: Liste von Glob-Patterns (z.B. ["*.sqlite-wal", "__pycache__"])

        Returns:
            Dict mit relativem Pfad als Key und File-Metadaten als Value
            Format: {rel_path: {"mtime": float, "size": int, "abs_path": str}}
        """
        if isinstance(exclude_patterns, (str, bytes)):
            exclude_patterns = [exclude_patterns]
        elif not isinstance(exclude_patterns, (list, tuple, set)):
            exclude_patterns = []
        else:
            exclude_patterns = [str(p) for p in exclude_patterns if str(p).strip()]

        tree = {}
        if not os.path.exists(root_path):
            if strict:
                raise FileNotFoundError(f"Quellordner nicht gefunden: {root_path}")
            return tree
        if not os.path.isdir(root_path):
            if strict:
                raise NotADirectoryError(f"Quelle ist kein lesbarer Ordner: {root_path}")
            return tree

        def handle_walk_error(error):
            if strict:
                raise OSError(f"Ordner kann nicht gelesen werden: {root_path}: {error}") from error
            log_warning(f"Scan warning for {root_path}: {error}")

        for root, dirs, files in os.walk(root_path, onerror=handle_walk_error):
            # V3 FIX: Filter directories
            dirs[:] = [d for d in dirs if not self._should_exclude(d, exclude_patterns)]

            for f in files:
                # V3 FIX: Check exclude patterns
                if self._should_exclude(f, exclude_patterns):
                    continue

                abs_p = os.path.join(root, f)
                rel_p = os.path.relpath(abs_p, root_path)

                try:
                    stat = os.stat(abs_p)
                    tree[rel_p] = {
                        "mtime": stat.st_mtime,
                        "size": stat.st_size,
                        "abs_path": abs_p
                    }
                except OSError as error:
                    if strict:
                        raise OSError(f"Quelldatei kann nicht gelesen werden: {abs_p}: {error}") from error
                    # File may have been deleted during scan
                    pass

        return tree

    def _should_exclude(self, name: str, patterns: list) -> bool:
        """
        Prüft ob eine Datei/Ordner ausgeschlossen werden soll.

        V3 NEW: Verwendet fnmatch für Glob-Pattern-Matching.

        Args:
            name: Datei- oder Ordnername (nicht vollständiger Pfad)
            patterns: Liste von Glob-Patterns (z.B. ["*.wal", "temp_*"])

        Returns:
            True wenn der Name auf ein Pattern matcht, sonst False
        """
        if isinstance(patterns, (str, bytes)):
            patterns = [patterns]
        elif not isinstance(patterns, (list, tuple, set)):
            patterns = []

        for pattern in patterns:
            if fnmatch(name, str(pattern)):
                return True
        return False


def _atomic_copy2(src, dst):
    """Kopiert mit Copy2-Metadaten über eine eigene Stage im Zielverzeichnis.

    Quelle und bestehendes Ziel bleiben bei Kopierfehlern erhalten. Ein reguläres,
    einfach verlinktes Readonly-Ziel darf ersetzt werden; bei einem Fehler wird
    sein Modus wiederhergestellt, sofern es noch dieselbe Datei ist. Externe
    Dateiaustausche und gleichzeitig veränderte Quellen sind keine Snapshots.
    """
    def checked_destination():
        source_stat = os.stat(src)
        try:
            destination_stat = os.stat(dst)
        except FileNotFoundError:
            return None
        if os.path.samestat(source_stat, destination_stat):
            raise shutil.SameFileError(f"Quelle und Ziel sind identisch: {src!r}")
        return destination_stat

    def cleanup_warning(message, error):
        # Die ursprüngliche Exception darf auch bei einem Loggerfehler bestehen bleiben.
        try:
            log_warning(f"{message}: {error}")
        except Exception:
            pass

    checked_destination()
    tmp = None
    fd = None
    original_target = None
    try:
        fd, tmp = tempfile.mkstemp(prefix=".prosync-", suffix=".tmp",
                                   dir=os.path.dirname(os.path.abspath(dst)))
        os.close(fd)
        fd = None
        shutil.copy2(src, tmp)
        target_stat = checked_destination()
        if os.name == "nt" and target_stat is not None and not target_stat.st_mode & stat.S_IWRITE:
            target_link_stat = os.lstat(dst)
            reparse = getattr(target_link_stat, "st_file_attributes", 0) & stat.FILE_ATTRIBUTE_REPARSE_POINT
            if (not stat.S_ISREG(target_link_stat.st_mode) or reparse
                    or target_stat.st_nlink != 1
                    or not os.path.samestat(target_stat, target_link_stat)):
                raise PermissionError("Schreibgeschütztes Ziel besitzt einen Dateialias")
            original_target = target_stat
            os.chmod(dst, target_stat.st_mode | stat.S_IWRITE)
        os.replace(tmp, dst)
    except BaseException:
        if fd is not None:
            try:
                os.close(fd)
            except OSError as error:
                cleanup_warning("Stage-Handle konnte nicht geschlossen werden", error)
        if original_target is not None:
            try:
                current = os.lstat(dst)
                if os.path.samestat(original_target, current):
                    os.chmod(dst, original_target.st_mode)
            except OSError as error:
                cleanup_warning("Zielmodus konnte nicht wiederhergestellt werden", error)
        if tmp is not None:
            try:
                # Copy2 kann Readonly übertragen: ausschließlich die eigene Stage ändern.
                try:
                    os.remove(tmp)
                except PermissionError:
                    os.chmod(tmp, stat.S_IWRITE | stat.S_IREAD)
                    os.remove(tmp)
            except FileNotFoundError:
                pass
            except OSError as error:
                cleanup_warning("Eigene Stage konnte nicht entfernt werden", error)
        raise


class FileSyncWorker(QThread):
    """
    V3.1 NEW: Worker for single-file synchronization.

    Simplified logic:
    - Only syncs one file
    - Supports one-way mode
    - WAL checkpoint before sync
    - No directory scanning needed
    """

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)
    sync_report = Signal(dict)

    def __init__(self, cfg):
        super().__init__()
        self.cfg = cfg
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False

    def run(self):
        try:
            _start_time = time.monotonic()
            _started_at = datetime.now(timezone.utc).isoformat()
            source_file = self.cfg.get("source_file", "")
            target_file = self.cfg.get("target_file", "")

            if not source_file or not target_file:
                self.error.emit("Quell- oder Ziel-Datei nicht angegeben")
                return

            # Check if source exists
            if not os.path.exists(source_file):
                self.error.emit(f"Quelldatei nicht gefunden: {source_file}")
                return

            if os.path.isdir(source_file):
                self.error.emit(f"Quelldatei ist ein Verzeichnis, keine Datei: {source_file}")
                return

            if target_file.endswith(("/", "\\")) or (os.path.exists(target_file) and os.path.isdir(target_file)):
                self.error.emit(f"Zieldatei darf kein Verzeichnis sein: {target_file}")
                return

            if os.path.normcase(os.path.abspath(source_file)) == os.path.normcase(os.path.abspath(target_file)):
                self.error.emit(f"Quell- und Zieldatei dürfen nicht identisch sein: {source_file}")
                return

            filename = os.path.basename(source_file)
            self.status.emit(f"[{self.cfg.get('name')}] Bereite Sync vor...")

            while self.is_paused and not self.is_killed:
                time.sleep(0.05)

            if self.is_killed:
                return

            # Step 1: WAL Checkpoint if needed
            if self.cfg.get("checkpoint_before_sync"):
                self.progress.emit(PROGRESS_CHECKPOINT, "checkpoint")
                self.status.emit(f"Checkpoint: {filename}")

                if DatabaseSafetyManager.checkpoint_sqlite_database(source_file):
                    self.status.emit(f"✓ Checkpoint erfolgreich: {filename}")
                else:
                    self.error.emit(
                        f"WAL-Checkpoint fehlgeschlagen; Datenbankkopie abgebrochen: {filename}"
                    )
                    return

            while self.is_paused and not self.is_killed:
                time.sleep(0.05)

            if self.is_killed:
                return

            # Step 2: Create target directory
            self.progress.emit(PROGRESS_PREPARE, "prepare")
            target_dir = os.path.dirname(target_file)
            if target_dir:
                os.makedirs(target_dir, exist_ok=True)

            while self.is_paused and not self.is_killed:
                time.sleep(0.05)

            if self.is_killed:
                return

            # Step 3: Copy file
            self.progress.emit(PROGRESS_COPY, "copy")
            self.status.emit(f"Kopiere: {filename}")

            try:
                _atomic_copy2(source_file, target_file)
                self.status.emit(f"✓ Datei kopiert: {filename}")
            except (OSError, IOError, PermissionError, shutil.Error) as e:
                self.error.emit(f"Fehler beim Kopieren: {e}")
                return

            while self.is_paused and not self.is_killed:
                time.sleep(0.05)

            if self.is_killed:
                return

            # Step 4: Verify
            self.progress.emit(PROGRESS_VERIFY, "verify")

            if not os.path.exists(target_file):
                self.error.emit(f"Zieldatei nach dem Kopieren nicht gefunden: {target_file}")
                return

            src_size = os.path.getsize(source_file)
            tgt_size = os.path.getsize(target_file)

            if src_size != tgt_size:
                self.error.emit(f"Größen stimmen nicht überein! ({src_size} vs {tgt_size})")
                return

            self.status.emit(f"✓ Verifizierung erfolgreich ({src_size:,} Bytes)")

            if self.cfg.get("verify_checksum"):
                src_hash = sha256_file(source_file)
                tgt_hash = sha256_file(target_file)
                if src_hash != tgt_hash:
                    self.error.emit(
                        f"Prüfsummen stimmen nicht überein! ({src_hash[:8]} vs {tgt_hash[:8]})"
                    )
                    return
                self.status.emit("✓ Prüfsummen-Verifizierung (SHA-256) erfolgreich")

            if self.is_killed:
                return

            # Done!
            _duration = time.monotonic() - _start_time
            report = {
                "connection": self.cfg.get("name", ""),
                "connection_id": self.conn_id,
                "mode": self.cfg.get("mode", "one_way"),
                "started_at": _started_at,
                "duration_seconds": round(_duration, 2),
                "files_copied": 1,
                "files_deleted": 0,
                "files_skipped": 0,
                "bytes_copied": tgt_size,
                "total_actions": 1,
            }
            self.sync_report.emit(report)
            self.progress.emit(PROGRESS_DONE, "done")
            self.status.emit(f"✓ Sync abgeschlossen: {filename}")
            self.finished.emit()

        except Exception as e:
            self.error.emit(f"Fehler: {str(e)}")

    def kill(self):
        """Stoppt den Worker sofort (bei nächster Prüfung)."""
        self.is_killed = True

    def pause(self):
        """Pausiert den Worker."""
        self.is_paused = True

    def resume(self):
        """Setzt den Worker fort."""
        self.is_paused = False

# ---------------- FOLDER SYNC WORKER (V3.1 IMPROVED) ----------------

class FolderSyncWorker(QThread):
    """
    V3.1 IMPROVED: Worker for folder synchronization.

    Now respects exclude_patterns for databases.
    """

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)
    sync_report = Signal(dict)  # emits report dict after each run

    def __init__(self, cfg, db=None):
        super().__init__()
        self.cfg = cfg
        self.db = db  # Optional database for indexing
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False
        self._last_pct = -1

    def run(self):
        try:
            mode = self.cfg.get("mode", "two_way")
            conflict_policy = self.cfg.get("conflict_policy", "source")
            src_root = self.cfg["source"]
            tgt_root = self.cfg["target"]

            if mode != "index_only":
                src_resolved = os.path.realpath(os.path.abspath(src_root))
                tgt_resolved = os.path.realpath(os.path.abspath(tgt_root))
                try:
                    common_root = os.path.commonpath([src_resolved, tgt_resolved])
                except ValueError:
                    common_root = None  # Different Windows drives cannot overlap.
                if common_root in (src_resolved, tgt_resolved):
                    raise ValueError(
                        "Quell- und Zielordner müssen getrennt sein und dürfen "
                        "nicht ineinander liegen"
                    )

            # V3.1: Get exclude patterns
            exclude_patterns = self.cfg.get("exclude_patterns", [])
            if isinstance(exclude_patterns, (str, bytes)):
                exclude_patterns = [exclude_patterns]
            elif not isinstance(exclude_patterns, (list, tuple, set)):
                exclude_patterns = []

            # 1. Scan
            self.status.emit(f"[{self.cfg['name']}] Scanne Quelle...")
            src_tree = SyncWalker().scan(src_root, exclude_patterns, strict=True)

            tgt_tree = {}
            if mode != "index_only":
                self.status.emit(f"[{self.cfg['name']}] Scanne Ziel...")
                tgt_tree = SyncWalker().scan(tgt_root, exclude_patterns)

            # 2. Compare
            self.status.emit(f"[{self.cfg['name']}] Vergleiche...")
            all_files = set(src_tree.keys()) | set(tgt_tree.keys())
            actions = []

            for f in all_files:
                in_src = f in src_tree
                in_tgt = f in tgt_tree

                if in_src and not in_tgt:
                    if mode in ["mirror", "update", "one_way", "two_way"]:
                        actions.append(("COPY_L2R", f))
                    elif mode == "index_only":
                        actions.append(("INDEX_SRC", f))

                elif in_tgt and not in_src:
                    if mode == "mirror":
                        actions.append(("DELETE_R", f))
                    elif mode == "two_way":
                        actions.append(("COPY_R2L", f))

                elif in_src and in_tgt:
                    s_meta = src_tree[f]
                    t_meta = tgt_tree[f]

                    if s_meta["size"] != t_meta["size"] or abs(s_meta["mtime"] - t_meta["mtime"]) > 1:
                        if mode in ("mirror", "update", "one_way"):
                            actions.append(("COPY_L2R", f))
                        elif mode == "two_way":
                            if conflict_policy == "source":
                                actions.append(("COPY_L2R", f))
                            elif conflict_policy == "target":
                                actions.append(("COPY_R2L", f))
                            else:  # newest
                                if s_meta["mtime"] > t_meta["mtime"]:
                                    actions.append(("COPY_L2R", f))
                                else:
                                    actions.append(("COPY_R2L", f))
                    else:
                        if mode == "index_only":
                            actions.append(("INDEX_SRC", f))
                        else:
                            actions.append(("INDEX_BOTH", f))

            # 3. Execute
            total = len(actions)
            _start_time = time.monotonic()
            _started_at = datetime.now(timezone.utc).isoformat()
            _stats = {"copied": 0, "deleted": 0, "skipped": 0, "bytes_copied": 0}
            for i, (act, rel_path) in enumerate(actions):
                if self.is_killed:
                    break

                while self.is_paused:
                    if self.is_killed:
                        break
                    time.sleep(0.5)

                pct = int((i / max(1, total)) * 100)
                if pct != self._last_pct:
                    self.progress.emit(pct, "sync")
                    self._last_pct = pct

                s_abs = os.path.join(src_root, rel_path)
                t_abs = os.path.join(tgt_root, rel_path) if tgt_root else ""

                try:
                    if act == "COPY_L2R":
                        self.status.emit(f"Kopiere -> {rel_path}")
                        os.makedirs(os.path.dirname(t_abs), exist_ok=True)
                        _atomic_copy2(s_abs, t_abs)
                        _stats["copied"] += 1
                        _stats["bytes_copied"] += os.path.getsize(t_abs) if os.path.exists(t_abs) else 0
                        if self.db:
                            self._db_log(self.db, s_abs, "source")
                            self._db_log(self.db, t_abs, "target")

                    elif act == "COPY_R2L":
                        self.status.emit(f"Kopiere <- {rel_path}")
                        os.makedirs(os.path.dirname(s_abs), exist_ok=True)
                        _atomic_copy2(t_abs, s_abs)
                        _stats["copied"] += 1
                        _stats["bytes_copied"] += os.path.getsize(s_abs) if os.path.exists(s_abs) else 0
                        if self.db:
                            self._db_log(self.db, s_abs, "source")

                    elif act == "DELETE_R":
                        self.status.emit(f"Lösche Ziel: {rel_path}")
                        if os.path.exists(t_abs):
                            try:
                                os.chmod(t_abs, stat.S_IWRITE | stat.S_IREAD)
                            except OSError:
                                pass
                            os.remove(t_abs)
                            _stats["deleted"] += 1

                    elif act in ("INDEX_SRC", "INDEX_BOTH"):
                        _stats["skipped"] += 1
                        if act == "INDEX_SRC":
                            if self.db and os.path.exists(s_abs):
                                self._db_log(self.db, s_abs, "source")
                        else:
                            if self.db:
                                if os.path.exists(s_abs):
                                    self._db_log(self.db, s_abs, "source")
                                if t_abs and os.path.exists(t_abs):
                                    self._db_log(self.db, t_abs, "target")

                except Exception as e:
                    message = f"Aktion {act} fehlgeschlagen für {rel_path}: {e}"
                    log_error(message)
                    raise RuntimeError(message) from e

            _duration = time.monotonic() - _start_time
            report = {
                "connection": self.cfg.get("name", ""),
                "connection_id": self.conn_id,
                "mode": mode,
                "started_at": _started_at,
                "duration_seconds": round(_duration, 2),
                "files_copied": _stats["copied"],
                "files_deleted": _stats["deleted"],
                "files_skipped": _stats["skipped"],
                "bytes_copied": _stats["bytes_copied"],
                "total_actions": total,
            }
            if self.is_killed:
                return
            self.sync_report.emit(report)
            self.progress.emit(100, "done")
            self.finished.emit()

        except Exception as e:
            self.error.emit(str(e))
        finally:
            # Bugsweep 27: WAL-Checkpoint explizit auslösen statt GC zu vertrauen
            if self.db:
                self.db.close()

    def _db_log(self, db, path, side):
        """Log file version to database (if indexing enabled)."""
        if not db:
            return
        try:
            stat = os.stat(path)
            h = sha256_file(path)
            mtime_iso = datetime.fromtimestamp(stat.st_mtime).isoformat()
            fid = db.log_version(os.path.basename(path), path, mtime_iso,
                               stat.st_size, h, side)

            if self.cfg.get("structure", {}).get("auto_tags"):
                root = self.cfg.get(side)
                if root and path.startswith(root):
                    rel = os.path.relpath(path, root)
                    dirs = os.path.dirname(rel).split(os.sep)
                    for d in dirs:
                        if d and d != ".":
                            db.add_tag(fid, d)
        except (OSError, sqlite3.Error, ValueError) as e:
            log_error(f"DB logging error for {path}: {e}")

    def kill(self):
        """Stoppt den Worker sofort (bei nächster Prüfung)."""
        self.is_killed = True

    def pause(self):
        """Pausiert den Worker."""
        self.is_paused = True

    def resume(self):
        """Setzt den Worker fort."""
        self.is_paused = False


def sftp_known_hosts_path():
    """Return the local known_hosts store used to pin SFTP/SSH host keys."""
    appdata = str(os.environ.get("APPDATA", "") or "").strip()
    base_dir = Path(appdata) if appdata else Path.home()
    if not base_dir.is_absolute():
        base_dir = Path.home()
    return base_dir / "ProSync" / "known_hosts"


def _ssh_host_key_name(hostname, port):
    """Mirror paramiko's own host-key lookup key (bracket/port suffix for non-default ports)."""
    return hostname if port == 22 else f"[{hostname}]:{port}"


def create_sftp_transport(cfg):
    """Create an SSH/SFTP transport from a ProSync SFTP configuration."""
    try:
        import paramiko
    except ImportError as exc:
        raise RuntimeError(
            "SFTP/SSH benötigt das optionale Paket 'paramiko'. "
            "Installiere es außerhalb von OneDrive z.B. mit: python -m pip install paramiko"
        ) from exc

    validate_sftp_connection(cfg)
    hostname = str(cfg.get("remote_host", "")).strip()
    port = int(cfg.get("remote_port") or 22)
    timeout = float(cfg.get("remote_timeout") or 20)

    known_hosts_path = sftp_known_hosts_path()
    known_hosts_path.parent.mkdir(parents=True, exist_ok=True)

    client = paramiko.SSHClient()
    client.load_system_host_keys()
    if known_hosts_path.exists():
        client.load_host_keys(str(known_hosts_path))

    # Sicherer Default: unbekannte oder abweichende Host-Keys werden abgelehnt
    # (paramiko.RejectPolicy). Bewusst KEIN WarningPolicy/AutoAddPolicy mehr als
    # Bypass -- beide wuerden einen Host-Key-Wechsel (z.B. Man-in-the-Middle)
    # stillschweigend durchlassen statt die Verbindung abzubrechen.
    client.set_missing_host_key_policy(paramiko.RejectPolicy())

    host_key_name = _ssh_host_key_name(hostname, port)
    if cfg.get("allow_unknown_host_key") and client.get_host_keys().lookup(host_key_name) is None:
        # Trust-on-First-Use: Key nur beim allerersten Kontakt mit diesem Host
        # abholen und dauerhaft pinnen. Ist der Host danach bekannt, greift
        # wieder RejectPolicy -- ein spaeter abweichender Key wird weiterhin
        # abgelehnt statt nur protokolliert.
        probe = paramiko.Transport((hostname, port))
        try:
            probe.start_client(timeout=timeout)
            server_key = probe.get_remote_server_key()
        finally:
            probe.close()
        client.get_host_keys().add(host_key_name, server_key.get_name(), server_key)
        client.save_host_keys(str(known_hosts_path))

    connect_kwargs = {
        "hostname": hostname,
        "port": port,
        "username": str(cfg.get("remote_username", "") or "").strip() or None,
        "timeout": timeout,
        "look_for_keys": True,
        "allow_agent": True,
    }
    key_file = str(cfg.get("remote_key_file", "") or "").strip()
    if key_file:
        connect_kwargs["key_filename"] = key_file

    client.connect(**connect_kwargs)
    return client, client.open_sftp()


class SftpTargetSyncWorker(QThread):
    """Synchronize a local folder to an SSH/SFTP target."""

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)
    sync_report = Signal(dict)

    def __init__(self, cfg, transport_factory=None):
        super().__init__()
        self.cfg = cfg
        self.transport_factory = transport_factory or create_sftp_transport
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False
        self._last_pct = -1

    @staticmethod
    def _is_dir_attr(attr):
        return stat.S_ISDIR(getattr(attr, "st_mode", 0))

    def _ensure_remote_dir(self, sftp, remote_dir):
        remote_dir = normalize_remote_path(remote_dir)
        if remote_dir in ("", "/"):
            return
        parts = [part for part in remote_dir.strip("/").split("/") if part]
        current = "/" if remote_dir.startswith("/") else ""
        for part in parts:
            current = posixpath.join(current, part) if current else part
            try:
                sftp.stat(current)
            except (FileNotFoundError, OSError):
                try:
                    sftp.mkdir(current)
                except OSError:
                    sftp.stat(current)

    def _scan_remote_tree(self, sftp, remote_root, exclude_patterns=None):
        remote_root = normalize_remote_path(remote_root)
        tree = {}
        walker = SyncWalker()
        patterns = exclude_patterns or []

        def walk(current_remote, rel_prefix=""):
            try:
                entries = sftp.listdir_attr(current_remote)
            except (FileNotFoundError, OSError):
                return
            for entry in entries:
                name = entry.filename
                if name in (".", ".."):
                    continue
                if walker._should_exclude(name, patterns):
                    continue
                rel = f"{rel_prefix}/{name}" if rel_prefix else name
                full = join_remote_path(current_remote, name)
                if self._is_dir_attr(entry):
                    walk(full, rel)
                else:
                    tree[rel] = {
                        "mtime": float(getattr(entry, "st_mtime", 0)),
                        "size": int(getattr(entry, "st_size", 0)),
                        "remote_path": full,
                    }

        walk(remote_root)
        return tree

    def _upload_file(self, sftp, local_path, remote_path):
        remote_dir = posixpath.dirname(remote_path)
        self._ensure_remote_dir(sftp, remote_dir)
        tmp_remote = f"{remote_path}.prosync_tmp"
        try:
            sftp.put(local_path, tmp_remote)
            posix_rename = getattr(sftp, "posix_rename", None)
            if callable(posix_rename):
                posix_rename(tmp_remote, remote_path)
            else:
                self._fallback_remote_replace(sftp, tmp_remote, remote_path)
            mtime = os.path.getmtime(local_path)
            try:
                sftp.utime(remote_path, (mtime, mtime))
            except (AttributeError, OSError):
                pass
        except BaseException:
            try:
                sftp.remove(tmp_remote)
            except Exception:
                pass
            raise

    @staticmethod
    def _fallback_remote_replace(sftp, tmp_remote, remote_path):
        """Replace a remote file without relying on rename-over-existing semantics."""
        destination_exists = False
        try:
            sftp.stat(remote_path)
            destination_exists = True
        except FileNotFoundError:
            pass
        except OSError as error:
            if getattr(error, "errno", None) != 2:
                raise

        backup_remote = None
        if destination_exists:
            backup_remote = f"{remote_path}.prosync_backup_{uuid.uuid4().hex}"
            sftp.rename(remote_path, backup_remote)

        try:
            sftp.rename(tmp_remote, remote_path)
        except BaseException as promote_error:
            if backup_remote is not None:
                try:
                    sftp.rename(backup_remote, remote_path)
                except Exception as restore_error:
                    raise RuntimeError(
                        f"SFTP-Ersetzung und Wiederherstellung fehlgeschlagen: {restore_error}"
                    ) from promote_error
            raise

        if backup_remote is not None:
            try:
                sftp.remove(backup_remote)
            except OSError as cleanup_error:
                log_warning(f"SFTP backup cleanup failed: {cleanup_error}")

    def _build_actions(self, src_tree, remote_tree, mode):
        src_norm = {k.replace("\\", "/"): v for k, v in src_tree.items()}
        remote_norm = {k.replace("\\", "/"): v for k, v in remote_tree.items()}
        all_files = set(src_norm.keys()) | set(remote_norm.keys())
        actions = []
        for rel_path in sorted(all_files):
            in_src = rel_path in src_norm
            in_remote = rel_path in remote_norm
            if in_src and not in_remote:
                actions.append(("UPLOAD", rel_path))
            elif in_src and in_remote:
                src_meta = src_norm[rel_path]
                remote_meta = remote_norm[rel_path]
                if (
                    src_meta["size"] != remote_meta["size"]
                    or abs(src_meta["mtime"] - remote_meta["mtime"]) > 1
                ):
                    actions.append(("UPLOAD", rel_path))
            elif in_remote and not in_src and mode == "mirror":
                actions.append(("DELETE_REMOTE", rel_path))
        return actions

    def run(self):
        ssh_client = None
        sftp = None
        try:
            validate_sftp_connection(self.cfg)
            mode = self.cfg.get("mode", "update")
            source_root = self.cfg["source"]
            remote_root = normalize_remote_path(self.cfg["target"])
            exclude_patterns = self.cfg.get("exclude_patterns", [])
            if isinstance(exclude_patterns, (str, bytes)):
                exclude_patterns = [exclude_patterns]

            self.status.emit(f"[{self.cfg.get('name')}] Verbinde mit SFTP-Ziel...")
            ssh_client, sftp = self.transport_factory(self.cfg)

            self.status.emit(f"[{self.cfg.get('name')}] Scanne Quelle...")
            raw_src_tree = SyncWalker().scan(source_root, exclude_patterns, strict=True)
            src_tree = {
                rel_p.replace("\\", "/"): meta
                for rel_p, meta in raw_src_tree.items()
            }

            self.status.emit(f"[{self.cfg.get('name')}] Scanne SFTP-Ziel...")
            self._ensure_remote_dir(sftp, remote_root)
            remote_tree = self._scan_remote_tree(sftp, remote_root, exclude_patterns)

            actions = self._build_actions(src_tree, remote_tree, mode)
            total = len(actions)
            started_at = datetime.now(timezone.utc).isoformat()
            start_time = time.monotonic()
            stats = {"copied": 0, "deleted": 0, "skipped": 0, "bytes_copied": 0}

            if total == 0:
                self.status.emit("✓ SFTP-Ziel ist bereits aktuell")

            for index, (action, rel_path) in enumerate(actions):
                if self.is_killed:
                    return
                while self.is_paused:
                    if self.is_killed:
                        return
                    time.sleep(0.5)

                pct = int((index / max(1, total)) * 100)
                if pct != self._last_pct:
                    self.progress.emit(pct, "sftp")
                    self._last_pct = pct

                if action == "UPLOAD":
                    local_path = src_tree[rel_path]["abs_path"]
                    remote_path = join_remote_path(remote_root, rel_path)
                    self.status.emit(f"SFTP Upload -> {rel_path}")
                    self._upload_file(sftp, local_path, remote_path)
                    stats["copied"] += 1
                    stats["bytes_copied"] += os.path.getsize(local_path)
                elif action == "DELETE_REMOTE":
                    remote_path = remote_tree[rel_path]["remote_path"]
                    self.status.emit(f"SFTP löscht Ziel: {rel_path}")
                    sftp.remove(remote_path)
                    stats["deleted"] += 1

            duration = time.monotonic() - start_time
            report = {
                "connection": self.cfg.get("name", ""),
                "connection_id": self.conn_id,
                "mode": mode,
                "target_type": ConnectionType.SFTP,
                "started_at": started_at,
                "duration_seconds": round(duration, 2),
                "files_copied": stats["copied"],
                "files_deleted": stats["deleted"],
                "files_skipped": stats["skipped"],
                "bytes_copied": stats["bytes_copied"],
                "total_actions": total,
            }
            self.sync_report.emit(report)
            self.progress.emit(100, "done")
            self.status.emit(f"✓ SFTP-Sync abgeschlossen: {total} Aktion(en)")
            self.finished.emit()
        except Exception as exc:
            self.error.emit(str(exc))
        finally:
            if sftp is not None:
                try:
                    sftp.close()
                except Exception:
                    pass
            if ssh_client is not None:
                try:
                    ssh_client.close()
                except Exception:
                    pass

    def kill(self):
        """Stop the worker at the next safe point."""
        self.is_killed = True

    def pause(self):
        """Pause the worker."""
        self.is_paused = True

    def resume(self):
        """Resume the worker."""
        self.is_paused = False
# ---------------- SCHEDULER ----------------
class ConnectionScheduler(QObject):
    """
    Verwaltet zeitgesteuerte automatische Synchronisationen.

    Nutzt QTimer um für jede Verbindung mit aktiviertem autosync
    periodisch das trigger_sync Signal zu emittieren. Die MainWindow
    führt dann die eigentliche Synchronisation durch.
    """

    trigger_sync = Signal(dict)

    def __init__(self, cfg, now_provider=None):
        super().__init__()
        self.cfg = cfg
        self.timers = {}
        self._now_provider = now_provider or (lambda tz: datetime.now(tz))

    def update_all(self):
        """
        Aktualisiert die Timer für alle Verbindungen.

        Stoppt Timer für gelöschte Verbindungen und ruft update_connection()
        für jede aktuell gespeicherte Verbindung auf.
        """
        current_ids = {conn["id"] for conn in self.cfg.list_connections()}
        for stale_id in list(self.timers.keys()):
            if stale_id not in current_ids:
                self.timers[stale_id].stop()
                del self.timers[stale_id]
        for conn in self.cfg.list_connections():
            self.update_connection(conn)

    def update_connection(self, conn):
        """
        Erstellt/aktualisiert den Timer für eine Verbindung.

        Entfernt alte Timer falls vorhanden. Erstellt neuen QTimer wenn
        autosync aktiviert ist mit dem konfigurierten Intervall.

        Args:
            conn: Connection-Dict mit autosync-Konfiguration
        """
        cid = conn["id"]
        if cid in self.timers:
            self.timers[cid].stop()
            del self.timers[cid]

        autosync = conn.get("autosync", {})
        if not isinstance(autosync, dict):
            autosync = {}
        if autosync.get("enabled", False):
            if autosync.get("mode", "interval") == "daily":
                self._start_daily_timer(conn, autosync)
                return
            raw_interval = autosync.get("interval_minutes", 15)
            try:
                interval_min = int(raw_interval)
            except (TypeError, ValueError):
                interval_min = 15
            timer = QTimer(self)
            timer.setSingleShot(False)
            timer.timeout.connect(lambda c=conn: self.trigger_sync.emit(c))
            interval_min = min(
                max(1, interval_min),
                MAX_AUTOSYNC_INTERVAL_MINUTES,
            )
            timer.start(interval_min * 60 * 1000)
            self.timers[cid] = timer

    def _start_daily_timer(self, conn, autosync):
        """Arm one daily timer from an explicit local time and IANA timezone."""
        try:
            run_at = parse_daily_time(autosync.get("daily_time", DEFAULT_DAILY_TIME))
            tz = resolve_iana_timezone(
                autosync.get("timezone", DEFAULT_DAILY_TIMEZONE)
            )
            now = self._now_provider(tz)
            weekdays = autosync.get("weekdays")
            next_run = next_daily_run(now, run_at, tz, weekdays=weekdays)
        except (TypeError, ValueError, RuntimeError) as exc:
            log_warning(
                f"Täglicher Zeitplan für {conn.get('name', conn.get('id', '?'))} "
                f"ist ungültig: {exc}"
            )
            return

        delay_ms = max(
            1,
            min(
                int((next_run.astimezone(timezone.utc) - now.astimezone(timezone.utc)).total_seconds() * 1000),
                MAX_QT_TIMER_INTERVAL_MS,
            ),
        )
        timer = QTimer(self)
        timer.setSingleShot(True)
        timer.timeout.connect(lambda cid=conn["id"]: self._on_daily_timer(cid))
        timer.start(delay_ms)
        self.timers[conn["id"]] = timer

    def _connection_by_id(self, conn_id):
        """Return the current saved connection to avoid rearming stale data."""
        for conn in self.cfg.list_connections():
            if conn.get("id") == conn_id:
                return conn
        return None

    def _on_daily_timer(self, conn_id):
        """Trigger one daily sync and immediately arm the next local occurrence."""
        conn = self._connection_by_id(conn_id)
        if conn is None:
            return
        autosync = conn.get("autosync", {})
        if not isinstance(autosync, dict) or not autosync.get("enabled", False):
            return
        if autosync.get("mode", "interval") != "daily":
            return
        self.trigger_sync.emit(conn)
        refreshed = self._connection_by_id(conn_id)
        if refreshed is not None:
            self.update_connection(refreshed)

    def rearm_daily(self):
        """Recalculate daily timers after an application resume."""
        for conn in self.cfg.list_connections():
            autosync = conn.get("autosync", {})
            if (
                isinstance(autosync, dict)
                and autosync.get("enabled", False)
                and autosync.get("mode", "interval") == "daily"
            ):
                self.update_connection(conn)

    def on_application_state_changed(self, state):
        """Rearm daily schedules when Qt reports that the app is active again."""
        if state == Qt.ApplicationState.ApplicationActive:
            self.rearm_daily()

    def stop_all(self):
        """
        Stoppt alle laufenden Timer und löscht die Timer-Liste.

        Wird beim Beenden der Anwendung aufgerufen.
        """
        for t in self.timers.values():
            t.stop()
        self.timers.clear()

# ---------------- GUI ----------------
class ConnectionDialog(QDialog):
    """V3 IMPROVED: Integrated database safety scanner."""

    def __init__(self, parent=None, existing=None):
        super().__init__(parent)
        self.setWindowTitle("Synchronisierung einrichten")
        self.existing = existing
        self.resize(DIALOG_WIDTH, DIALOG_HEIGHT)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        self.name = QLineEdit(existing["name"] if existing else "")
        self.name.setAccessibleName("Name der Aufgabe")
        self.name.setPlaceholderText("z.B. Dokumente-Synchronisation")
        self.name.setToolTip("Eindeutiger Name für diese Synchronisationsaufgabe")

        self.source = QLineEdit(existing["source"] if existing else "")
        self.source.setAccessibleName("Quellordner")
        self.source.setPlaceholderText("Pfad zum Quellordner")
        self.source.setToolTip("Quellverzeichnis für die Synchronisation")

        self.target = QLineEdit(existing["target"] if existing else "")
        self.target.setAccessibleName("Zielordner")
        self.target.setPlaceholderText("Pfad zum Zielordner")
        self.target.setToolTip("Zielverzeichnis für die Synchronisation")

        self.mode = QComboBox()
        self.mode.setAccessibleName("Synchronisationsmodus")
        self.mode.setToolTip("Wähle den Synchronisationsmodus (mirror, update, two_way, index_only, one_way)")
        self.mode.addItems(["mirror", "update", "two_way", "index_only", "one_way"])  # V3: Added one_way
        if existing:
            self.mode.setCurrentText(existing.get("mode", "mirror"))
        self.mode.currentTextChanged.connect(self.on_mode_change)

        self.conflict = QComboBox()
        self.conflict.setAccessibleName("Konfliktbehandlung")
        self.conflict.setToolTip("Strategie bei beidseitigen Dateiänderungen (source, target, newest)")
        self.conflict.addItems(["source", "target", "newest"])  # V3: Changed order (source first)
        if existing:
            self.conflict.setCurrentText(existing.get("conflict_policy", "source"))

        btn_src = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_src,
            name="Quellordner auswählen",
            tooltip="Quellordner auswählen",
            description="Öffnet den Ordnerdialog für den Quellordner.",
        )
        btn_src.clicked.connect(lambda: self.pick(self.source))
        btn_tgt = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_tgt,
            name="Zielordner auswählen",
            tooltip="Zielordner auswählen",
            description="Öffnet den Ordnerdialog für den Zielordner.",
        )
        btn_tgt.clicked.connect(lambda: self.pick(self.target))

        h_src = QHBoxLayout()
        h_src.addWidget(self.source)
        h_src.addWidget(btn_src)

        h_tgt = QHBoxLayout()
        h_tgt.addWidget(self.target)
        h_tgt.addWidget(btn_tgt)

        form.addRow("Name der Aufgabe", self.name)
        form.addRow("Quelle", h_src)
        form.addRow("Ziel", h_tgt)
        form.addRow("Sync-Modus", self.mode)
        form.addRow("Bei Konflikt", self.conflict)

        # Indexierung optional machen
        self.chk_indexing = QCheckBox("Datenbank-Indexierung & Historie aktivieren")
        self.chk_indexing.setAccessibleName("Datenbank-Indexierung & Historie aktivieren")
        self.chk_indexing.setToolTip("Erstellt eine SQLite-Datenbank für Volltextsuche und Dateiversionierung.")
        if existing:
            self.chk_indexing.setChecked(existing.get("indexing", True))
        else:
            self.chk_indexing.setChecked(True)
        self.chk_indexing.stateChanged.connect(self.on_indexing_change)
        form.addRow("", self.chk_indexing)

        self.chk_tags = QCheckBox("Auto-Tags aus Ordnernamen")
        self.chk_tags.setAccessibleName("Auto-Tags aus Ordnernamen generieren")
        self.chk_tags.setToolTip("Generiert automatische Schlagwörter aus den Verzeichnisnamen.")
        if existing and "structure" in existing:
            self.chk_tags.setChecked(existing["structure"].get("auto_tags", True))
        else:
            self.chk_tags.setChecked(True)
        form.addRow("", self.chk_tags)

        self.db_container = QWidget()
        db_lay = QHBoxLayout(self.db_container)
        db_lay.setContentsMargins(0,0,0,0)
        self.db_path = QLineEdit(existing["db_path"] if existing else "")
        self.db_path.setAccessibleName("Datenbank-Dateipfad")
        self.db_path.setPlaceholderText("Pfad zur SQLite-Indexdatenbank (optional)")
        self.db_path.setToolTip("Speicherort der SQLite-Indexdatenbank für diese Aufgabe")
        btn_db = QPushButton("💾")
        configure_compact_button_accessibility(
            btn_db,
            name="Datenbank-Datei auswählen",
            tooltip="Datenbank-Datei auswählen",
            description="Wählt die Datenbank-Datei für Suche und Historie aus.",
        )
        btn_db.clicked.connect(lambda: self.pick_file(self.db_path))
        db_lay.addWidget(self.db_path)
        db_lay.addWidget(btn_db)

        form.addRow("Datenbank-Datei", self.db_container)

        lay.addLayout(form)

        # V3 NEW: Database Safety Scanner
        lay.addWidget(self._create_safety_scanner())

        # Buttons
        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

        # Initialize UI state
        self.on_mode_change(self.mode.currentText())
        self.on_indexing_change()

    def _create_safety_scanner(self):
        """Erstellt das Database Safety Scanner Widget."""
        safety_box = QWidget()
        safety_box.setStyleSheet(
            "background-color: #f0f0f0; border: 1px solid #ccc; "
            "border-radius: 4px; padding: 8px;"
        )
        safety_lay = QVBoxLayout(safety_box)

        lbl_safety_title = QLabel("<b>🛡️ Datenbank-Sicherheitsprüfung (V3)</b>")
        safety_lay.addWidget(lbl_safety_title)

        btn_scan = QPushButton("🔍 Quelle auf Datenbanken scannen")
        configure_compact_button_accessibility(
            btn_scan,
            name="Quelle auf Datenbanken scannen",
            tooltip="Quelle auf Datenbanken scannen",
            description="Prüft den Quellordner auf Datenbanken und empfiehlt sichere Einstellungen.",
        )
        btn_scan.clicked.connect(self.scan_for_databases)
        safety_lay.addWidget(btn_scan)

        self.safety_info = QTextEdit()
        self.safety_info.setReadOnly(True)
        self.safety_info.setMaximumHeight(100)
        self.safety_info.setAccessibleName("Datenbank-Sicherheitsbericht")
        self.safety_info.setAccessibleDescription("Zeigt das Ergebnis der Datenbank-Sicherheitsprüfung an.")
        self.safety_info.setPlaceholderText(
            "Klicke 'Scannen' um Datenbanken zu erkennen und "
            "sichere Einstellungen zu erhalten."
        )
        safety_lay.addWidget(self.safety_info)

        return safety_box

    def scan_for_databases(self):
        """V3 NEW: Scan source directory for databases and show recommendations."""
        source = self.source.text().strip()
        if not source or not os.path.exists(source):
            self.safety_info.setText("⚠ Bitte gültiges Quellverzeichnis angeben!")
            return

        self.safety_info.setText("🔍 Scanne Verzeichnis...")
        QApplication.processEvents()

        # Scan for databases
        databases = DatabaseSafetyManager.scan_directory_for_databases(source)

        if not databases:
            self.safety_info.setText("✓ Keine Datenbanken gefunden.\nStandard-Einstellungen sind sicher.")
            return

        # Analyze databases
        has_wal = any(db["wal_mode"] or db["has_wal_files"] for db in databases)

        info_lines = [f"📊 {len(databases)} Datenbank(en) gefunden:\n"]

        for db in databases[:5]:  # Show max 5
            wal_status = "⚠ WAL" if db["wal_mode"] else "✓"
            info_lines.append(f"  {wal_status} {db['name']} ({db['size_mb']:.1f} MB)")

        if len(databases) > 5:
            info_lines.append(f"  ... und {len(databases) - 5} weitere")

        if has_wal:
            info_lines.append("\n🛡️ EMPFOHLENE EINSTELLUNGEN:")
            info_lines.append("  • Modus: one_way (statt two_way)")
            info_lines.append("  • Konflikt: source (statt newest)")
            info_lines.append("  • Auto-Sync: DEAKTIVIERT")
            info_lines.append("\nWAL-Dateien werden automatisch ausgeschlossen!")
        else:
            info_lines.append("\n✓ Keine WAL-Datenbanken.")
            info_lines.append("Standard-Einstellungen sind sicher.")

        self.safety_info.setText("\n".join(info_lines))

    def on_mode_change(self, txt):
        is_index_only = (txt == "index_only")
        self.target.setEnabled(not is_index_only)
        self.conflict.setEnabled(not is_index_only)
        if is_index_only:
            self.chk_indexing.setChecked(True)
            self.chk_indexing.setEnabled(False)
        else:
            self.chk_indexing.setEnabled(True)

    def on_indexing_change(self):
        enabled = self.chk_indexing.isChecked()
        self.db_container.setEnabled(enabled)
        self.chk_tags.setEnabled(enabled)

    def pick(self, line):
        d = QFileDialog.getExistingDirectory(self, "Ordner wählen")
        if d:
            line.setText(d)

    def pick_file(self, line):
        f, _ = QFileDialog.getSaveFileName(self, "DB speichern unter",
                                          "profiler.db", "SQLite (*.db)")
        if f:
            line.setText(f)

    def get_result(self):
        """V3 IMPROVED: Apply database safety settings automatically."""
        source = self.source.text()

        db = self.db_path.text()
        if self.chk_indexing.isChecked() and not db and source:
            db = os.path.join(source, "profiler_index.db")

        autosync = {"enabled": False, "interval_minutes": 15}
        if self.existing and "autosync" in self.existing:
            autosync = self.existing["autosync"]

        conn_config = {
            "id": self.existing["id"] if self.existing else f"conn-{uuid.uuid4().hex[:6]}",
            "name": self.name.text(),
            "source": source,
            "target": self.target.text(),
            "mode": self.mode.currentText(),
            "conflict_policy": self.conflict.currentText(),
            "indexing": self.chk_indexing.isChecked(),
            "db_path": db,
            "structure": {"auto_tags": self.chk_tags.isChecked()},
            "autosync": autosync,
            "exclude_patterns": self.existing.get("exclude_patterns", []) if self.existing else []
        }

        # V3.1 NEW: Apply database safety settings automatically (for folders)
        conn_config["type"] = ConnectionType.FOLDER
        self._apply_safety_settings(conn_config, source)
        return conn_config

    def _apply_safety_settings(self, conn_config, source):
        """Wendet automatische Datenbank-Sicherheitseinstellungen an."""
        if not source or not os.path.exists(source):
            return

        databases = DatabaseSafetyManager.scan_directory_for_databases(source)
        conn_config, warnings, excluded_dbs, was_changed = \
            DatabaseSafetyManager.apply_safe_settings_folder(conn_config, databases)

        if was_changed and warnings:
            self._show_safety_message(warnings, excluded_dbs)

    def _show_safety_message(self, warnings, excluded_dbs):
        """Zeigt Informationsnachricht über angewendete Sicherheitseinstellungen."""
        msg = "🛡️ Datenbank-Sicherheitseinstellungen wurden automatisch angewendet:\n\n"
        msg += "\n".join(warnings)

        if excluded_dbs:
            msg += f"\n\n{len(excluded_dbs)} Datenbank(en) wurden ausgeschlossen:"
            for db in excluded_dbs[:3]:  # Show first 3
                msg += f"\n  • {db['name']} ({db['size_mb']:.1f} MB)"
            if len(excluded_dbs) > 3:
                msg += f"\n  ... und {len(excluded_dbs) - 3} weitere"
            msg += "\n\n💡 Tipp: Erstelle Datei-Verbindungen für einzelne Datenbank-Backups"

        QMessageBox.information(self, "Sicherheitseinstellungen angewendet", msg)

# ---------------- FILE CONNECTION DIALOG (V3.1 NEW) ----------------
class FileConnectionDialog(QDialog):
    """V3.1 NEW: Dialog for single-file synchronization."""

    def __init__(self, parent=None, existing=None, suggested_file=None):
        super().__init__(parent)
        self.setWindowTitle("Datei synchronisieren")
        self.existing = existing
        self.resize(500, 450)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        # Name
        self.name = QLineEdit(existing["name"] if existing else "")
        self.name.setAccessibleName("Name der Aufgabe")
        self.name.setPlaceholderText("z.B. Datenbank-Backup")
        self.name.setToolTip("Eindeutiger Name für diese Datei-Synchronisationsaufgabe")
        form.addRow("Name der Aufgabe", self.name)

        # Source File
        self.source_file = QLineEdit(existing.get("source_file", suggested_file or "") if existing else (suggested_file or ""))
        self.source_file.setAccessibleName("Quelldatei")
        self.source_file.setPlaceholderText("Pfad zur Quelldatei")
        self.source_file.setToolTip("Quelldatei, die synchronisiert werden soll")
        btn_src = QPushButton("📄")
        configure_compact_button_accessibility(
            btn_src,
            name="Quelldatei auswählen",
            tooltip="Quelldatei auswählen",
            description="Öffnet den Dateidialog für die Quelldatei.",
        )
        btn_src.clicked.connect(lambda: self.pick_file(self.source_file, "Quelldatei wählen"))
        h_src = QHBoxLayout()
        h_src.addWidget(self.source_file)
        h_src.addWidget(btn_src)
        form.addRow("Quelldatei", h_src)

        # Target File
        self.target_file = QLineEdit(existing.get("target_file", "") if existing else "")
        self.target_file.setAccessibleName("Zieldatei")
        self.target_file.setPlaceholderText("Pfad zur Zieldatei")
        self.target_file.setToolTip("Zieldatei, in die synchronisiert werden soll")
        btn_tgt = QPushButton("📄")
        configure_compact_button_accessibility(
            btn_tgt,
            name="Zieldatei auswählen",
            tooltip="Zieldatei auswählen",
            description="Öffnet den Dateidialog für die Zieldatei.",
        )
        btn_tgt.clicked.connect(lambda: self.pick_file(self.target_file, "Zieldatei wählen"))
        h_tgt = QHBoxLayout()
        h_tgt.addWidget(self.target_file)
        h_tgt.addWidget(btn_tgt)
        form.addRow("Zieldatei", h_tgt)

        # Mode (for files, usually one-way)
        self.mode = QComboBox()
        self.mode.setAccessibleName("Synchronisationsmodus")
        self.mode.setToolTip("Wähle den Synchronisationsmodus für Dateien (one_way empfohlen)")
        self.mode.addItems(["one_way", "two_way"])
        if existing:
            self.mode.setCurrentText(existing.get("mode", "one_way"))
        form.addRow("Sync-Modus", self.mode)

        # Checkpoint option
        self.chk_checkpoint = QCheckBox("WAL-Checkpoint vor Sync (für SQLite)")
        self.chk_checkpoint.setAccessibleName("WAL-Checkpoint vor Sync (für SQLite)")
        self.chk_checkpoint.setToolTip("Führt vor der Synchronisation einen WAL-Checkpoint aus, um Datenkonsistenz sicherzustellen")
        if existing:
            self.chk_checkpoint.setChecked(existing.get("checkpoint_before_sync", False))
        form.addRow("", self.chk_checkpoint)

        lay.addLayout(form)

        # Safety info box
        safety_box = QWidget()
        safety_box.setStyleSheet("background-color: #f0f0f0; border: 1px solid #ccc; border-radius: 4px; padding: 8px;")
        safety_lay = QVBoxLayout(safety_box)

        lbl_safety = QLabel("<b>🛡️ Datei-Sicherheit (V3.1)</b>")
        safety_lay.addWidget(lbl_safety)

        self.safety_info = QTextEdit()
        self.safety_info.setReadOnly(True)
        self.safety_info.setMaximumHeight(120)
        self.safety_info.setAccessibleName("Datei-Sicherheitsbericht")
        self.safety_info.setAccessibleDescription("Zeigt die Analyse der Datei hinsichtlich SQLite- und WAL-Sicherheit an.")
        self.safety_info.setPlaceholderText("Datei-Synchronisierung ist ideal für Datenbanken.\nWAL-Dateien werden automatisch übersprungen.")
        safety_lay.addWidget(self.safety_info)

        # Auto-analyze button
        btn_analyze = QPushButton("🔍 Datei analysieren")
        configure_compact_button_accessibility(
            btn_analyze,
            name="Datei analysieren",
            tooltip="Datei analysieren",
            description="Prüft die ausgewählte Datei auf Datenbank-Sicherheitsanforderungen.",
        )
        btn_analyze.clicked.connect(self.analyze_file)
        safety_lay.addWidget(btn_analyze)

        lay.addWidget(safety_box)

        # Buttons
        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

        # Auto-analyze if suggested file provided
        if suggested_file and os.path.exists(suggested_file):
            QTimer.singleShot(100, self.analyze_file)

    def pick_file(self, line, title):
        """Pick a file (not folder)."""
        f, _ = QFileDialog.getOpenFileName(self, title)
        if f:
            line.setText(f)
            # Auto-set target if source was picked
            if line == self.source_file and not self.target_file.text():
                # Suggest target path
                source_dir = os.path.dirname(f)
                filename = os.path.basename(f)
                # Could suggest network path here
                self.target_file.setPlaceholderText(f"[Ziel-Pfad für {filename}]")

    def analyze_file(self):
        """Analyze source file and show recommendations."""
        source_file = self.source_file.text().strip()
        if not source_file or not os.path.exists(source_file):
            self.safety_info.setText("⚠ Bitte gültige Quelldatei angeben!")
            return

        filename = os.path.basename(source_file)
        info_lines = [f"📄 Datei: {filename}\n"]

        # Check if database
        if DatabaseSafetyManager.is_database_file(source_file):
            db_type = "unbekannt"
            wal_mode = False
            size_mb = 0

            try:
                size_mb = os.path.getsize(source_file) / (1024 * 1024)
                info_lines.append(f"Größe: {size_mb:.1f} MB")
            except OSError:
                # File may not exist or is inaccessible
                pass

            # SQLite check
            if DatabaseSafetyManager.is_sqlite_database(source_file):
                db_type = "SQLite"
                wal_mode = DatabaseSafetyManager.check_wal_mode(source_file)

                if wal_mode:
                    info_lines.append(f"Typ: {db_type} (WAL-Modus ⚠)")
                    info_lines.append("\n🛡️ EMPFEHLUNGEN:")
                    info_lines.append("  • Modus: one_way")
                    info_lines.append("  • WAL-Checkpoint: AKTIVIERT")
                    info_lines.append("\n✓ WAL-Dateien werden automatisch übersprungen")

                    # Auto-apply settings
                    self.mode.setCurrentText("one_way")
                    self.chk_checkpoint.setChecked(True)
                else:
                    info_lines.append(f"Typ: {db_type} (Journal-Modus ✓)")
                    info_lines.append("\n✓ Sicher für Sync")

            elif DatabaseSafetyManager.is_access_database(source_file):
                db_type = "MS Access"
                info_lines.append(f"Typ: {db_type}")
                info_lines.append("\n💡 Empfehlung: one_way Modus")
                self.mode.setCurrentText("one_way")

            else:
                info_lines.append("Typ: Datenbank (erkannt)")
        else:
            info_lines.append("Typ: Reguläre Datei")
            info_lines.append("\n✓ Kann two_way synchronisiert werden")

        self.safety_info.setText("\n".join(info_lines))

        # Auto-set name if empty
        if not self.name.text():
            base_name = os.path.splitext(filename)[0]
            self.name.setText(f"{base_name} - Backup")

    def get_result(self):
        """Return file connection configuration."""
        source_file = self.source_file.text()
        target_file = self.target_file.text()

        conn_config = {
            "id": self.existing["id"] if self.existing else f"conn-{uuid.uuid4().hex[:6]}",
            "type": ConnectionType.FILE,  # V3.1: Mark as FILE connection
            "name": self.name.text(),
            "source_file": source_file,
            "target_file": target_file,
            "mode": self.mode.currentText(),
            "checkpoint_before_sync": self.chk_checkpoint.isChecked(),
            "autosync": self.existing.get("autosync", {"enabled": False, "interval_minutes": 15}) if self.existing else {"enabled": False}
        }

        # V3.1: Apply file safety settings
        if source_file and os.path.exists(source_file):
            conn_config, warnings, was_changed = DatabaseSafetyManager.apply_safe_settings_file(conn_config)

            if was_changed and warnings:
                msg = "🛡️ Sicherheitseinstellungen wurden automatisch angewendet:\n\n"
                msg += "\n".join(warnings)
                QMessageBox.information(self, "Sicherheitseinstellungen", msg)

        return conn_config


class SftpTargetDialog(QDialog):
    """Dialog for local-folder to SSH/SFTP target synchronization."""

    def __init__(self, parent=None, existing=None):
        super().__init__(parent)
        self.setWindowTitle("SFTP/SSH-Ziel synchronisieren")
        self.existing = existing or {}
        self.resize(560, 520)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        self.name = QLineEdit(self.existing.get("name", ""))
        self.name.setAccessibleName("Name der Aufgabe")
        self.name.setPlaceholderText("z.B. Webserver-Backup")
        self.name.setToolTip("Eindeutiger Name für diese SFTP-Synchronisationsaufgabe")

        self.source = QLineEdit(self.existing.get("source", ""))
        self.source.setAccessibleName("Lokaler Quellordner")
        self.source.setPlaceholderText("Pfad zum lokalen Quellordner")
        self.source.setToolTip("Lokaler Quellordner, der zum SFTP-Server übertragen werden soll")

        self.remote_host = QLineEdit(self.existing.get("remote_host", ""))
        self.remote_host.setAccessibleName("SFTP-Host")
        self.remote_host.setPlaceholderText("z.B. sftp.example.com oder IP-Adresse")
        self.remote_host.setToolTip("Hostname oder IP-Adresse des SFTP/SSH-Servers")

        self.remote_port = QLineEdit(str(self.existing.get("remote_port", 22)))
        self.remote_port.setAccessibleName("SFTP-Port")
        self.remote_port.setToolTip("SSH/SFTP-Port (Standard: 22)")

        self.remote_username = QLineEdit(self.existing.get("remote_username", ""))
        self.remote_username.setAccessibleName("SFTP-Benutzername")
        self.remote_username.setPlaceholderText("z.B. backup_user")
        self.remote_username.setToolTip("Benutzername für die SSH/SFTP-Authentifizierung")

        self.remote_key_file = QLineEdit(self.existing.get("remote_key_file", ""))
        self.remote_key_file.setAccessibleName("SSH-Schlüsseldatei")
        self.remote_key_file.setPlaceholderText("Optional: Pfad zu id_rsa / id_ed25519")
        self.remote_key_file.setToolTip("Pfad zur privaten SSH-Schlüsseldatei (optional bei SSH-Agent)")

        self.target = QLineEdit(self.existing.get("target", ""))
        self.target.setAccessibleName("Remote-Zielpfad")
        self.target.setPlaceholderText("z.B. /var/backup/data")
        self.target.setToolTip("Zielverzeichnis auf dem SFTP-Server")

        btn_src = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_src,
            name="Quellordner auswählen",
            tooltip="Quellordner auswählen",
            description="Öffnet den Ordnerdialog für den lokalen Quellordner.",
        )
        btn_src.clicked.connect(lambda: self.pick_folder(self.source))
        h_src = QHBoxLayout()
        h_src.addWidget(self.source)
        h_src.addWidget(btn_src)

        btn_key = QPushButton("🔑")
        configure_compact_button_accessibility(
            btn_key,
            name="SSH-Schlüssel auswählen",
            tooltip="SSH-Schlüssel auswählen",
            description="Wählt optional eine private Schlüsseldatei für SFTP aus.",
        )
        btn_key.clicked.connect(lambda: self.pick_file(self.remote_key_file))
        h_key = QHBoxLayout()
        h_key.addWidget(self.remote_key_file)
        h_key.addWidget(btn_key)

        self.mode = QComboBox()
        self.mode.setAccessibleName("Synchronisationsmodus")
        self.mode.setToolTip("SFTP-Synchronisationsmodus (update, mirror, one_way)")
        self.mode.addItems(["update", "mirror", "one_way"])
        self.mode.setCurrentText(self.existing.get("mode", "update"))

        self.allow_unknown_host_key = QCheckBox("Unbekannten Host-Key beim ersten Verbinden automatisch vertrauen (wird dauerhaft gepinnt)")
        self.allow_unknown_host_key.setAccessibleName("Unbekannten Host-Key beim ersten Verbinden automatisch vertrauen")
        self.allow_unknown_host_key.setToolTip("Pinnt den SSH-Host-Key beim ersten Verbindungsaufbau automatisch dauerhaft via TOFU")
        self.allow_unknown_host_key.setChecked(bool(self.existing.get("allow_unknown_host_key", False)))

        raw_patterns = self.existing.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            patterns_text = str(raw_patterns)
        else:
            patterns_text = "; ".join(str(p) for p in raw_patterns if str(p).strip())
        self.exclude_patterns = QLineEdit(patterns_text)
        self.exclude_patterns.setAccessibleName("Dateiausschluss-Muster")
        self.exclude_patterns.setToolTip("Muster für auszuschließende Dateien oder Verzeichnisse, getrennt durch Semikolon")
        self.exclude_patterns.setPlaceholderText("z.B. *.tmp; __pycache__; *.db-wal")

        form.addRow("Name der Aufgabe", self.name)
        form.addRow("Lokale Quelle", h_src)
        form.addRow("SFTP-Host", self.remote_host)
        form.addRow("Port", self.remote_port)
        form.addRow("Benutzername", self.remote_username)
        form.addRow("SSH-Key (optional)", h_key)
        form.addRow("Remote-Zielpfad", self.target)
        form.addRow("Sync-Modus", self.mode)
        form.addRow("Ausschlüsse", self.exclude_patterns)
        form.addRow("", self.allow_unknown_host_key)
        lay.addLayout(form)

        warning = QTextEdit()
        warning.setReadOnly(True)
        warning.setMaximumHeight(110)
        warning.setAccessibleName("SFTP-Sicherheitshinweis")
        warning.setAccessibleDescription("Sicherheitshinweis zur Eignung von SFTP für relationale Datenbanken und Passwörter.")
        warning.setText(
            f"⚠ {REMOTE_UNSAFE_DATABASE_WARNING}\n\n"
            "Passwörter werden in ProSync nicht gespeichert. Nutze SSH-Agent "
            "oder eine Schlüsseldatei."
        )
        lay.addWidget(warning)

        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

    def pick_folder(self, line):
        path = QFileDialog.getExistingDirectory(self, "Lokalen Quellordner wählen")
        if path:
            line.setText(path)

    def pick_file(self, line):
        path, _ = QFileDialog.getOpenFileName(self, "SSH-Schlüssel wählen")
        if path:
            line.setText(path)

    @staticmethod
    def _parse_patterns(text):
        return [
            part.strip()
            for part in str(text or "").replace("\n", ";").split(";")
            if part.strip()
        ]

    def get_result(self):
        try:
            port = int(str(self.remote_port.text()).strip() or "22")
        except ValueError:
            port = 22

        conn_config = {
            "id": self.existing["id"] if self.existing.get("id") else f"conn-{uuid.uuid4().hex[:6]}",
            "type": ConnectionType.SFTP,
            "name": self.name.text().strip(),
            "source": self.source.text().strip(),
            "target": normalize_remote_path(self.target.text()),
            "remote_host": self.remote_host.text().strip(),
            "remote_port": port,
            "remote_username": self.remote_username.text().strip(),
            "remote_key_file": self.remote_key_file.text().strip(),
            "allow_unknown_host_key": self.allow_unknown_host_key.isChecked(),
            "mode": self.mode.currentText(),
            "conflict_policy": "source",
            "indexing": False,
            "autosync": self.existing.get(
                "autosync",
                {"enabled": False, "interval_minutes": DEFAULT_AUTOSYNC_INTERVAL},
            ),
            "exclude_patterns": self._parse_patterns(self.exclude_patterns.text()),
            "remote_warning": REMOTE_UNSAFE_DATABASE_WARNING,
        }
        return conn_config


class ConnectionListWidget(QListWidget):
    """V3.2 NEW: Barrierefreie Aufgabenliste mit Tastaturnavigation und Schnellaktionen."""

    def __init__(self, parent=None):
        super().__init__(parent)
        self.setSelectionMode(QAbstractItemView.SelectionMode.ExtendedSelection)
        self.setAccessibleName("Synchronisations-Aufgaben")
        self.setAccessibleDescription(
            "Liste aller konfigurierten Ordner-, Datei- und SFTP-Synchronisationen. "
            "Tastenkürzel: F2 oder Doppelklick zum Bearbeiten, Entf zum Löschen, "
            "F5, Strg+R oder Eingabe zum Starten, Strg+C zum Kopieren der Pfade."
        )

    def keyPressEvent(self, event):
        key = event.key()
        modifiers = event.modifiers()
        parent_window = self.window()

        if key in (Qt.Key.Key_Delete, Qt.Key.Key_Backspace):
            if hasattr(parent_window, "delete_selected_connection"):
                parent_window.delete_selected_connection()
                event.accept()
                return

        elif key == Qt.Key.Key_F2:
            if hasattr(parent_window, "edit_selected_connection"):
                parent_window.edit_selected_connection()
                event.accept()
                return

        elif key in (Qt.Key.Key_Return, Qt.Key.Key_Enter):
            if hasattr(parent_window, "start_sync"):
                parent_window.start_sync()
                event.accept()
                return

        elif key == Qt.Key.Key_C and bool(modifiers & Qt.KeyboardModifier.ControlModifier):
            if hasattr(parent_window, "copy_selected_connection_info"):
                parent_window.copy_selected_connection_info()
                event.accept()
                return

        super().keyPressEvent(event)


class MainWindow(QMainWindow):
    # V3.2 NEW: Notification-Typen für Toast-System
    class NotificationType:
        INFO = QSystemTrayIcon.MessageIcon.Information
        SUCCESS = QSystemTrayIcon.MessageIcon.Information  # Windows hat kein Success
        WARNING = QSystemTrayIcon.MessageIcon.Warning
        ERROR = QSystemTrayIcon.MessageIcon.Critical
    
    def __init__(self, cfg):
        super().__init__()
        self.setWindowTitle("ProSync V3.2 - Sync & Index mit DB-Sicherheit")  # V3.2: Toast-Notifications
        self.setWindowIcon(load_app_icon())
        self.resize(900, 600)
        self.cfg = cfg
        self.worker = None
        self.batch_queue = BatchSyncQueue()
        self._worker_had_error = False
        self._stop_requested = False

        self.scheduler = ConnectionScheduler(cfg)
        self.scheduler.trigger_sync.connect(self.on_auto_sync_triggered)
        app = QApplication.instance()
        if app is not None:
            app.applicationStateChanged.connect(self.scheduler.on_application_state_changed)

        self.tray_icon = QSystemTrayIcon(self)
        self.setup_tray_icon()

        tray_menu = QMenu(self)
        act_show = tray_menu.addAction("Öffnen")
        act_show.triggered.connect(self.show_and_raise)

        if HAS_WINREG:
            act_autostart = QAction("Mit Windows starten", self)
            act_autostart.setCheckable(True)
            act_autostart.setChecked(AutostartManager.is_autostart_enabled())
            act_autostart.triggered.connect(self.toggle_autostart)
            tray_menu.addAction(act_autostart)

        tray_menu.addSeparator()
        act_quit = tray_menu.addAction("Beenden")
        act_quit.triggered.connect(self.force_quit)
        self.tray_icon.setContextMenu(tray_menu)
        self.tray_icon.activated.connect(self.on_tray_click)
        self.tray_icon.show()

        central = QWidget()
        self.setCentralWidget(central)
        main_lay = QVBoxLayout(central)

        toolbar_lay = QHBoxLayout()

        # V3.1 NEW: Menu button for adding connections
        btn_add = QPushButton("➕ Neue Aufgabe")
        btn_add.setToolTip("Neue Synchronisations-Aufgabe hinzufügen (Strg+N)")
        btn_add.setStatusTip("Öffnet das Menü zum Erstellen einer Ordner-, Datei- oder SFTP-Synchronisation.")
        btn_add.setAccessibleName("Neue Aufgabe hinzufügen")
        btn_add.setAccessibleDescription("Öffnet ein Untermenü zum Erstellen einer neuen Ordner-, Datei- oder SFTP-Synchronisationsaufgabe.")
        btn_add.setShortcut("Ctrl+N")

        add_menu = QMenu(self)
        act_folder = add_menu.addAction("📁 Ordner synchronisieren")
        act_folder.triggered.connect(self.add_folder_connection)
        act_file = add_menu.addAction("📄 Datei synchronisieren")
        act_file.triggered.connect(self.add_file_connection)
        act_sftp = add_menu.addAction("🌐 SFTP/SSH-Ziel synchronisieren")
        act_sftp.triggered.connect(self.add_sftp_connection)
        btn_add.setMenu(add_menu)

        # V3 NEW: Database audit button
        btn_audit = QPushButton("🛡️ Sicherheitsprüfung")
        btn_audit.setToolTip("Prüfe alle Verbindungen auf Datenbank-Sicherheit (Strg+Shift+A)")
        btn_audit.setStatusTip("Prüft alle eingerichteten Verbindungen auf Datenbank-Sicherheitskriterien.")
        btn_audit.setAccessibleName("Sicherheitsprüfung ausführen")
        btn_audit.setAccessibleDescription("Führt eine Sicherheitsprüfung aller Verbindungen hinsichtlich SQLite- und WAL-Sicherheit durch.")
        btn_audit.setShortcut("Ctrl+Shift+A")
        btn_audit.clicked.connect(self.audit_all_connections)

        self.btn_profiler = QPushButton("📚 ProFiler öffnen")
        self.btn_profiler.setToolTip("Startet ProFiler als Companion-App")
        self.btn_profiler.setStatusTip("Startet die ProFiler-Anwendung zur tiefen Dateianalyse.")
        self.btn_profiler.setAccessibleName("ProFiler öffnen")
        self.btn_profiler.setAccessibleDescription("Öffnet die ProFiler Companion-App zur erweiterten Analyse.")
        self.btn_profiler.clicked.connect(self.launch_profiler)

        btn_portable = QPushButton("⇄ Profil austauschen")
        btn_portable.setToolTip("ProSync-Profil exportieren oder importieren")
        btn_portable.setStatusTip("Exportiert oder importiert ein übertragbares ProSync-Profil.")
        btn_portable.setAccessibleName("Profil austauschen")
        btn_portable.setAccessibleDescription("Öffnet das Menü zum Exportieren oder Importieren übertragbarer Synchronisationsprofile.")
        portable_menu = QMenu(self)
        act_export_profile = portable_menu.addAction("📤 Profil exportieren")
        act_export_profile.triggered.connect(self.export_portable_profile_dialog)
        act_import_profile = portable_menu.addAction("📥 Profil importieren")
        act_import_profile.triggered.connect(self.import_portable_profile_dialog)
        btn_portable.setMenu(portable_menu)

        empty = QWidget()
        empty.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Preferred)

        self.btn_search = QPushButton("🔍 Datenbank durchsuchen")
        self.btn_search.setToolTip("ProFiler-Search für Indexdatenbanken öffnen (Strg+F)")
        self.btn_search.setStatusTip("Öffnet das ProFiler-Search-Fenster zur Volltextsuche in allen Indexdatenbanken.")
        self.btn_search.setAccessibleName("Datenbank durchsuchen")
        self.btn_search.setAccessibleDescription("Öffnet die Suchmaske zum Durchsuchen der erstellten Indexdatenbanken.")
        self.btn_search.setShortcut("Ctrl+F")
        self.btn_search.clicked.connect(self.open_reader)

        toolbar_lay.addWidget(btn_add)
        toolbar_lay.addWidget(btn_audit)  # V3 NEW
        toolbar_lay.addWidget(self.btn_profiler)
        toolbar_lay.addWidget(btn_portable)
        toolbar_lay.addWidget(empty)
        toolbar_lay.addWidget(self.btn_search)
        main_lay.addLayout(toolbar_lay)

        splitter = QSplitter(Qt.Orientation.Horizontal)
        self.list = ConnectionListWidget(self)
        self.list.itemClicked.connect(self.on_item_select)
        self.list.itemDoubleClicked.connect(self.edit_selected_connection)
        self.list.itemSelectionChanged.connect(self.refresh_selection_state)
        self.list.setContextMenuPolicy(Qt.ContextMenuPolicy.CustomContextMenu)
        self.list.customContextMenuRequested.connect(self.open_context_menu)

        right_panel = QWidget()
        r_lay = QVBoxLayout(right_panel)
        self.lbl_info = QLabel("Wähle eine Aufgabe...")
        self.lbl_info.setStyleSheet("font-weight: bold; font-size: 14px;")

        ctrl_lay = QHBoxLayout()
        self.btn_run = QPushButton("▶ Start Sync")
        self.btn_run.setToolTip("Ausgewählte Synchronisationsaufgabe(n) starten (F5 / Strg+R / Eingabe)")
        self.btn_run.setStatusTip("Startet die Ausführung der aktuell ausgewählten Synchronisationsaufgabe(n).")
        self.btn_run.setAccessibleName("Synchronisation starten")
        self.btn_run.setAccessibleDescription("Startet die ausgewählte Synchronisationsaufgabe oder den Batch-Lauf.")
        self.btn_run.setShortcut("F5")
        self.btn_run.clicked.connect(self.start_sync)

        # V3.2 NEW: Ergänzender Shortcut Strg+R gemäß Tooltip
        self.shortcut_sync_r = QShortcut(QKeySequence("Ctrl+R"), self)
        self.shortcut_sync_r.activated.connect(self.start_sync)

        self.btn_pause = QPushButton("⏸ Pause")
        self.btn_pause.setToolTip("Laufende Synchronisation pausieren oder fortsetzen")
        self.btn_pause.setStatusTip("Pausiert den aktiven Synchronisationslauf oder setzt ihn fort.")
        self.btn_pause.setAccessibleName("Synchronisation pausieren")
        self.btn_pause.setAccessibleDescription("Pausiert die aktuell laufende Synchronisationsaufgabe.")
        self.btn_pause.clicked.connect(self.toggle_pause)
        self.btn_pause.setEnabled(False)

        self.btn_stop = QPushButton("⏹ Stop")
        self.btn_stop.setToolTip("Laufende Synchronisation abbrechen")
        self.btn_stop.setStatusTip("Stoppt die aktuell laufende Synchronisationsaufgabe sofort.")
        self.btn_stop.setAccessibleName("Synchronisation stoppen")
        self.btn_stop.setAccessibleDescription("Bricht den laufenden Synchronisationsvorgang ab.")
        self.btn_stop.clicked.connect(self.stop_worker)
        self.btn_stop.setEnabled(False)
        ctrl_lay.addWidget(self.btn_run)
        ctrl_lay.addWidget(self.btn_pause)
        ctrl_lay.addWidget(self.btn_stop)

        self.progress = QProgressBar()
        self.lbl_status = QLabel("Bereit")
        self.lbl_status.setWordWrap(True)
        r_lay.addWidget(self.lbl_info)
        r_lay.addLayout(ctrl_lay)
        r_lay.addWidget(self.progress)
        r_lay.addWidget(self.lbl_status)
        r_lay.addStretch()

        splitter.addWidget(self.list)
        splitter.addWidget(right_panel)
        splitter.setStretchFactor(1, 2)
        main_lay.addWidget(splitter)

        self.status_bar = self.statusBar()
        self.lbl_status_summary = QLabel("Aufgaben: 0 | Auto-Sync: 0")
        self.lbl_status_summary.setAccessibleName("Synchronisations-Statusübersicht")
        self.lbl_status_summary.setAccessibleDescription("Zeigt die Gesamtanzahl der Aufgaben und aktiven Auto-Syncs an.")
        self.status_bar.addPermanentWidget(self.lbl_status_summary)

        self.populate_list()
        self.scheduler.update_all()

    def setup_tray_icon(self):
        icon = load_app_icon()
        if not icon.isNull():
            self.tray_icon.setIcon(icon)
        else:
            icon_path = os.path.join(app_base_dir(), "ICO_TRAY.ico")
            if os.path.exists(icon_path):
                self.tray_icon.setIcon(QIcon(icon_path))
            else:
                self.tray_icon.setIcon(
                    self.style().standardIcon(QStyle.StandardPixmap.SP_DriveNetIcon)
                )
        self.tray_icon.setToolTip("ProSync V3.2 - Läuft im Hintergrund")

    # ============ V3.2 NEW: TOAST-NOTIFICATION SYSTEM ============
    def notify(self, title: str, message: str, 
               msg_type: QSystemTrayIcon.MessageIcon = None,
               duration_ms: int = 3000):
        """
        V3.2 NEW: Zentrale Toast-Notification Methode.
        
        Args:
            title: Titel der Benachrichtigung
            message: Nachrichtentext
            msg_type: Info/Warning/Critical (default: Info)
            duration_ms: Anzeigedauer in ms (default: 3000)
        """
        # Prüfe ob Notifications aktiviert sind
        app_settings = self.cfg.data.get("app", {})
        if not app_settings.get("notifications_enabled", True):
            return
        
        if msg_type is None:
            msg_type = self.NotificationType.INFO
        
        if self.tray_icon.isVisible():
            self.tray_icon.showMessage(title, message, msg_type, duration_ms)
    
    def notify_sync_started(self, conn_name: str):
        """V3.2: Benachrichtigung bei Sync-Start."""
        self.notify("ProSync", f"▶ Sync gestartet: {conn_name}", 
                   self.NotificationType.INFO, 2000)
    
    def notify_sync_finished(self, conn_name: str, success: bool = True):
        """V3.2: Benachrichtigung bei Sync-Ende."""
        if success:
            self.notify("ProSync", f"✓ Sync abgeschlossen: {conn_name}",
                       self.NotificationType.SUCCESS, 3000)
        else:
            self.notify("ProSync", f"⚠ Sync fehlgeschlagen: {conn_name}",
                       self.NotificationType.ERROR, 5000)
    
    def notify_error(self, message: str):
        """V3.2: Fehler-Benachrichtigung."""
        self.notify("ProSync - Fehler", message, 
                   self.NotificationType.ERROR, 5000)
    
    def notify_auto_sync(self, conn_name: str):
        """V3.2: Benachrichtigung bei Auto-Sync."""
        self.notify("ProSync [Auto]", f"⏰ Starte automatischen Sync: {conn_name}",
                   self.NotificationType.INFO, 2000)
    # ============ END TOAST-NOTIFICATION SYSTEM ============

    def toggle_autostart(self, checked):
        if AutostartManager.set_autostart(checked):
            self.lbl_status.setText(f"Autostart {'aktiviert' if checked else 'deaktiviert'}")
        else:
            QMessageBox.warning(self, "Fehler",
                              "Autostart konnte nicht geändert werden (Rechte?).")

    def populate_list(self):
        self.list.clear()
        for c in self.cfg.list_connections():
            auto_txt = " [Auto]" if c.get("autosync", {}).get("enabled") else ""

            # V3 NEW: Show safety status
            safety_txt = ""
            if c.get("_safety_analysis", {}).get("auto_configured"):
                safety_txt = " 🛡️"

            # V3.1 NEW: Show connection type icon
            conn_type = c.get("type", ConnectionType.FOLDER)
            if conn_type == ConnectionType.FILE:
                type_icon = "📄"
            elif conn_type == ConnectionType.SFTP:
                type_icon = "🌐"
            else:
                type_icon = "📁"

            item = QListWidgetItem(f"{type_icon} {c['name']}{auto_txt}{safety_txt}")

            # V3.1: Different tooltip for file vs folder
            if conn_type == ConnectionType.FILE:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[FILE] {src} -> {tgt} ({c.get('mode', 'one_way')})")
            elif conn_type == ConnectionType.SFTP:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[SFTP] {src} -> {tgt} ({c.get('mode', 'update')})")
            else:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[FOLDER] {src} -> {tgt} ({c.get('mode', 'two_way')})")

            item.setData(Qt.ItemDataRole.UserRole, c)
            self.list.addItem(item)

        conns = self.cfg.list_connections()
        auto_count = sum(1 for c in conns if c.get("autosync", {}).get("enabled"))
        if hasattr(self, "lbl_status_summary"):
            self.lbl_status_summary.setText(f"Aufgaben: {len(conns)} | Auto-Sync: {auto_count}")

        self.refresh_selection_state()

    def get_selected_connections(self):
        """Liest die aktuell ausgewählten Verbindungen dedupliziert aus."""
        items = self.list.selectedItems()
        if not items and self.list.currentItem():
            items = [self.list.currentItem()]

        selected = []
        seen_ids = set()
        for item in items:
            conn = item.data(Qt.ItemDataRole.UserRole)
            conn_id = conn.get("id")
            if not conn_id or conn_id in seen_ids:
                continue
            seen_ids.add(conn_id)
            selected.append(conn)
        return selected

    @staticmethod
    def _portable_hint_label(data, key):
        """Read a redacted path hint from an imported portable profile."""
        portable_meta = data.get("_portable_import", {})
        if not isinstance(portable_meta, dict):
            return ""
        hints = portable_meta.get("path_hints", {})
        if not isinstance(hints, dict):
            return ""
        return str(hints.get(key, "")).strip()

    def _format_connection_endpoint(self, data, role):
        """Prefer real local paths, otherwise show redacted remapping hints."""
        conn_type = data.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            field_map = {
                "source": ("source_file", "source_label"),
                "target": ("target_file", "target_label"),
            }
        elif conn_type == ConnectionType.SFTP:
            field_map = {
                "source": ("source", "source_label"),
                "target": ("target", "target_label"),
            }
        else:
            field_map = {
                "source": ("source", "source_label"),
                "target": ("target", "target_label"),
                "db": ("db_path", "db_label"),
            }

        actual_key, hint_key = field_map[role]
        actual_value = str(data.get(actual_key, "") or "").strip()
        if actual_value:
            return actual_value

        hint = self._portable_hint_label(data, hint_key)
        if hint:
            return f"[neu zuordnen] {hint}"
        return "?"

    def _connection_requires_path_mapping(self, data):
        """Imported portable profiles must be mapped before their first sync."""
        portable_meta = data.get("_portable_import", {})
        if not isinstance(portable_meta, dict) or not portable_meta.get("requires_mapping"):
            return False

        conn_type = data.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            return not (str(data.get("source_file", "")).strip() and str(data.get("target_file", "")).strip())
        if conn_type == ConnectionType.SFTP:
            return not (
                str(data.get("source", "")).strip()
                and str(data.get("target", "")).strip()
                and str(data.get("remote_host", "")).strip()
            )
        return not (str(data.get("source", "")).strip() and str(data.get("target", "")).strip())

    def refresh_selection_state(self):
        """Aktualisiert Detailanzeige und Button-Status anhand der Auswahl."""
        selected = self.get_selected_connections()
        selected_count = len(selected)
        is_running = bool(self.worker and self.worker.isRunning())

        if selected_count > 1:
            preview_names = ", ".join(conn["name"] for conn in selected[:3])
            if selected_count > 3:
                preview_names += f" … (+{selected_count - 3})"
            self.lbl_info.setText(
                f"📦 Batch-Auswahl ({selected_count} Aufgaben)\n"
                f"{preview_names}"
            )
            self.btn_run.setText("▶ Batch starten")
            self.btn_run.setEnabled(
                not is_running
                and not any(self._connection_requires_path_mapping(conn) for conn in selected)
            )
            self.btn_pause.setEnabled(False)
            self.btn_stop.setEnabled(is_running)
            return

        self.btn_run.setText("▶ Start Sync")
        if selected_count == 1:
            self._show_connection_details(selected[0])
            return

        self.lbl_info.setText("Wähle eine Aufgabe...")
        self.btn_run.setEnabled(not is_running)
        self.btn_pause.setEnabled(False)
        self.btn_stop.setEnabled(is_running)

    def _show_connection_details(self, data):
        """Zeigt die Details der aktuell ausgewählten Verbindung an."""
        conn_type = data.get("type", ConnectionType.FOLDER)

        # V3.1: Different info display for FILE vs FOLDER
        if conn_type == ConnectionType.FILE:
            # File connection info
            checkpoint_txt = " [Checkpoint: AN]" if data.get("checkpoint_before_sync") else ""
            safety_info = ""
            mapping_note = ""

            if "_file_analysis" in data:
                fa = data["_file_analysis"]
                db_type = fa.get("type", "unknown")
                size_mb = fa.get("size_mb", 0)
                wal_mode = fa.get("wal_mode", False)
                wal_txt = " (WAL)" if wal_mode else ""
                safety_info = f"\n🛡️ Typ: {db_type}{wal_txt}, {size_mb:.1f} MB"

            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quelldatei und Zieldatei vor dem ersten Sync neu wählen."

            self.lbl_info.setText(
                f"📄 {data['name']} [{data.get('mode', 'one_way').upper()}]{checkpoint_txt}{safety_info}{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {self._format_connection_endpoint(data, 'target')}"
            )
        elif conn_type == ConnectionType.SFTP:
            mapping_note = ""
            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quellordner, SFTP-Host und Remote-Ziel vor dem ersten Sync neu wählen."
            self.lbl_info.setText(
                f"🌐 {data['name']} [{data.get('mode', 'update').upper()}]"
                f"\n⚠ Nicht datenbanksicher über SFTP"
                f"{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {sftp_connection_display(data)}"
            )
        else:
            # Folder connection info
            idx_txt = " [Index: AN]" if data.get("indexing", True) else " [Index: AUS]"

            # V3 NEW: Show safety info
            safety_info = ""
            mapping_note = ""
            if "_safety_analysis" in data:
                sa = data["_safety_analysis"]
                excluded = sa.get("excluded_databases", 0)
                if excluded > 0:
                    safety_info = f"\n🛡️ {excluded} DB(s) ausgeschlossen, {sa.get('databases_found', 0)} total"
                else:
                    safety_info = f"\n🛡️ {sa.get('databases_found', 0)} DB(s) gefunden"

            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quell- und Zielordner vor dem ersten Sync neu wählen."

            self.lbl_info.setText(
                f"📁 {data['name']} [{data.get('mode', 'two_way').upper()}]{idx_txt}{safety_info}{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {self._format_connection_endpoint(data, 'target')}"
            )

        is_running = bool(self.worker and self.worker.isRunning())
        is_this_task_running = is_running and (self.worker.conn_id == data['id'])
        self.btn_run.setEnabled(not is_running and not self._connection_requires_path_mapping(data))
        self.btn_pause.setEnabled(is_this_task_running)
        self.btn_stop.setEnabled(is_this_task_running)
        if is_this_task_running and self.worker.is_paused:
            self.btn_pause.setText("▶ Fortsetzen")
        else:
            self.btn_pause.setText("⏸ Pause")

    def add_folder_connection(self):
        """V3.1: Add folder connection."""
        dlg = ConnectionDialog(self)
        if dlg.exec():
            self.cfg.add_or_update_connection(dlg.get_result())
            self.scheduler.update_all()
            self.populate_list()

    def add_file_connection(self):
        """V3.1 NEW: Add file connection."""
        dlg = FileConnectionDialog(self)
        if dlg.exec():
            self.cfg.add_or_update_connection(dlg.get_result())
            self.scheduler.update_all()
            self.populate_list()

    def add_sftp_connection(self):
        """Add an SFTP target connection."""
        dlg = SftpTargetDialog(self)
        if dlg.exec():
            conn = dlg.get_result()
            try:
                validate_sftp_connection(conn)
            except ValueError as exc:
                QMessageBox.warning(self, "SFTP-Konfiguration prüfen", str(exc))
                return
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_all()
            self.populate_list()

    def on_item_select(self, _item):
        self.refresh_selection_state()

    def start_sync(self):
        if hasattr(self, "btn_run") and not self.btn_run.isEnabled():
            return
        selected = self.get_selected_connections()
        if not selected:
            return
        unmapped = [conn["name"] for conn in selected if self._connection_requires_path_mapping(conn)]
        if unmapped:
            QMessageBox.warning(
                self,
                "Pfadzuordnung erforderlich",
                "Diese importierten Profile müssen vor dem ersten Sync lokal neu zugeordnet werden:\n\n"
                + "\n".join(unmapped),
            )
            return
        if len(selected) > 1:
            self.start_batch_sync(selected)
            return
        self.run_sync_logic(selected[0])

    def export_portable_profile_dialog(self):
        """Exportiere Verbindungen als redigiertes Austauschprofil."""
        default_path = str(Path.home() / f"{PORTABLE_PROFILE_SCHEMA}.json")
        export_path, _selected_filter = QFileDialog.getSaveFileName(
            self,
            "Profil exportieren",
            default_path,
            "JSON-Dateien (*.json)",
        )
        if not export_path:
            return

        try:
            payload = self.cfg.export_portable_profile(export_path)
        except Exception as exc:
            QMessageBox.critical(
                self,
                "Export fehlgeschlagen",
                f"Das Austauschprofil konnte nicht gespeichert werden:\n{exc}",
            )
            return

        QMessageBox.information(
            self,
            "Profil exportiert",
            f"{len(payload.get('connections', []))} Aufgabe(n) wurden exportiert.\n\n"
            "Lokale Pfade, `app.profiler_path` und andere persönliche Systempfade "
            "sind im Austauschformat bewusst redigiert.",
        )

    def import_portable_profile_dialog(self):
        """Importiere ein redigiertes Austauschprofil als lokale Entwürfe."""
        import_path, _selected_filter = QFileDialog.getOpenFileName(
            self,
            "Profil importieren",
            str(Path.home()),
            "JSON-Dateien (*.json)",
        )
        if not import_path:
            return

        try:
            result = self.cfg.import_portable_profile(import_path)
        except Exception as exc:
            QMessageBox.critical(
                self,
                "Import fehlgeschlagen",
                f"Das Austauschprofil konnte nicht importiert werden:\n{exc}",
            )
            return

        self.scheduler.update_all()
        self.populate_list()
        schedule_note = ""
        if result["normalized_daily_schedules"]:
            schedule_note = (
                "\n\n"
                f"{result['normalized_daily_schedules']} tägliche Zeitplanung(en) "
                "waren ungültig und wurden sicher auf 09:00 Europe/Berlin "
                "zurückgesetzt. Bitte vor dem Aktivieren prüfen."
            )
        QMessageBox.information(
            self,
            "Profil importiert",
            f"{result['imported']} Aufgabe(n) wurden als lokale Entwürfe angelegt.\n"
            f"Neu vergebene IDs wegen Kollisionen: {result['renamed']}.\n\n"
            "Bitte Quell- und Zielpfade vor dem ersten Sync neu zuordnen."
            f"{schedule_note}",
        )

    def start_batch_sync(self, connections):
        """Startet einen sequenziellen Batch-Lauf über mehrere Verbindungen."""
        if self.worker is not None and self.worker.isRunning():
            QMessageBox.warning(self, "Beschäftigt",
                              "Es läuft bereits ein Synchronisationsvorgang.")
            return

        planned = self.batch_queue.start(connections)
        if len(planned) < 2:
            self.batch_queue.reset()
            if planned:
                self.run_sync_logic(planned[0])
            return

        self.progress.setValue(0)
        self.lbl_status.setText(f"Batch gestartet ({len(planned)} Aufgaben).")
        self.notify("ProSync", f"▶ Batch gestartet: {len(planned)} Aufgaben",
                   self.NotificationType.INFO, 2500)
        self._run_next_batch_sync()

    def _run_next_batch_sync(self):
        """Startet die nächste Verbindung aus der aktiven Batch-Queue."""
        conn = self.batch_queue.next_connection()
        if conn is None:
            return

        current_index = self.batch_queue.completed_count + 1
        total = self.batch_queue.total
        self.lbl_status.setText(f"[Batch {current_index}/{total}] Starte {conn['name']}...")
        self.run_sync_logic(conn)

    def run_sync_logic(self, conn_data):
        if self.worker is not None and self.worker.isRunning():
            QMessageBox.warning(self, "Beschäftigt",
                              "Es läuft bereits ein Synchronisationsvorgang.")
            return

        self._worker_had_error = False
        self._stop_requested = False
        self.btn_run.setEnabled(False)
        self.btn_stop.setEnabled(True)
        self.btn_pause.setEnabled(True)
        self.btn_pause.setText("⏸ Pause")
        
        # V3.2 NEW: Toast bei Sync-Start
        self.notify_sync_started(conn_data.get("name", "Unbekannt"))

        # V3.1 NEW: Select worker based on connection type
        conn_type = conn_data.get("type", ConnectionType.FOLDER)

        if conn_type == ConnectionType.FILE:
            # File sync worker (no database indexing)
            self.worker = FileSyncWorker(conn_data)
        elif conn_type == ConnectionType.SFTP:
            self.worker = SftpTargetSyncWorker(conn_data)
        else:
            # Folder sync worker (with optional database)
            db = None
            if conn_data.get("indexing") and conn_data.get("db_path"):
                try:
                    db = ConnectionDB(conn_data["db_path"])
                except Exception as e:
                    log_warning(f"Warning: Could not open indexing database: {e}")

            self.worker = FolderSyncWorker(conn_data, db)

        self.worker.progress.connect(self.progress.setValue)
        self.worker.status.connect(self.lbl_status.setText)
        self.worker.finished.connect(self.worker_finished)
        # V3.2 CHANGED: Error-Handler mit Notification
        self.worker.error.connect(self._handle_worker_error)
        # Sync-Report speichern
        if hasattr(self.worker, "sync_report"):
            self.worker.sync_report.connect(self._save_sync_report)
        self.worker.start()

    def _handle_worker_error(self, error_msg: str):
        """V3.2 NEW: Zentraler Error-Handler mit Notification."""
        self._worker_had_error = True
        QMessageBox.critical(self, "Fehler", error_msg)
        self.notify_error(error_msg[:100])  # Kürzen für Toast
        if self.batch_queue.total > 1 and self.batch_queue.current is not None:
            self.lbl_status.setText(
                f"Batch-Fehler bei {self.batch_queue.current.get('name', 'Unbekannt')}."
            )
        self.btn_stop.setEnabled(False)
        self.btn_pause.setEnabled(False)
        QTimer.singleShot(0, self.worker_finished)

    def toggle_pause(self):
        if self.worker and self.worker.isRunning():
            if self.worker.is_paused:
                self.worker.resume()
                self.btn_pause.setText("⏸ Pause")
                self.lbl_status.setText(f"[{self.worker.cfg['name']}] Fahre fort...")
            else:
                self.worker.pause()
                self.btn_pause.setText("▶ Fortsetzen")
                self.lbl_status.setText(f"[{self.worker.cfg['name']}] Pausiert")

    def on_auto_sync_triggered(self, conn):
        if self.worker is not None and self.worker.isRunning():
            return
        if self.batch_queue.active:
            return
        self.lbl_status.setText(f"[Auto] Starte Sync für {conn['name']}...")
        # V3.2 NEW: Toast bei Auto-Sync
        self.notify_auto_sync(conn.get("name", "Unbekannt"))
        self.run_sync_logic(conn)

    def stop_worker(self):
        self._stop_requested = True
        if self.batch_queue.active:
            skipped = self.batch_queue.cancel_pending()
            if skipped:
                self.lbl_status.setText(
                    f"Breche Batch ab... ({len(skipped)} verbleibend)"
                )
        if self.worker:
            self.worker.kill()
            if self.batch_queue.total <= 1:
                self.lbl_status.setText("Breche ab...")

    def _save_sync_report(self, report: dict) -> None:
        """Persist a sync-run report as JSON and keep the last 100 entries."""
        save_sync_report(report)

    def worker_finished(self):
        conn_name = self.worker.cfg.get("name", "Sync") if self.worker else "Sync"
        had_error = self._worker_had_error
        stop_requested = self._stop_requested
        is_batch_run = self.batch_queue.total > 1

        self._worker_had_error = False
        self._stop_requested = False
        self.worker = None

        self.btn_run.setEnabled(True)
        self.btn_stop.setEnabled(False)
        self.btn_pause.setEnabled(False)
        self.btn_pause.setText("⏸ Pause")

        if stop_requested:
            self.progress.setValue(0)
            if is_batch_run:
                self.batch_queue.reset()
                self.lbl_status.setText("Batch abgebrochen.")
            else:
                self.lbl_status.setText("Abgebrochen.")
            self.refresh_selection_state()
            return

        if is_batch_run:
            if had_error:
                self.batch_queue.cancel_pending()
                self.batch_queue.reset()
                self.progress.setValue(0)
                self.lbl_status.setText(f"Batch abgebrochen bei {conn_name}.")
                self.refresh_selection_state()
                return

            self.batch_queue.mark_current_finished()
            completed = self.batch_queue.completed_count
            total = self.batch_queue.total
            remaining = self.batch_queue.remaining_count

            if remaining > 0:
                self.progress.setValue(0)
                self.lbl_status.setText(
                    f"Batch-Fortschritt: {completed}/{total} abgeschlossen, {remaining} verbleibend."
                )
                QTimer.singleShot(0, self._run_next_batch_sync)
                return

            self.batch_queue.reset()
            self.progress.setValue(100)
            self.lbl_status.setText(f"Batch abgeschlossen ({completed}/{total}).")
            self.notify("ProSync", f"✓ Batch abgeschlossen: {completed} Aufgaben",
                       self.NotificationType.SUCCESS, 3000)
            self.refresh_selection_state()
            return

        if had_error:
            self.progress.setValue(0)
            self.refresh_selection_state()
            return

        self.progress.setValue(100)
        self.lbl_status.setText("Fertig.")
        # V3.2 CHANGED: Verwende zentrale Notification-Methode
        self.notify_sync_finished(conn_name, success=True)
        self.refresh_selection_state()
        self.worker = None

    def audit_all_connections(self):
        """V3 NEW: Audit all connections for database safety."""
        connections = self.cfg.list_connections()
        if not connections:
            QMessageBox.information(self, "Sicherheitsprüfung",
                                  "Keine Verbindungen konfiguriert.")
            return

        results = []
        fixed_count = 0

        for conn in connections:
            conn_type = conn.get("type", ConnectionType.FOLDER)

            if conn_type == ConnectionType.FILE:
                # File connections - check file safety
                updated_conn, warnings, was_changed = DatabaseSafetyManager.apply_safe_settings_file(
                    conn.copy()
                )

                if was_changed:
                    self.cfg.add_or_update_connection(updated_conn)
                    fixed_count += 1
                    results.append(f"✓ {conn['name']} [FILE]: {len(warnings)} Änderung(en)")
                    for w in warnings:
                        results.append(f"  - {w}")
                else:
                    results.append(f"✓ {conn['name']} [FILE]: Bereits sicher konfiguriert")

            elif conn_type == ConnectionType.SFTP:
                try:
                    validate_sftp_connection(conn)
                    results.append(f"⚠ {conn['name']} [SFTP]: {REMOTE_UNSAFE_DATABASE_WARNING}")
                except ValueError as exc:
                    results.append(f"⚠ {conn['name']} [SFTP]: {exc}")
            else:
                # Folder connections - check for databases
                source = conn.get("source", "")
                if not source or not os.path.exists(source):
                    continue

                databases = DatabaseSafetyManager.scan_directory_for_databases(source)

                if databases:
                    # Apply safe settings
                    updated_conn, warnings, excluded_dbs, was_changed = DatabaseSafetyManager.apply_safe_settings_folder(
                        conn.copy(), databases
                    )

                    if was_changed:
                        # Update configuration
                        self.cfg.add_or_update_connection(updated_conn)
                        fixed_count += 1
                        results.append(f"✓ {conn['name']}: {len(warnings)} Änderung(en)")
                        for w in warnings:
                            results.append(f"  - {w}")
                    else:
                        results.append(f"✓ {conn['name']}: Bereits sicher konfiguriert")

        if results:
            msg = f"🛡️ Sicherheitsprüfung abgeschlossen\n\n"
            if fixed_count > 0:
                msg += f"{fixed_count} Verbindung(en) wurden aktualisiert:\n\n"
            msg += "\n".join(results)
            QMessageBox.information(self, "Sicherheitsprüfung", msg)

            # Refresh UI
            self.populate_list()
            self.scheduler.update_all()
        else:
            QMessageBox.information(self, "Sicherheitsprüfung",
                                  "Keine Datenbanken in konfigurierten Quellen gefunden.")

    def edit_selected_connection(self, item=None):
        """Öffnet den Bearbeitungsdialog für die aktuell ausgewählte Verbindung."""
        conn = None
        if item is not None and hasattr(item, "data"):
            conn = item.data(Qt.ItemDataRole.UserRole)
        if not conn:
            selected = self.get_selected_connections()
            if selected:
                conn = selected[0]
        if not conn:
            return

        conn_type = conn.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            dlg = FileConnectionDialog(self, existing=conn)
        elif conn_type == ConnectionType.SFTP:
            dlg = SftpTargetDialog(self, existing=conn)
        else:
            dlg = ConnectionDialog(self, existing=conn)

        if dlg.exec():
            updated = dlg.get_result()
            if updated.get("type") == ConnectionType.SFTP:
                try:
                    validate_sftp_connection(updated)
                except ValueError as exc:
                    QMessageBox.warning(self, "SFTP-Konfiguration prüfen", str(exc))
                    return
            self.cfg.add_or_update_connection(updated)
            self.scheduler.update_all()
            self.populate_list()

    def delete_selected_connection(self):
        """Löscht die ausgewählte(n) Verbindung(en) nach Sicherheitsabfrage."""
        selected = self.get_selected_connections()
        if not selected:
            return

        if self.worker and self.worker.isRunning():
            running_id = getattr(self.worker, "conn_id", None)
            if any(conn.get("id") == running_id for conn in selected):
                QMessageBox.warning(self, "Beschäftigt", "Eine laufende Aufgabe kann nicht gelöscht werden.")
                return

        if len(selected) == 1:
            conn_name = selected[0].get("name", "Aufgabe")
            msg = f"Aufgabe '{conn_name}' wirklich löschen?"
        else:
            msg = f"{len(selected)} ausgewählte Aufgaben wirklich löschen?"

        if QMessageBox.question(self, "Löschen", msg) == QMessageBox.StandardButton.Yes:
            for conn in selected:
                self.cfg.remove_connection(conn["id"])
            self.scheduler.update_all()
            self.populate_list()

    def copy_selected_connection_info(self):
        """Kopiert Name, Modus, Quell- und Zielpfade der ausgewählten Aufgaben in die Zwischenablage."""
        selected = self.get_selected_connections()
        if not selected:
            return
        lines = []
        for conn in selected:
            conn_type = conn.get("type", ConnectionType.FOLDER)
            name = conn.get("name", "Unbenannt")
            mode = conn.get("mode", "")
            src = self._format_connection_endpoint(conn, "source")
            tgt = self._format_connection_endpoint(conn, "target")
            lines.append(f"{name} [{conn_type}, {mode}]: {src} -> {tgt}")
        text = "\n".join(lines)
        clipboard = QApplication.clipboard()
        if clipboard:
            clipboard.setText(text)
            if hasattr(self, "statusBar") and self.statusBar():
                self.statusBar().showMessage(f"{len(selected)} Aufgabe(n) in Zwischenablage kopiert.", 3000)

    def open_context_menu(self, pos):
        item = self.list.itemAt(pos)
        if not item:
            return

        conn = item.data(Qt.ItemDataRole.UserRole)
        autosync = conn.get("autosync", {"enabled": False, "interval_minutes": 15})
        selected_connections = self.get_selected_connections()

        menu = QMenu(self)
        batch_action = None
        if len(selected_connections) > 1:
            batch_action = menu.addAction(
                f"Batch aus Auswahl starten ({len(selected_connections)})"
            )
            menu.addSeparator()
        act_edit = menu.addAction("Bearbeiten (F2)")
        act_del = menu.addAction("Löschen (Entf)")
        act_copy = menu.addAction("Details kopieren (Strg+C)")
        menu.addSeparator()

        act_auto = QAction("Automatisch ausführen", self)
        act_auto.setCheckable(True)
        act_auto.setChecked(autosync.get("enabled", False))
        menu.addAction(act_auto)

        interval_menu = menu.addMenu("Intervall")
        group = QActionGroup(self)
        current_int = autosync.get("interval_minutes", 15)
        for mins in [5, 15, 30, 60, 120]:
            act_int = QAction(f"Alle {mins} Minuten", self)
            act_int.setCheckable(True)
            act_int.setData(mins)
            if mins == current_int:
                act_int.setChecked(True)
            group.addAction(act_int)
            interval_menu.addAction(act_int)

        daily_action = menu.addAction("Tägliche Uhrzeit festlegen…")

        res = menu.exec(self.list.viewport().mapToGlobal(pos))

        if res == batch_action:
            self.start_batch_sync(selected_connections)

        elif res == act_del:
            self.delete_selected_connection()

        elif res == act_edit:
            self.edit_selected_connection(item)

        elif res == act_copy:
            self.copy_selected_connection_info()

        elif res == act_auto:
            conn["autosync"] = conn.get("autosync", {})
            conn["autosync"]["enabled"] = act_auto.isChecked()
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_connection(conn)
            self.populate_list()

        elif res in group.actions():
            conn["autosync"] = conn.get("autosync", {})
            conn["autosync"]["mode"] = "interval"
            conn["autosync"]["interval_minutes"] = res.data()
            conn["autosync"]["enabled"] = True
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_connection(conn)
            self.populate_list()

        elif res == daily_action:
            current = conn.get("autosync", {})
            if not isinstance(current, dict):
                current = {}
            daily_time, accepted = QInputDialog.getText(
                self,
                "Tägliche Ausführung",
                "Uhrzeit (HH:MM):",
                text=str(current.get("daily_time", DEFAULT_DAILY_TIME)),
            )
            if not accepted:
                return
            timezone_name, accepted = QInputDialog.getText(
                self,
                "Tägliche Ausführung",
                "IANA-Zeitzone:",
                text=str(current.get("timezone", DEFAULT_DAILY_TIMEZONE)),
            )
            if not accepted:
                return
            try:
                parsed_time = parse_daily_time(daily_time)
                tz = resolve_iana_timezone(timezone_name)
            except ValueError as exc:
                QMessageBox.warning(self, "Zeitplan prüfen", str(exc))
                return
            conn["autosync"] = dict(current)
            conn["autosync"].update(
                {
                    "enabled": True,
                    "mode": "daily",
                    "daily_time": parsed_time.strftime("%H:%M"),
                    "timezone": tz.key,
                }
            )
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_connection(conn)
            self.populate_list()

    def _launch_tool_process(self, tool_path):
        """Launch a local Python, batch or executable tool."""
        tool_path = Path(tool_path).expanduser()
        if tool_path.suffix.lower() == ".py":
            launch_cmd = [sys.executable, str(tool_path)]
        elif tool_path.suffix.lower() == ".bat":
            launch_cmd = ["cmd", "/c", str(tool_path)]
        else:
            launch_cmd = [str(tool_path)]

        kwargs = {"cwd": str(tool_path.parent)}
        if sys.platform == "win32":
            kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
        subprocess.Popen(launch_cmd, **kwargs)

    def open_reader(self):
        base_dir = app_base_dir()
        if getattr(sys, "frozen", False):
            reader_path = os.path.join(base_dir, "ProSyncReader.exe")
        else:
            reader_path = os.path.join(base_dir, "ProSyncReader.py")
        if os.path.exists(reader_path):
            self._launch_tool_process(reader_path)
        else:
            QMessageBox.warning(self, "Nicht gefunden",
                              "ProSyncReader wurde nicht gefunden.")

    def launch_profiler(self):
        """Startet ProFiler als optionale Companion-App."""
        base_dir = Path(app_base_dir())
        app_settings = self.cfg.data.get("app", {})
        profiler_path = resolve_profiler_launch_path(
            base_dir,
            app_settings.get("profiler_path", ""),
        )

        if not profiler_path:
            QMessageBox.warning(
                self,
                "ProFiler nicht gefunden",
                "ProFiler konnte nicht automatisch gefunden werden.\n\n"
                "Bitte lege den Pfad in ProSync_config.json unter "
                "'app.profiler_path' fest oder platziere ProFiler neben "
                "ProSync im gemeinsamen Software-Baum."
            )
            return

        try:
            self._launch_tool_process(profiler_path)
            QMessageBox.information(
                self,
                "ProFiler gestartet",
                "ProFiler wurde als optionale Companion-App gestartet.\n\n"
                "ProSync bleibt geöffnet, beide Werkzeuge laufen unabhängig."
            )
        except Exception as e:
            QMessageBox.critical(
                self,
                "Fehler",
                f"Konnte ProFiler nicht starten:\n{str(e)}"
            )

    def closeEvent(self, event):
        if self.tray_icon.isVisible():
            self.hide()
            # V3.2 CHANGED: Verwende zentrale Notification-Methode
            self.notify("ProSync", "Läuft im Hintergrund weiter. Doppelklick auf Tray-Icon zum Öffnen.",
                       self.NotificationType.INFO, 2500)
            event.ignore()
        else:
            event.accept()

    def show_and_raise(self):
        self.show()
        self.raise_()
        self.activateWindow()

    def on_tray_click(self, reason):
        if reason == QSystemTrayIcon.ActivationReason.DoubleClick:
            self.show_and_raise()

    def force_quit(self):
        self.scheduler.stop_all()
        QApplication.quit()


def build_cli_parser():
    """Build the headless ProSync CLI parser."""
    parser = argparse.ArgumentParser(
        prog="ProSync",
        description="Headless ProSync connection runner.",
    )
    action = parser.add_mutually_exclusive_group(required=True)
    action.add_argument(
        "--list",
        action="store_true",
        help="List configured connections without starting the GUI.",
    )
    action.add_argument(
        "--run",
        metavar="ID_OR_NAME",
        help="Run one configured connection by exact ID or exact name.",
    )
    action.add_argument(
        "--all",
        action="store_true",
        help="Run all configured connections sequentially.",
    )
    parser.add_argument(
        "--config",
        default=os.path.join(app_base_dir(), "ProSync_config.json"),
        help="Path to ProSync_config.json. Defaults to the app directory.",
    )
    parser.add_argument(
        "--quiet",
        action="store_true",
        help="Suppress status lines during sync runs.",
    )
    return parser


def _ensure_core_application():
    """Ensure QThread/QObject infrastructure exists for headless workers."""
    app = QCoreApplication.instance()
    if app is None:
        app = QCoreApplication([])
    return app


def _connection_label(conn):
    """Return the best human-readable connection label."""
    name = str(conn.get("name") or "").strip()
    conn_id = str(conn.get("id") or "").strip()
    return name or conn_id or "Unbenannte Verbindung"


def _format_autosync(conn):
    autosync = conn.get("autosync", {})
    if not isinstance(autosync, dict):
        return "off"
    enabled = "on" if autosync.get("enabled") else "off"
    if autosync.get("mode", "interval") == "daily":
        daily_time = autosync.get("daily_time", DEFAULT_DAILY_TIME)
        timezone_name = autosync.get("timezone", DEFAULT_DAILY_TIMEZONE)
        return f"{enabled}/daily {daily_time} {timezone_name}"
    interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
    return f"{enabled}/{interval}m"


def print_cli_connections(connections, stream=None):
    """Print configured connections in a compact, script-friendly table."""
    if stream is None:
        stream = sys.stdout
    if not connections:
        print("Keine Verbindungen konfiguriert.", file=stream)
        return

    print("ID\tName\tTyp\tModus\tAutosync", file=stream)
    for conn in connections:
        print(
            "\t".join(
                [
                    str(conn.get("id", "")),
                    _connection_label(conn),
                    str(conn.get("type", ConnectionType.FOLDER)),
                    str(conn.get("mode", "")),
                    _format_autosync(conn),
                ]
            ),
            file=stream,
        )


def select_cli_connection(connections, selector):
    """Select a connection by exact ID first, then by exact case-insensitive name."""
    selector = str(selector or "").strip()
    if not selector:
        raise ValueError("Keine Verbindung angegeben")

    id_matches = [
        conn for conn in connections
        if str(conn.get("id", "")).strip() == selector
    ]
    if len(id_matches) == 1:
        return id_matches[0]

    selector_fold = selector.casefold()
    name_matches = [
        conn for conn in connections
        if str(conn.get("name", "")).strip().casefold() == selector_fold
    ]
    if len(name_matches) == 1:
        return name_matches[0]
    if len(name_matches) > 1:
        raise ValueError(f"Mehrere Verbindungen heißen '{selector}'. Bitte ID verwenden.")
    raise ValueError(f"Verbindung nicht gefunden: {selector}")


def create_cli_worker(conn):
    """Create the same worker type the GUI uses for a connection."""
    conn_type = conn.get("type", ConnectionType.FOLDER)
    if conn_type == ConnectionType.FILE:
        return FileSyncWorker(conn)
    if conn_type == ConnectionType.SFTP:
        return SftpTargetSyncWorker(conn)

    db = None
    if conn.get("indexing") and conn.get("db_path"):
        try:
            db = ConnectionDB(conn["db_path"])
        except Exception as exc:
            log_warning(f"Warning: Could not open indexing database: {exc}")
    return FolderSyncWorker(conn, db)


def run_headless_connection(conn, quiet=False):
    """Run one configured connection synchronously without opening the GUI."""
    _ensure_core_application()
    worker = create_cli_worker(conn)
    label = _connection_label(conn)
    errors = []
    reports = []
    finished = {"value": False}

    def on_status(message):
        if not quiet:
            print(message, flush=True)

    def on_error(message):
        errors.append(str(message))
        print(f"Fehler [{label}]: {message}", file=sys.stderr, flush=True)

    def on_finished():
        finished["value"] = True

    def on_report(report):
        reports.append(report)
        save_sync_report(report)

    worker.status.connect(on_status)
    worker.error.connect(on_error)
    worker.finished.connect(on_finished)
    if hasattr(worker, "sync_report"):
        worker.sync_report.connect(on_report)

    if not quiet:
        print(f"Starte: {label}", flush=True)
    worker.run()

    if errors:
        return {"ok": False, "errors": errors, "reports": reports}
    if not finished["value"]:
        message = "Sync wurde nicht abgeschlossen"
        print(f"Fehler [{label}]: {message}", file=sys.stderr, flush=True)
        return {"ok": False, "errors": [message], "reports": reports}

    if not quiet:
        print(f"Fertig: {label}", flush=True)
    return {"ok": True, "errors": [], "reports": reports}


def run_headless_connections(connections, quiet=False):
    """Run multiple connections sequentially and stop on the first failure."""
    if not connections:
        print("Keine Verbindungen konfiguriert.", file=sys.stderr)
        return 2

    for index, conn in enumerate(connections, start=1):
        if not quiet:
            print(f"[{index}/{len(connections)}]", flush=True)
        result = run_headless_connection(conn, quiet=quiet)
        if not result["ok"]:
            return 1
    return 0


def run_cli(argv=None):
    """Run ProSync in headless CLI mode."""
    parser = build_cli_parser()
    args = parser.parse_args(argv)

    cfg = ConfigManager(args.config)
    connections = [
        conn for conn in cfg.list_connections()
        if isinstance(conn, dict)
    ]

    if args.list:
        print_cli_connections(connections)
        return 0

    _ensure_core_application()
    lock_file = QLockFile(QDir.temp().filePath("prosync.lock"))
    if not lock_file.tryLock(100):
        print("ProSync läuft bereits. Headless-Sync abgebrochen.", file=sys.stderr)
        return 2

    try:
        if args.run:
            try:
                selected = select_cli_connection(connections, args.run)
            except ValueError as exc:
                print(str(exc), file=sys.stderr)
                return 2
            return run_headless_connections([selected], quiet=args.quiet)

        if args.all:
            return run_headless_connections(connections, quiet=args.quiet)
    finally:
        lock_file.unlock()

    return 2


def main() -> None:
    """
    Haupteinstiegspunkt der ProSync-Anwendung.

    Initialisiert QApplication, ConfigManager und MainWindow.
    Verhindert mehrere Instanzen über QLockFile.
    """
    if len(sys.argv) > 1:
        sys.exit(run_cli(sys.argv[1:]))

    app = QApplication(sys.argv)
    app.setWindowIcon(load_app_icon())
    lock_file = QLockFile(QDir.temp().filePath("prosync.lock"))
    if not lock_file.tryLock(100):
        sys.exit(0)

    app.setQuitOnLastWindowClosed(False)
    app.setStyle("Fusion")

    cfg = ConfigManager(
        os.path.join(app_base_dir(), "ProSync_config.json")
    )

    win = MainWindow(cfg)
    win.show()
    sys.exit(app.exec())

if __name__ == "__main__":
    main()