ProSyncStart_V3.1.py

import sys
import os
import argparse
import ntpath
import json
import uuid
import hashlib
import shutil
import threading
import sqlite3
import time
import subprocess
import re
import posixpath
import stat
from datetime import datetime, timezone
from fnmatch import fnmatch
from pathlib import Path
from PySide6.QtWidgets import (
    QApplication, QMainWindow, QWidget, QVBoxLayout, QListWidget, QListWidgetItem,
    QToolBar, QMenu, QHBoxLayout, QPushButton, QProgressBar, QLabel,
    QDialog, QFormLayout, QLineEdit, QComboBox, QCheckBox, QDialogButtonBox,
    QFileDialog, QMessageBox, QSystemTrayIcon, QStyle, QSizePolicy, QSplitter,
    QAbstractItemView,
    QTextEdit
)
from PySide6.QtCore import Qt, QThread, Signal, QObject, QTimer, QLockFile, QDir, QCoreApplication
from PySide6.QtGui import QAction, QActionGroup, QIcon

# ProSync Logger
from logger import log_debug, log_info, log_warning, log_error


def _configure_windows_utf8_streams() -> None:
    """Use UTF-8 console streams on Windows without replacing capture objects."""
    if sys.platform != 'win32':
        return

    for stream_name in ("stdout", "stderr"):
        stream = getattr(sys, stream_name, None)
        reconfigure = getattr(stream, "reconfigure", None)
        if reconfigure is None:
            continue
        try:
            reconfigure(encoding="utf-8")
        except (AttributeError, OSError, ValueError):
            # Test runners and embedded hosts may expose non-standard streams.
            # Keeping the existing object intact is safer than replacing it.
            pass


# Windows UTF-8 Fix
_configure_windows_utf8_streams()


def app_base_dir() -> str:
    """Return the runtime directory for local and frozen builds."""
    if getattr(sys, "frozen", False):
        return os.path.dirname(sys.executable)
    return os.path.dirname(os.path.abspath(__file__))


WINDOWS_ENV_VAR_PATTERN = re.compile(r"%([^%]+)%")


def normalize_configured_tool_path(base_dir, configured_path):
    """Expand a configured tool path and anchor relative paths at the app root."""
    raw_path = str(configured_path).strip()
    if not raw_path:
        return None

    expanded_raw_path = WINDOWS_ENV_VAR_PATTERN.sub(
        lambda match: os.environ.get(match.group(1), match.group(0)),
        raw_path,
    )
    expanded_path = Path(os.path.expandvars(expanded_raw_path)).expanduser()
    if not expanded_path.is_absolute():
        expanded_path = Path(base_dir).expanduser() / expanded_path
    return expanded_path


def resolve_profiler_launch_path(base_dir, configured_path=""):
    """Resolve the best available ProFiler entrypoint."""
    base_dir = Path(base_dir).expanduser()
    sibling_root = base_dir.parent / "REL-PUB_ProFiler"

    candidates = []
    if configured_path:
        configured = normalize_configured_tool_path(base_dir, configured_path)
        if configured.is_dir():
            candidates.extend([
                configured / "Profiler_Suite_V15.py",
                configured / "ProFiler.exe",
                configured / "dist" / "ProFiler" / "ProFiler.exe",
                configured / "START.bat",
            ])
        else:
            candidates.append(configured)

    candidates.extend([
        base_dir / "Profiler_Suite_V15.py",
        base_dir / "ProFiler.exe",
        base_dir / "START.bat",
        sibling_root / "Profiler_Suite_V15.py",
        sibling_root / "ProFiler.exe",
        sibling_root / "START.bat",
        sibling_root / "dist" / "ProFiler" / "ProFiler.exe",
    ])

    seen = set()
    for candidate in candidates:
        candidate = Path(candidate).expanduser()
        resolved = str(candidate)
        if resolved in seen:
            continue
        seen.add(resolved)
        if candidate.exists():
            return candidate

    return None


def configure_compact_button_accessibility(button, *, name: str, tooltip: str, description: str | None = None) -> None:
    """Keep compact symbol buttons screenreader-friendly without adding permanent labels."""
    button.setToolTip(tooltip)
    button.setStatusTip(tooltip)
    button.setAccessibleName(name)
    button.setAccessibleDescription(description or tooltip)

# Windows Registry Support (Optional)
try:
    import winreg
    HAS_WINREG = True
except ImportError:
    HAS_WINREG = False

# ---------------- CONSTANTS ----------------
DB_CONNECTION_TIMEOUT = 5.0  # Seconds for SQLite database connection timeout
SEARCH_RESULT_LIMIT = 500    # Maximum number of search results
DEFAULT_AUTOSYNC_INTERVAL = 15
PORTABLE_PROFILE_SCHEMA = "prosync-profile-v1"
PORTABLE_PROFILE_APP_VERSION = "3.2"

# FileSyncWorker Progress Percentages
PROGRESS_CHECKPOINT = 10   # WAL checkpoint phase
PROGRESS_PREPARE = 30      # Target directory creation
PROGRESS_COPY = 50         # File copy phase
PROGRESS_VERIFY = 90       # Verification phase
PROGRESS_DONE = 100        # Completion

# Dialog Dimensions
DIALOG_WIDTH = 500         # Default width for ConnectionDialog
DIALOG_HEIGHT = 600        # Default height for ConnectionDialog (increased for safety info)


def default_config_data():
    """Return a fresh default structure for the local configuration file."""
    return {"app": {}, "connections": []}


def portable_path_label(raw_path, fallback):
    """Derive a non-sensitive display label from a local path."""
    value = str(raw_path or "").strip().rstrip("\\/")
    if not value:
        return fallback

    name = ntpath.basename(value) or os.path.basename(value)
    if name:
        return name

    drive, _tail = ntpath.splitdrive(value)
    if drive:
        return f"{drive}\\"
    return fallback


def sync_report_log_path():
    """Return the local report log path used by ProSync."""
    appdata = str(os.environ.get("APPDATA", "") or "").strip()
    base_dir = Path(appdata) if appdata else Path.home()
    if not base_dir.is_absolute():
        base_dir = Path.home()
    reports_dir = base_dir / "ProSync" / "reports"
    return reports_dir / "sync_log.json"


def save_sync_report(report):
    """Persist a sync-run report as JSON and keep the last 100 entries."""
    try:
        reports_dir = sync_report_log_path().parent
        reports_dir.mkdir(parents=True, exist_ok=True)

        log_file = sync_report_log_path()
        if log_file.exists():
            try:
                with open(log_file, "r", encoding="utf-8") as fh:
                    all_reports = json.load(fh)
                if not isinstance(all_reports, list):
                    all_reports = []
            except (json.JSONDecodeError, UnicodeDecodeError, OSError):
                all_reports = []
        else:
            all_reports = []

        all_reports.append(report)
        all_reports = all_reports[-100:]

        tmp_path = str(log_file) + ".tmp"
        with open(tmp_path, "w", encoding="utf-8") as fh:
            json.dump(all_reports, fh, ensure_ascii=False, indent=2)
        os.replace(tmp_path, log_file)

        log_info(
            f"Sync-Report gespeichert: {report['files_copied']} kopiert, "
            f"{report['files_deleted']} gelöscht, "
            f"{report['bytes_copied']:,} Bytes, "
            f"{report['duration_seconds']}s"
        )
    except Exception as exc:
        log_warning(f"Konnte Sync-Report nicht speichern: {exc}")

# ---------------- DATABASE SAFETY MANAGER ----------------
class DatabaseSafetyManager:
    """
    V3.1 IMPROVED: Option D - Separate handling for folder vs. file connections.

    For FOLDER connections:
    - Critical DBs are auto-excluded
    - User gets warning
    - Suggestion to create FILE connection for DB

    For FILE connections:
    - Enforce one-way for critical DBs
    - Auto-enable WAL checkpoint
    - Prevent two-way sync
    """

    # Database file extensions
    DB_EXTENSIONS = {
        ".sqlite", ".sqlite3", ".db", ".db3",
        ".mdb", ".accdb"  # MS Access
    }

    # MS Access lock files
    ACCESS_LOCK_EXTENSIONS = {
        ".ldb", ".laccdb"
    }

    @classmethod
    def is_database_file(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine Datenbank ist (anhand der Dateiendung).

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine bekannte Datenbank-Endung hat
        """
        ext = Path(filepath).suffix.lower()
        return ext in cls.DB_EXTENSIONS

    @classmethod
    def is_access_lock_file(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine MS Access Lock-Datei ist.

        MS Access erstellt .ldb (Access 2003) oder .laccdb (Access 2007+) Lock-Dateien
        wenn eine Datenbank geöffnet ist. Diese sollten nie kopiert werden.

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine MS Access Lock-Datei ist (.ldb, .laccdb)
        """
        ext = Path(filepath).suffix.lower()
        return ext in cls.ACCESS_LOCK_EXTENSIONS

    @classmethod
    def is_sqlite_database(cls, filepath: str) -> bool:
        """
        Prüft ob eine Datei eine SQLite-Datenbank ist (durch Lesen des Headers).

        Liest die ersten 16 Bytes der Datei und prüft auf die SQLite-Magic-Number
        "SQLite format 3". Dies ist zuverlässiger als nur die Dateiendung zu prüfen.

        Args:
            filepath: Pfad zur zu prüfenden Datei

        Returns:
            True wenn die Datei eine gültige SQLite 3 Datenbank ist
        """
        if not os.path.exists(filepath):
            return False
        try:
            with open(filepath, 'rb') as f:
                header = f.read(16)
                return header.startswith(b'SQLite format 3')
        except (OSError, IOError):
            return False

    @classmethod
    def check_wal_mode(cls, db_path: str) -> bool:
        """
        Prüft ob eine SQLite-Datenbank im WAL-Modus läuft.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei

        Returns:
            True wenn die Datenbank im WAL-Modus ist, sonst False
        """
        if not os.path.exists(db_path):
            return False
        # Bugsweep 26 BUG-A1: conn in finally schliessen — bei Exception (z.B. fetchone()[0] auf None)
        # blieb die Connection sonst offen (Handle-Leak auf Nutzer-DB, blockiert spaeteres Kopieren).
        conn = None
        try:
            conn = sqlite3.connect(f"file:{db_path}?mode=ro", uri=True, timeout=DB_CONNECTION_TIMEOUT)
            cur = conn.cursor()
            cur.execute("PRAGMA journal_mode;")
            row = cur.fetchone()
            return bool(row) and row[0].upper() == "WAL"
        except (sqlite3.Error, OSError):
            return False
        finally:
            if conn is not None:
                conn.close()

    @classmethod
    def scan_directory_for_databases(cls, directory: str) -> list:
        """
        Scannt ein Verzeichnis nach Datenbankdateien und analysiert sie.

        Args:
            directory: Pfad zum zu scannenden Verzeichnis

        Returns:
            Liste von Dicts mit Datenbank-Metadaten (type, wal_mode, size_mb, etc.)
        """
        databases = []
        if not os.path.exists(directory):
            return databases

        try:
            for root, dirs, files in os.walk(directory):
                # Skip hidden and cache directories
                dirs[:] = [d for d in dirs if not d.startswith('.') and d != '__pycache__']

                for file in files:
                    filepath = os.path.join(root, file)
                    if cls.is_database_file(filepath):
                        db_info = cls._analyze_database_file(filepath, directory)
                        databases.append(db_info)

        except Exception as e:
            log_error(f"Error scanning directory: {e}")

        return databases

    @classmethod
    def _analyze_database_file(cls, filepath: str, base_directory: str) -> dict:
        """Analysiert eine einzelne Datenbankdatei und gibt Metadaten zurück."""
        db_info = {
            "path": filepath,
            "name": os.path.basename(filepath),
            "relative_path": os.path.relpath(filepath, base_directory),
            "type": "unknown",
            "wal_mode": False,
            "has_wal_files": False,
            "size_mb": 0,
            "is_critical": False
        }

        # Analyze SQLite databases
        if cls.is_sqlite_database(filepath):
            db_info["type"] = "sqlite"
            db_info["wal_mode"] = cls.check_wal_mode(filepath)
            db_info["has_wal_files"] = (
                os.path.exists(filepath + "-wal") or
                os.path.exists(filepath + "-shm")
            )
            db_info["is_critical"] = db_info["wal_mode"] or db_info["has_wal_files"]

        # Analyze MS Access databases
        elif filepath.endswith(('.mdb', '.accdb')):
            db_info["type"] = "ms_access"

        # Get file size
        try:
            db_info["size_mb"] = os.path.getsize(filepath) / (1024 * 1024)
        except OSError:
            pass

        return db_info

    @classmethod
    def apply_safe_settings_folder(cls, conn_config: dict, databases: list) -> tuple:
        """
        V3.1 NEW: Apply safe settings for FOLDER connections.

        Strategy:
        - Exclude critical databases from folder sync
        - Keep two-way for all other files
        - Suggest creating FILE connections for excluded DBs

        Returns: (modified_config, warnings_list, excluded_dbs_list, was_changed)
        """
        warnings = []
        excluded_dbs = []
        was_changed = False

        # Filtere kritische Datenbanken (WAL-Modus oder WAL-Dateien vorhanden)
        critical_dbs = [db for db in databases if db.get("is_critical")]

        if critical_dbs:
            # Initialisiere exclude_patterns falls noch nicht vorhanden
            if "exclude_patterns" not in conn_config:
                conn_config["exclude_patterns"] = []

            # Verwende Set für schnellere Duplikatsprüfung
            current_excludes = set(conn_config["exclude_patterns"])

            for db in critical_dbs:
                db_name = db["name"]

                # Schließe die Datenbankdatei selbst aus
                if db_name not in current_excludes:
                    conn_config["exclude_patterns"].append(db_name)
                    current_excludes.add(db_name)
                    was_changed = True

                # Schließe zugehörige WAL-Dateien aus (SQLite Write-Ahead Log)
                # -wal: Write-Ahead Log Datei
                # -shm: Shared Memory Datei
                # -journal: Rollback Journal (für Non-WAL Mode)
                wal_patterns = [
                    db_name + "-wal",
                    db_name + "-shm",
                    db_name + "-journal"
                ]

                for pattern in wal_patterns:
                    if pattern not in current_excludes:
                        conn_config["exclude_patterns"].append(pattern)
                        current_excludes.add(pattern)
                        was_changed = True

                excluded_dbs.append(db)

            # Add general unsafe patterns
            for pattern in ["*.lock", "*.lck", "*.tmp", ".DS_Store", "Thumbs.db",
                          "__pycache__", "*.pyc"]:
                if pattern not in current_excludes:
                    conn_config["exclude_patterns"].append(pattern)
                    current_excludes.add(pattern)
                    was_changed = True

            if excluded_dbs:
                warnings.append(f"⚠ {len(excluded_dbs)} kritische Datenbank(en) ausgeschlossen")
                warnings.append("💡 Erstelle Datei-Verbindungen für einzelne DB-Sync")

                # Speichere Metadaten über ausgeschlossene DBs für spätere Referenz
                # (z.B. um dem User zu zeigen welche DBs ausgeschlossen wurden)
                conn_config["_auto_excluded_dbs"] = [
                    {
                        "name": db["name"],
                        "size_mb": db["size_mb"],
                        "type": db["type"],
                        "wal_mode": db.get("wal_mode", False),
                        "relative_path": db.get("relative_path", db["name"])
                    }
                    for db in excluded_dbs
                ]

        # MS Access lock files
        access_dbs = [db for db in databases if db.get("type") == "ms_access"]
        if access_dbs:
            lock_patterns = ["*.ldb", "*.laccdb"]
            current_excludes = set(conn_config.get("exclude_patterns", []))

            for pattern in lock_patterns:
                if pattern not in current_excludes:
                    if "exclude_patterns" not in conn_config:
                        conn_config["exclude_patterns"] = []
                    conn_config["exclude_patterns"].append(pattern)
                    was_changed = True

            if was_changed:
                warnings.append("✓ MS Access Lock-Dateien ausgeschlossen (.ldb, .laccdb)")

        # Add safety metadata
        if databases:
            conn_config["_safety_analysis"] = {
                "databases_found": len(databases),
                "critical_databases": len(critical_dbs),
                "excluded_databases": len(excluded_dbs),
                "total_db_size_mb": sum(db.get("size_mb", 0) for db in databases),
                "last_check": datetime.now(timezone.utc).isoformat(),
                "auto_configured": True,
                "version": "3.1",
                "connection_type": "folder"
            }

        return (conn_config, warnings, excluded_dbs, was_changed)

    @classmethod
    def apply_safe_settings_file(cls, conn_config: dict) -> tuple:
        """
        V3.1 NEW: Apply safe settings for FILE connections.

        Strategy:
        - Enforce one-way for critical database files
        - Enable WAL checkpoint for SQLite WAL databases
        - Disable auto-sync by default

        Returns: (modified_config, warnings_list, was_changed)
        """
        warnings = []
        was_changed = False

        source_file = conn_config.get("source_file", "")

        if not source_file or not os.path.exists(source_file):
            return (conn_config, warnings, was_changed)

        filename = os.path.basename(source_file)

        # Check if database file
        if cls.is_database_file(source_file):
            db_info = {
                "name": filename,
                "type": "unknown",
                "wal_mode": False,
                "size_mb": 0,
                "is_critical": False
            }

            # Analyze SQLite
            if cls.is_sqlite_database(source_file):
                db_info["type"] = "sqlite"
                db_info["wal_mode"] = cls.check_wal_mode(source_file)
                db_info["is_critical"] = db_info["wal_mode"]

                # Enable checkpoint for WAL databases
                if db_info["wal_mode"]:
                    if not conn_config.get("checkpoint_before_sync"):
                        conn_config["checkpoint_before_sync"] = True
                        warnings.append("✓ WAL-Checkpoint vor Sync aktiviert")
                        was_changed = True

            elif source_file.endswith(('.mdb', '.accdb')):
                db_info["type"] = "ms_access"

            # Get size
            try:
                db_info["size_mb"] = os.path.getsize(source_file) / (1024 * 1024)
            except OSError:
                pass

            # Enforce one-way for critical databases
            if db_info["is_critical"] or db_info["type"] in ["sqlite", "ms_access"]:
                if conn_config.get("mode") != "one_way":
                    conn_config["mode"] = "one_way"
                    warnings.append("⚠ Modus auf one_way gesetzt (kritische Datenbank)")
                    was_changed = True

                # Disable auto-sync
                if conn_config.get("autosync", {}).get("enabled", False):
                    conn_config["autosync"]["enabled"] = False
                    conn_config["autosync"]["_reason"] = "Manuelle Sync empfohlen für Datenbanken"
                    warnings.append("⚠ Auto-sync deaktiviert (manueller Sync empfohlen)")
                    was_changed = True

            # Add metadata
            conn_config["_file_analysis"] = {
                "filename": filename,
                "type": db_info["type"],
                "size_mb": db_info["size_mb"],
                "wal_mode": db_info.get("wal_mode", False),
                "is_critical": db_info["is_critical"],
                "checkpoint_enabled": conn_config.get("checkpoint_before_sync", False),
                "last_check": datetime.now(timezone.utc).isoformat(),
                "version": "3.1",
                "connection_type": "file"
            }

        return (conn_config, warnings, was_changed)

    @classmethod
    def checkpoint_sqlite_database(cls, db_path: str) -> bool:
        """
        Führt einen WAL-Checkpoint auf einer SQLite-Datenbank aus.

        WAL (Write-Ahead Logging) speichert Änderungen zunächst in einer separaten
        -wal Datei. Ein Checkpoint merged diese Änderungen zurück in die Hauptdatei.
        Dies ist wichtig vor dem Kopieren, um einen konsistenten Zustand zu garantieren.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei

        Returns:
            True wenn erfolgreich, False bei Fehler
        """
        if not os.path.exists(db_path):
            return False

        # Bugsweep 26 BUG-A2: conn in finally schliessen — bei Checkpoint-Fehler (DB gelockt/Rechte)
        # blieb sie sonst offen und das Handle blockierte das anschliessende Kopieren der DB.
        conn = None
        try:
            # Verbinde zur DB mit 30s Timeout (falls gerade gelockt)
            conn = sqlite3.connect(db_path, timeout=30.0)
            conn.execute("PRAGMA wal_checkpoint(FULL);")
            conn.commit()
            log_info(f"✓ WAL checkpoint successful: {os.path.basename(db_path)}")
            return True
        except Exception as e:
            log_warning(f"⚠ WAL checkpoint failed: {e}")
            return False
        finally:
            if conn is not None:
                conn.close()

# ---------------- CONNECTION TYPES (V3.1 NEW) ----------------
class ConnectionType:
    """V3.1 NEW: Connection type constants."""
    FOLDER = "folder"  # Sync entire folder
    FILE = "file"      # Sync single file only
    SFTP = "sftp"      # Sync local folder to SSH/SFTP target


REMOTE_UNSAFE_DATABASE_WARNING = (
    "SFTP-Ziele sind nicht datenbanksicher: WAL-/Lock-Dateien und Remote-"
    "Atomizität können nicht wie bei lokalen Datei-Verbindungen garantiert "
    "werden. Nutze für SQLite/Access lieber eine lokale Datei-Verbindung."
)


def normalize_remote_path(path):
    """Normalize a configured SFTP path without applying local filesystem rules."""
    raw = str(path or "").strip().replace("\\", "/")
    if not raw:
        return ""
    normalized = posixpath.normpath(raw)
    if raw.startswith("/") and not normalized.startswith("/"):
        normalized = "/" + normalized
    return normalized.rstrip("/") or "/"


def join_remote_path(root, rel_path=""):
    """Join remote POSIX path fragments for SFTP operations."""
    root = normalize_remote_path(root)
    rel = str(rel_path or "").replace("\\", "/").strip("/")
    if not rel:
        return root
    return posixpath.join(root, rel)


def sftp_connection_display(conn):
    """Return a secret-free SFTP endpoint label."""
    user = str(conn.get("remote_username", "") or "").strip()
    host = str(conn.get("remote_host", "") or "").strip()
    try:
        port = int(conn.get("remote_port") or 22)
    except (TypeError, ValueError):
        port = 22
    remote = normalize_remote_path(conn.get("target", ""))
    user_prefix = f"{user}@" if user else ""
    port_suffix = f":{port}" if port != 22 else ""
    if not host:
        return remote or "?"
    return f"{user_prefix}{host}{port_suffix}:{remote}"


def validate_sftp_connection(conn):
    """Validate SFTP target configuration and reject unsafe sync modes."""
    source = str(conn.get("source", "") or "").strip()
    target = normalize_remote_path(conn.get("target", ""))
    host = str(conn.get("remote_host", "") or "").strip()
    if not source:
        raise ValueError("SFTP-Quelle fehlt")
    if not os.path.isdir(source):
        raise ValueError(f"SFTP-Quelle ist kein Ordner: {source}")
    if not host:
        raise ValueError("SFTP-Host fehlt")
    if not target:
        raise ValueError("SFTP-Zielpfad fehlt")
    mode = conn.get("mode", "update")
    if mode not in ("mirror", "update", "one_way"):
        raise ValueError("SFTP unterstützt nur mirror, update oder one_way")
    if conn.get("checkpoint_before_sync"):
        raise ValueError(REMOTE_UNSAFE_DATABASE_WARNING)
    return True

# ---------------- AUTOSTART MANAGER ----------------
class AutostartManager:
    """
    Verwaltet den Windows-Autostart für ProSync über die Registry.

    Nutzt den Run-Schlüssel in HKEY_CURRENT_USER um die Anwendung
    beim Windows-Start automatisch zu starten. Windows-spezifisch (winreg).
    """

    APP_NAME = "ProSync"

    @staticmethod
    def set_autostart(enable=True):
        """
        Aktiviert oder deaktiviert den Windows-Autostart für ProSync.

        Args:
            enable: True = Autostart aktivieren, False = deaktivieren

        Returns:
            True bei Erfolg, False bei Fehler oder fehlender winreg-Unterstützung
        """
        if not HAS_WINREG: return False
        try:
            key = winreg.OpenKey(winreg.HKEY_CURRENT_USER,
                                 r"Software\Microsoft\Windows\CurrentVersion\Run",
                                 0, winreg.KEY_SET_VALUE)
            if enable:
                if getattr(sys, 'frozen', False):
                    exe_path = f'"{sys.executable}"'
                else:
                    script_path = os.path.abspath(__file__)
                    exe_path = f'"{sys.executable}" "{script_path}"'
                winreg.SetValueEx(key, AutostartManager.APP_NAME, 0, winreg.REG_SZ, exe_path)
            else:
                try:
                    winreg.DeleteValue(key, AutostartManager.APP_NAME)
                except FileNotFoundError: pass
            winreg.CloseKey(key)
            return True
        except Exception as e:
            log_error(f"Registry Fehler: {e}")
            return False

    @staticmethod
    def is_autostart_enabled():
        """
        Prüft ob ProSync im Windows-Autostart eingetragen ist.

        Returns:
            True wenn Autostart aktiv, False sonst
        """
        if not HAS_WINREG: return False
        try:
            key = winreg.OpenKey(winreg.HKEY_CURRENT_USER,
                                 r"Software\Microsoft\Windows\CurrentVersion\Run",
                                 0, winreg.KEY_READ)
            winreg.QueryValueEx(key, AutostartManager.APP_NAME)
            winreg.CloseKey(key)
            return True
        except (FileNotFoundError, OSError):
            return False

# ---------------- CONFIG ----------------
class ConfigManager:
    """
    Verwaltet die ProSync-Konfigurationsdatei (JSON).

    Die Konfiguration enthält App-Einstellungen und alle Sync-Verbindungen.
    Automatisches Laden/Speichern bei Änderungen.
    """

    def __init__(self, path):
        """
        Initialisiert den ConfigManager und lädt die Konfiguration.

        Args:
            path: Pfad zur Konfigurationsdatei (ProSync_config.json)
        """
        self.path = path
        self.data = default_config_data()
        self.load()

    def load(self):
        """
        Lädt die Konfiguration aus der JSON-Datei.

        Bei Fehler oder fehlender Datei wird eine neue Config erstellt.
        """
        if os.path.exists(self.path):
            try:
                with open(self.path, "r", encoding="utf-8") as f:
                    loaded = json.load(f)
                if not isinstance(loaded, dict):
                    log_error(
                        "Config load error: expected JSON object root, "
                        f"got {type(loaded).__name__}"
                    )
                    self.data = default_config_data()
                    self.save()
                    return
                self.data = loaded
                if not isinstance(self.data.get("app"), dict):
                    self.data["app"] = {}
                if not isinstance(self.data.get("connections"), list):
                    self.data["connections"] = []
            except (json.JSONDecodeError, OSError, UnicodeDecodeError) as e:
                log_error(f"Config load error: {e}")
                self.data = default_config_data()
                self.save()
        else:
            self.save()

    def save(self):
        """
        Speichert die Konfiguration in die JSON-Datei.

        Erstellt das Verzeichnis falls es nicht existiert.
        """
        os.makedirs(os.path.dirname(self.path) or ".", exist_ok=True)
        # Bugsweep 26 BUG-A3: atomar schreiben (tmp + os.replace), sonst korrupte config.json bei
        # Absturz/OneDrive-Lock mitten im json.dump.
        tmp = f"{self.path}.tmp"
        with open(tmp, "w", encoding="utf-8") as f:
            json.dump(self.data, f, indent=2, ensure_ascii=False)
        os.replace(tmp, self.path)

    def list_connections(self):
        """
        Gibt alle gespeicherten Sync-Verbindungen zurück.

        Returns:
            Liste von Connection-Dicts
        """
        return self.data.get("connections", [])

    def add_or_update_connection(self, conn):
        """
        Fügt eine neue Verbindung hinzu oder aktualisiert eine bestehende.

        Die Verbindung wird anhand der ID identifiziert. Speichert automatisch.

        Args:
            conn: Connection-Dict mit mindestens {"id": "..."}
        """
        conns = self.data.get("connections", [])
        found = False
        for i, c in enumerate(conns):
            if c.get("id") == conn.get("id"):
                conns[i] = conn
                found = True
                break
        if not found:
            conns.append(conn)
        self.data["connections"] = conns
        self.save()

    def remove_connection(self, conn_id):
        """
        Entfernt eine Verbindung anhand der ID.

        Args:
            conn_id: ID der zu entfernenden Verbindung
        """
        self.data["connections"] = [c for c in self.data.get("connections", [])
                                    if c.get("id") != conn_id]
        self.save()

    @staticmethod
    def _portable_path_hints(conn):
        """Build redacted path hints for a portable profile export."""
        conn_type = conn.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            return {
                "source_label": portable_path_label(conn.get("source_file", ""), "Quelldatei"),
                "target_label": portable_path_label(conn.get("target_file", ""), "Zieldatei"),
            }
        if conn_type == ConnectionType.SFTP:
            return {
                "source_label": portable_path_label(conn.get("source", ""), "Quellordner"),
                "target_label": portable_path_label(conn.get("target", ""), "SFTP-Ziel"),
            }

        hints = {
            "source_label": portable_path_label(conn.get("source", ""), "Quellordner"),
            "target_label": portable_path_label(conn.get("target", ""), "Zielordner"),
        }
        if conn.get("indexing"):
            hints["db_label"] = portable_path_label(conn.get("db_path", ""), "Indexdatenbank")
        return hints

    @staticmethod
    def _portable_safety_summary(conn):
        """Reduce local safety metadata to a redacted summary."""
        if "_safety_analysis" in conn and isinstance(conn["_safety_analysis"], dict):
            safety = conn["_safety_analysis"]
            return {
                "kind": "folder",
                "databases_found": int(safety.get("databases_found", 0)),
                "critical_databases": int(safety.get("critical_databases", 0)),
                "excluded_databases": int(safety.get("excluded_databases", 0)),
                "total_db_size_mb": round(float(safety.get("total_db_size_mb", 0)), 2),
            }

        if "_file_analysis" in conn and isinstance(conn["_file_analysis"], dict):
            analysis = conn["_file_analysis"]
            return {
                "kind": "file",
                "type": analysis.get("type", "unknown"),
                "wal_mode": bool(analysis.get("wal_mode", False)),
                "is_critical": bool(analysis.get("is_critical", False)),
                "size_mb": round(float(analysis.get("size_mb", 0)), 2),
            }
        return None

    @staticmethod
    def _portable_report_snapshot():
        """Read the local sync-report log and expose only report-safe metadata."""
        log_file = sync_report_log_path()
        if not log_file.exists():
            return {"count": 0, "latest": None}

        try:
            with open(log_file, "r", encoding="utf-8") as fh:
                reports = json.load(fh)
        except (OSError, json.JSONDecodeError, UnicodeDecodeError):
            return {"count": 0, "latest": None}

        if not isinstance(reports, list):
            return {"count": 0, "latest": None}

        latest = reports[-1] if reports else None
        if not isinstance(latest, dict):
            latest = None

        latest_summary = None
        if latest:
            latest_summary = {
                "connection": latest.get("connection", ""),
                "connection_id": latest.get("connection_id", ""),
                "mode": latest.get("mode", ""),
                "started_at": latest.get("started_at", ""),
                "duration_seconds": latest.get("duration_seconds", 0),
                "files_copied": latest.get("files_copied", 0),
                "files_deleted": latest.get("files_deleted", 0),
                "files_skipped": latest.get("files_skipped", 0),
                "bytes_copied": latest.get("bytes_copied", 0),
                "total_actions": latest.get("total_actions", 0),
            }

        return {"count": len(reports), "latest": latest_summary}

    @staticmethod
    def _portable_autosync(conn):
        """Normalize autosync settings for export without leaking local runtime state."""
        autosync = conn.get("autosync", {})
        interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
        try:
            interval = int(interval)
        except (TypeError, ValueError):
            interval = DEFAULT_AUTOSYNC_INTERVAL
        return {
            "enabled": bool(autosync.get("enabled", False)),
            "interval_minutes": max(1, interval),
        }

    @staticmethod
    def _portable_patterns(conn):
        """Normalize exclude patterns for export to avoid character-wise string splitting."""
        raw_patterns = conn.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            raw_patterns = [raw_patterns]
        elif not isinstance(raw_patterns, (list, tuple)):
            raw_patterns = []
        return [str(pattern) for pattern in raw_patterns if str(pattern).strip()]

    def _build_portable_connection(self, conn):
        """Create one redacted portable connection entry."""
        conn_type = conn.get("type", ConnectionType.FOLDER)
        default_mode = "one_way" if conn_type == ConnectionType.FILE else "mirror"
        if conn_type == ConnectionType.SFTP:
            default_mode = "update"
        portable = {
            "id": conn.get("id", ""),
            "name": conn.get("name", ""),
            "type": conn_type,
            "mode": conn.get("mode", default_mode),
            "exclude_patterns": self._portable_patterns(conn),
            "autosync": self._portable_autosync(conn),
            "path_hints": self._portable_path_hints(conn),
        }

        if conn_type == ConnectionType.FILE:
            portable["checkpoint_before_sync"] = bool(conn.get("checkpoint_before_sync", False))
        elif conn_type == ConnectionType.SFTP:
            portable["conflict_policy"] = "source"
            portable["indexing"] = False
            portable["remote_warning"] = REMOTE_UNSAFE_DATABASE_WARNING
        else:
            portable["conflict_policy"] = conn.get("conflict_policy", "source")
            portable["indexing"] = bool(conn.get("indexing", True))

        safety_summary = self._portable_safety_summary(conn)
        if safety_summary:
            portable["safety_summary"] = safety_summary

        return portable

    def export_portable_profile(self, export_path):
        """Write the redacted exchange format `prosync-profile-v1.json`."""
        payload = {
            "schema": PORTABLE_PROFILE_SCHEMA,
            "exported_at": datetime.now(timezone.utc).isoformat(),
            "exported_from": {
                "app": "ProSync",
                "version": PORTABLE_PROFILE_APP_VERSION,
            },
            "app": {
                "notifications_enabled": bool(
                    self.data.get("app", {}).get("notifications_enabled", True)
                )
            },
            "connections": [
                self._build_portable_connection(conn)
                for conn in self.data.get("connections", [])
                if isinstance(conn, dict)
            ],
            "reports": self._portable_report_snapshot(),
        }

        os.makedirs(os.path.dirname(export_path) or ".", exist_ok=True)
        # BUG-U4: atomar (tmp + os.replace) — kein korruptes Export-Profil bei Absturz mid-write
        tmp_path = export_path + ".tmp"
        with open(tmp_path, "w", encoding="utf-8") as fh:
            json.dump(payload, fh, ensure_ascii=False, indent=2)
        os.replace(tmp_path, export_path)
        return payload

    def _portable_to_local_connection(self, portable_conn, existing_ids):
        """Convert one portable profile entry back to a local editable connection."""
        if not isinstance(portable_conn, dict):
            raise ValueError("Ungültiger Verbindungs-Eintrag im Austauschformat")

        conn_type = portable_conn.get("type", ConnectionType.FOLDER)
        if conn_type not in (ConnectionType.FOLDER, ConnectionType.FILE, ConnectionType.SFTP):
            conn_type = ConnectionType.FOLDER

        original_id = str(portable_conn.get("id") or uuid.uuid4())
        conn_id = original_id
        renamed = False
        if conn_id in existing_ids:
            conn_id = f"import-{uuid.uuid4().hex[:8]}"
            renamed = True
        existing_ids.add(conn_id)

        autosync = portable_conn.get("autosync", {})
        interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
        try:
            interval = int(interval)
        except (TypeError, ValueError):
            interval = DEFAULT_AUTOSYNC_INTERVAL

        raw_patterns = portable_conn.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            raw_patterns = [raw_patterns]
        elif not isinstance(raw_patterns, (list, tuple)):
            raw_patterns = []

        default_mode = "one_way" if conn_type == ConnectionType.FILE else "mirror"
        if conn_type == ConnectionType.SFTP:
            default_mode = "update"

        imported_conn = {
            "id": conn_id,
            "name": str(portable_conn.get("name") or "Importierte Aufgabe").strip() or "Importierte Aufgabe",
            "type": conn_type,
            "mode": portable_conn.get("mode", default_mode),
            "exclude_patterns": [
                str(pattern)
                for pattern in raw_patterns
                if str(pattern).strip()
            ],
            "autosync": {
                "enabled": False,
                "interval_minutes": max(1, interval),
                "_reason": "Pfadzuordnung nach Import erforderlich",
            },
            "_portable_import": {
                "schema": PORTABLE_PROFILE_SCHEMA,
                "imported_at": datetime.now(timezone.utc).isoformat(),
                "original_id": original_id,
                "requires_mapping": True,
                "path_hints": portable_conn.get("path_hints", {}),
            },
        }

        safety_summary = portable_conn.get("safety_summary")
        if isinstance(safety_summary, dict):
            imported_conn["_portable_import"]["safety_summary"] = safety_summary

        if conn_type == ConnectionType.FILE:
            imported_conn["source_file"] = ""
            imported_conn["target_file"] = ""
            imported_conn["checkpoint_before_sync"] = bool(
                portable_conn.get("checkpoint_before_sync", False)
            )
        elif conn_type == ConnectionType.SFTP:
            imported_conn["source"] = ""
            imported_conn["target"] = ""
            imported_conn["remote_host"] = ""
            imported_conn["remote_port"] = 22
            imported_conn["remote_username"] = ""
            imported_conn["remote_key_file"] = ""
            imported_conn["indexing"] = False
            imported_conn["conflict_policy"] = "source"
            imported_conn["remote_warning"] = REMOTE_UNSAFE_DATABASE_WARNING
        else:
            imported_conn["source"] = ""
            imported_conn["target"] = ""
            imported_conn["db_path"] = ""
            imported_conn["indexing"] = bool(portable_conn.get("indexing", True))
            imported_conn["conflict_policy"] = portable_conn.get("conflict_policy", "source")

        return imported_conn, renamed

    def import_portable_profile(self, import_path):
        """Import a redacted portable profile without restoring private local paths."""
        # Bugsweep 26 BUG-A4: open() im try (fehlendes open -> ValueError statt rohem OSError).
        try:
            with open(import_path, "r", encoding="utf-8") as fh:
                payload = json.load(fh)
        except (json.JSONDecodeError, OSError, UnicodeDecodeError):
            raise ValueError("Austauschdatei enthält kein gültiges JSON")

        if not isinstance(payload, dict):
            raise ValueError("Austauschdatei muss ein JSON-Objekt enthalten")
        if payload.get("schema") != PORTABLE_PROFILE_SCHEMA:
            raise ValueError("Unbekanntes Austauschformat")

        connections = payload.get("connections", [])
        if not isinstance(connections, list):
            raise ValueError("Austauschdatei enthält keine gültige Verbindungsliste")

        app_settings = payload.get("app", {})
        if not isinstance(self.data.get("app"), dict):
            self.data["app"] = {}
        if isinstance(app_settings, dict) and isinstance(
            app_settings.get("notifications_enabled"), bool
        ):
            self.data["app"]["notifications_enabled"] = app_settings["notifications_enabled"]

        existing_ids = {
            conn.get("id")
            for conn in self.data.get("connections", [])
            if isinstance(conn, dict) and conn.get("id")
        }
        imported = []
        renamed = 0
        for portable_conn in connections:
            local_conn, did_rename = self._portable_to_local_connection(
                portable_conn,
                existing_ids,
            )
            if did_rename:
                renamed += 1
            imported.append(local_conn)

        self.data["connections"] = self.data.get("connections", []) + imported
        self.save()
        return {"imported": len(imported), "renamed": renamed}


class BatchSyncQueue:
    """
    Verwaltet einen deduplizierten Batch-Lauf aus mehreren Verbindungen.

    Die Queue arbeitet Verbindungen in der Auswahl-Reihenfolge ab und
    verhindert doppelte IDs innerhalb desselben Batch-Laufs.
    """

    def __init__(self):
        self.reset()

    def reset(self):
        """Setzt den kompletten Batch-Status zurück."""
        self.pending = []
        self.current = None
        self.completed = []
        self.total = 0

    def start(self, connections):
        """
        Initialisiert einen neuen Batch-Lauf.

        Args:
            connections: Ausgewählte Connection-Dicts

        Returns:
            Deduplizierte Liste der geplanten Verbindungen
        """
        self.reset()
        seen_ids = set()
        for conn in connections:
            conn_id = conn.get("id")
            if not conn_id or conn_id in seen_ids:
                continue
            seen_ids.add(conn_id)
            self.pending.append(conn)
        self.total = len(self.pending)
        return list(self.pending)

    @property
    def active(self):
        """True, solange noch Batch-Arbeit läuft oder aussteht."""
        return self.current is not None or bool(self.pending)

    @property
    def completed_count(self):
        """Anzahl bereits erfolgreich abgearbeiteter Verbindungen."""
        return len(self.completed)

    @property
    def remaining_count(self):
        """Anzahl noch nicht gestarteter Verbindungen."""
        return len(self.pending)

    def next_connection(self):
        """
        Gibt die nächste Verbindung für den Batch-Lauf zurück.

        Returns:
            Connection-Dict oder None wenn nichts mehr aussteht
        """
        if self.current is not None:
            return self.current
        if not self.pending:
            return None
        self.current = self.pending.pop(0)
        return self.current

    def mark_current_finished(self):
        """
        Markiert die aktuelle Batch-Verbindung als erfolgreich abgeschlossen.

        Returns:
            Die abgeschlossene Verbindung oder None
        """
        if self.current is None:
            return None
        finished = self.current
        self.completed.append(finished)
        self.current = None
        return finished

    def cancel_pending(self):
        """
        Verwirft alle noch wartenden Batch-Verbindungen.

        Returns:
            Liste der verworfenen Verbindungen
        """
        skipped = list(self.pending)
        self.pending.clear()
        return skipped

# ---------------- DB ----------------
DDL = """
CREATE TABLE IF NOT EXISTS files(id INTEGER PRIMARY KEY, content_hash TEXT UNIQUE, size INTEGER, mime TEXT, first_seen TEXT);
CREATE TABLE IF NOT EXISTS versions(id INTEGER PRIMARY KEY, file_id INTEGER, name TEXT, path TEXT, mtime TEXT, ctime TEXT, version_index INTEGER, source_side TEXT);
CREATE TABLE IF NOT EXISTS tags(id INTEGER PRIMARY KEY, file_id INTEGER, tag TEXT);
CREATE TABLE IF NOT EXISTS events(id INTEGER PRIMARY KEY, file_id INTEGER, event_type TEXT, details TEXT, ts TEXT);
"""

class ConnectionDB:
    """
    Indexierungs-Datenbank für ProSync-Verbindungen.

    Speichert Dateiversionen, Hashes, Tags und Events für Suchfunktion.
    V3 IMPROVED: WAL checkpoint on close, 30s timeout, busy_timeout.
    """

    def __init__(self, db_path):
        """
        Initialisiert die Indexierungs-Datenbank.

        Args:
            db_path: Pfad zur SQLite-Datenbankdatei
        """
        self.db_path = db_path
        os.makedirs(os.path.dirname(db_path) or ".", exist_ok=True)
        # V3 FIX: Added timeout and better isolation
        self.conn = sqlite3.connect(
            db_path,
            check_same_thread=False,
            timeout=30.0  # V3: Prevent immediate lock errors
        )
        self.conn.execute("PRAGMA busy_timeout=30000;")  # V3: 30 second busy timeout
        self.conn.executescript(DDL)
        # Bugsweep 26 BUG-db (KRITISCH): check_same_thread=False erlaubt Cross-Thread-Zugriff
        # (Worker-Thread loggt via _db_log, Main-Thread kann parallel lesen) -> ohne Serialisierung
        # drohen "recursive use of cursors"/Korruption. RLock (reentrant, da log_version->get_file_id).
        self._lock = threading.RLock()

    def close(self):
        """V3 IMPROVED: WAL checkpoint before close."""
        with self._lock:
            if self.conn:
                try:
                    # V3 FIX: Checkpoint WAL to merge changes
                    self.conn.execute("PRAGMA wal_checkpoint(FULL);")
                    self.conn.commit()
                except Exception as e:
                    log_warning(f"Warning: WAL checkpoint failed: {e}")
                finally:
                    self.conn.close()
                    self.conn = None  # Bugsweep 27: Guard damit doppelter close()-Aufruf sauber abbricht

    def get_file_id(self, content_hash, size):
        """
        Gibt die ID einer Datei anhand ihres Hash zurück oder erstellt einen neuen Eintrag.

        Args:
            content_hash: SHA256-Hash der Datei
            size: Größe der Datei in Bytes

        Returns:
            File-ID (Integer)
        """
        with self._lock:
            cur = self.conn.cursor()
            cur.execute("SELECT id FROM files WHERE content_hash=?", (content_hash,))
            row = cur.fetchone()
            if row: return row[0]
            ts = datetime.now(timezone.utc).isoformat()
            cur.execute("INSERT INTO files(content_hash,size,first_seen) VALUES (?,?,?)",
                       (content_hash, size, ts))
            self.conn.commit()
            return cur.lastrowid

    def log_version(self, name, path, mtime, size, content_hash, side):
        """
        Loggt eine neue Dateiversionen in die Datenbank.

        Args:
            name: Dateiname
            path: Pfad zur Datei
            mtime: Modification Time (ISO-Format)
            size: Größe in Bytes
            content_hash: SHA256-Hash
            side: "source" oder "target"

        Returns:
            File-ID (Integer)
        """
        with self._lock:
            fid = self.get_file_id(content_hash, size)
            cur = self.conn.cursor()
            cur.execute("SELECT id, version_index FROM versions WHERE path=? AND mtime=?",
                       (path, mtime))
            if cur.fetchone():
                return fid

            cur.execute("SELECT MAX(version_index) FROM versions WHERE file_id=?", (fid,))
            res = cur.fetchone()
            idx = (res[0] + 1) if res and res[0] else 1

            ctime = datetime.now(timezone.utc).isoformat()
            self.conn.execute(
                "INSERT INTO versions(file_id,name,path,mtime,ctime,version_index,source_side) VALUES (?,?,?,?,?,?,?)",
                (fid, name, path, mtime, ctime, idx, side)
            )
            self.conn.commit()
            return fid

    def add_tag(self, fid, tag):
        """
        Fügt einen Tag zu einer Datei hinzu.

        Args:
            fid: File-ID
            tag: Tag-String
        """
        with self._lock:
            self.conn.execute("INSERT OR IGNORE INTO tags(file_id,tag) VALUES (?,?)", (fid, tag))
            self.conn.commit()

# ---------------- SYNC LOGIC ----------------
def sha256_file(path: str, chunk_size: int = 1024*1024) -> str:
    """
    Berechnet SHA256-Hash einer Datei mit chunk-basiertem Lesen.

    Args:
        path: Pfad zur Datei
        chunk_size: Größe der gelesenen Chunks in Bytes (Standard: 1MB)

    Returns:
        SHA256-Hash als Hexadezimal-String, oder "ERROR" bei Fehler
    """
    h = hashlib.sha256()
    try:
        with open(path, "rb") as f:
            while chunk := f.read(chunk_size):
                h.update(chunk)
    except (OSError, PermissionError) as e:
        log_error(f"Hash error for {path}: {e}")
        return "ERROR"
    return h.hexdigest()

class SyncWalker:
    """V3 IMPROVED: Better pattern matching for excludes."""
    def scan(self, root_path, exclude_patterns=None):
        """
        Scannt ein Verzeichnis und erstellt einen File-Tree.

        V3 NEW: Unterstützt glob-style Exclude-Patterns.

        Args:
            root_path: Wurzelverzeichnis zum Scannen
            exclude_patterns: Liste von Glob-Patterns (z.B. ["*.sqlite-wal", "__pycache__"])

        Returns:
            Dict mit relativem Pfad als Key und File-Metadaten als Value
            Format: {rel_path: {"mtime": float, "size": int, "abs_path": str}}
        """
        if exclude_patterns is None:
            exclude_patterns = []

        tree = {}
        if not os.path.exists(root_path):
            return tree

        for root, dirs, files in os.walk(root_path):
            # V3 FIX: Filter directories
            dirs[:] = [d for d in dirs if not self._should_exclude(d, exclude_patterns)]

            for f in files:
                # V3 FIX: Check exclude patterns
                if self._should_exclude(f, exclude_patterns):
                    continue

                abs_p = os.path.join(root, f)
                rel_p = os.path.relpath(abs_p, root_path)

                try:
                    stat = os.stat(abs_p)
                    tree[rel_p] = {
                        "mtime": stat.st_mtime,
                        "size": stat.st_size,
                        "abs_path": abs_p
                    }
                except OSError:
                    # File may have been deleted during scan
                    pass

        return tree

    def _should_exclude(self, name: str, patterns: list) -> bool:
        """
        Prüft ob eine Datei/Ordner ausgeschlossen werden soll.

        V3 NEW: Verwendet fnmatch für Glob-Pattern-Matching.

        Args:
            name: Datei- oder Ordnername (nicht vollständiger Pfad)
            patterns: Liste von Glob-Patterns (z.B. ["*.wal", "temp_*"])

        Returns:
            True wenn der Name auf ein Pattern matcht, sonst False
        """
        for pattern in patterns:
            if fnmatch(name, pattern):
                return True
        return False


def _atomic_copy2(src, dst):
    """Bugsweep 26 BUG-copy (KRITISCH): atomar kopieren — tmp + os.replace statt direktem
    shutil.copy2. Ein Absturz/kill mitten in copy2 hinterliess sonst eine HALBE Zieldatei (fuer
    SQLite-DBs — dem Haupt-Use-Case — fatal: korrupter Header). os.replace ist atomar auf gleichem
    Volume; bei Fehler wird die tmp-Datei aufgeraeumt."""
    tmp = f"{dst}.prosync_tmp"
    try:
        shutil.copy2(src, tmp)
        os.replace(tmp, dst)
    except BaseException:
        try:
            if os.path.exists(tmp):
                os.remove(tmp)
        except OSError:
            pass
        raise


class FileSyncWorker(QThread):
    """
    V3.1 NEW: Worker for single-file synchronization.

    Simplified logic:
    - Only syncs one file
    - Supports one-way mode
    - WAL checkpoint before sync
    - No directory scanning needed
    """

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)

    def __init__(self, cfg):
        super().__init__()
        self.cfg = cfg
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False

    def run(self):
        try:
            source_file = self.cfg.get("source_file", "")
            target_file = self.cfg.get("target_file", "")

            if not source_file or not target_file:
                self.error.emit("Quell- oder Ziel-Datei nicht angegeben")
                return

            # Check if source exists
            if not os.path.exists(source_file):
                self.error.emit(f"Quelldatei nicht gefunden: {source_file}")
                return

            filename = os.path.basename(source_file)
            self.status.emit(f"[{self.cfg.get('name')}] Bereite Sync vor...")

            # Step 1: WAL Checkpoint if needed
            if self.cfg.get("checkpoint_before_sync"):
                self.progress.emit(PROGRESS_CHECKPOINT, "checkpoint")
                self.status.emit(f"Checkpoint: {filename}")

                if DatabaseSafetyManager.checkpoint_sqlite_database(source_file):
                    self.status.emit(f"✓ Checkpoint erfolgreich: {filename}")
                else:
                    self.status.emit(f"⚠ Checkpoint fehlgeschlagen (Sync wird fortgesetzt)")

            if self.is_killed:
                return

            # Step 2: Create target directory
            self.progress.emit(PROGRESS_PREPARE, "prepare")
            target_dir = os.path.dirname(target_file)
            if target_dir:
                os.makedirs(target_dir, exist_ok=True)

            # Step 3: Copy file
            self.progress.emit(PROGRESS_COPY, "copy")
            self.status.emit(f"Kopiere: {filename}")

            try:
                _atomic_copy2(source_file, target_file)
                self.status.emit(f"✓ Datei kopiert: {filename}")
            except (OSError, IOError, PermissionError, shutil.Error) as e:
                self.error.emit(f"Fehler beim Kopieren: {e}")
                return

            # Step 4: Verify
            self.progress.emit(PROGRESS_VERIFY, "verify")

            if os.path.exists(target_file):
                src_size = os.path.getsize(source_file)
                tgt_size = os.path.getsize(target_file)

                if src_size == tgt_size:
                    self.status.emit(f"✓ Verifizierung erfolgreich ({src_size:,} Bytes)")
                else:
                    self.error.emit(f"Größen stimmen nicht überein! ({src_size} vs {tgt_size})")
                    return

            if self.is_killed:
                return

            # Done!
            self.progress.emit(PROGRESS_DONE, "done")
            self.status.emit(f"✓ Sync abgeschlossen: {filename}")
            self.finished.emit()

        except Exception as e:
            self.error.emit(f"Fehler: {str(e)}")

    def kill(self):
        """Stoppt den Worker sofort (bei nächster Prüfung)."""
        self.is_killed = True

    def pause(self):
        """Pausiert den Worker."""
        self.is_paused = True

    def resume(self):
        """Setzt den Worker fort."""
        self.is_paused = False

# ---------------- FOLDER SYNC WORKER (V3.1 IMPROVED) ----------------

class FolderSyncWorker(QThread):
    """
    V3.1 IMPROVED: Worker for folder synchronization.

    Now respects exclude_patterns for databases.
    """

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)
    sync_report = Signal(dict)  # emits report dict after each run

    def __init__(self, cfg, db=None):
        super().__init__()
        self.cfg = cfg
        self.db = db  # Optional database for indexing
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False
        self._last_pct = -1

    def run(self):
        try:
            mode = self.cfg.get("mode", "two_way")
            conflict_policy = self.cfg.get("conflict_policy", "source")
            src_root = self.cfg["source"]
            tgt_root = self.cfg["target"]

            # V3.1: Get exclude patterns
            exclude_patterns = self.cfg.get("exclude_patterns", [])

            # 1. Scan
            self.status.emit(f"[{self.cfg['name']}] Scanne Quelle...")
            src_tree = SyncWalker().scan(src_root, exclude_patterns)

            tgt_tree = {}
            if mode != "index_only":
                self.status.emit(f"[{self.cfg['name']}] Scanne Ziel...")
                tgt_tree = SyncWalker().scan(tgt_root, exclude_patterns)

            # 2. Compare
            self.status.emit(f"[{self.cfg['name']}] Vergleiche...")
            all_files = set(src_tree.keys()) | set(tgt_tree.keys())
            actions = []

            for f in all_files:
                in_src = f in src_tree
                in_tgt = f in tgt_tree

                if in_src and not in_tgt:
                    if mode in ["mirror", "update", "two_way"]:
                        actions.append(("COPY_L2R", f))
                    elif mode == "index_only":
                        actions.append(("INDEX_SRC", f))

                elif in_tgt and not in_src:
                    if mode == "mirror":
                        actions.append(("DELETE_R", f))
                    elif mode == "two_way":
                        actions.append(("COPY_R2L", f))

                elif in_src and in_tgt:
                    s_meta = src_tree[f]
                    t_meta = tgt_tree[f]

                    # BUGSWEEP-26 REVIEW-NOTIZ (NICHT auto-gefixt — User-Entscheidung): mode=="one_way"
                    # faellt hier durch ALLE Branches -> fuer geaenderte Dateien wird keine Action
                    # erzeugt (stiller No-Op im FolderSyncWorker; one_way existiert aber im Dialog/
                    # FileSyncWorker). Ob das Absicht ist (one_way nur fuer Einzeldatei) oder fehlende
                    # Implementierung, muss fachlich geklaert werden -> bewusst unveraendert.
                    if s_meta["size"] != t_meta["size"] or abs(s_meta["mtime"] - t_meta["mtime"]) > 1:
                        if mode == "mirror" or mode == "update":
                            actions.append(("COPY_L2R", f))
                        elif mode == "two_way":
                            if conflict_policy == "source":
                                actions.append(("COPY_L2R", f))
                            elif conflict_policy == "target":
                                actions.append(("COPY_R2L", f))
                            else:  # newest
                                if s_meta["mtime"] > t_meta["mtime"]:
                                    actions.append(("COPY_L2R", f))
                                else:
                                    actions.append(("COPY_R2L", f))
                    else:
                        if mode == "index_only":
                            actions.append(("INDEX_SRC", f))
                        else:
                            actions.append(("INDEX_BOTH", f))

            # 3. Execute
            total = len(actions)
            _start_time = time.monotonic()
            _started_at = datetime.now(timezone.utc).isoformat()
            _stats = {"copied": 0, "deleted": 0, "skipped": 0, "bytes_copied": 0}
            for i, (act, rel_path) in enumerate(actions):
                if self.is_killed:
                    break

                while self.is_paused:
                    if self.is_killed:
                        break
                    time.sleep(0.5)

                pct = int((i / max(1, total)) * 100)
                if pct != self._last_pct:
                    self.progress.emit(pct, "sync")
                    self._last_pct = pct

                s_abs = os.path.join(src_root, rel_path)
                t_abs = os.path.join(tgt_root, rel_path) if tgt_root else ""

                try:
                    if act == "COPY_L2R":
                        self.status.emit(f"Kopiere -> {rel_path}")
                        os.makedirs(os.path.dirname(t_abs), exist_ok=True)
                        _atomic_copy2(s_abs, t_abs)
                        _stats["copied"] += 1
                        _stats["bytes_copied"] += os.path.getsize(t_abs) if os.path.exists(t_abs) else 0
                        if self.db:
                            self._db_log(self.db, s_abs, "source")
                            self._db_log(self.db, t_abs, "target")

                    elif act == "COPY_R2L":
                        self.status.emit(f"Kopiere <- {rel_path}")
                        os.makedirs(os.path.dirname(s_abs), exist_ok=True)
                        _atomic_copy2(t_abs, s_abs)
                        _stats["copied"] += 1
                        _stats["bytes_copied"] += os.path.getsize(s_abs) if os.path.exists(s_abs) else 0
                        if self.db:
                            self._db_log(self.db, s_abs, "source")

                    elif act == "DELETE_R":
                        self.status.emit(f"Lösche Ziel: {rel_path}")
                        if os.path.exists(t_abs):
                            os.remove(t_abs)
                            _stats["deleted"] += 1

                    elif act in ("INDEX_SRC", "INDEX_BOTH"):
                        _stats["skipped"] += 1
                        if act == "INDEX_SRC":
                            if self.db and os.path.exists(s_abs):
                                self._db_log(self.db, s_abs, "source")
                        else:
                            if self.db:
                                if os.path.exists(s_abs):
                                    self._db_log(self.db, s_abs, "source")
                                if t_abs and os.path.exists(t_abs):
                                    self._db_log(self.db, t_abs, "target")

                except Exception as e:
                    log_error(f"Error {act} on {rel_path}: {e}")

            _duration = time.monotonic() - _start_time
            report = {
                "connection": self.cfg.get("name", ""),
                "connection_id": self.conn_id,
                "mode": mode,
                "started_at": _started_at,
                "duration_seconds": round(_duration, 2),
                "files_copied": _stats["copied"],
                "files_deleted": _stats["deleted"],
                "files_skipped": _stats["skipped"],
                "bytes_copied": _stats["bytes_copied"],
                "total_actions": total,
            }
            if self.is_killed:
                return
            self.sync_report.emit(report)
            self.progress.emit(100, "done")
            self.finished.emit()

        except Exception as e:
            self.error.emit(str(e))
        finally:
            # Bugsweep 27: WAL-Checkpoint explizit auslösen statt GC zu vertrauen
            if self.db:
                self.db.close()

    def _db_log(self, db, path, side):
        """Log file version to database (if indexing enabled)."""
        if not db:
            return
        try:
            stat = os.stat(path)
            h = sha256_file(path)
            mtime_iso = datetime.fromtimestamp(stat.st_mtime).isoformat()
            fid = db.log_version(os.path.basename(path), path, mtime_iso,
                               stat.st_size, h, side)

            if self.cfg.get("structure", {}).get("auto_tags"):
                root = self.cfg.get(side)
                if root and path.startswith(root):
                    rel = os.path.relpath(path, root)
                    dirs = os.path.dirname(rel).split(os.sep)
                    for d in dirs:
                        if d and d != ".":
                            db.add_tag(fid, d)
        except (OSError, sqlite3.Error, ValueError) as e:
            log_error(f"DB logging error for {path}: {e}")

    def kill(self):
        """Stoppt den Worker sofort (bei nächster Prüfung)."""
        self.is_killed = True

    def pause(self):
        """Pausiert den Worker."""
        self.is_paused = True

    def resume(self):
        """Setzt den Worker fort."""
        self.is_paused = False


def sftp_known_hosts_path():
    """Return the local known_hosts store used to pin SFTP/SSH host keys."""
    appdata = str(os.environ.get("APPDATA", "") or "").strip()
    base_dir = Path(appdata) if appdata else Path.home()
    if not base_dir.is_absolute():
        base_dir = Path.home()
    return base_dir / "ProSync" / "known_hosts"


def _ssh_host_key_name(hostname, port):
    """Mirror paramiko's own host-key lookup key (bracket/port suffix for non-default ports)."""
    return hostname if port == 22 else f"[{hostname}]:{port}"


def create_sftp_transport(cfg):
    """Create an SSH/SFTP transport from a ProSync SFTP configuration."""
    try:
        import paramiko
    except ImportError as exc:
        raise RuntimeError(
            "SFTP/SSH benötigt das optionale Paket 'paramiko'. "
            "Installiere es außerhalb von OneDrive z.B. mit: python -m pip install paramiko"
        ) from exc

    validate_sftp_connection(cfg)
    hostname = str(cfg.get("remote_host", "")).strip()
    port = int(cfg.get("remote_port") or 22)
    timeout = float(cfg.get("remote_timeout") or 20)

    known_hosts_path = sftp_known_hosts_path()
    known_hosts_path.parent.mkdir(parents=True, exist_ok=True)

    client = paramiko.SSHClient()
    client.load_system_host_keys()
    if known_hosts_path.exists():
        client.load_host_keys(str(known_hosts_path))

    # Sicherer Default: unbekannte oder abweichende Host-Keys werden abgelehnt
    # (paramiko.RejectPolicy). Bewusst KEIN WarningPolicy/AutoAddPolicy mehr als
    # Bypass -- beide wuerden einen Host-Key-Wechsel (z.B. Man-in-the-Middle)
    # stillschweigend durchlassen statt die Verbindung abzubrechen.
    client.set_missing_host_key_policy(paramiko.RejectPolicy())

    host_key_name = _ssh_host_key_name(hostname, port)
    if cfg.get("allow_unknown_host_key") and client.get_host_keys().lookup(host_key_name) is None:
        # Trust-on-First-Use: Key nur beim allerersten Kontakt mit diesem Host
        # abholen und dauerhaft pinnen. Ist der Host danach bekannt, greift
        # wieder RejectPolicy -- ein spaeter abweichender Key wird weiterhin
        # abgelehnt statt nur protokolliert.
        probe = paramiko.Transport((hostname, port))
        try:
            probe.start_client(timeout=timeout)
            server_key = probe.get_remote_server_key()
        finally:
            probe.close()
        client.get_host_keys().add(host_key_name, server_key.get_name(), server_key)
        client.save_host_keys(str(known_hosts_path))

    connect_kwargs = {
        "hostname": hostname,
        "port": port,
        "username": str(cfg.get("remote_username", "") or "").strip() or None,
        "timeout": timeout,
        "look_for_keys": True,
        "allow_agent": True,
    }
    key_file = str(cfg.get("remote_key_file", "") or "").strip()
    if key_file:
        connect_kwargs["key_filename"] = key_file

    client.connect(**connect_kwargs)
    return client, client.open_sftp()


class SftpTargetSyncWorker(QThread):
    """Synchronize a local folder to an SSH/SFTP target."""

    progress = Signal(int, str)
    status = Signal(str)
    finished = Signal()
    error = Signal(str)
    sync_report = Signal(dict)

    def __init__(self, cfg, transport_factory=None):
        super().__init__()
        self.cfg = cfg
        self.transport_factory = transport_factory or create_sftp_transport
        self.conn_id = cfg.get("id")
        self.is_killed = False
        self.is_paused = False
        self._last_pct = -1

    @staticmethod
    def _is_dir_attr(attr):
        return stat.S_ISDIR(getattr(attr, "st_mode", 0))

    def _ensure_remote_dir(self, sftp, remote_dir):
        remote_dir = normalize_remote_path(remote_dir)
        if remote_dir in ("", "/"):
            return
        parts = [part for part in remote_dir.strip("/").split("/") if part]
        current = "/" if remote_dir.startswith("/") else ""
        for part in parts:
            current = posixpath.join(current, part) if current else part
            try:
                sftp.stat(current)
            except (FileNotFoundError, OSError):
                try:
                    sftp.mkdir(current)
                except OSError:
                    sftp.stat(current)

    def _scan_remote_tree(self, sftp, remote_root):
        remote_root = normalize_remote_path(remote_root)
        tree = {}

        def walk(current_remote, rel_prefix=""):
            try:
                entries = sftp.listdir_attr(current_remote)
            except (FileNotFoundError, OSError):
                return
            for entry in entries:
                name = entry.filename
                if name in (".", ".."):
                    continue
                rel = f"{rel_prefix}/{name}" if rel_prefix else name
                full = join_remote_path(current_remote, name)
                if self._is_dir_attr(entry):
                    walk(full, rel)
                else:
                    tree[rel] = {
                        "mtime": float(getattr(entry, "st_mtime", 0)),
                        "size": int(getattr(entry, "st_size", 0)),
                        "remote_path": full,
                    }

        walk(remote_root)
        return tree

    def _upload_file(self, sftp, local_path, remote_path):
        remote_dir = posixpath.dirname(remote_path)
        self._ensure_remote_dir(sftp, remote_dir)
        tmp_remote = f"{remote_path}.prosync_tmp"
        try:
            sftp.put(local_path, tmp_remote)
            sftp.rename(tmp_remote, remote_path)
            mtime = os.path.getmtime(local_path)
            try:
                sftp.utime(remote_path, (mtime, mtime))
            except (AttributeError, OSError):
                pass
        except BaseException:
            try:
                sftp.remove(tmp_remote)
            except Exception:
                pass
            raise

    def _build_actions(self, src_tree, remote_tree, mode):
        all_files = set(src_tree.keys()) | set(remote_tree.keys())
        actions = []
        for rel_path in sorted(all_files):
            in_src = rel_path in src_tree
            in_remote = rel_path in remote_tree
            if in_src and not in_remote:
                actions.append(("UPLOAD", rel_path))
            elif in_src and in_remote:
                src_meta = src_tree[rel_path]
                remote_meta = remote_tree[rel_path]
                if (
                    src_meta["size"] != remote_meta["size"]
                    or abs(src_meta["mtime"] - remote_meta["mtime"]) > 1
                ):
                    actions.append(("UPLOAD", rel_path))
            elif in_remote and not in_src and mode == "mirror":
                actions.append(("DELETE_REMOTE", rel_path))
        return actions

    def run(self):
        ssh_client = None
        sftp = None
        try:
            validate_sftp_connection(self.cfg)
            mode = self.cfg.get("mode", "update")
            source_root = self.cfg["source"]
            remote_root = normalize_remote_path(self.cfg["target"])
            exclude_patterns = self.cfg.get("exclude_patterns", [])
            if isinstance(exclude_patterns, (str, bytes)):
                exclude_patterns = [exclude_patterns]

            self.status.emit(f"[{self.cfg.get('name')}] Verbinde mit SFTP-Ziel...")
            ssh_client, sftp = self.transport_factory(self.cfg)

            self.status.emit(f"[{self.cfg.get('name')}] Scanne Quelle...")
            src_tree = SyncWalker().scan(source_root, exclude_patterns)

            self.status.emit(f"[{self.cfg.get('name')}] Scanne SFTP-Ziel...")
            self._ensure_remote_dir(sftp, remote_root)
            remote_tree = self._scan_remote_tree(sftp, remote_root)

            actions = self._build_actions(src_tree, remote_tree, mode)
            total = len(actions)
            started_at = datetime.now(timezone.utc).isoformat()
            start_time = time.monotonic()
            stats = {"copied": 0, "deleted": 0, "skipped": 0, "bytes_copied": 0}

            if total == 0:
                self.status.emit("✓ SFTP-Ziel ist bereits aktuell")

            for index, (action, rel_path) in enumerate(actions):
                if self.is_killed:
                    return
                while self.is_paused:
                    if self.is_killed:
                        return
                    time.sleep(0.5)

                pct = int((index / max(1, total)) * 100)
                if pct != self._last_pct:
                    self.progress.emit(pct, "sftp")
                    self._last_pct = pct

                if action == "UPLOAD":
                    local_path = src_tree[rel_path]["abs_path"]
                    remote_path = join_remote_path(remote_root, rel_path)
                    self.status.emit(f"SFTP Upload -> {rel_path}")
                    self._upload_file(sftp, local_path, remote_path)
                    stats["copied"] += 1
                    stats["bytes_copied"] += os.path.getsize(local_path)
                elif action == "DELETE_REMOTE":
                    remote_path = remote_tree[rel_path]["remote_path"]
                    self.status.emit(f"SFTP löscht Ziel: {rel_path}")
                    sftp.remove(remote_path)
                    stats["deleted"] += 1

            duration = time.monotonic() - start_time
            report = {
                "connection": self.cfg.get("name", ""),
                "connection_id": self.conn_id,
                "mode": mode,
                "target_type": ConnectionType.SFTP,
                "started_at": started_at,
                "duration_seconds": round(duration, 2),
                "files_copied": stats["copied"],
                "files_deleted": stats["deleted"],
                "files_skipped": stats["skipped"],
                "bytes_copied": stats["bytes_copied"],
                "total_actions": total,
            }
            self.sync_report.emit(report)
            self.progress.emit(100, "done")
            self.status.emit(f"✓ SFTP-Sync abgeschlossen: {total} Aktion(en)")
            self.finished.emit()
        except Exception as exc:
            self.error.emit(str(exc))
        finally:
            if sftp is not None:
                try:
                    sftp.close()
                except Exception:
                    pass
            if ssh_client is not None:
                try:
                    ssh_client.close()
                except Exception:
                    pass

    def kill(self):
        """Stop the worker at the next safe point."""
        self.is_killed = True

    def pause(self):
        """Pause the worker."""
        self.is_paused = True

    def resume(self):
        """Resume the worker."""
        self.is_paused = False
# ---------------- SCHEDULER ----------------
class ConnectionScheduler(QObject):
    """
    Verwaltet zeitgesteuerte automatische Synchronisationen.

    Nutzt QTimer um für jede Verbindung mit aktiviertem autosync
    periodisch das trigger_sync Signal zu emittieren. Die MainWindow
    führt dann die eigentliche Synchronisation durch.
    """

    trigger_sync = Signal(dict)

    def __init__(self, cfg):
        super().__init__()
        self.cfg = cfg
        self.timers = {}

    def update_all(self):
        """
        Aktualisiert die Timer für alle Verbindungen.

        Stoppt Timer für gelöschte Verbindungen und ruft update_connection()
        für jede aktuell gespeicherte Verbindung auf.
        """
        current_ids = {conn["id"] for conn in self.cfg.list_connections()}
        for stale_id in list(self.timers.keys()):
            if stale_id not in current_ids:
                self.timers[stale_id].stop()
                del self.timers[stale_id]
        for conn in self.cfg.list_connections():
            self.update_connection(conn)

    def update_connection(self, conn):
        """
        Erstellt/aktualisiert den Timer für eine Verbindung.

        Entfernt alte Timer falls vorhanden. Erstellt neuen QTimer wenn
        autosync aktiviert ist mit dem konfigurierten Intervall.

        Args:
            conn: Connection-Dict mit autosync-Konfiguration
        """
        cid = conn["id"]
        if cid in self.timers:
            self.timers[cid].stop()
            del self.timers[cid]

        autosync = conn.get("autosync", {})
        if not isinstance(autosync, dict):
            autosync = {}
        if autosync.get("enabled", False):
            raw_interval = autosync.get("interval_minutes", 15)
            try:
                interval_min = int(raw_interval)
            except (TypeError, ValueError):
                interval_min = 15
            timer = QTimer()
            timer.setSingleShot(False)
            timer.timeout.connect(lambda c=conn: self.trigger_sync.emit(c))
            timer.start(max(1, interval_min) * 60 * 1000)
            self.timers[cid] = timer

    def stop_all(self):
        """
        Stoppt alle laufenden Timer und löscht die Timer-Liste.

        Wird beim Beenden der Anwendung aufgerufen.
        """
        for t in self.timers.values():
            t.stop()
        self.timers.clear()

# ---------------- GUI ----------------
class ConnectionDialog(QDialog):
    """V3 IMPROVED: Integrated database safety scanner."""

    def __init__(self, parent=None, existing=None):
        super().__init__(parent)
        self.setWindowTitle("Synchronisierung einrichten")
        self.existing = existing
        self.resize(DIALOG_WIDTH, DIALOG_HEIGHT)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        self.name = QLineEdit(existing["name"] if existing else "")
        self.source = QLineEdit(existing["source"] if existing else "")
        self.target = QLineEdit(existing["target"] if existing else "")

        self.mode = QComboBox()
        self.mode.addItems(["mirror", "update", "two_way", "index_only", "one_way"])  # V3: Added one_way
        if existing:
            self.mode.setCurrentText(existing.get("mode", "mirror"))
        self.mode.currentTextChanged.connect(self.on_mode_change)

        self.conflict = QComboBox()
        self.conflict.addItems(["source", "target", "newest"])  # V3: Changed order (source first)
        if existing:
            self.conflict.setCurrentText(existing.get("conflict_policy", "source"))

        btn_src = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_src,
            name="Quellordner auswählen",
            tooltip="Quellordner auswählen",
            description="Öffnet den Ordnerdialog für den Quellordner.",
        )
        btn_src.clicked.connect(lambda: self.pick(self.source))
        btn_tgt = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_tgt,
            name="Zielordner auswählen",
            tooltip="Zielordner auswählen",
            description="Öffnet den Ordnerdialog für den Zielordner.",
        )
        btn_tgt.clicked.connect(lambda: self.pick(self.target))

        h_src = QHBoxLayout()
        h_src.addWidget(self.source)
        h_src.addWidget(btn_src)

        h_tgt = QHBoxLayout()
        h_tgt.addWidget(self.target)
        h_tgt.addWidget(btn_tgt)

        form.addRow("Name der Aufgabe", self.name)
        form.addRow("Quelle", h_src)
        form.addRow("Ziel", h_tgt)
        form.addRow("Sync-Modus", self.mode)
        form.addRow("Bei Konflikt", self.conflict)

        # Indexierung optional machen
        self.chk_indexing = QCheckBox("Datenbank-Indexierung & Historie aktivieren")
        self.chk_indexing.setToolTip("Erstellt eine DB für Suche und Versionierung.")
        if existing:
            self.chk_indexing.setChecked(existing.get("indexing", True))
        else:
            self.chk_indexing.setChecked(True)
        self.chk_indexing.stateChanged.connect(self.on_indexing_change)
        form.addRow("", self.chk_indexing)

        self.chk_tags = QCheckBox("Auto-Tags aus Ordnernamen")
        if existing and "structure" in existing:
            self.chk_tags.setChecked(existing["structure"].get("auto_tags", True))
        else:
            self.chk_tags.setChecked(True)
        form.addRow("", self.chk_tags)

        self.db_container = QWidget()
        db_lay = QHBoxLayout(self.db_container)
        db_lay.setContentsMargins(0,0,0,0)
        self.db_path = QLineEdit(existing["db_path"] if existing else "")
        btn_db = QPushButton("💾")
        configure_compact_button_accessibility(
            btn_db,
            name="Datenbank-Datei auswählen",
            tooltip="Datenbank-Datei auswählen",
            description="Wählt die Datenbank-Datei für Suche und Historie aus.",
        )
        btn_db.clicked.connect(lambda: self.pick_file(self.db_path))
        db_lay.addWidget(self.db_path)
        db_lay.addWidget(btn_db)

        form.addRow("Datenbank-Datei", self.db_container)

        lay.addLayout(form)

        # V3 NEW: Database Safety Scanner
        lay.addWidget(self._create_safety_scanner())

        # Buttons
        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

        # Initialize UI state
        self.on_mode_change(self.mode.currentText())
        self.on_indexing_change()

    def _create_safety_scanner(self):
        """Erstellt das Database Safety Scanner Widget."""
        safety_box = QWidget()
        safety_box.setStyleSheet(
            "background-color: #f0f0f0; border: 1px solid #ccc; "
            "border-radius: 4px; padding: 8px;"
        )
        safety_lay = QVBoxLayout(safety_box)

        lbl_safety_title = QLabel("<b>🛡️ Datenbank-Sicherheitsprüfung (V3)</b>")
        safety_lay.addWidget(lbl_safety_title)

        btn_scan = QPushButton("🔍 Quelle auf Datenbanken scannen")
        configure_compact_button_accessibility(
            btn_scan,
            name="Quelle auf Datenbanken scannen",
            tooltip="Quelle auf Datenbanken scannen",
            description="Prüft den Quellordner auf Datenbanken und empfiehlt sichere Einstellungen.",
        )
        btn_scan.clicked.connect(self.scan_for_databases)
        safety_lay.addWidget(btn_scan)

        self.safety_info = QTextEdit()
        self.safety_info.setReadOnly(True)
        self.safety_info.setMaximumHeight(100)
        self.safety_info.setPlaceholderText(
            "Klicke 'Scannen' um Datenbanken zu erkennen und "
            "sichere Einstellungen zu erhalten."
        )
        safety_lay.addWidget(self.safety_info)

        return safety_box

    def scan_for_databases(self):
        """V3 NEW: Scan source directory for databases and show recommendations."""
        source = self.source.text().strip()
        if not source or not os.path.exists(source):
            self.safety_info.setText("⚠ Bitte gültiges Quellverzeichnis angeben!")
            return

        self.safety_info.setText("🔍 Scanne Verzeichnis...")
        QApplication.processEvents()

        # Scan for databases
        databases = DatabaseSafetyManager.scan_directory_for_databases(source)

        if not databases:
            self.safety_info.setText("✓ Keine Datenbanken gefunden.\nStandard-Einstellungen sind sicher.")
            return

        # Analyze databases
        has_wal = any(db["wal_mode"] or db["has_wal_files"] for db in databases)

        info_lines = [f"📊 {len(databases)} Datenbank(en) gefunden:\n"]

        for db in databases[:5]:  # Show max 5
            wal_status = "⚠ WAL" if db["wal_mode"] else "✓"
            info_lines.append(f"  {wal_status} {db['name']} ({db['size_mb']:.1f} MB)")

        if len(databases) > 5:
            info_lines.append(f"  ... und {len(databases) - 5} weitere")

        if has_wal:
            info_lines.append("\n🛡️ EMPFOHLENE EINSTELLUNGEN:")
            info_lines.append("  • Modus: one_way (statt two_way)")
            info_lines.append("  • Konflikt: source (statt newest)")
            info_lines.append("  • Auto-Sync: DEAKTIVIERT")
            info_lines.append("\nWAL-Dateien werden automatisch ausgeschlossen!")
        else:
            info_lines.append("\n✓ Keine WAL-Datenbanken.")
            info_lines.append("Standard-Einstellungen sind sicher.")

        self.safety_info.setText("\n".join(info_lines))

    def on_mode_change(self, txt):
        is_index_only = (txt == "index_only")
        self.target.setEnabled(not is_index_only)
        self.conflict.setEnabled(not is_index_only)
        if is_index_only:
            self.chk_indexing.setChecked(True)
            self.chk_indexing.setEnabled(False)
        else:
            self.chk_indexing.setEnabled(True)

    def on_indexing_change(self):
        enabled = self.chk_indexing.isChecked()
        self.db_container.setEnabled(enabled)
        self.chk_tags.setEnabled(enabled)

    def pick(self, line):
        d = QFileDialog.getExistingDirectory(self, "Ordner wählen")
        if d:
            line.setText(d)

    def pick_file(self, line):
        f, _ = QFileDialog.getSaveFileName(self, "DB speichern unter",
                                          "profiler.db", "SQLite (*.db)")
        if f:
            line.setText(f)

    def get_result(self):
        """V3 IMPROVED: Apply database safety settings automatically."""
        source = self.source.text()

        db = self.db_path.text()
        if self.chk_indexing.isChecked() and not db and source:
            db = os.path.join(source, "profiler_index.db")

        autosync = {"enabled": False, "interval_minutes": 15}
        if self.existing and "autosync" in self.existing:
            autosync = self.existing["autosync"]

        conn_config = {
            "id": self.existing["id"] if self.existing else f"conn-{uuid.uuid4().hex[:6]}",
            "name": self.name.text(),
            "source": source,
            "target": self.target.text(),
            "mode": self.mode.currentText(),
            "conflict_policy": self.conflict.currentText(),
            "indexing": self.chk_indexing.isChecked(),
            "db_path": db,
            "structure": {"auto_tags": self.chk_tags.isChecked()},
            "autosync": autosync,
            "exclude_patterns": self.existing.get("exclude_patterns", []) if self.existing else []
        }

        # V3.1 NEW: Apply database safety settings automatically (for folders)
        conn_config["type"] = ConnectionType.FOLDER
        self._apply_safety_settings(conn_config, source)
        return conn_config

    def _apply_safety_settings(self, conn_config, source):
        """Wendet automatische Datenbank-Sicherheitseinstellungen an."""
        if not source or not os.path.exists(source):
            return

        databases = DatabaseSafetyManager.scan_directory_for_databases(source)
        conn_config, warnings, excluded_dbs, was_changed = \
            DatabaseSafetyManager.apply_safe_settings_folder(conn_config, databases)

        if was_changed and warnings:
            self._show_safety_message(warnings, excluded_dbs)

    def _show_safety_message(self, warnings, excluded_dbs):
        """Zeigt Informationsnachricht über angewendete Sicherheitseinstellungen."""
        msg = "🛡️ Datenbank-Sicherheitseinstellungen wurden automatisch angewendet:\n\n"
        msg += "\n".join(warnings)

        if excluded_dbs:
            msg += f"\n\n{len(excluded_dbs)} Datenbank(en) wurden ausgeschlossen:"
            for db in excluded_dbs[:3]:  # Show first 3
                msg += f"\n  • {db['name']} ({db['size_mb']:.1f} MB)"
            if len(excluded_dbs) > 3:
                msg += f"\n  ... und {len(excluded_dbs) - 3} weitere"
            msg += "\n\n💡 Tipp: Erstelle Datei-Verbindungen für einzelne Datenbank-Backups"

        QMessageBox.information(self, "Sicherheitseinstellungen angewendet", msg)

# ---------------- FILE CONNECTION DIALOG (V3.1 NEW) ----------------
class FileConnectionDialog(QDialog):
    """V3.1 NEW: Dialog for single-file synchronization."""

    def __init__(self, parent=None, existing=None, suggested_file=None):
        super().__init__(parent)
        self.setWindowTitle("Datei synchronisieren")
        self.existing = existing
        self.resize(500, 450)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        # Name
        self.name = QLineEdit(existing["name"] if existing else "")
        form.addRow("Name der Aufgabe", self.name)

        # Source File
        self.source_file = QLineEdit(existing.get("source_file", suggested_file or "") if existing else (suggested_file or ""))
        btn_src = QPushButton("📄")
        configure_compact_button_accessibility(
            btn_src,
            name="Quelldatei auswählen",
            tooltip="Quelldatei auswählen",
            description="Öffnet den Dateidialog für die Quelldatei.",
        )
        btn_src.clicked.connect(lambda: self.pick_file(self.source_file, "Quelldatei wählen"))
        h_src = QHBoxLayout()
        h_src.addWidget(self.source_file)
        h_src.addWidget(btn_src)
        form.addRow("Quelldatei", h_src)

        # Target File
        self.target_file = QLineEdit(existing.get("target_file", "") if existing else "")
        btn_tgt = QPushButton("📄")
        configure_compact_button_accessibility(
            btn_tgt,
            name="Zieldatei auswählen",
            tooltip="Zieldatei auswählen",
            description="Öffnet den Dateidialog für die Zieldatei.",
        )
        btn_tgt.clicked.connect(lambda: self.pick_file(self.target_file, "Zieldatei wählen"))
        h_tgt = QHBoxLayout()
        h_tgt.addWidget(self.target_file)
        h_tgt.addWidget(btn_tgt)
        form.addRow("Zieldatei", h_tgt)

        # Mode (for files, usually one-way)
        self.mode = QComboBox()
        self.mode.addItems(["one_way", "two_way"])
        if existing:
            self.mode.setCurrentText(existing.get("mode", "one_way"))
        form.addRow("Sync-Modus", self.mode)

        # Checkpoint option
        self.chk_checkpoint = QCheckBox("WAL-Checkpoint vor Sync (für SQLite)")
        if existing:
            self.chk_checkpoint.setChecked(existing.get("checkpoint_before_sync", False))
        form.addRow("", self.chk_checkpoint)

        lay.addLayout(form)

        # Safety info box
        safety_box = QWidget()
        safety_box.setStyleSheet("background-color: #f0f0f0; border: 1px solid #ccc; border-radius: 4px; padding: 8px;")
        safety_lay = QVBoxLayout(safety_box)

        lbl_safety = QLabel("<b>🛡️ Datei-Sicherheit (V3.1)</b>")
        safety_lay.addWidget(lbl_safety)

        self.safety_info = QTextEdit()
        self.safety_info.setReadOnly(True)
        self.safety_info.setMaximumHeight(120)
        self.safety_info.setPlaceholderText("Datei-Synchronisierung ist ideal für Datenbanken.\nWAL-Dateien werden automatisch übersprungen.")
        safety_lay.addWidget(self.safety_info)

        # Auto-analyze button
        btn_analyze = QPushButton("🔍 Datei analysieren")
        configure_compact_button_accessibility(
            btn_analyze,
            name="Datei analysieren",
            tooltip="Datei analysieren",
            description="Prüft die ausgewählte Datei auf Datenbank-Sicherheitsanforderungen.",
        )
        btn_analyze.clicked.connect(self.analyze_file)
        safety_lay.addWidget(btn_analyze)

        lay.addWidget(safety_box)

        # Buttons
        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

        # Auto-analyze if suggested file provided
        if suggested_file and os.path.exists(suggested_file):
            QTimer.singleShot(100, self.analyze_file)

    def pick_file(self, line, title):
        """Pick a file (not folder)."""
        f, _ = QFileDialog.getOpenFileName(self, title)
        if f:
            line.setText(f)
            # Auto-set target if source was picked
            if line == self.source_file and not self.target_file.text():
                # Suggest target path
                source_dir = os.path.dirname(f)
                filename = os.path.basename(f)
                # Could suggest network path here
                self.target_file.setPlaceholderText(f"[Ziel-Pfad für {filename}]")

    def analyze_file(self):
        """Analyze source file and show recommendations."""
        source_file = self.source_file.text().strip()
        if not source_file or not os.path.exists(source_file):
            self.safety_info.setText("⚠ Bitte gültige Quelldatei angeben!")
            return

        filename = os.path.basename(source_file)
        info_lines = [f"📄 Datei: {filename}\n"]

        # Check if database
        if DatabaseSafetyManager.is_database_file(source_file):
            db_type = "unbekannt"
            wal_mode = False
            size_mb = 0

            try:
                size_mb = os.path.getsize(source_file) / (1024 * 1024)
                info_lines.append(f"Größe: {size_mb:.1f} MB")
            except OSError:
                # File may not exist or is inaccessible
                pass

            # SQLite check
            if DatabaseSafetyManager.is_sqlite_database(source_file):
                db_type = "SQLite"
                wal_mode = DatabaseSafetyManager.check_wal_mode(source_file)

                if wal_mode:
                    info_lines.append(f"Typ: {db_type} (WAL-Modus ⚠)")
                    info_lines.append("\n🛡️ EMPFEHLUNGEN:")
                    info_lines.append("  • Modus: one_way")
                    info_lines.append("  • WAL-Checkpoint: AKTIVIERT")
                    info_lines.append("\n✓ WAL-Dateien werden automatisch übersprungen")

                    # Auto-apply settings
                    self.mode.setCurrentText("one_way")
                    self.chk_checkpoint.setChecked(True)
                else:
                    info_lines.append(f"Typ: {db_type} (Journal-Modus ✓)")
                    info_lines.append("\n✓ Sicher für Sync")

            elif source_file.endswith(('.mdb', '.accdb')):
                db_type = "MS Access"
                info_lines.append(f"Typ: {db_type}")
                info_lines.append("\n💡 Empfehlung: one_way Modus")
                self.mode.setCurrentText("one_way")

            else:
                info_lines.append("Typ: Datenbank (erkannt)")
        else:
            info_lines.append("Typ: Reguläre Datei")
            info_lines.append("\n✓ Kann two_way synchronisiert werden")

        self.safety_info.setText("\n".join(info_lines))

        # Auto-set name if empty
        if not self.name.text():
            base_name = os.path.splitext(filename)[0]
            self.name.setText(f"{base_name} - Backup")

    def get_result(self):
        """Return file connection configuration."""
        source_file = self.source_file.text()
        target_file = self.target_file.text()

        conn_config = {
            "id": self.existing["id"] if self.existing else f"conn-{uuid.uuid4().hex[:6]}",
            "type": ConnectionType.FILE,  # V3.1: Mark as FILE connection
            "name": self.name.text(),
            "source_file": source_file,
            "target_file": target_file,
            "mode": self.mode.currentText(),
            "checkpoint_before_sync": self.chk_checkpoint.isChecked(),
            "autosync": self.existing.get("autosync", {"enabled": False, "interval_minutes": 15}) if self.existing else {"enabled": False}
        }

        # V3.1: Apply file safety settings
        if source_file and os.path.exists(source_file):
            conn_config, warnings, was_changed = DatabaseSafetyManager.apply_safe_settings_file(conn_config)

            if was_changed and warnings:
                msg = "🛡️ Sicherheitseinstellungen wurden automatisch angewendet:\n\n"
                msg += "\n".join(warnings)
                QMessageBox.information(self, "Sicherheitseinstellungen", msg)

        return conn_config


class SftpTargetDialog(QDialog):
    """Dialog for local-folder to SSH/SFTP target synchronization."""

    def __init__(self, parent=None, existing=None):
        super().__init__(parent)
        self.setWindowTitle("SFTP/SSH-Ziel synchronisieren")
        self.existing = existing or {}
        self.resize(560, 520)
        lay = QVBoxLayout(self)
        form = QFormLayout()

        self.name = QLineEdit(self.existing.get("name", ""))
        self.source = QLineEdit(self.existing.get("source", ""))
        self.remote_host = QLineEdit(self.existing.get("remote_host", ""))
        self.remote_port = QLineEdit(str(self.existing.get("remote_port", 22)))
        self.remote_username = QLineEdit(self.existing.get("remote_username", ""))
        self.remote_key_file = QLineEdit(self.existing.get("remote_key_file", ""))
        self.target = QLineEdit(self.existing.get("target", ""))

        btn_src = QPushButton("📂")
        configure_compact_button_accessibility(
            btn_src,
            name="Quellordner auswählen",
            tooltip="Quellordner auswählen",
            description="Öffnet den Ordnerdialog für den lokalen Quellordner.",
        )
        btn_src.clicked.connect(lambda: self.pick_folder(self.source))
        h_src = QHBoxLayout()
        h_src.addWidget(self.source)
        h_src.addWidget(btn_src)

        btn_key = QPushButton("🔑")
        configure_compact_button_accessibility(
            btn_key,
            name="SSH-Schlüssel auswählen",
            tooltip="SSH-Schlüssel auswählen",
            description="Wählt optional eine private Schlüsseldatei für SFTP aus.",
        )
        btn_key.clicked.connect(lambda: self.pick_file(self.remote_key_file))
        h_key = QHBoxLayout()
        h_key.addWidget(self.remote_key_file)
        h_key.addWidget(btn_key)

        self.mode = QComboBox()
        self.mode.addItems(["update", "mirror", "one_way"])
        self.mode.setCurrentText(self.existing.get("mode", "update"))

        self.allow_unknown_host_key = QCheckBox("Unbekannten Host-Key beim ersten Verbinden automatisch vertrauen (wird dauerhaft gepinnt)")
        self.allow_unknown_host_key.setChecked(bool(self.existing.get("allow_unknown_host_key", False)))

        raw_patterns = self.existing.get("exclude_patterns", [])
        if isinstance(raw_patterns, (str, bytes)):
            patterns_text = str(raw_patterns)
        else:
            patterns_text = "; ".join(str(p) for p in raw_patterns if str(p).strip())
        self.exclude_patterns = QLineEdit(patterns_text)
        self.exclude_patterns.setPlaceholderText("z.B. *.tmp; __pycache__; *.db-wal")

        form.addRow("Name der Aufgabe", self.name)
        form.addRow("Lokale Quelle", h_src)
        form.addRow("SFTP-Host", self.remote_host)
        form.addRow("Port", self.remote_port)
        form.addRow("Benutzername", self.remote_username)
        form.addRow("SSH-Key (optional)", h_key)
        form.addRow("Remote-Zielpfad", self.target)
        form.addRow("Sync-Modus", self.mode)
        form.addRow("Ausschlüsse", self.exclude_patterns)
        form.addRow("", self.allow_unknown_host_key)
        lay.addLayout(form)

        warning = QTextEdit()
        warning.setReadOnly(True)
        warning.setMaximumHeight(110)
        warning.setText(
            f"⚠ {REMOTE_UNSAFE_DATABASE_WARNING}\n\n"
            "Passwörter werden in ProSync nicht gespeichert. Nutze SSH-Agent "
            "oder eine Schlüsseldatei."
        )
        lay.addWidget(warning)

        buttons = QDialogButtonBox(
            QDialogButtonBox.StandardButton.Ok |
            QDialogButtonBox.StandardButton.Cancel
        )
        buttons.accepted.connect(self.accept)
        buttons.rejected.connect(self.reject)
        lay.addWidget(buttons)

    def pick_folder(self, line):
        path = QFileDialog.getExistingDirectory(self, "Lokalen Quellordner wählen")
        if path:
            line.setText(path)

    def pick_file(self, line):
        path, _ = QFileDialog.getOpenFileName(self, "SSH-Schlüssel wählen")
        if path:
            line.setText(path)

    @staticmethod
    def _parse_patterns(text):
        return [
            part.strip()
            for part in str(text or "").replace("\n", ";").split(";")
            if part.strip()
        ]

    def get_result(self):
        try:
            port = int(str(self.remote_port.text()).strip() or "22")
        except ValueError:
            port = 22

        conn_config = {
            "id": self.existing["id"] if self.existing.get("id") else f"conn-{uuid.uuid4().hex[:6]}",
            "type": ConnectionType.SFTP,
            "name": self.name.text().strip(),
            "source": self.source.text().strip(),
            "target": normalize_remote_path(self.target.text()),
            "remote_host": self.remote_host.text().strip(),
            "remote_port": port,
            "remote_username": self.remote_username.text().strip(),
            "remote_key_file": self.remote_key_file.text().strip(),
            "allow_unknown_host_key": self.allow_unknown_host_key.isChecked(),
            "mode": self.mode.currentText(),
            "conflict_policy": "source",
            "indexing": False,
            "autosync": self.existing.get(
                "autosync",
                {"enabled": False, "interval_minutes": DEFAULT_AUTOSYNC_INTERVAL},
            ),
            "exclude_patterns": self._parse_patterns(self.exclude_patterns.text()),
            "remote_warning": REMOTE_UNSAFE_DATABASE_WARNING,
        }
        return conn_config

class MainWindow(QMainWindow):
    # V3.2 NEW: Notification-Typen für Toast-System
    class NotificationType:
        INFO = QSystemTrayIcon.MessageIcon.Information
        SUCCESS = QSystemTrayIcon.MessageIcon.Information  # Windows hat kein Success
        WARNING = QSystemTrayIcon.MessageIcon.Warning
        ERROR = QSystemTrayIcon.MessageIcon.Critical
    
    def __init__(self, cfg):
        super().__init__()
        self.setWindowTitle("ProSync V3.2 - Sync & Index mit DB-Sicherheit")  # V3.2: Toast-Notifications
        self.resize(900, 600)
        self.cfg = cfg
        self.worker = None
        self.batch_queue = BatchSyncQueue()
        self._worker_had_error = False
        self._stop_requested = False

        self.scheduler = ConnectionScheduler(cfg)
        self.scheduler.trigger_sync.connect(self.on_auto_sync_triggered)

        self.tray_icon = QSystemTrayIcon(self)
        self.setup_tray_icon()

        tray_menu = QMenu(self)
        act_show = tray_menu.addAction("Öffnen")
        act_show.triggered.connect(self.show_and_raise)

        if HAS_WINREG:
            act_autostart = QAction("Mit Windows starten", self)
            act_autostart.setCheckable(True)
            act_autostart.setChecked(AutostartManager.is_autostart_enabled())
            act_autostart.triggered.connect(self.toggle_autostart)
            tray_menu.addAction(act_autostart)

        tray_menu.addSeparator()
        act_quit = tray_menu.addAction("Beenden")
        act_quit.triggered.connect(self.force_quit)
        self.tray_icon.setContextMenu(tray_menu)
        self.tray_icon.activated.connect(self.on_tray_click)
        self.tray_icon.show()

        central = QWidget()
        self.setCentralWidget(central)
        main_lay = QVBoxLayout(central)

        toolbar_lay = QHBoxLayout()

        # V3.1 NEW: Menu button for adding connections
        btn_add = QPushButton("➕ Neue Aufgabe")
        add_menu = QMenu(self)
        act_folder = add_menu.addAction("📁 Ordner synchronisieren")
        act_folder.triggered.connect(self.add_folder_connection)
        act_file = add_menu.addAction("📄 Datei synchronisieren")
        act_file.triggered.connect(self.add_file_connection)
        act_sftp = add_menu.addAction("🌐 SFTP/SSH-Ziel synchronisieren")
        act_sftp.triggered.connect(self.add_sftp_connection)
        btn_add.setMenu(add_menu)

        # V3 NEW: Database audit button
        btn_audit = QPushButton("🛡️ Sicherheitsprüfung")
        btn_audit.setToolTip("Prüfe alle Verbindungen auf Datenbank-Sicherheit")
        btn_audit.clicked.connect(self.audit_all_connections)

        self.btn_profiler = QPushButton("📚 ProFiler öffnen")
        self.btn_profiler.setToolTip("Startet ProFiler als Companion-App")
        self.btn_profiler.clicked.connect(self.launch_profiler)

        btn_portable = QPushButton("⇄ Profil austauschen")
        portable_menu = QMenu(self)
        act_export_profile = portable_menu.addAction("📤 Profil exportieren")
        act_export_profile.triggered.connect(self.export_portable_profile_dialog)
        act_import_profile = portable_menu.addAction("📥 Profil importieren")
        act_import_profile.triggered.connect(self.import_portable_profile_dialog)
        btn_portable.setMenu(portable_menu)

        empty = QWidget()
        empty.setSizePolicy(QSizePolicy.Policy.Expanding, QSizePolicy.Policy.Preferred)

        self.btn_search = QPushButton("🔍 Datenbank durchsuchen")
        self.btn_search.clicked.connect(self.open_reader)

        toolbar_lay.addWidget(btn_add)
        toolbar_lay.addWidget(btn_audit)  # V3 NEW
        toolbar_lay.addWidget(self.btn_profiler)
        toolbar_lay.addWidget(btn_portable)
        toolbar_lay.addWidget(empty)
        toolbar_lay.addWidget(self.btn_search)
        main_lay.addLayout(toolbar_lay)

        splitter = QSplitter(Qt.Orientation.Horizontal)
        self.list = QListWidget()
        self.list.setSelectionMode(QAbstractItemView.SelectionMode.ExtendedSelection)
        self.list.itemClicked.connect(self.on_item_select)
        self.list.itemSelectionChanged.connect(self.refresh_selection_state)
        self.list.setContextMenuPolicy(Qt.ContextMenuPolicy.CustomContextMenu)
        self.list.customContextMenuRequested.connect(self.open_context_menu)

        right_panel = QWidget()
        r_lay = QVBoxLayout(right_panel)
        self.lbl_info = QLabel("Wähle eine Aufgabe...")
        self.lbl_info.setStyleSheet("font-weight: bold; font-size: 14px;")

        ctrl_lay = QHBoxLayout()
        self.btn_run = QPushButton("▶ Start Sync")
        self.btn_run.clicked.connect(self.start_sync)
        self.btn_pause = QPushButton("⏸ Pause")
        self.btn_pause.clicked.connect(self.toggle_pause)
        self.btn_pause.setEnabled(False)
        self.btn_stop = QPushButton("⏹ Stop")
        self.btn_stop.clicked.connect(self.stop_worker)
        self.btn_stop.setEnabled(False)
        ctrl_lay.addWidget(self.btn_run)
        ctrl_lay.addWidget(self.btn_pause)
        ctrl_lay.addWidget(self.btn_stop)

        self.progress = QProgressBar()
        self.lbl_status = QLabel("Bereit")
        self.lbl_status.setWordWrap(True)
        r_lay.addWidget(self.lbl_info)
        r_lay.addLayout(ctrl_lay)
        r_lay.addWidget(self.progress)
        r_lay.addWidget(self.lbl_status)
        r_lay.addStretch()

        splitter.addWidget(self.list)
        splitter.addWidget(right_panel)
        splitter.setStretchFactor(1, 2)
        main_lay.addWidget(splitter)

        self.populate_list()
        self.scheduler.update_all()

    def setup_tray_icon(self):
        icon_path = os.path.join(app_base_dir(), "ICO_TRAY.ico")
        if os.path.exists(icon_path):
            self.tray_icon.setIcon(QIcon(icon_path))
        else:
            self.tray_icon.setIcon(
                self.style().standardIcon(QStyle.StandardPixmap.SP_DriveNetIcon)
            )
        self.tray_icon.setToolTip("ProSync V3.2 - Läuft im Hintergrund")

    # ============ V3.2 NEW: TOAST-NOTIFICATION SYSTEM ============
    def notify(self, title: str, message: str, 
               msg_type: QSystemTrayIcon.MessageIcon = None,
               duration_ms: int = 3000):
        """
        V3.2 NEW: Zentrale Toast-Notification Methode.
        
        Args:
            title: Titel der Benachrichtigung
            message: Nachrichtentext
            msg_type: Info/Warning/Critical (default: Info)
            duration_ms: Anzeigedauer in ms (default: 3000)
        """
        # Prüfe ob Notifications aktiviert sind
        app_settings = self.cfg.data.get("app", {})
        if not app_settings.get("notifications_enabled", True):
            return
        
        if msg_type is None:
            msg_type = self.NotificationType.INFO
        
        if self.tray_icon.isVisible():
            self.tray_icon.showMessage(title, message, msg_type, duration_ms)
    
    def notify_sync_started(self, conn_name: str):
        """V3.2: Benachrichtigung bei Sync-Start."""
        self.notify("ProSync", f"▶ Sync gestartet: {conn_name}", 
                   self.NotificationType.INFO, 2000)
    
    def notify_sync_finished(self, conn_name: str, success: bool = True):
        """V3.2: Benachrichtigung bei Sync-Ende."""
        if success:
            self.notify("ProSync", f"✓ Sync abgeschlossen: {conn_name}",
                       self.NotificationType.SUCCESS, 3000)
        else:
            self.notify("ProSync", f"⚠ Sync fehlgeschlagen: {conn_name}",
                       self.NotificationType.ERROR, 5000)
    
    def notify_error(self, message: str):
        """V3.2: Fehler-Benachrichtigung."""
        self.notify("ProSync - Fehler", message, 
                   self.NotificationType.ERROR, 5000)
    
    def notify_auto_sync(self, conn_name: str):
        """V3.2: Benachrichtigung bei Auto-Sync."""
        self.notify("ProSync [Auto]", f"⏰ Starte automatischen Sync: {conn_name}",
                   self.NotificationType.INFO, 2000)
    # ============ END TOAST-NOTIFICATION SYSTEM ============

    def toggle_autostart(self, checked):
        if AutostartManager.set_autostart(checked):
            self.lbl_status.setText(f"Autostart {'aktiviert' if checked else 'deaktiviert'}")
        else:
            QMessageBox.warning(self, "Fehler",
                              "Autostart konnte nicht geändert werden (Rechte?).")

    def populate_list(self):
        self.list.clear()
        for c in self.cfg.list_connections():
            auto_txt = " [Auto]" if c.get("autosync", {}).get("enabled") else ""

            # V3 NEW: Show safety status
            safety_txt = ""
            if c.get("_safety_analysis", {}).get("auto_configured"):
                safety_txt = " 🛡️"

            # V3.1 NEW: Show connection type icon
            conn_type = c.get("type", ConnectionType.FOLDER)
            if conn_type == ConnectionType.FILE:
                type_icon = "📄"
            elif conn_type == ConnectionType.SFTP:
                type_icon = "🌐"
            else:
                type_icon = "📁"

            item = QListWidgetItem(f"{type_icon} {c['name']}{auto_txt}{safety_txt}")

            # V3.1: Different tooltip for file vs folder
            if conn_type == ConnectionType.FILE:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[FILE] {src} -> {tgt} ({c.get('mode', 'one_way')})")
            elif conn_type == ConnectionType.SFTP:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[SFTP] {src} -> {tgt} ({c.get('mode', 'update')})")
            else:
                src = self._format_connection_endpoint(c, "source")
                tgt = self._format_connection_endpoint(c, "target")
                item.setToolTip(f"[FOLDER] {src} -> {tgt} ({c.get('mode', 'two_way')})")

            item.setData(Qt.ItemDataRole.UserRole, c)
            self.list.addItem(item)
        self.refresh_selection_state()

    def get_selected_connections(self):
        """Liest die aktuell ausgewählten Verbindungen dedupliziert aus."""
        items = self.list.selectedItems()
        if not items and self.list.currentItem():
            items = [self.list.currentItem()]

        selected = []
        seen_ids = set()
        for item in items:
            conn = item.data(Qt.ItemDataRole.UserRole)
            conn_id = conn.get("id")
            if not conn_id or conn_id in seen_ids:
                continue
            seen_ids.add(conn_id)
            selected.append(conn)
        return selected

    @staticmethod
    def _portable_hint_label(data, key):
        """Read a redacted path hint from an imported portable profile."""
        portable_meta = data.get("_portable_import", {})
        if not isinstance(portable_meta, dict):
            return ""
        hints = portable_meta.get("path_hints", {})
        if not isinstance(hints, dict):
            return ""
        return str(hints.get(key, "")).strip()

    def _format_connection_endpoint(self, data, role):
        """Prefer real local paths, otherwise show redacted remapping hints."""
        conn_type = data.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            field_map = {
                "source": ("source_file", "source_label"),
                "target": ("target_file", "target_label"),
            }
        elif conn_type == ConnectionType.SFTP:
            field_map = {
                "source": ("source", "source_label"),
                "target": ("target", "target_label"),
            }
        else:
            field_map = {
                "source": ("source", "source_label"),
                "target": ("target", "target_label"),
                "db": ("db_path", "db_label"),
            }

        actual_key, hint_key = field_map[role]
        actual_value = str(data.get(actual_key, "") or "").strip()
        if actual_value:
            return actual_value

        hint = self._portable_hint_label(data, hint_key)
        if hint:
            return f"[neu zuordnen] {hint}"
        return "?"

    def _connection_requires_path_mapping(self, data):
        """Imported portable profiles must be mapped before their first sync."""
        portable_meta = data.get("_portable_import", {})
        if not isinstance(portable_meta, dict) or not portable_meta.get("requires_mapping"):
            return False

        conn_type = data.get("type", ConnectionType.FOLDER)
        if conn_type == ConnectionType.FILE:
            return not (str(data.get("source_file", "")).strip() and str(data.get("target_file", "")).strip())
        if conn_type == ConnectionType.SFTP:
            return not (
                str(data.get("source", "")).strip()
                and str(data.get("target", "")).strip()
                and str(data.get("remote_host", "")).strip()
            )
        return not (str(data.get("source", "")).strip() and str(data.get("target", "")).strip())

    def refresh_selection_state(self):
        """Aktualisiert Detailanzeige und Button-Status anhand der Auswahl."""
        selected = self.get_selected_connections()
        selected_count = len(selected)
        is_running = bool(self.worker and self.worker.isRunning())

        if selected_count > 1:
            preview_names = ", ".join(conn["name"] for conn in selected[:3])
            if selected_count > 3:
                preview_names += f" … (+{selected_count - 3})"
            self.lbl_info.setText(
                f"📦 Batch-Auswahl ({selected_count} Aufgaben)\n"
                f"{preview_names}"
            )
            self.btn_run.setText("▶ Batch starten")
            self.btn_run.setEnabled(
                not is_running
                and not any(self._connection_requires_path_mapping(conn) for conn in selected)
            )
            self.btn_pause.setEnabled(False)
            self.btn_stop.setEnabled(is_running)
            return

        self.btn_run.setText("▶ Start Sync")
        if selected_count == 1:
            self._show_connection_details(selected[0])
            return

        self.lbl_info.setText("Wähle eine Aufgabe...")
        self.btn_run.setEnabled(not is_running)
        self.btn_pause.setEnabled(False)
        self.btn_stop.setEnabled(is_running)

    def _show_connection_details(self, data):
        """Zeigt die Details der aktuell ausgewählten Verbindung an."""
        conn_type = data.get("type", ConnectionType.FOLDER)

        # V3.1: Different info display for FILE vs FOLDER
        if conn_type == ConnectionType.FILE:
            # File connection info
            checkpoint_txt = " [Checkpoint: AN]" if data.get("checkpoint_before_sync") else ""
            safety_info = ""
            mapping_note = ""

            if "_file_analysis" in data:
                fa = data["_file_analysis"]
                db_type = fa.get("type", "unknown")
                size_mb = fa.get("size_mb", 0)
                wal_mode = fa.get("wal_mode", False)
                wal_txt = " (WAL)" if wal_mode else ""
                safety_info = f"\n🛡️ Typ: {db_type}{wal_txt}, {size_mb:.1f} MB"

            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quelldatei und Zieldatei vor dem ersten Sync neu wählen."

            self.lbl_info.setText(
                f"📄 {data['name']} [{data.get('mode', 'one_way').upper()}]{checkpoint_txt}{safety_info}{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {self._format_connection_endpoint(data, 'target')}"
            )
        elif conn_type == ConnectionType.SFTP:
            mapping_note = ""
            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quellordner, SFTP-Host und Remote-Ziel vor dem ersten Sync neu wählen."
            self.lbl_info.setText(
                f"🌐 {data['name']} [{data.get('mode', 'update').upper()}]"
                f"\n⚠ Nicht datenbanksicher über SFTP"
                f"{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {sftp_connection_display(data)}"
            )
        else:
            # Folder connection info
            idx_txt = " [Index: AN]" if data.get("indexing", True) else " [Index: AUS]"

            # V3 NEW: Show safety info
            safety_info = ""
            mapping_note = ""
            if "_safety_analysis" in data:
                sa = data["_safety_analysis"]
                excluded = sa.get("excluded_databases", 0)
                if excluded > 0:
                    safety_info = f"\n🛡️ {excluded} DB(s) ausgeschlossen, {sa.get('databases_found', 0)} total"
                else:
                    safety_info = f"\n🛡️ {sa.get('databases_found', 0)} DB(s) gefunden"

            if self._connection_requires_path_mapping(data):
                mapping_note = "\n⚠ Importiertes Profil: Quell- und Zielordner vor dem ersten Sync neu wählen."

            self.lbl_info.setText(
                f"📁 {data['name']} [{data.get('mode', 'two_way').upper()}]{idx_txt}{safety_info}{mapping_note}\n"
                f"Src: {self._format_connection_endpoint(data, 'source')}\n"
                f"Tgt: {self._format_connection_endpoint(data, 'target')}"
            )

        is_running = bool(self.worker and self.worker.isRunning())
        is_this_task_running = is_running and (self.worker.conn_id == data['id'])
        self.btn_run.setEnabled(not is_running and not self._connection_requires_path_mapping(data))
        self.btn_pause.setEnabled(is_this_task_running)
        self.btn_stop.setEnabled(is_this_task_running)
        if is_this_task_running and self.worker.is_paused:
            self.btn_pause.setText("▶ Fortsetzen")
        else:
            self.btn_pause.setText("⏸ Pause")

    def add_folder_connection(self):
        """V3.1: Add folder connection."""
        dlg = ConnectionDialog(self)
        if dlg.exec():
            self.cfg.add_or_update_connection(dlg.get_result())
            self.scheduler.update_all()
            self.populate_list()

    def add_file_connection(self):
        """V3.1 NEW: Add file connection."""
        dlg = FileConnectionDialog(self)
        if dlg.exec():
            self.cfg.add_or_update_connection(dlg.get_result())
            self.scheduler.update_all()
            self.populate_list()

    def add_sftp_connection(self):
        """Add an SFTP target connection."""
        dlg = SftpTargetDialog(self)
        if dlg.exec():
            conn = dlg.get_result()
            try:
                validate_sftp_connection(conn)
            except ValueError as exc:
                QMessageBox.warning(self, "SFTP-Konfiguration prüfen", str(exc))
                return
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_all()
            self.populate_list()

    def on_item_select(self, _item):
        self.refresh_selection_state()

    def start_sync(self):
        selected = self.get_selected_connections()
        if not selected:
            return
        unmapped = [conn["name"] for conn in selected if self._connection_requires_path_mapping(conn)]
        if unmapped:
            QMessageBox.warning(
                self,
                "Pfadzuordnung erforderlich",
                "Diese importierten Profile müssen vor dem ersten Sync lokal neu zugeordnet werden:\n\n"
                + "\n".join(unmapped),
            )
            return
        if len(selected) > 1:
            self.start_batch_sync(selected)
            return
        self.run_sync_logic(selected[0])

    def export_portable_profile_dialog(self):
        """Exportiere Verbindungen als redigiertes Austauschprofil."""
        default_path = str(Path.home() / f"{PORTABLE_PROFILE_SCHEMA}.json")
        export_path, _selected_filter = QFileDialog.getSaveFileName(
            self,
            "Profil exportieren",
            default_path,
            "JSON-Dateien (*.json)",
        )
        if not export_path:
            return

        try:
            payload = self.cfg.export_portable_profile(export_path)
        except Exception as exc:
            QMessageBox.critical(
                self,
                "Export fehlgeschlagen",
                f"Das Austauschprofil konnte nicht gespeichert werden:\n{exc}",
            )
            return

        QMessageBox.information(
            self,
            "Profil exportiert",
            f"{len(payload.get('connections', []))} Aufgabe(n) wurden exportiert.\n\n"
            "Lokale Pfade, `app.profiler_path` und andere persönliche Systempfade "
            "sind im Austauschformat bewusst redigiert.",
        )

    def import_portable_profile_dialog(self):
        """Importiere ein redigiertes Austauschprofil als lokale Entwürfe."""
        import_path, _selected_filter = QFileDialog.getOpenFileName(
            self,
            "Profil importieren",
            str(Path.home()),
            "JSON-Dateien (*.json)",
        )
        if not import_path:
            return

        try:
            result = self.cfg.import_portable_profile(import_path)
        except Exception as exc:
            QMessageBox.critical(
                self,
                "Import fehlgeschlagen",
                f"Das Austauschprofil konnte nicht importiert werden:\n{exc}",
            )
            return

        self.scheduler.update_all()
        self.populate_list()
        QMessageBox.information(
            self,
            "Profil importiert",
            f"{result['imported']} Aufgabe(n) wurden als lokale Entwürfe angelegt.\n"
            f"Neu vergebene IDs wegen Kollisionen: {result['renamed']}.\n\n"
            "Bitte Quell- und Zielpfade vor dem ersten Sync neu zuordnen.",
        )

    def start_batch_sync(self, connections):
        """Startet einen sequenziellen Batch-Lauf über mehrere Verbindungen."""
        if self.worker is not None and self.worker.isRunning():
            QMessageBox.warning(self, "Beschäftigt",
                              "Es läuft bereits ein Synchronisationsvorgang.")
            return

        planned = self.batch_queue.start(connections)
        if len(planned) < 2:
            self.batch_queue.reset()
            if planned:
                self.run_sync_logic(planned[0])
            return

        self.progress.setValue(0)
        self.lbl_status.setText(f"Batch gestartet ({len(planned)} Aufgaben).")
        self.notify("ProSync", f"▶ Batch gestartet: {len(planned)} Aufgaben",
                   self.NotificationType.INFO, 2500)
        self._run_next_batch_sync()

    def _run_next_batch_sync(self):
        """Startet die nächste Verbindung aus der aktiven Batch-Queue."""
        conn = self.batch_queue.next_connection()
        if conn is None:
            return

        current_index = self.batch_queue.completed_count + 1
        total = self.batch_queue.total
        self.lbl_status.setText(f"[Batch {current_index}/{total}] Starte {conn['name']}...")
        self.run_sync_logic(conn)

    def run_sync_logic(self, conn_data):
        if self.worker is not None and self.worker.isRunning():
            QMessageBox.warning(self, "Beschäftigt",
                              "Es läuft bereits ein Synchronisationsvorgang.")
            return

        self._worker_had_error = False
        self._stop_requested = False
        self.btn_run.setEnabled(False)
        self.btn_stop.setEnabled(True)
        self.btn_pause.setEnabled(True)
        self.btn_pause.setText("⏸ Pause")
        
        # V3.2 NEW: Toast bei Sync-Start
        self.notify_sync_started(conn_data.get("name", "Unbekannt"))

        # V3.1 NEW: Select worker based on connection type
        conn_type = conn_data.get("type", ConnectionType.FOLDER)

        if conn_type == ConnectionType.FILE:
            # File sync worker (no database indexing)
            self.worker = FileSyncWorker(conn_data)
        elif conn_type == ConnectionType.SFTP:
            self.worker = SftpTargetSyncWorker(conn_data)
        else:
            # Folder sync worker (with optional database)
            db = None
            if conn_data.get("indexing") and conn_data.get("db_path"):
                try:
                    db = ConnectionDB(conn_data["db_path"])
                except Exception as e:
                    log_warning(f"Warning: Could not open indexing database: {e}")

            self.worker = FolderSyncWorker(conn_data, db)

        self.worker.progress.connect(self.progress.setValue)
        self.worker.status.connect(self.lbl_status.setText)
        self.worker.finished.connect(self.worker_finished)
        # V3.2 CHANGED: Error-Handler mit Notification
        self.worker.error.connect(self._handle_worker_error)
        # Sync-Report speichern
        if isinstance(self.worker, (FolderSyncWorker, SftpTargetSyncWorker)):
            self.worker.sync_report.connect(self._save_sync_report)
        self.worker.start()

    def _handle_worker_error(self, error_msg: str):
        """V3.2 NEW: Zentraler Error-Handler mit Notification."""
        self._worker_had_error = True
        QMessageBox.critical(self, "Fehler", error_msg)
        self.notify_error(error_msg[:100])  # Kürzen für Toast
        if self.batch_queue.total > 1 and self.batch_queue.current is not None:
            self.lbl_status.setText(
                f"Batch-Fehler bei {self.batch_queue.current.get('name', 'Unbekannt')}."
            )
        self.btn_stop.setEnabled(False)
        self.btn_pause.setEnabled(False)
        QTimer.singleShot(0, self.worker_finished)

    def toggle_pause(self):
        if self.worker and self.worker.isRunning():
            if self.worker.is_paused:
                self.worker.resume()
                self.btn_pause.setText("⏸ Pause")
                self.lbl_status.setText(f"[{self.worker.cfg['name']}] Fahre fort...")
            else:
                self.worker.pause()
                self.btn_pause.setText("▶ Fortsetzen")
                self.lbl_status.setText(f"[{self.worker.cfg['name']}] Pausiert")

    def on_auto_sync_triggered(self, conn):
        if self.worker is not None and self.worker.isRunning():
            return
        if self.batch_queue.active:
            return
        self.lbl_status.setText(f"[Auto] Starte Sync für {conn['name']}...")
        # V3.2 NEW: Toast bei Auto-Sync
        self.notify_auto_sync(conn.get("name", "Unbekannt"))
        self.run_sync_logic(conn)

    def stop_worker(self):
        self._stop_requested = True
        if self.batch_queue.active:
            skipped = self.batch_queue.cancel_pending()
            if skipped:
                self.lbl_status.setText(
                    f"Breche Batch ab... ({len(skipped)} verbleibend)"
                )
        if self.worker:
            self.worker.kill()
            if self.batch_queue.total <= 1:
                self.lbl_status.setText("Breche ab...")

    def _save_sync_report(self, report: dict) -> None:
        """Persist a sync-run report as JSON and keep the last 100 entries."""
        save_sync_report(report)

    def worker_finished(self):
        conn_name = self.worker.cfg.get("name", "Sync") if self.worker else "Sync"
        had_error = self._worker_had_error
        stop_requested = self._stop_requested
        is_batch_run = self.batch_queue.total > 1

        self._worker_had_error = False
        self._stop_requested = False
        self.worker = None

        self.btn_run.setEnabled(True)
        self.btn_stop.setEnabled(False)
        self.btn_pause.setEnabled(False)
        self.btn_pause.setText("⏸ Pause")

        if stop_requested:
            self.progress.setValue(0)
            if is_batch_run:
                self.batch_queue.reset()
                self.lbl_status.setText("Batch abgebrochen.")
            else:
                self.lbl_status.setText("Abgebrochen.")
            self.refresh_selection_state()
            return

        if is_batch_run:
            if had_error:
                self.batch_queue.cancel_pending()
                self.batch_queue.reset()
                self.progress.setValue(0)
                self.lbl_status.setText(f"Batch abgebrochen bei {conn_name}.")
                self.refresh_selection_state()
                return

            self.batch_queue.mark_current_finished()
            completed = self.batch_queue.completed_count
            total = self.batch_queue.total
            remaining = self.batch_queue.remaining_count

            if remaining > 0:
                self.progress.setValue(0)
                self.lbl_status.setText(
                    f"Batch-Fortschritt: {completed}/{total} abgeschlossen, {remaining} verbleibend."
                )
                QTimer.singleShot(0, self._run_next_batch_sync)
                return

            self.batch_queue.reset()
            self.progress.setValue(100)
            self.lbl_status.setText(f"Batch abgeschlossen ({completed}/{total}).")
            self.notify("ProSync", f"✓ Batch abgeschlossen: {completed} Aufgaben",
                       self.NotificationType.SUCCESS, 3000)
            self.refresh_selection_state()
            return

        if had_error:
            self.progress.setValue(0)
            self.refresh_selection_state()
            return

        self.progress.setValue(100)
        self.lbl_status.setText("Fertig.")
        # V3.2 CHANGED: Verwende zentrale Notification-Methode
        self.notify_sync_finished(conn_name, success=True)
        self.refresh_selection_state()
        self.worker = None

    def audit_all_connections(self):
        """V3 NEW: Audit all connections for database safety."""
        connections = self.cfg.list_connections()
        if not connections:
            QMessageBox.information(self, "Sicherheitsprüfung",
                                  "Keine Verbindungen konfiguriert.")
            return

        results = []
        fixed_count = 0

        for conn in connections:
            conn_type = conn.get("type", ConnectionType.FOLDER)

            if conn_type == ConnectionType.FILE:
                # File connections - check file safety
                updated_conn, warnings, was_changed = DatabaseSafetyManager.apply_safe_settings_file(
                    conn.copy()
                )

                if was_changed:
                    self.cfg.add_or_update_connection(updated_conn)
                    fixed_count += 1
                    results.append(f"✓ {conn['name']} [FILE]: {len(warnings)} Änderung(en)")
                    for w in warnings:
                        results.append(f"  - {w}")
                else:
                    results.append(f"✓ {conn['name']} [FILE]: Bereits sicher konfiguriert")

            elif conn_type == ConnectionType.SFTP:
                try:
                    validate_sftp_connection(conn)
                    results.append(f"⚠ {conn['name']} [SFTP]: {REMOTE_UNSAFE_DATABASE_WARNING}")
                except ValueError as exc:
                    results.append(f"⚠ {conn['name']} [SFTP]: {exc}")
            else:
                # Folder connections - check for databases
                source = conn.get("source", "")
                if not source or not os.path.exists(source):
                    continue

                databases = DatabaseSafetyManager.scan_directory_for_databases(source)

                if databases:
                    # Apply safe settings
                    updated_conn, warnings, excluded_dbs, was_changed = DatabaseSafetyManager.apply_safe_settings_folder(
                        conn.copy(), databases
                    )

                    if was_changed:
                        # Update configuration
                        self.cfg.add_or_update_connection(updated_conn)
                        fixed_count += 1
                        results.append(f"✓ {conn['name']}: {len(warnings)} Änderung(en)")
                        for w in warnings:
                            results.append(f"  - {w}")
                    else:
                        results.append(f"✓ {conn['name']}: Bereits sicher konfiguriert")

        if results:
            msg = f"🛡️ Sicherheitsprüfung abgeschlossen\n\n"
            if fixed_count > 0:
                msg += f"{fixed_count} Verbindung(en) wurden aktualisiert:\n\n"
            msg += "\n".join(results)
            QMessageBox.information(self, "Sicherheitsprüfung", msg)

            # Refresh UI
            self.populate_list()
            self.scheduler.update_all()
        else:
            QMessageBox.information(self, "Sicherheitsprüfung",
                                  "Keine Datenbanken in konfigurierten Quellen gefunden.")

    def open_context_menu(self, pos):
        item = self.list.itemAt(pos)
        if not item:
            return

        conn = item.data(Qt.ItemDataRole.UserRole)
        autosync = conn.get("autosync", {"enabled": False, "interval_minutes": 15})
        selected_connections = self.get_selected_connections()

        menu = QMenu(self)
        batch_action = None
        if len(selected_connections) > 1:
            batch_action = menu.addAction(
                f"Batch aus Auswahl starten ({len(selected_connections)})"
            )
            menu.addSeparator()
        act_edit = menu.addAction("Bearbeiten")
        act_del = menu.addAction("Löschen")
        menu.addSeparator()

        act_auto = QAction("Automatisch ausführen", self)
        act_auto.setCheckable(True)
        act_auto.setChecked(autosync.get("enabled", False))
        menu.addAction(act_auto)

        interval_menu = menu.addMenu("Intervall")
        group = QActionGroup(self)
        current_int = autosync.get("interval_minutes", 15)
        for mins in [5, 15, 30, 60, 120]:
            act_int = QAction(f"Alle {mins} Minuten", self)
            act_int.setCheckable(True)
            act_int.setData(mins)
            if mins == current_int:
                act_int.setChecked(True)
            group.addAction(act_int)
            interval_menu.addAction(act_int)

        res = menu.exec(self.list.viewport().mapToGlobal(pos))

        if res == batch_action:
            self.start_batch_sync(selected_connections)

        elif res == act_del:
            if self.worker and self.worker.isRunning() and self.worker.conn_id == conn['id']:
                return
            if QMessageBox.question(self, "Löschen", "Aufgabe löschen?") == QMessageBox.StandardButton.Yes:
                self.cfg.remove_connection(conn['id'])
                self.scheduler.update_all()
                self.populate_list()

        elif res == act_edit:
            conn_type = conn.get("type", ConnectionType.FOLDER)
            if conn_type == ConnectionType.FILE:
                dlg = FileConnectionDialog(self, existing=conn)
            elif conn_type == ConnectionType.SFTP:
                dlg = SftpTargetDialog(self, existing=conn)
            else:
                dlg = ConnectionDialog(self, existing=conn)
            if dlg.exec():
                updated = dlg.get_result()
                if updated.get("type") == ConnectionType.SFTP:
                    try:
                        validate_sftp_connection(updated)
                    except ValueError as exc:
                        QMessageBox.warning(self, "SFTP-Konfiguration prüfen", str(exc))
                        return
                self.cfg.add_or_update_connection(updated)
                self.scheduler.update_all()
                self.populate_list()

        elif res == act_auto:
            conn["autosync"] = conn.get("autosync", {})
            conn["autosync"]["enabled"] = act_auto.isChecked()
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_connection(conn)
            self.populate_list()

        elif res in group.actions():
            conn["autosync"] = conn.get("autosync", {})
            conn["autosync"]["interval_minutes"] = res.data()
            conn["autosync"]["enabled"] = True
            self.cfg.add_or_update_connection(conn)
            self.scheduler.update_connection(conn)
            self.populate_list()

    def _launch_tool_process(self, tool_path):
        """Launch a local Python, batch or executable tool."""
        tool_path = Path(tool_path).expanduser()
        if tool_path.suffix.lower() == ".py":
            launch_cmd = [sys.executable, str(tool_path)]
        elif tool_path.suffix.lower() == ".bat":
            launch_cmd = ["cmd", "/c", str(tool_path)]
        else:
            launch_cmd = [str(tool_path)]

        kwargs = {"cwd": str(tool_path.parent)}
        if sys.platform == "win32":
            kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
        subprocess.Popen(launch_cmd, **kwargs)

    def open_reader(self):
        base_dir = app_base_dir()
        if getattr(sys, "frozen", False):
            reader_path = os.path.join(base_dir, "ProSyncReader.exe")
        else:
            reader_path = os.path.join(base_dir, "ProSyncReader.py")
        if os.path.exists(reader_path):
            self._launch_tool_process(reader_path)
        else:
            QMessageBox.warning(self, "Nicht gefunden",
                              "ProSyncReader wurde nicht gefunden.")

    def launch_profiler(self):
        """Startet ProFiler als optionale Companion-App."""
        base_dir = Path(app_base_dir())
        app_settings = self.cfg.data.get("app", {})
        profiler_path = resolve_profiler_launch_path(
            base_dir,
            app_settings.get("profiler_path", ""),
        )

        if not profiler_path:
            QMessageBox.warning(
                self,
                "ProFiler nicht gefunden",
                "ProFiler konnte nicht automatisch gefunden werden.\n\n"
                "Bitte lege den Pfad in ProSync_config.json unter "
                "'app.profiler_path' fest oder platziere ProFiler neben "
                "ProSync im gemeinsamen Software-Baum."
            )
            return

        try:
            self._launch_tool_process(profiler_path)
            QMessageBox.information(
                self,
                "ProFiler gestartet",
                "ProFiler wurde als optionale Companion-App gestartet.\n\n"
                "ProSync bleibt geöffnet, beide Werkzeuge laufen unabhängig."
            )
        except Exception as e:
            QMessageBox.critical(
                self,
                "Fehler",
                f"Konnte ProFiler nicht starten:\n{str(e)}"
            )

    def closeEvent(self, event):
        if self.tray_icon.isVisible():
            self.hide()
            # V3.2 CHANGED: Verwende zentrale Notification-Methode
            self.notify("ProSync", "Läuft im Hintergrund weiter. Doppelklick auf Tray-Icon zum Öffnen.",
                       self.NotificationType.INFO, 2500)
            event.ignore()
        else:
            event.accept()

    def show_and_raise(self):
        self.show()
        self.raise_()
        self.activateWindow()

    def on_tray_click(self, reason):
        if reason == QSystemTrayIcon.ActivationReason.DoubleClick:
            self.show_and_raise()

    def force_quit(self):
        self.scheduler.stop_all()
        QApplication.quit()


def build_cli_parser():
    """Build the headless ProSync CLI parser."""
    parser = argparse.ArgumentParser(
        prog="ProSync",
        description="Headless ProSync connection runner.",
    )
    action = parser.add_mutually_exclusive_group(required=True)
    action.add_argument(
        "--list",
        action="store_true",
        help="List configured connections without starting the GUI.",
    )
    action.add_argument(
        "--run",
        metavar="ID_OR_NAME",
        help="Run one configured connection by exact ID or exact name.",
    )
    action.add_argument(
        "--all",
        action="store_true",
        help="Run all configured connections sequentially.",
    )
    parser.add_argument(
        "--config",
        default=os.path.join(app_base_dir(), "ProSync_config.json"),
        help="Path to ProSync_config.json. Defaults to the app directory.",
    )
    parser.add_argument(
        "--quiet",
        action="store_true",
        help="Suppress status lines during sync runs.",
    )
    return parser


def _ensure_core_application():
    """Ensure QThread/QObject infrastructure exists for headless workers."""
    app = QCoreApplication.instance()
    if app is None:
        app = QCoreApplication([])
    return app


def _connection_label(conn):
    """Return the best human-readable connection label."""
    name = str(conn.get("name") or "").strip()
    conn_id = str(conn.get("id") or "").strip()
    return name or conn_id or "Unbenannte Verbindung"


def _format_autosync(conn):
    autosync = conn.get("autosync", {})
    if not isinstance(autosync, dict):
        return "off"
    enabled = "on" if autosync.get("enabled") else "off"
    interval = autosync.get("interval_minutes", DEFAULT_AUTOSYNC_INTERVAL)
    return f"{enabled}/{interval}m"


def print_cli_connections(connections, stream=None):
    """Print configured connections in a compact, script-friendly table."""
    if stream is None:
        stream = sys.stdout
    if not connections:
        print("Keine Verbindungen konfiguriert.", file=stream)
        return

    print("ID\tName\tTyp\tModus\tAutosync", file=stream)
    for conn in connections:
        print(
            "\t".join(
                [
                    str(conn.get("id", "")),
                    _connection_label(conn),
                    str(conn.get("type", ConnectionType.FOLDER)),
                    str(conn.get("mode", "")),
                    _format_autosync(conn),
                ]
            ),
            file=stream,
        )


def select_cli_connection(connections, selector):
    """Select a connection by exact ID first, then by exact case-insensitive name."""
    selector = str(selector or "").strip()
    if not selector:
        raise ValueError("Keine Verbindung angegeben")

    id_matches = [
        conn for conn in connections
        if str(conn.get("id", "")).strip() == selector
    ]
    if len(id_matches) == 1:
        return id_matches[0]

    selector_fold = selector.casefold()
    name_matches = [
        conn for conn in connections
        if str(conn.get("name", "")).strip().casefold() == selector_fold
    ]
    if len(name_matches) == 1:
        return name_matches[0]
    if len(name_matches) > 1:
        raise ValueError(f"Mehrere Verbindungen heißen '{selector}'. Bitte ID verwenden.")
    raise ValueError(f"Verbindung nicht gefunden: {selector}")


def create_cli_worker(conn):
    """Create the same worker type the GUI uses for a connection."""
    conn_type = conn.get("type", ConnectionType.FOLDER)
    if conn_type == ConnectionType.FILE:
        return FileSyncWorker(conn)
    if conn_type == ConnectionType.SFTP:
        return SftpTargetSyncWorker(conn)

    db = None
    if conn.get("indexing") and conn.get("db_path"):
        try:
            db = ConnectionDB(conn["db_path"])
        except Exception as exc:
            log_warning(f"Warning: Could not open indexing database: {exc}")
    return FolderSyncWorker(conn, db)


def run_headless_connection(conn, quiet=False):
    """Run one configured connection synchronously without opening the GUI."""
    _ensure_core_application()
    worker = create_cli_worker(conn)
    label = _connection_label(conn)
    errors = []
    reports = []
    finished = {"value": False}

    def on_status(message):
        if not quiet:
            print(message, flush=True)

    def on_error(message):
        errors.append(str(message))
        print(f"Fehler [{label}]: {message}", file=sys.stderr, flush=True)

    def on_finished():
        finished["value"] = True

    def on_report(report):
        reports.append(report)
        save_sync_report(report)

    worker.status.connect(on_status)
    worker.error.connect(on_error)
    worker.finished.connect(on_finished)
    if isinstance(worker, (FolderSyncWorker, SftpTargetSyncWorker)):
        worker.sync_report.connect(on_report)

    if not quiet:
        print(f"Starte: {label}", flush=True)
    worker.run()

    if errors:
        return {"ok": False, "errors": errors, "reports": reports}
    if not finished["value"]:
        message = "Sync wurde nicht abgeschlossen"
        print(f"Fehler [{label}]: {message}", file=sys.stderr, flush=True)
        return {"ok": False, "errors": [message], "reports": reports}

    if not quiet:
        print(f"Fertig: {label}", flush=True)
    return {"ok": True, "errors": [], "reports": reports}


def run_headless_connections(connections, quiet=False):
    """Run multiple connections sequentially and stop on the first failure."""
    if not connections:
        print("Keine Verbindungen konfiguriert.", file=sys.stderr)
        return 2

    for index, conn in enumerate(connections, start=1):
        if not quiet:
            print(f"[{index}/{len(connections)}]", flush=True)
        result = run_headless_connection(conn, quiet=quiet)
        if not result["ok"]:
            return 1
    return 0


def run_cli(argv=None):
    """Run ProSync in headless CLI mode."""
    parser = build_cli_parser()
    args = parser.parse_args(argv)

    cfg = ConfigManager(args.config)
    connections = [
        conn for conn in cfg.list_connections()
        if isinstance(conn, dict)
    ]

    if args.list:
        print_cli_connections(connections)
        return 0

    _ensure_core_application()
    lock_file = QLockFile(QDir.temp().filePath("prosync.lock"))
    if not lock_file.tryLock(100):
        print("ProSync läuft bereits. Headless-Sync abgebrochen.", file=sys.stderr)
        return 2

    try:
        if args.run:
            try:
                selected = select_cli_connection(connections, args.run)
            except ValueError as exc:
                print(str(exc), file=sys.stderr)
                return 2
            return run_headless_connections([selected], quiet=args.quiet)

        if args.all:
            return run_headless_connections(connections, quiet=args.quiet)
    finally:
        lock_file.unlock()

    return 2


def main() -> None:
    """
    Haupteinstiegspunkt der ProSync-Anwendung.

    Initialisiert QApplication, ConfigManager und MainWindow.
    Verhindert mehrere Instanzen über QLockFile.
    """
    if len(sys.argv) > 1:
        sys.exit(run_cli(sys.argv[1:]))

    app = QApplication(sys.argv)
    lock_file = QLockFile(QDir.temp().filePath("prosync.lock"))
    if not lock_file.tryLock(100):
        sys.exit(0)

    app.setQuitOnLastWindowClosed(False)
    app.setStyle("Fusion")

    cfg = ConfigManager(
        os.path.join(app_base_dir(), "ProSync_config.json")
    )

    win = MainWindow(cfg)
    win.show()
    sys.exit(app.exec())

if __name__ == "__main__":
    main()