blitcp_gui.py

#!/usr/bin/env python3
# Copyright 2026 George Kapellakis
# Licensed under the Apache License, Version 2.0
# See LICENSE file for details.
"""blitcp — PySide6 modern GUI.

A faithful native reproduction of the blitcp modern look-and-feel mockup:
sidebar navigation, transfer composer with live progress simulation, connections
manager, remote/local file browser, history and settings — light & dark themes.

Icons use the bundled Tabler Icons webfont (assets/tabler-icons.ttf).
"""
import os
import base64
import re
import urllib.parse
import shutil
import subprocess
import tempfile
import sys
import threading
import time
from collections import deque


def _ensure_std_streams():
    """Give the process real std streams. Frozen, windowed builds (double-clicked
    on Windows) have NO console, so sys.stdout/stderr are None — and blitcp.py
    (a CLI module) reads sys.stdout.isatty() at import and writes to these streams,
    so without this the engine import fails and the GUI silently loses it
    (FC_OK=False). It also makes `--fc-core` a fully working CLI:

      * launched from cmd WITH redirection (> file / | pipe) → wrap the inherited
        OS handle so the output actually lands in the file/pipe;
      * launched from cmd WITHOUT redirection → attach to the parent console and
        print there;
      * double-clicked (no console) → route to os.devnull so nothing crashes.
    """
    if sys.stdout is not None and sys.stderr is not None:
        return

    if sys.platform.startswith("win"):
        try:
            import ctypes
            import msvcrt
            k = ctypes.windll.kernel32
            k.GetStdHandle.restype = ctypes.c_void_p
            k.GetStdHandle.argtypes = [ctypes.c_uint]
            STD = {"stdout": 0xFFFFFFF5, "stderr": 0xFFFFFFF4, "stdin": 0xFFFFFFF6}
            INVALID = ctypes.c_void_p(-1).value

            def _wrap(which, mode):
                """Wrap an already-inherited std handle (redirection) as a file."""
                h = k.GetStdHandle(STD[which])
                if not h or h == INVALID:
                    return None
                try:
                    fd = msvcrt.open_osfhandle(h, 0)
                    return os.fdopen(fd, mode, buffering=1)
                except OSError:
                    return None

            out = _wrap("stdout", "w") if sys.stdout is None else sys.stdout
            err = _wrap("stderr", "w") if sys.stderr is None else sys.stderr
            # Nothing inherited (no redirection) → attach to the parent console.
            if out is None or err is None:
                if k.AttachConsole(-1):           # ATTACH_PARENT_PROCESS
                    if out is None:
                        out = open("CONOUT$", "w", buffering=1)
                    if err is None:
                        err = open("CONOUT$", "w", buffering=1)
                    if sys.stdin is None:
                        try:
                            sys.stdin = open("CONIN$", "r")
                        except OSError:
                            pass
            if sys.stdout is None and out is not None:
                sys.stdout = out
            if sys.stderr is None and err is not None:
                sys.stderr = err
        except Exception:
            pass

    _devnull = open(os.devnull, "w")
    if sys.stdout is None:
        sys.stdout = _devnull
    if sys.stderr is None:
        sys.stderr = _devnull


_ensure_std_streams()

# Reuse the real blitcp engine for credentials + remote listing when it sits
# next to this file. Optional: the GUI still runs (with demo data) without it.
# The engine version the GUI fetches when it runs WITHOUT blitcp.py next to it
# (_download_core). Nothing else reads it: with the engine loaded, GUI_VERSION
# below is the engine's own __version__. Bump together with blitcp.py's
# __version__ on release — uat_gui GUI-VER-1 and the auditor fail otherwise.
_GUI_PIN = "4.2.15"
GUI_REPO = "gekap/blitcp"
# Shown only on the Settings version card, which the user opened on
# purpose. Static URL — nothing is fetched, nothing is tracked.
SUPPORT_URL = "https://ko-fi.com/blitcp"
SUPPORT_URL_ALT = "https://liberapay.com/blitcp"

try:
    import blitcp as fc
    # blitcp installs a CLI-style excepthook on import; restore the default so
    # the GUI behaves normally.
    sys.excepthook = sys.__excepthook__
    FC_OK = True
except Exception:
    try:
        # Pre-rename engine sitting beside an updated GUI still loads.
        import fast_copy as fc
        sys.excepthook = sys.__excepthook__
        FC_OK = True
    except Exception:
        fc = None
        FC_OK = False

# One version for the window title, the Settings card and the update check: the
# engine's. A literal here drifted — v4.2.13 showed "blitcp 4.2.3".
GUI_VERSION = (getattr(fc, "__version__", None) if FC_OK else None) or _GUI_PIN

# ── i18n (see I18N_DESIGN.md) ───────────────────────────────────────────────
# The GUI shares the engine's gettext domain. Without the engine (demo mode)
# strings simply render in English. fc._ is a live function, so a later
# fc.set_language() re-routes every subsequent lookup.
I18N_CHOICES = [("en", "English"), ("el", "Ελληνικά"), ("zh_CN", "中文"),
                ("de", "Deutsch"), ("it", "Italiano"), ("es", "Español"),
                ("ja", "日本語")]

if FC_OK:
    # getattr-guarded: a pre-rename engine loaded through the fallback below
    # (fast-copy ≤3.12.x) predates i18n and has no _tr/set_language. The GUI
    # must still RUN with it — English strings, not a crash.
    def _tr(s):
        f = getattr(fc, "_tr", None)
        return f(s) if f else s

    def set_language(lang):
        f = getattr(fc, "set_language", None)
        if f:
            f(lang)
else:
    def _tr(s):
        return s

    def set_language(lang):
        pass


def _early_gui_language():
    """Apply the saved GUI language BEFORE any widget text is built.
    Mirrors BlitcpGUI._config_dir()/_load_gui_settings(), which need an
    instance that doesn't exist yet at this point in startup."""
    try:
        import json
        if sys.platform.startswith("win"):
            base = os.environ.get("APPDATA") or os.path.expanduser("~")
        else:
            base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
                os.path.expanduser("~"), ".config")
        # Read-only here — new config dir first, pre-rename one as fallback
        # (the instance _config_dir migrates it on first write).
        lang = None
        for d in ("blitcp", "fast_copy"):
            try:
                with open(os.path.join(base, d, "gui_settings.json")) as f:
                    lang = json.load(f).get("language")
                break
            except (OSError, ValueError):
                continue
        if lang:
            set_language(lang)
    except (OSError, ValueError):
        pass

from PySide6.QtCore import (
    Qt, QTimer, Signal, Slot, QThread, QObject, QPropertyAnimation, QEasingCurve,
    QProcess, QProcessEnvironment,
)
from PySide6.QtGui import (
    QFontDatabase, QFont, QColor, QPixmap, QPainter, QIcon, QTextCharFormat,
    QTextCursor, QTextOption,
)
from PySide6.QtWidgets import (
    QApplication, QWidget, QLabel, QPushButton, QLineEdit, QComboBox,
    QVBoxLayout, QHBoxLayout, QGridLayout, QStackedWidget, QScrollArea,
    QDialog, QGraphicsOpacityEffect, QSizePolicy, QFrame, QFormLayout,
    QFileDialog, QMessageBox, QCheckBox, QTextBrowser, QPlainTextEdit,
)

def _host_env():
    """The environment of the user's session, for programs the GUI launches
    (file manager, browser). The frozen Linux build's
    runtime hook points GIO at an empty module directory so its bundled libgio
    leaves the host's newer gio modules alone (build.py, GIO_HOOK); a browser
    or file manager started from here must get the host's GIO back, with the
    host's libraries — so PyInstaller's LD_LIBRARY_PATH is undone too."""
    import json
    env = dict(os.environ)
    saved = env.pop("_BLITCP_GIO_SAVED", None)
    if saved:
        try:
            for k, v in json.loads(saved).items():
                if v is None:
                    env.pop(k, None)
                else:
                    env[k] = v
        except (ValueError, AttributeError):
            pass
    if getattr(sys, "frozen", False) and "LD_LIBRARY_PATH" in env:
        orig = env.pop("LD_LIBRARY_PATH_ORIG", None)
        if orig:
            env["LD_LIBRARY_PATH"] = orig
        else:
            env.pop("LD_LIBRARY_PATH")
    return env


# Lines the visible transfer log keeps; older ones drop off the top. The full
# diagnostic transcript is _BoundedLog's job — this is only what is on screen.
LOG_MAX_LINES = 10000


class _BoundedLog:
    """Memory-bounded transcript for the on-failure diagnostic log.

    The root cause of a failure is carried by the ENGINE'S STDERR lines (the GUI
    feeds those in prefixed with "[stderr] "), which are low-volume — so we retain
    ALL of them (bounded) regardless of WHERE in a million-line run they occur,
    instead of a fixed head window that only ever captures startup banners. Plus
    a tail of recent output for context. Memory stays bounded without dropping the
    line that explains the failure."""

    def __init__(self, errors=4000, tail=6000):
        self._errors = deque(maxlen=errors)  # stderr lines — the root-cause carriers
        self._tail = deque(maxlen=tail)       # recent output of any kind

    def append(self, line):
        self._tail.append(line)
        if line.startswith("[stderr]"):
            self._errors.append(line)

    def extend(self, lines):
        for ln in lines:
            self.append(ln)

    def lines(self):
        tail = list(self._tail)
        tail_set = set(tail)
        # stderr/error lines that scrolled out of the tail window — the earliest
        # (often root-cause) errors that a plain tail buffer would have lost.
        earlier_errors = [e for e in self._errors if e not in tail_set]
        out = []
        if earlier_errors:
            out.append("=== earlier error output (stderr) ===")
            out.extend(earlier_errors)
            out.append("=== recent output (tail) ===")
        out.extend(tail)
        return out


# ─────────────────────────────────────────────────────────── icon font ──
HERE = os.path.dirname(os.path.abspath(__file__))
FONT_PATH = os.path.join(HERE, "assets", "tabler-icons.ttf")

# name → PUA codepoint, extracted from tabler-icons 3.35.0 css
TI = {
    "adjustments": "ea03", "alert-triangle": "ea06", "arrow-down": "ea16",
    "arrow-down-circle": "ea11", "arrow-up-circle": "ea20", "arrows-exchange": "f1f4",
    "bolt": "ea38", "book": "ea39", "brand-aws": "fa4c", "brand-azure": "fa4d",
    "brand-google": "ec1f", "brand-python": "ed01", "bucket": "ea47", "check": "ea5e",
    "chevron-right": "ea61", "cloud": "ea76", "corner-left-up": "ea7f",
    "device-desktop": "ea89", "device-floppy": "eb62", "eye": "ea9a",
    "file-text": "eaa2", "file-zip": "ed4e", "flask": "ebd2", "folder": "eaad",
    "folders": "eaae", "history": "ebea", "key": "eac7", "lock-open": "eae1",
    "moon": "eaf8", "pencil": "eb04", "player-play": "ed46", "plus": "eb0b",
    "refresh": "eb13", "server-2": "f07c", "settings": "eb20", "sun": "eb30",
    "trash": "eb41", "x": "eb55",
}

ICON_FAMILY = "tabler-icons"

# The Tabler icon font (subset to just the glyphs this GUI uses) is embedded as
# base64 so the app is a single self-contained .py — no assets/ folder needed on
# Windows/macOS/Linux. Falls back to assets/tabler-icons.ttf if present.
_ICON_FONT_B64 = (
"""AAEAAAALAIAAAwAwR1NVQrjmuNIAADVkAAAAKk9TLzJAKYCTAAAzOAAAAGBjbWFwpNudFQAAM5gAAAFEZ2x5ZkljIIoAAAC8AAAx
WmhlYWQxz4alAAAyiAAAADZoaGVhDFoIdQAAMxQAAAAkaG10eAPyAAAAADLAAAAAUmxvY2HPq9xLAAAyOAAAAFBtYXhwAD0BTgAA
MhgAAAAgbmFtZQQ0GH8AADTcAAAAaHBvc3QADQAAAAA1RAAAACAABgAAAAADeQMHAC8AXwCKAJgApgC0AAATJicmNTQ3Nj8BNTQ3
Njc2MzIWFxYdARcyFxYXFhcWBwYHBgcVFAcGBwYiJyYnJjUXJicmNTQ3Nj8BNTQ3Njc2MzIWFxYdARcyFxYXFhcWBwYHBgcVFAcG
BwYHIyInJjUTNDc2MzIWFRQXMhcWFxYXFgYHBgcVFAcGBwYiJyYnJj0BJicmNTQ3Nj8BFw4BFhcWFzMyNzY3NiYFDgEWHwEeATMy
Njc2JhcOARYfAR4BMzI2NzYm2hoVIwsSKwoBAgYNFg0YAgECBw4RDREICQYEDRcpAQEGDCwMBgEB+hoVIwsSKwoBAgYNFg0YAgEC
Bw4RDREICQYEDRcpAwURBAMKHAkF+ggMGA8ZAgcOEQ0RCAkMFBYhAQEGDCwMBgEBGxQjCxIrCiEREggTBAMKFwsGAQIf/fcREggT
AQQGBhEXAQIf5RESCBMBBAYGERcBAh8BbgkUIjcbGSoTBERFAwkJEBUNA0ZDAQkLEBQYHR8WFSUOl5kDCAkQEAkIA5ljCRQiNxsZ
KhMEwcEECQkQFQ0EwsABCQsQFBgdHxYVJQ4aHAoOCQIBFgweAoEODBIZEwUBCQsQFBgcPhkcC9bWBAgJEBAJCATW1gkUIzcaGCsT
BE0DHyMJAgERCQgWHYEDHyMJAQIBFwwWHf4DHyMJAQIBFwwWHQAEAAAAAAPMA0EAGwAuAEkAVAAAAT4BFxYXHgEXFgAXFgYHBgcG
IyEmJyYnJjc2AAE2NzYnJgAnJiMiBwYABwYXFhcBPgEWFxYdARQGDwEOAisBIi4BLwEuAT0BNBcOAR4BNz4BNTQmAZoQOiEkHgcQ
BAYBUgMPChgaKQQS/Us1GxcBAQ0CAVMBxRUEBAYD/q4DCRATCgP+rgQFAwUVATMEJCUFAQIDAQILCgcMBwkMAgEDAiARDwUbFg0R
IAMKGB4CARcGEAYJ/coGHkkcHgkBDCMdJyIZBQI1/WwIEw4MBgI0AwsMA/3NCAsOEggBpxYQERUEWEEUDAUBBAsFBQsEAQUMFEFY
/wMdIhQFBBcNFBkAAgAA/+4CpwMzAD4ASgAAARYHBgcGDwERNz4BNzYeAQcVBgcGBwYPAQ4BByMGJyMuAS8BJicmJyYnNSY+ARce
AR8BEScmJyY1NDc+ARcWBw4BFhcWNjc2LgEiAnkCAQENEycKHRgOCQ0YDQICAwQPDSUyEAsHAQcHAQcLEDIlDQ8EAwICDRgNCgwY
HgoXEh8jH10lKX0NEAELDyoJBwgWGALKCxAfGSMSBP5BHBgLAQINGA0BBwUHDw4lMg8HAQEBAQcPMiUODwcFBwENGA0CAQoXHgG/
BAoUIjA4IiAHGRwiBBkeCw8HEw4cEgABAAAAAAMkAuIALwAAAQ4BBwYdAScmJyYOARcVFhcWHwEWFxYXFhczFjY/ATY3Njc1Ni4B
BwYPATU0Jy4BAfAKDwIBXFoGEB4RAgEFCBxfRhgdCgYHAg0VfmgWBgQBAhEeEAZaXAEDIwLbBBELA/TyW1oECAkbDwIGBwocYEYY
GwgFAgIMfmgXCAYGAg8bCQgEWlvy8wQSFQAAAgAA/+sCqAMyADoASAAAATY3NhcWHwEeARcVFgYnLgEvAREXMhcWFxYXFgcGBw4B
JyYnLgE1NDc2PwERBw4BBwYuATc1PgE/ATYTDgEWFxYXMzI3Njc2JgHpCAkQDQIdVw4HAgMeFQkOGB0CBw4RDREICQYIHx1NIiQT
BwYLEisKHhgMCg0YDQICBw8yQRIREggTBAMKFwsGAQIfAysEAQIJAR5XDwsHARYdAwELGBz+QQEJCxAUGBwfKxsaChASJQ8aEhoY
KxMEAb8eFwoBAg0YDQEHCxAyQf1uAx8jCQIBEQkIFh0AAAIAAP/tA0oDNAAdADMAAAE2Fh8BFTMWFxYXFhUUBgAOASYvATUjJicm
NTQ2AAMGDwEUOwEeARcVNzY/ATQrAS4BJzUCDBErCAHJEAQKBwsE/rcRHhwGAcgRBBwEAVJyIDAZWVoPCAdoIDAZWVoPBwgDJg4K
GIKDAQEDBwsSDAn+ORQHDxKCgwEBCh0MCgHR/tQsQSMBCQgPrI8sQSMBCQgPrAAAAwAAAAADnwLqADYARgBYAAABNhcWHwE3Njc2
FxYXHgEXFhURBgcGLwEmJyYHBgcGBwYmJyYnJgcGBwYHBicmJwMQPgE3Njc2FyYnJg8CFTc2NzYXFhcRNwYPARE3Njc2FxYXNS8B
JicmASoYJUlADhBFSTw7LCcbFwUBCAgQFQ8YIDg5TEUSBgkPDRkhNzhLRRIJDgsNCwEFDA4XIkPRNjlQTAwBDRAeNjRHN8I1LQwN
EB42NEc3AQodIjkC5QMEBh4GBx8FBA0JEgsSDAIP/dsPCA0GCA4KEgEBJQkCAwMIDgsRAQIkCQIEBgcVARYBEhUOBwwNGG8XBQYh
BeLiBQUGCwECGAHDIAYUBf48BQUGCwECGOLhBQ0HDQADAAD/6gN0AzgAJgA/AFsAABM2NzY3NhcWFxYXHgEVFAYHBgcGBwYHBicm
JyYnJicmJyYnJj0BNgU0JyYnJicmKwEGBw4BFRQWFxYzMjc2NzYFMBcWFxYXFhcWMzI3Njc2NzY1NAcGBwYnJicmixFLQ2ZhZGdI
TxkFAwgVNBQYBxxbQloyHSogLw8EOToBBgECmBITIyYyOkIpSj44QUpARVRaSD4kIf3XBxgQLgEKHCtVNiM9DwctKwpJSo2KHi0J
An9DLSkQDwwNJik/DhMTICxOwklXED4XEAUCBggTHS8M0dUHHSYXBBMRExYSFQsNBBQSNhoeOxITFhMfHYIaUzypAhQLEQYLHA+k
nwUBBR8MFyYIFAQAAQAAAAADeAKKACUAAAEGBwYHAScmJyYnIyYGBwYdAQYXFhcWHwEWFxY2NzYANzYuASMiAz4ECQwr/rGgFQcG
BgIOGQYCAQUFGBFAXxEFCRUJBAGkBQoEFw8JAogBCAsq/rGgFAUEAQINDQQHCggGCRkRQF4RAgQBBQIBogcNIBYAAAEAAAAAAqYC
tQAtAAABDgEXFRYXFh8BBwYHBgcVBh4BNzM2NzY/AjY3Njc1Nic1JicmLwEmJyYnIyYBeBATAwIEBxjCwhgHBAICDRgNAgYFBhI7
mxYFBAIBAQIEBRbGHAoGBgQKArMEHBACBwYJGcLCGQkGBwINGA0CAQQEEjqbFggGBgIHBwIGBggWxhwHBQICAAACAAAAAAPQAuMA
KQBUAAABPgIXFhcWFxYdARceAgcOAQcGByMiJyYvASYnLgE3Njc2NzY3NjMyNwYHBgcGBwYHBgcOAhYXFh8BITc2NzY1NCcmJyYn
JiMiJyYnNDc2Jy4BAQIXWXQ9SDk1HR0NNlMmCgxTOggn574wJREFQDAsJQ4OMRoiGRoQBgHzOC00EAcOChcdEBw1EhQcHy4KAhYK
GBMfDw4WFBYGHBkLEgMBChoZZgI6N04kCAkmJDUzNQkBBUBkNzpPCgEBAQEDAQwsKnY7Py8ZEQwGBFYEICQ7FggFAgMGCjVKShsd
CgMDCBEcLiAZFQ0LAgEFCBkJBzUwLjUAAAEAAAAAAyYC3gBKAAABBg8BBg8BBgcGHQEUFx4BNzM+AT8BFRQXHgEXFhcWIDc+ASYn
JisBIiciLwEuAScmPQEXHgEXMxY3Njc2PQE0JyYvAiYnJisBIgFzBgMEMChFEAQDAgYZDgEHCgtZAQMnICIqCwECBRYPEBUEhGIe
CgcIARMaBAJZCwoHAQUJDggLAwQQOVcRBgUIAwsC2wIDBC4oRhIHBQcKBwQNDQIBBgtYoaQGJUEVFgUBAQUkJAUBAgMBCCAUDpyi
WAsGAQECAggLEwQHBQcSOVYRBAMAAAMAAAAAA54DBwA9AEEARgAAEzAxNjc2NzYhBRYXFhcRBgcGByMGIwYrARUzMhcWFxYGDwEG
BwYrASInLgE0Njc+ATsBNSMiJyInIyYnJicTESERARUzNSNeBQoSIQwBVAFaIxEKBgUMER0BBg0SO1kZEwgPCAsIEAEEBQkcttIK
DREPDQQLDxlZOxINBgEVDxQHUwKa/mCmpgLAFQ4bBwIBCRgOF/5GFhAWCAIBUgIECw8lCgECAQECBBYbFQUCAVIBAgYNEx4Brf5g
AaD94ylSAAQAAAAAA6ICswAkAEUAVwBhAAABMzEWFxYXFhcWFzEWFxYHBgcGBwYHBicmJy4BJyY3Njc2Nz4BFyIHBgcGBwYHBhQX
FhcWFxYXFjc2NzY3PgE0JicmJy4BAyYnJjY3NhcWFxYXFgcGBwYmNw4BFhcWNjc2JgHoHS0hPDdIPyQZEAMEBAMQLzdSYVhWc2Qg
VRQKChctMis0bz8wMSkpIh8YEg8OEhggJC0wOTxKQkg9DB8mDmWBCDVIHwQDKyQpLSMWFAcHBQonJV4zFRIQFxEcAgMdArMBBwwf
KUgrKBkICwwIGEk1ThwZDRFSG2cmFRQrNjwfJydPFREhGiIaGRYGFRsaIxshERUCAiElTA4sBTQQdRIBAf7ZICsoRxARDQsbFx4b
FzEdGwaiAyYmAwIUERUdAAAGAAD/7wNMAzIAKABMAFAAXgBvAH8AAAEyMzY7ATIWHwEWHwEeARcVFhUPAQ4BBwYrASYnJicmJyYn
ETY3Njc2FwYPAQYHBh0BEBcWFxYXITY3Njc2PQEjIicuAScmNSY9ASMGBRUzJwU2MhceAQYHBiInLgE2FzY7ARcWFxYUBgcGIicu
ATYXDgEWHwEhNzY3NjQmJyYiAR4BB1NFgxULBAEDNZcOBwEBAQIKOygH3bwiBRsXKAkBAQEBBxIfNxAIAQIBAQIDCgUMAbQMBgsC
AUJFBBckBwMB7hQBVkEg/tsFMgUVEBAVBTEFFQ8QEgOHhgwDAwwVDwf2BxUTDRoTEwkSBgEQDAMDDBUPB/cDMAECAgEBNZkPCgUC
Be7sCik3BAEBAQYQHTIHLQIMLQcdGCtPBg4CBA0RP9T+3QoNCAUFBQUJDgTT0QEEIBYIEA0zPQE6QSFMAgIEJSUEAQEFJCSiAQcC
AwwhGAIBAQIkJqADICMJBAcCAwwhGAIBAAACAAAAAAOfAwcAJwBGAAATPgE3NjMXHgEfATMyFx4BFxYVEQcGBwYHBgchJicmJyYn
JjURNDc2FwYHBgcRFhcWFxYgNzY3NjcRLgEnIyciJi8BJi8BI5QRHBwTPGAIEi48jogQJzgIAQIHEhwwBy399i0HGRgqCwEBDGEN
BgQDBQUIDQoCRgoNCAUFBwcQ1kcVDAQBAjw6nwLxCwkBAQEDEC47AgY3JwQL/psKHhckCQEBAQEFEBwzBA4B1w0ENCUGCQUJ/iIM
BQoDAgIDCgUMAWIOBwkBAgIBATw6AAADAAAAAAOfAzEAQQBsAIkAAAE2MhceAR8BMzIXMhczFhcWFxYVERQHDgEHDgEHIxUUBwYH
BgcGICcuAS8BLgE1ETQ3Njc2Nz4BOwE1NDc2NzY3NhcGBwYHERYXFhcWOwEyNzY/ATY3NjcRJicmLwEmIyYrASYnJicmLwEjIg8B
BgcGBxEeARchNjc2NzUjIiciJzEuAScmPQEjBgF2BogDCQ4eJmhDFg4IAR0YJQkBAQYjGRAcHBsFCBgeJgr+TAshNgsBBAEBBxAX
JwsVFhoDBA4IDx4pCwcFCAsEBgwE1ZotDQoEAgcFAwUEAwUIAQUGCBmmGQgGBAISNzkZIK8MBgQEBgoOAbYNBwUFmWYfFQgoNAcC
LwUDMAEBAgweJgECBxEcLwQK/skKBBwuDQgGARofER8YHgYBAQUuIQQKJmYBDQwEHRYgDAQCGhcQGhUNDRhQAwgFDv5zEAQGAwEB
AQMBBAcECgE4CQUIBAEDAgEBAgQBEzcBqAUJBQn+dA8JBgQIBQs1AQIJNicQfIIBAAADAAD/8AOfAz0ARACNAJoAAAE2NzYXMxYX
Fh8BFhcWFRQHDgEHBgcGLwEHBgcGBwYjIiYnLgEnJjQ3Njc2Nz4BPwEzNTQ2NzY7ATU+AT8BJyY3Njc+AQEOAQcGHQEzMjY3Nj8B
Njc2FzMyFxYXFhcWNjc+ATc2NCcuAScmBwYHDgEHDgEXFhcWFxYVFAYHBg8BFQcOAQcGKwEVFAcOAQcBDgEWFxY3Njc2NC4BAgAY
IT47AQsGCRWODgUcJQV8BSk2NSgJfnsMGRENKR0PChQcBQIBBA0IEwsHCRsaDQ4KGBcGChggBRsCASEFe/7ICQYBARsXDQYCj3oU
CAUHBA0LBgoPDBMoEAd5BAwMBKAHFBwYDwZ5BQsFCAUPCwQGBAoHGykBCA4LBxQWAQINEAFkFBAQFggKDQcKERcDDBQKEx8GBQcU
jg8HKjI4LgZ7BSEBAhsFfnsIEAQDAQQHHxUHPgseFg0TCwUEARccGgQDNQsLGCEJKDU2KQV8/Y8JCggHFB0BBAGPeRMFBAEGBAsP
BQgECwV7BhQsEwahBQ4BAQoEeAcQKRMMDwoGCw0JCwsHGyomJg8NAgEWFQgKDQkBoAUlJAQBAgQICyEUCAADAAD/7wNMA2EATABp
AHwAAAE2Nz4BFxYXFhcWFxYHDgEmJyYnJicmJyYGBwYHMQYVBh0BITIXFh8BHgEXFhcVBgcGBwYPASEiJyYnJicmJzU0NzQ/ATY3
Nj8BPgE3ASYnIyIHIw4BBwYdARQXFB8BFhcWFyE2NzY3NjUlDgIXFhcWFzMyNzY1NCYnIyYBNBIyMH03JxsXDAoDAgMFHyEJAwEC
BQ8kIVEeIgsCAQEsJg0ICQMiLQcBAQEBBRAcMQr+SQ0EGhcpCgEBAgMBESsYIgEBAQUBxAoW2GptBAwSAgECAwEECAUJAbQLBgsD
Af74HiQFDhAfBwMOIRgaLSIGCQK9QyooDhwUIRsjGxsVCBAQCREGEBYPKhYVBBgaLggNFDxbAQEDAQs0IwYX6xYHGhgoCwIBBhAd
MwcW2x8LCAkCMhYMBFxLHxL+tBYKAQITDAOCXxwJBgYBCAUDBAUFCA4EhU8FKzgXGQoCARQXKCEwAQEAAAIAAP/tA4UDMgA0AFUA
AAE2NzY3NhYXFhUUBw4BBwYHBhcWFx4BNz4BFx4BBwYHBgcGBwYHBicmJyYnMSYnJicmNz4BNwYHDgEXFhcWFxYzMjc2PwEnIicm
JyYnJicmJyY/ATQHARg3Qi8vHBcKDAEDEBQiDxAJCyg4qFcODQcQEQUDDxgiLzxLXDk4TkBQNhYMFwUHFhRYzGJAOyIdH0sjIkBN
ODdVOwQfJRw1Lz4yFxMfBQYsCQgC7CURDQIBBAoMEQgFBhQUKTg6O0E2RzIeBQECBB4RCxwtJjYhKgkECg8nMVUlHzc6TU5HeQ8b
SUS1VVk7GxAdEx5HBAEFCRkhOx0oQkRcVxIBAgADAAAAAANbAvEAGgAmAC4AADcmJzU3NjcBNjc2PwE2FhcWFxYHBgcGBwYPAQE2
LgEHBg8BFhc3NgUHFTM2NyYnphUJAwMgAWgyEAsLAyxkJScKAwEEGQXi5AgHAZ8IESoYHBgKNTYKDv6QsWyxsTY2GgcXvAcFIAFp
MQ4KBQIXDiEjNhAYLiMI4uMFAwIZGTEcAQMWCjY1Cg6ZsmuxsjU2AAABAAAAAANLAt4ATQAAAQ4BBxUGBwYdASMiBwYPAQYHBhQX
Fh8BFhcWOwEVFBcWHwEWFxYyNzY/ATY3Nj0BMzI3Nj8BNjc2NCcmLwEmJyYrATU0JyYvASYnJiMiAfAHDAQDAQHcHAkGBQEGBgkJ
BgYBBQYJHNwBAQIBAwYLIgsGAwECAQHcHAkGBQEGBgkJBgYBBQYJHNwBAQIBAgcMDgwC2wIMBgEFBgkc3AEBAgEDBgsiCwYDAQIB
AdwcCQYFAQYGCQkGBgEFBgkc3AEBAgEDBgsiCwYDAQIBAdwcCQYFAQUGCwACAAAAAAN5AxQAPgB8AAATMhcWFxUXNzY3NhYXFhcW
BwYmJyYnJicmJyYnLgEHBgcGDwEXMhceARcWFxUUBwYHBiInJicmLwE1Njc2NzYTBgcGFxYXHgEXFjc2PwEXFRYXFjI3Njc2NzUn
JicmJyYiBwYHBhQXFhcWMxcGBwYHBgcGIyInLgEnJicuAbARCQYKAQpKamXMSEwVBQ0NJwwEAgIDCA4hQDyXRUszAgICJh0JDw8G
AgEQCQgFrAUNCQUGAQEBAwcLCQ4JDAUOMjGSVFlVUjcKAQoGCSMLBwMBAQEGBQkNA7ADCAkQEAkIAykmAw0TGSMoMjdKQD1RDAIC
BhwC3AcFEh8fC1IcGzlMUXQdEA4CDwUIBQ4oHkgtKxQcHUECAwMBAQEKDQQDChYMBgEBAQIKBgxcUA0FCgcL/rMEChAbVUdEVAcH
IiM8Cx8fEgUHCwcKBQ1QXAwGCgIBAQEGDCwMBgEBAQUPFxMaDxMhIHBFDQcNDgAEAAD/7AOgAzQAeQDvAQMBEAAANzQ3Njc2NTQn
JicmJyY3Njc2NzY3NjU0JyYnJjc+ATc2FxYXFjMyNz4BNzY3Njc2MzYXFhcWFxYXFjMyNzY3NhcWFxYXFgcGFhcWFxYUBwYHBhUU
FxYXFgYHBiMiJyYnJiIHBgcGBwYHBicmJy4BJyYjIgcGBwYnLgEBNCcmIyIHBgcGJyYnJicuAQYHBgcGIyInLgEiBwYVFBcWFxYH
BgcxDgIXFhcWFxYXFh0BFAcGBw4BFRQWNz4BMzIXFhceARcWMjc2NzY3Njc+ARcWFxYzMjYnLgE1NDc2NzY3NiYnJicmJyYnLgE1
NDc2NzYBJicmNjc2MxYXHgEHBgcGBwYHBjcOAhceAT4CJicmtgQDBgccExQWCw0GBQ8VJgsHCgcLAgMPDSoaFRUMEhEGDwcECwUI
DQ8VEg0QFhoUGQkCBgkPBxEUDhcbFhUcBwkZBxARJhYVFBcoGggJAgQREiAyEg0IDA4TCAsDBh0fJismDAgEDAUHDwcRFA4XGyQs
AjwFBxIJDRQXChAdFh4MBRsaAwgSIDMTDggZEggMBwoDAxYYKA0JBgMEFhESIwkCBAIGBAMcDBYZESofHAkDBgcFEwQIBAIDBggO
PB8SGg8FEREGCwcLFTIYAwEICAQMEwsUEAYGBAMGB/7CNhgWGCkuQzAnJSkCAhsUISIoLA8ZIgoKCzA4KAgYFxq6Eg0IDA4JGQcE
EBIaHiIbFB4LAgYJDwYRGREdHhkgBQQEAwgHCAUgCA8MDggGAwUHERUhCwcKCAkCBAgHFBkgKS4OGwMLHh1KHSAMBRoHERQOFzUU
IgQDBgcFBxAeGBkCAiALDgggBQkICQIECAw9AdAKCAwHCgMBAwQQFScUCw8RGRQkBAMNBQcSCQ0UFyYjJAoEBxMJDwYFDRgmBw0K
Fw4ICQUIBxERBgsHGRciDAgEAgIEBwULEwwUIAQCCwccDBYZERoZLA4HEwsQBQIDBggNHw4WDhEOCAwO/p4bNjJuIycBGhhOLC8o
HhMVAgP6BSQxFxocBig2MAwNAAAKAAD/6wOjAzUAEgAiADIARQBXAGoAfQCOAKAArwAAAT4BFhcWFAcxBgcGIicmJzEmNAU0NjMy
HgIVFAYjIi4CBSImNTQ+AjIXFhUUDgIHFAcOAScmJy4BNzY3Njc2FhcWBzYuAScmBwYHBhYXFhcWNjc2JTYyFzEWFxYUBwYHMQYi
Jy4BNgU0NzY3NjIXHgEGBwYiJzEmJyYBIiY1NDY3PgEyFxYVFA4CJTQ3NjMyFx4CFRQGIyIuAgcGBwYUFx4BNjc2NCcuAQHVBCQl
BQEBAQYMLAwGAQH+9hYVCxAgChgSDBAhCQIiEhgJJA0cDA4JIRAqJiR5QTYoJh8MDCkwQTtyIyVVBxs4IiQhJhIRCxocKxw/Fhn+
CwQvBwkIEREICQUvBRUQDwK5EAkIBTEEFg8QFQUvBQkIEf3SEhgJEBIPHAwOCiEPAcIJDBYMCQYhCRgSDA8hCtIVBgEBBSQkBQEB
AyMDDxYQERUFLwUJCBERCAkFL3ASGAogEAwSGAohDzoYEgwOJAgKDRMMDyEKxEQ1My0PDigmaDQ4KjILCy8yNVciQCsEBRITJSJO
HB4IBhUYGmMBAQEGDCwMBgEBAQUkJCQWDAYBAQEFJCQFAQEBBgz+4hgSDA8QEgkLDBMMECEJRg8LEAYEIQ8MEhgJIRAsBxcFMAYW
DxAVBS8FEhUABQAA/+8DeQMxAC8AMwBPAGQAewAAATYzMhceAR8BHgEdATMWFx4BBiMHAgcOAQcGICcmJyYnJgMnIiY2NzY3MzU0
Nz4BFxUzNQUUHwEWFxYfARYXFhchNjc2PwE2NzY/ATY1NCAXPgEWFxYdAQYHBg8BDgEmJyYnNTY3DgEHBh0BFhcWHwEeATY3Njc1
JicuAQGcBVxTEBUhCAEEAqMMBBYLGRgCJAEFOCsH/pkIMR0XAwEkAhgZCxYEDKMCBCUppv63Ew4FAgIEAQkLBBgBLhgECwkBBAIC
BQ4T/hR7ByUiAwEBAQEDAgofHAUBAQHJDBUCAQEBAQMCCh8cBQEBAQEFGQMwAQIEGhMCChQkMAEBBygjE/5BBCo9CAEBCiQeIwQB
vxMiKQcBASwoDholTlNTqA3dqDIOCgQCCwMBAQEBAwsCBAoOMqjdDQFwFA0TFgSCXhwJBgUCDQcPEAQS5hMhAhUOBIJeHAkGBQIN
Bw8QBBLlFAQPEAAAAQAAAAADJQK2AD8AABMOARcVFhcWHwEHBgcGBxUGHgE3MzY3Nj8BFxYXFhczFjYnNSYnJi8BNzY3Njc1Ni4B
ByMGBwYPAScmJyYnIyb6EBIDAgQHGMLCGAcEAgINGA0CBgYHE8vCGQkGBwIVHgMCBAcYwsIYBwQCAg0YDQIHBgkZwsMZCAYHAwsC
swQcEAIHBgkZwsIZCQYHAg0YDQICAwUTysIYBwQCAx0WAgcGCRnCwhkJBgcCDRgNAgIEBxjCwhgHBAICAAAFAAAAAAN1AwcAGwBB
AEUAWQBoAAATMDM2MxceAx8BFAcOAQ8BISYnJicDEDc+ARciBwYHERYXITY3Nj8BNSYnIxUUBgcxBg8BDgErAScmJyYnJj0BMxUz
NQc2FxYXFhUUBgcGJyYnJjY3Njc2FwYHBhUUFjY3Njc1NCcm8gdyadwMGoAYBgEBBTMmDP3mKRkcCgEBBj1JGAoOCAYWAgwJBQkF
AUdGGQEFBwgBBAoSPbwRBQYCAVSmNRkfIhYZLyUoKSwWFQYaHC0ECAsHDB8mCQEBEQ4DBgEBBhiAGgza3QYmOQoCCRgaLQEIAQsG
KjxOBAUU/fQWBgMEBw7OzUdHQTUTCAsFAQICAQkFCBMNMT5SUvoEDA0bIC0oQQ0ODg8lIlMfIggBVAMHDBMWFgoSBAIKGQsJAAAD
AAD/7wMoAzIAJgAqADQAAAE2IBceAQYPARUXFhcWBwYPAQYjBiMhJicuASc1Jjc2NxM1JicmNhcVMzUHBgchJzQvAiMBeAUBAAYV
EBAWB1NRBAUHChsDBgcLIv50IAYXHQIBAwUSkR0JCRNvVGFLSwGaAUtLNjYDMAICBSUkBAHI5dwOFBQbDQIDAgEBBiIXAQgLDzIB
kMgEExEmTqam/M/PAgHPzQEAAAIAAP/zA6oDMwBdAHkAAAEzMhceARcWBwYHBgcGBwYmJy4BJyYnMRUUBw4BBwYHIyInJicmJzU0
Nz4BNzYyFxYXFhUUDwEOAQ8BFx4BNzY3Njc2Nz4BJyYnLgEHBgcOAQcGBw4BLgE3Njc2NzYXBgcxDgEVFBceARcWFxY+AScmLwE1
LgEnMS4BAd4mZFdRcBQVFBVBNkNNXQ8wDUmCMh4CAQEKDQQDCQwKDQYBAQECEwwF1QYICRASAQYOI1gIL6dcYlApHSsLAgICCDc0
oldcSzdECQIBBRweEwIJJS5LW44QBwQBAQIOIi4DECYSCwEnJQECAwYdAzMtKpNZXFphTz8lKwcBAQEJQDQhAywhCg4OBgIBBQcP
BBBebwQNEwIBAQEGDBYZCgEEAQEBDElSBwc/ICs/TA0xDl9KRkgICDkpdEUOAw8OBhoVS0hXOELJBg4IGUVYBAoRIi4CDAwjFAMn
JoYSCwYLDgACAAD/6QOlAzoAQQCCAAATNjc+ARcWFzEWFxYHDgEHBicmJyYnJiMiBw4BFxYXFhcWMzI/AScuASc1NjcxNjchHgEX
FhcWBgcGBwYnJicuAiUiBwYHBgcGBwYXFhcWFxY3Njc2NzY9ASMVFzMWFxYVFAcGBwYHBgcGJicmJyY3Njc2Nz4BHwE3NjQnJicm
Jy4BiCpKRa5XWkwXCRAPAnQGDwsIDxQQGyQ/LywnCgspFRUnM081CG0MBwwBAQUXAWIODAMBAgZfV1tvP0dSQ09cAgGKJy4zLDIf
JAoJEhMsMERNXV5JQiYj+gGMEAYJERIfIyoxNkB4KCsKBAIEFh8/Oos/CicJEBUYICEINAJIVTo3Kw8PNQ8NFhcEaQQIAgEJDAUJ
IiBoNTgoFQsVNQcCBQcShQsEEwkGDAwIGGrBPUALBxEUMDmwx+0REiImNDtJO0JFOD0gIwUINjBKRkUJFRUJBgoPFB4gHSITFwID
OjQ4RRkfNy9AKiYNHAUjCAIJCggLBQEBAAUAAP/vA6ADMQBWAIsAlgDQAN8AAAEyMzYzMhceARcWFxYdATMyFxYfAR4BFxUWFRYV
FAcOAQcGKwEVFAYHDgEHBisBIiYnJicmJy4BPQEjIicuASc1JjUmNTQ3PgE/ATY3NjsBNTQ2NzY3NhcOAQcGHQEzMhceAQYHBisB
BgcOAQcGBxUXFhcWOwE1NzY3PgE3NjcyNzY3NjQnJicmJyMGFzQ2HgEOASYnJicFFAcUBw4BBwYHBiMiBw4BBwYUFx4BFxYXMzY3
Njc2PQEjIicuATY3NjsBNjc+ATc2NzUnJicmJyYiAw4BHgE3Njc2NTQnJicmAZwBBzQqPhUeIxMZBwUzJgwJDAIfLAcCAQEEPiwF
MSwCBAo0IgUmZjIUDBMTHwwEAjMuDCUzCQIBAQQuIwINCQwlMgIECRIeMQsPAgFAQQQVEA8WBJeDFgQKDgMBAQEJEwMRTAEBAQoz
JQleYwMUBgICBhYEDZ4NCh8mEQ0eHwkCAQEjAQECDxAZKQxsUwMKDgIBAQIPCwQNng0EFgYBQEEEFRAPFgSXhBUECQ8DAQEBBgYJ
DgZRsREQAxcTCgkSCggNCgMwAQECDxMZHBEhGwEBBAELMSEBBw0UPGAHLD8FAUU5GQ0gLQcBAQQGDRglCxUWGwIJMyYBBw0UPGAH
JToLAQQBAUU5GQ0aFCBOBBEKBEFAAQUkJAUBAQEDDwoEEE1cFwYBOSkIBiUxCAEBAgkVB9UHFggBAQFSFxYKIx4PCRIEA0kYGCMO
FSESGwkDAgQRCgXXBQoRBAEBAQEIFgVBQAEFJCQFAQEBAw8JBQ1QXA0FCgIB/ogDGiEWAQEFDBgTCgkDAgAAAgAAAAADdQMMABYA
HwAAJSYnJicRNjc2FzIAFx4BFAYHBgArAQYTED8BNjQvASYBKw8JBgkNCA4TAQIqAwYHBwYD/dYBAggnAtLQ0NICGQEJBg8CsBQG
CQb+rQMFEhASBQP+rQIBd/78AoGAAoCBAgAACAAA/8YDTAMyAG0AfwCXAKoAvQDLAOYA9wAAATIzNjsBMhcyHwEWFxYXFhcWFREU
BxQPAQ4BByMGIyInJicmJzU0NzYzNzY3Nj8BNjc2NREmJyMiBhceAQYHBgcjIicmJyY2NzYmKwEHBgcGBwYRFRQXFh8BHgEXFg4B
JyYnJicmJxE2Nz4BNzYXMjM2MzIXFhUUBgcGIicuATYHNDc2NzYyFxYXFhQHBgcOASMiJyYnJicXNjIXHgEVFAYHBgcjJicmJyY2
BzY3NjsBFhceAQYHDgEiJicuARc2MhceAQYHBiInLgE2Bz4BFxYXFhUUBgcOAQcOASImJy4BLwE1NDc2FwYHBg8BFTM1NCc0JzEm
JyYBHgEHU0VwIQoHBQEHaW0EAwEBAgQBCzAgAg0bIgkNCQIBFQwdHgkFCAQBAwEBXFtVCgMDEQ4NEwQFGBwKEQYFDxADBA0sPwwF
CgMCAQECAQQZBAYHGBEUFh0HAQEBAQQdFhjzAQMQCxwMFhQQBicHFhIOXQ0ICQYzBgwICwoFBQYOFh0JDAkCAXYGKQYQFA4PBAY2
EAUIAgMVWQgKCBcZBQQQDwYOCQ0tDggQA3QGMQYVDxAUBTAGFRAPYiJcJSYJAQIEBhgPDBNUEgoTHAYCAQhpDQgEBQFTAQIECQ8D
MAECAwEFaGwJBQoPNP6oMw8LCQQfLQcDAwQSBAMKHAkFAQQDBQgCBAoOMAF/XFwBAQYhIgYBAQQFFBAfBQEBAQUFCA0K/t3UPxEN
BAIJEQkMHxMDAxUdJgctAgstBxYtDxGjAQUJHBAXAgEBAiQndxQLBwICAgMKCx8MBgMEAgMFEQQDIAEBAhcQDRYFAQEJBQgNEB5c
CAIBAQEFHR8JBQMDBQsoOwECBiMiBQIBBSQkcSIDGx0xCDYsEwwPGAYEAgEEBxwUClwXBSUVBAkGCy4vLh8KBwQKBw4AAAcAAAAA
A58DBwAtAE0AWQBqAIgAlgCnAAATNiAXHgEXFhQHBg8BFxYXFhQHBgcGBwYHBiAnLgEnJjQ3Nj8BJyYnJjQ3Njc2FwYHBgcGBxUU
Fx4BFxYgNz4BNzY1NCYvASYnJiclIgcXMhcWFRQGJicmPgEXNDc2OwEXHgEHBg8BIiYnJgcOAQcGFRQWHwEWFxYXITY3Nj8BPgE1
NCcuAScmIBc0NhYXFhUUBiYvAS4BNwYVFBcWFyE3PgEnJi8BIwbwCAIMBztSBgEBBSoICCoFAQECCQ4cJTkJ/fgJO1IGAQEFKggI
KgUBAQYoKUcVEBkLAQECBSMYDgH6DhgjBQICBQELFQwT/v95hSoKChMbJAsJAhaRHAOIhwUODwYGF4WBFAcMuhgiBQICBQEKEQoc
AggdCg8LAQUCAgUjGA7+AwYgJgoCHyYJAQIBxBwHBRIBEAUODwYHF4VyFQMGAQEIUzsKXgo6LAgILDoKXgoWFyYZIQkBAQhTOwte
CjgtCAgsOgpeCjkqLEwCCw8hBAouLw4YJAUCAgUkGA4vLBILARcMBwUBAVMGChoVFgQPDB8XKiAJAQMHHg8RCgEFBgu/BSQYDi8s
EgsBFQsHCQoGChYBCxIsLw4YJAUCfRQZBxUFDBcWCRMBBAYuCh0RCQYKAwceDxEKAQEAAgAAAAADoQK4ACEARQAAASY+ARcWHwEW
FxYXFRYGBwYgJy4BNj8BNjc2MyEvAS4BJwEOARcVFhcWHwEeARcWNz4BJzUuAS8CITI3Nj8BPgEmJyYgAqUDFCAOBldAEgYDAgIU
EQf9uwcTEwcQAQMHCSABwz8eCQQB/dsRFAMCBAUTexUUBwQJERUDAQQJHj8BpTQPCgQCEAYUEgb9uAKEEhoHCQRXQBQHBQcCEB4C
AQEDHiMKAQIBAT8fCQkG/uMDHRACBgYHFHoVEAIBAgMcEAEGCQkfPwEBAwEKIx0DAQAGAAD/7AOhAt4AKABhAJYAoQDLAO4AABM2
MzIXFh8CFAcGBwYiJyYnJj0BIxUUBwYPAQ4BIyInJicmNT8BPgEXNjc2MzIeAx8BNzY3NjIXFh8BNzY3Njc2NzY7ATIXFhcHBgcG
IyImJyYvAQcGBw4BIyInJicmJTY7ARYXHgEGBwYuAScjFTMyFxYVFgcGBwYHIyInLgI2FxYXFhczNSMiJy4BJyY3NDc+AQUmBgcG
BxUzNTQmATY3NhcWFxYXHgEHBgcGBwYHBiYnJjc2NzY3NiYnJicmJyYnJicmPQE0BQYHBhcWFxYXFhcWNzY3Njc2JicmBgcOASci
JyYnJicuASKxBRIlHBkJAgEBAgoMIgwKAgEpAwURAQQGBhEMCgIBAQIIK8UDCAsUCQsNBQcHDAsOBwolCgcNCwwIAwQGAwwEBwYQ
CA4EGhoDCxoODwcGDhMTDgYHDw4aCwIaHAG6CiEgCAUZHwETDBwVAisaPBcQAQcOKwQIIiMNFB8BGxUPCgUFKhwcDA8hBgQBAwYi
/doJEQYBASkCAdAJEAkVWzYWCQoGAQQRDhQSDRAkBQcPEw0KBQMDDxMVHBsTBw0JAv3TCgkMAgMZLjtrXUpQQDYvCA0OFQkODjyE
QBUjMDA9Ng4LFALcARgWIQpmaAQMCgwMCgwDGBYWGQkOCQECAQwKDARoZgoeKRwPCQwFCwocJT8XHggJCggdFz8pCxEGBQgCBQkb
g4MGFgkNCh8pKR8KDQkWBICFKwIBAQcoLQ0IAxEMKiEWKyMWJg0BAQMGJSwcBAILBgwqBAQhFBEgGQoXIVEHBQkCBj8iHQv+oxEF
AwEGGwsHBxQTODcvJCAGBw0RExkgKB4dGAMFBgQFAQEDBg8EBwwHOQQLDQ8UEiIeNgUCDw0VEgwRKQcDAwYbGwEICxUbKAsFAAQA
AAAAA8sDXgAZAEAATABhAAABNhceAQcGAgcOASMGIyInLgE1NDc2PwI2FzY3NjMyFxYXARYHBgcGByEmJyYnJjU0NzY3Nj8BNicm
JyY3Njc2DwIGHQEzMj8BNiMXBg8BFBcWFx4BFRQPAQ4BOwEDBwYB5xQQDw8BAf4EBw8WEDZXCg0RAgVRVZB0cQQGDBANCAUJASgE
BwcSBCf9+isECgcMAwYOAmK1A1A3AQYCAj889jVFRSUlAVZVAcQKEQw0ZAMDARM9PAOPj+AMDgNUCgYEGw0H/YYFCQYBAgMWDQcI
DsDJhWqLBwUJBQML/YUODxIFAQEBAQQHCxEJCA4HAiREAWNFAwoOCZSOXTKiogMCAdbVohknHAFAfgcFBgcVDRgYAQHgGiAAAAAA
AQAAACcBTQAVAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAABBgGPAgUCUgLGAxgDpgQyBHMEvQU/Ba4GFwayB3IH4QiqCZEKTArS
CyMLlQxSDeEO4g+fEAMQnxD0EaoSbhOtE+YVTRZKFroYFxitAAEAAAABAABjGSblXw889QALA+gAAAAA5O4SgwAAAADk7hKDAAD/
mQjUISEAAAAIAAIAAAAAAAAAAAAAA/IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAA4T/nAAACNYAAAAACNQAAQAAAAAAAAAAAAAAAAAAAAIABAPyAZAABQAABZsC
vAAAAIwFmwK8AAAB4AAxAQIAAAIABQMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUGZFZADA6gP6TQOE/5wAWiEhAGcAAAABAAAAAAAA
AAAAAAAAAAIAAAACAAAAAwAAABQAAwABAAAAFAAEATAAAABIAEAABQAI6gPqBuoR6hbqIOo56kfqXuph6nbqf+qJ6prqouqu6sfq
4er46wTrC+sT6yDrMOtB61XrYuvS6+rsH+0B7UbtTvB88fT6Tf//AADqA+oG6hHqFuog6jjqR+pe6mHqdup/6onqmuqi6q3qx+rh
6vjrBOsL6xPrIOsw60HrVeti69Lr6uwf7QHtRu1O8Hzx9PpM//8V/hX8FfIV7hXlFc4VwRWrFakVlRWNFYQVdBVtFWMVSxUyFRwV
ERULFQQU+BTpFNkUxhS6FEsUNBQAEx8S2xLUD6cOMAXZAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAEIAAwABBAkAAQAYAAAAAwABBAkAAgAOABgAAwABBAkAAwAYAAAA
AwABBAkABAAYAAAAAwABBAkABgAYAAAAdABhAGIAbABlAHIALQBpAGMAbwBuAHMAUgBlAGcAdQBsAGEAcgADAAAAAAAAAAoAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAOAAoADAAAAAAAAkRGTFQADmxhdG4AEgAIAAAAAAAAAAD//wAAAAA="""
)


def load_icon_font():
    """Register the icon font and set ICON_FAMILY. Returns True on success."""
    global ICON_FAMILY
    from PySide6.QtCore import QByteArray
    fid = -1
    try:
        raw = base64.b64decode(_ICON_FONT_B64)
        fid = QFontDatabase.addApplicationFontFromData(QByteArray(raw))
    except Exception:
        fid = -1
    if fid == -1 and os.path.exists(FONT_PATH):
        fid = QFontDatabase.addApplicationFont(FONT_PATH)
    fams = QFontDatabase.applicationFontFamilies(fid) if fid != -1 else []
    if fams:
        ICON_FAMILY = fams[0]
        return True
    return False


def ic(name):
    """Return the unicode glyph for a tabler icon name."""
    cp = TI.get(name)
    return chr(int(cp, 16)) if cp else "?"


def make_app_icon():
    """Build the window/taskbar icon: green bolt on a dark rounded badge.
    Multi-size so it stays crisp in titlebars, taskbars and alt-tab."""
    icon = QIcon()
    for s in (16, 24, 32, 48, 64, 128, 256):
        pm = QPixmap(s, s)
        pm.fill(Qt.transparent)
        p = QPainter(pm)
        p.setRenderHint(QPainter.Antialiasing)
        p.setRenderHint(QPainter.TextAntialiasing)
        p.setPen(Qt.NoPen)
        p.setBrush(QColor("#16171d"))
        r = s * 0.16
        p.drawRoundedRect(0, 0, s, s, r, r)
        f = QFont(ICON_FAMILY)
        f.setPixelSize(int(s * 0.64))
        p.setFont(f)
        p.setPen(QColor("#2fe06a"))
        p.drawText(pm.rect(), Qt.AlignCenter, ic("bolt"))
        p.end()
        icon.addPixmap(pm)
    return icon


# ───────────────────────────────────────────────────────────── themes ──
LIGHT = {
    "bg": "#f6f7f9", "panel": "#ffffff", "p2": "#f1f3f6", "line": "#cfd3da",
    "line2": "#bcc1ca", "txt": "#1a1d23", "muted": "#6b7280", "faint": "#9ca3af",
    "accent": "#6366f1", "accenth": "#4f46e5", "asoft": "#eef0fe", "atx": "#4338ca",
    "ok": "#15803d", "okbg": "#e9f7ee", "warn": "#b45309", "warnbg": "#fdf3e3",
    "danger": "#dc2626", "side": "#16171d", "sidetx": "#b9bcc7", "sideact": "#23252e",
    "sideico": "#7c7f8c",
}
DARK = {
    "bg": "#0f1014", "panel": "#1a1c22", "p2": "#23262e", "line": "#333845",
    "line2": "#414755", "txt": "#e9eaee", "muted": "#9aa0ab", "faint": "#676d78",
    "accent": "#818cf8", "accenth": "#a5aefc", "asoft": "#262a48", "atx": "#c7caff",
    "ok": "#4ade80", "okbg": "#16271c", "warn": "#fbbf24", "warnbg": "#2a2113",
    "danger": "#f87171", "side": "#0b0c10", "sidetx": "#b9bcc7", "sideact": "#1c1f27",
    "sideico": "#6a6e7b",
}

MONO = "'SF Mono','DejaVu Sans Mono',Menlo,Consolas,monospace"


def stylesheet(v):
    """Build the global QSS from a theme variable map."""
    return f"""
    * {{ font-family: 'Inter','Segoe UI',-apple-system,sans-serif,'{ICON_FAMILY}';
        font-size: 13px; color: {v['txt']}; outline: none; }}
    QWidget#root {{ background: {v['bg']}; }}

    /* sidebar */
    QWidget#side {{ background: {v['side']}; }}
    QLabel#brandName {{ color: #fff; font-size: 13px; font-weight: 700; letter-spacing: 0.5px; }}
    QLabel#brandLogo {{ color: #2fe06a; font-family: '{ICON_FAMILY}'; font-size: 18px;
        background: #1d1f27; border: 1px solid #2a2c35;
        border-radius: 9px; min-width: 30px; max-width: 30px; min-height: 30px; max-height: 30px;
        qproperty-alignment: AlignCenter; }}
    QLabel#brandVer {{ color: {v['sideico']}; font-size: 10px; border: 1px solid #2a2c35;
        border-radius: 8px; padding: 2px 7px; }}

    QPushButton#navitem {{ color: {v['sidetx']}; background: transparent; border: none;
        border-radius: 10px; padding: 10px 12px; text-align: left; font-size: 13px; }}
    QPushButton#navitem:hover {{ background: {v['sideact']}; }}
    QPushButton#navitem[active="true"] {{ background: {v['sideact']}; color: #fff; font-weight: 500; }}

    QPushButton#themebtn {{ color: {v['sidetx']}; background: {v['sideact']}; border: none;
        border-radius: 10px; padding: 9px 12px; text-align: left; font-size: 12px; }}
    QLabel#sfoot {{ color: {v['sideico']}; font-size: 10px; }}

    /* content */
    QScrollArea, QScrollArea > QWidget > QWidget {{ background: transparent; border: none; }}
    QLabel#h2 {{ font-size: 19px; font-weight: 600; }}
    QLabel#sub {{ font-size: 12px; color: {v['muted']}; }}
    QLabel#lbl {{ font-size: 11px; color: {v['muted']}; font-weight: 500; }}
    QLabel#sectl {{ font-size: 11px; color: {v['faint']}; font-weight: 600; }}
    QLabel#pill {{ font-size: 10px; background: {v['asoft']}; color: {v['atx']};
        border-radius: 10px; padding: 3px 10px; }}

    /* rows */
    QFrame#row {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 8px; }}
    QFrame#row[warn="true"] {{ border: 1px solid {v['warn']}; }}
    QLabel#rowicon {{ color: {v['faint']}; font-family: '{ICON_FAMILY}'; font-size: 17px; }}
    QLabel#path {{ font-family: {MONO}; font-size: 12px; color: {v['txt']}; }}
    QLineEdit#path {{ font-family: {MONO}; font-size: 12px; color: {v['txt']};
        border: none; background: transparent; }}

    /* tags */
    QPushButton#tag {{ font-size: 10px; font-weight: 500; border-radius: 11px; padding: 4px 10px;
        border: none; }}
    QPushButton#tag[state="on"] {{ background: {v['accent']}; color: #fff; }}
    QPushButton#tag[state="off"] {{ background: transparent; color: {v['faint']}; }}
    QPushButton#tag[state="off"]:hover {{ color: {v['muted']}; }}
    QPushButton#tag[state="dis"] {{ background: transparent; color: {v['line2']}; }}

    QPushButton#rm {{ color: {v['faint']}; font-family: '{ICON_FAMILY}'; font-size: 17px;
        border: none; background: transparent; border-radius: 7px; padding: 3px; }}
    QPushButton#rm:hover {{ color: {v['danger']}; background: {v['warnbg']}; }}

    /* add source button */
    QPushButton#add {{ background: transparent; border: 1.5px dashed {v['line2']};
        border-radius: 8px; color: {v['muted']}; font-size: 12px; min-height: 40px; }}
    QPushButton#add:hover {{ border-color: {v['accent']}; color: {v['accent']};
        background: {v['asoft']}; }}

    /* warn bar */
    QFrame#warnbar {{ background: {v['warnbg']}; border-radius: 8px; }}
    QLabel#warntext {{ color: {v['warn']}; font-size: 12px; }}
    QLabel#warnicon {{ color: {v['warn']}; font-family: '{ICON_FAMILY}'; font-size: 16px; }}
    QLabel#arrow {{ color: {v['faint']}; font-family: '{ICON_FAMILY}'; font-size: 18px; }}

    /* option pills */
    QPushButton#opt {{ font-size: 11px; font-weight: 500; padding: 7px 13px; border-radius: 11px;
        background: {v['p2']}; color: {v['muted']}; border: 1px solid transparent; }}
    QPushButton#opt:hover {{ border-color: {v['line2']}; }}
    QPushButton#opt[active="true"] {{ background: {v['asoft']}; color: {v['atx']};
        border-color: transparent; }}
    QLabel#optlbl {{ font-size: 12px; color: {v['muted']}; }}

    QComboBox#mini {{ min-height: 32px; border: 1px solid {v['line']}; border-radius: 9px;
        background: {v['panel']}; font-size: 12px; padding: 0 8px; color: {v['txt']}; }}
    QComboBox#mini::drop-down {{ border: none; width: 20px; }}
    QComboBox#mini::down-arrow {{ image: none; border-left: 4px solid transparent;
        border-right: 4px solid transparent; border-top: 5px solid {v['muted']};
        margin-right: 6px; }}
    QComboBox QAbstractItemView {{ background: {v['panel']}; color: {v['txt']};
        border: 1px solid {v['line']}; selection-background-color: {v['asoft']};
        selection-color: {v['atx']}; }}

    /* buttons */
    QPushButton#btn {{ min-height: 42px; border-radius: 8px; border: 1px solid {v['line2']};
        background: {v['panel']}; color: {v['txt']}; font-size: 13px; font-weight: 500;
        padding: 0 17px; }}
    QPushButton#btn:hover {{ border-color: {v['accent']}; color: {v['accent']}; }}
    QPushButton#btn:disabled {{ color: {v['faint']}; border-color: {v['line']}; }}
    QPushButton#btnprimary {{ min-height: 42px; border-radius: 8px; border: 1px solid {v['accent']};
        background: {v['accent']}; color: #fff; font-size: 13px; font-weight: 500; padding: 0 17px; }}
    QPushButton#btnprimary:hover {{ background: {v['accenth']}; border-color: {v['accenth']}; }}
    QPushButton#btnprimary:disabled {{ background: {v['line2']}; border-color: {v['line2']};
        color: {v['panel']}; }}
    QPushButton#btnsm {{ min-height: 34px; border-radius: 8px; border: 1px solid {v['line2']};
        background: {v['panel']}; color: {v['txt']}; font-size: 12px; font-weight: 500; padding: 0 13px; }}
    QPushButton#btnsm:hover {{ border-color: {v['accent']}; color: {v['accent']}; }}
    QPushButton#btnsmprimary {{ min-height: 34px; border-radius: 8px; border: 1px solid {v['accent']};
        background: {v['accent']}; color: #fff; font-size: 12px; font-weight: 500; padding: 0 13px; }}
    QPushButton#btnsmprimary:hover {{ background: {v['accenth']}; border-color: {v['accenth']}; }}

    /* advanced panel */
    QFrame#adv {{ border: 1px solid {v['line']}; border-radius: 8px; background: {v['panel']}; }}
    QLabel#gl {{ font-size: 10px; color: {v['faint']}; font-weight: 600; }}
    QLabel#advlbl {{ font-size: 11px; color: {v['muted']}; }}
    QLineEdit#advinput {{ min-height: 34px; border: 1px solid {v['line']}; border-radius: 9px;
        background: {v['bg']}; font-size: 12px; padding: 0 10px; color: {v['txt']}; }}
    QLineEdit#advinput:focus {{ border-color: {v['accent']}; }}
    QFrame#chips {{ border: 1px solid {v['line']}; border-radius: 9px; background: {v['bg']}; }}
    QFrame#chip {{ background: {v['p2']}; border-radius: 7px; }}
    QLabel#chiptext {{ font-family: {MONO}; font-size: 11px; color: {v['txt']}; }}
    QPushButton#chipx {{ color: {v['faint']}; font-family: '{ICON_FAMILY}'; font-size: 13px;
        border: none; background: transparent; }}
    QPushButton#chipx:hover {{ color: {v['danger']}; }}
    QPushButton#chipadd {{ color: {v['muted']}; border: none; background: transparent; font-size: 12px; }}
    QPushButton#chipadd:hover {{ color: {v['accent']}; }}

    /* progress */
    QFrame#prog {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 10px; }}
    QLabel#pstate {{ font-size: 13px; font-weight: 600; }}
    QLabel#pfiles {{ font-size: 12px; color: {v['muted']}; font-family: {MONO}; }}
    QFrame#bar {{ background: {v['p2']}; border-radius: 5px; }}
    QFrame#barf {{ border-radius: 5px; }}
    QLabel#statk {{ font-size: 10px; color: {v['faint']}; font-weight: 500; }}
    QLabel#statv {{ font-size: 17px; font-weight: 600; }}
    QLabel#statvok {{ font-size: 17px; font-weight: 600; color: {v['ok']}; }}
    QFrame#logbox {{ background: {v['bg']}; border: 1px solid {v['line']}; border-radius: 9px; }}
    QPlainTextEdit#logview {{ font-family: {MONO}; font-size: 12.5px; color: {v['muted']};
        background: transparent; border: none; padding: 7px 9px; }}

    /* connection cards */
    QFrame#conn {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 8px; }}
    QLabel#connicon {{ color: {v['accent']}; font-family: '{ICON_FAMILY}'; font-size: 19px; }}
    QLabel#connname {{ font-size: 13px; font-weight: 600; }}
    QLabel#connmeta {{ font-size: 11px; color: {v['faint']}; font-family: {MONO}; }}
    QLabel#badgeok {{ font-size: 10px; background: {v['okbg']}; color: {v['ok']};
        border-radius: 10px; padding: 4px 10px; }}
    QLabel#badgeidle {{ font-size: 10px; background: {v['p2']}; color: {v['muted']};
        border-radius: 10px; padding: 4px 10px; }}
    QLabel#badgetest {{ font-size: 10px; background: {v['warnbg']}; color: {v['warn']};
        border-radius: 10px; padding: 4px 10px; }}
    QPushButton#ib, QPushButton#ibdel {{ color: {v['faint']}; font-family: '{ICON_FAMILY}';
        font-size: 17px; border: none; background: transparent; border-radius: 8px; padding: 5px; }}
    QPushButton#ib:hover {{ color: {v['accent']}; background: {v['asoft']}; }}
    QPushButton#ibdel:hover {{ color: {v['danger']}; background: {v['warnbg']}; }}

    /* browser */
    QFrame#crumb {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 8px; }}
    QLabel#crumbico {{ color: {v['muted']}; font-family: '{ICON_FAMILY}'; font-size: 15px; }}
    QPushButton#crumbc {{ color: {v['accent']}; font-family: {MONO}; font-size: 12px;
        border: none; background: transparent; }}
    QLabel#crumbsep {{ color: {v['muted']}; font-family: '{ICON_FAMILY}'; font-size: 15px; }}
    QLabel#crumbpart {{ color: {v['muted']}; font-family: {MONO}; font-size: 12px; }}
    QFrame#fitem {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 8px; }}
    QFrame#fitem[sel="true"] {{ border-color: {v['accent']}; background: {v['asoft']}; }}
    QLabel#fi {{ color: {v['muted']}; font-family: '{ICON_FAMILY}'; font-size: 18px; }}
    QLabel#fidir {{ color: {v['accent']}; font-family: '{ICON_FAMILY}'; font-size: 18px; }}
    QLabel#fn {{ font-family: {MONO}; font-size: 13px; color: {v['txt']}; }}
    QLabel#fs {{ color: {v['faint']}; font-size: 11px; font-family: {MONO}; }}

    /* history */
    QFrame#hrun {{ background: {v['panel']}; border: 1px solid {v['line']}; border-radius: 8px; }}
    QLabel#hp {{ font-family: {MONO}; font-size: 12px; font-weight: 500; }}
    QLabel#hs {{ font-size: 11px; color: {v['muted']}; }}

    /* dialogs */
    QDialog {{ background: {v['panel']}; }}
    QLabel#sheettitle {{ font-size: 16px; font-weight: 600; }}
    QLabel#fieldlbl {{ font-size: 11px; color: {v['muted']}; font-weight: 500; }}
    QLineEdit#fieldinput, QComboBox#fieldinput {{ min-height: 38px; border: 1px solid {v['line']};
        border-radius: 9px; background: {v['bg']}; font-size: 13px; padding: 0 11px; color: {v['txt']}; }}
    QLineEdit#fieldinput:focus, QComboBox#fieldinput:focus {{ border-color: {v['accent']}; }}
    QComboBox#fieldinput::drop-down {{ border: none; width: 22px; }}
    QComboBox#fieldinput::down-arrow {{ image: none; border-left: 4px solid transparent;
        border-right: 4px solid transparent; border-top: 5px solid {v['muted']}; margin-right: 7px; }}

    QScrollBar:vertical {{ background: transparent; width: 9px; margin: 0; }}
    QScrollBar::handle:vertical {{ background: {v['line2']}; border-radius: 4px; min-height: 24px; }}
    QScrollBar::add-line, QScrollBar::sub-line {{ height: 0; }}
    QScrollBar:horizontal {{ background: transparent; height: 9px; }}
    QScrollBar::handle:horizontal {{ background: {v['line2']}; border-radius: 4px; min-width: 24px; }}
    """


# ─────────────────────────────────────────────────────── helper widgets ──
def repolish(w):
    w.style().unpolish(w)
    w.style().polish(w)
    w.update()


class ClickLabel(QLabel):
    clicked = Signal()

    def mousePressEvent(self, e):
        if e.button() == Qt.LeftButton:
            self.clicked.emit()
        super().mousePressEvent(e)


class ClickFrame(QFrame):
    clicked = Signal()
    doubleClicked = Signal()

    def mousePressEvent(self, e):
        if e.button() == Qt.LeftButton:
            self.clicked.emit()
        super().mousePressEvent(e)

    def mouseDoubleClickEvent(self, e):
        if e.button() == Qt.LeftButton:
            self.doubleClicked.emit()
        super().mouseDoubleClickEvent(e)


def iconbtn(name, oid="ib", size=None):
    b = QPushButton(ic(name))
    b.setObjectName(oid)
    b.setCursor(Qt.PointingHandCursor)
    b.setFont(QFont(ICON_FAMILY))
    if size:
        b.setFixedSize(*size)
    return b


def textbtn(text, icon=None, oid="btn"):
    label = (ic(icon) + "  " + text) if icon else text
    b = QPushButton(label)
    b.setObjectName(oid)
    b.setCursor(Qt.PointingHandCursor)
    b.setFont(_mixed_font())
    return b


def _mixed_font():
    # Inter for text but the glyphs come from the icon font; Qt falls back per-glyph,
    # so we set a normal UI font and rely on font-substitution for the PUA glyphs.
    f = QFont("Inter")
    return f


def fmt_size(n):
    units = ["B", "KB", "MB", "GB", "TB"]
    i = 0
    while n >= 1024 and i < len(units) - 1:
        n /= 1024.0
        i += 1
    return (f"{n:.1f}" if i else f"{int(n)}") + " " + units[i]


def parse_size(text):
    """'8.3 GB' / '512KB' / '1.2GiB' → bytes (int). None on failure."""
    m = re.match(r"\s*([\d.]+)\s*([KMGTP]?)i?B\s*$", text, re.I)
    if not m:
        return None
    mult = {"": 1, "K": 1024, "M": 1024**2, "G": 1024**3,
            "T": 1024**4, "P": 1024**5}[m.group(2).upper()]
    try:
        return int(float(m.group(1)) * mult)
    except ValueError:
        return None


def fmt_time(s):
    s = round(s)
    return f"{s}s" if s < 60 else f"{s // 60}m {s % 60}s"


def mask(v):
    if not v:
        return ""
    v = str(v)
    return v[:2] + "…" + v[-2:] if len(v) > 6 else "••••"


def base(p):
    p = re.sub(r"[\\/]+$", "", p)
    return re.split(r"[\\/]", p)[-1]


def is_remote(p):
    return bool(re.search(r"@.+:", p) or re.search(r"://", p))


# ──────────────────────────────────────────────────────────── toast ──
class Toast(QLabel):
    def __init__(self, parent):
        super().__init__(parent)
        self.setStyleSheet(
            "background:#16171d; color:#fff; font-size:12px; font-weight:500;"
            "padding:10px 16px; border-radius:11px;")
        self.setAttribute(Qt.WA_TransparentForMouseEvents)
        self._eff = QGraphicsOpacityEffect(self)
        self.setGraphicsEffect(self._eff)
        self._eff.setOpacity(0.0)
        self._anim = QPropertyAnimation(self._eff, b"opacity")
        self._anim.setDuration(200)
        self._timer = QTimer(self)
        self._timer.setSingleShot(True)
        self._timer.timeout.connect(self._fade_out)
        self.hide()

    def show_msg(self, msg):
        self.setText(ic("check") + "  " + msg)
        self.adjustSize()
        self._reposition()
        self.show()
        self.raise_()
        self._anim.stop()
        self._anim.setStartValue(self._eff.opacity())
        self._anim.setEndValue(1.0)
        self._anim.start()
        self._timer.start(1700)

    def _fade_out(self):
        self._anim.stop()
        self._anim.setStartValue(self._eff.opacity())
        self._anim.setEndValue(0.0)
        self._anim.start()

    def _reposition(self):
        p = self.parent()
        x = (p.width() - self.width()) // 2
        y = p.height() - self.height() - 18
        self.move(x, y)


# ───────────────────────────────────────────────────── modal dialogs ──
class PasswordDialog(QDialog):
    """Generic password / passphrase prompt (matches #pwModal)."""

    def __init__(self, parent, title, sub, label, allow_empty=False,
                 confirm=False, generator=False):
        super().__init__(parent)
        self.allow_empty = allow_empty
        self.confirm = confirm
        # Offer a diceware generate button only when SETTING a passphrase and
        # the engine provides the generator (a pre-rename engine may not).
        self.generator = (generator and confirm and FC_OK
                          and hasattr(fc, "generate_passphrase"))
        self.setWindowTitle(title)
        self.setModal(True)
        self.setFixedWidth(400)
        lay = QVBoxLayout(self)
        lay.setContentsMargins(24, 22, 24, 22)
        lay.setSpacing(0)

        t = QLabel(title)
        t.setObjectName("sheettitle")
        lay.addWidget(t)
        if sub:
            lay.addSpacing(8)
            s = QLabel(sub)
            s.setObjectName("sub")
            s.setWordWrap(True)
            s.setTextFormat(Qt.RichText)
            lay.addWidget(s)
        lay.addSpacing(14)

        ll = QLabel(label)
        ll.setObjectName("fieldlbl")
        lay.addWidget(ll)
        lay.addSpacing(5)
        self.input = QLineEdit()
        self.input.setObjectName("fieldinput")
        self.input.setEchoMode(QLineEdit.Password)
        self.input.setPlaceholderText("••••••••")
        self.input.returnPressed.connect(self._confirm)
        lay.addWidget(self.input)

        self.input2 = None
        if confirm:
            lay.addSpacing(12)
            ll2 = QLabel(_tr("Confirm passphrase"))
            ll2.setObjectName("fieldlbl")
            lay.addWidget(ll2)
            lay.addSpacing(5)
            self.input2 = QLineEdit()
            self.input2.setObjectName("fieldinput")
            self.input2.setEchoMode(QLineEdit.Password)
            self.input2.setPlaceholderText("••••••••")
            self.input2.returnPressed.connect(self._confirm)
            lay.addWidget(self.input2)

        self.err = QLabel("")
        self.err.setObjectName("sub")
        self.err.setWordWrap(True)
        self.err.setStyleSheet("color:#e5484d;")
        self.err.hide()
        lay.addSpacing(8)
        lay.addWidget(self.err)
        lay.addSpacing(18)

        row = QHBoxLayout()
        if self.generator:
            gen = textbtn(_tr("Generate"), "bolt", oid="btn")
            gen.setToolTip(_tr("Fill in a random 6-word passphrase (~77 bits)"))
            gen.clicked.connect(self._generate)
            row.addWidget(gen)
        row.addStretch(1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(self.reject)
        ok = textbtn(_tr("Confirm"), "lock-open", oid="btnprimary")
        ok.clicked.connect(self._confirm)
        row.addWidget(cancel)
        row.addWidget(ok)
        lay.addLayout(row)
        QTimer.singleShot(40, self.input.setFocus)

    def _generate(self):
        """Fill both fields with a fresh diceware passphrase and reveal it —
        the user must be able to read it to store it in a password manager."""
        phrase, bits = fc.generate_passphrase()
        for w in (self.input, self.input2):
            if w is not None:
                w.setText(phrase)
                w.setEchoMode(QLineEdit.Normal)
        self.err.setStyleSheet("color:#30a46c;")
        self.err.setText(_tr("Generated ({0} bits). Save it in your password "
                             "manager now — it is shown only here.").format(bits))
        self.err.show()

    def _confirm(self):
        txt = self.input.text()
        if self.confirm:
            if not txt and not self.allow_empty:
                return self._fail("Enter a passphrase.")
            if txt != self.input2.text():
                return self._fail("Passphrases do not match.")
            return self.accept()
        if txt or self.allow_empty:
            self.accept()

    def _fail(self, msg):
        self.err.setStyleSheet("color:#e5484d;")  # back to red after a green Generate note
        self.err.setText(msg)
        self.err.show()


FIELDSETS = {
    "s3": [
        ("endpoint_url", "Endpoint URL (blank = AWS)", "MinIO / R2 / Wasabi", False),
        ("access_key_id", "Access key ID", "", False),
        ("secret_access_key", "Secret access key", "", True),
        ("region", "Region", "us-east-1", False),
        ("container", "Default bucket", "", False),
        ("prefix", "Default prefix", "", False),
    ],
    "az": [
        ("connection_string", "Connection string (blank = account+key)", "", True),
        ("account", "Account name", "", False),
        ("key", "Account key", "", True),
        ("container", "Default container", "", False),
        ("prefix", "Default prefix", "", False),
    ],
    "gs": [
        ("project", "GCP project id", "", False),
        ("credentials", "Service-account JSON (blank = ADC)", "/path/sa.json", False),
        ("container", "Default bucket", "", False),
        ("prefix", "Default prefix", "", False),
    ],
    "ssh": [
        ("host", "Host", "", False),
        ("user", "User", "", False),
        ("port", "Port", "", False),
        ("key", "Private key path (blank = password/agent)", "~/.ssh/id_ed25519", False),
        ("password", "Password — or passphrase if the key is encrypted", "", True),
        ("path", "Default remote path", "", False),
    ],
    "smb": [
        ("host", "Host (name or IP)", "", False),
        ("user", "User", "", False),
        ("password", "Password (blank = anonymous/guest)", "", True),
        ("domain", "Domain (blank = none)", "", False),
        ("port", "Port", "445", False),
        ("share", "Default share", "", False),
    ],
    # Matched by HOST, like SSH: any http(s):// source on this host picks these
    # up automatically, so a download behind a login needs no flags.
    "http": [
        ("host", "Host (as it appears in the URL)", "dl.example.com", False),
        ("user", "User (blank = none, e.g. token-only auth)", "", False),
        ("password", "Password", "", True),
        ("header", "Extra header (blank = none)",
         "Authorization: Bearer …", True),
        ("cookies", "Cookies / browser session (blank = none)",
         "cookies.txt path, or a browser name like 'firefox'", False),
    ],
}

# Browsers whose live login blitcp can read (--cookies-from-browser). Kept in
# step with the loader table in blitcp.py's _cookie_header_for(); "browser"
# means "try all of them".
COOKIE_BROWSERS = [
    ("chrome", "Chrome"), ("chromium", "Chromium"), ("firefox", "Firefox"),
    ("edge", "Edge"), ("brave", "Brave"), ("opera", "Opera"),
    ("safari", "Safari"), ("browser", "Any browser (try all)"),
]
TYPE_LABELS = [
    ("s3", "Amazon S3 / compatible"), ("az", "Azure Blob"),
    ("gs", "Google Cloud Storage"), ("ssh", "SSH / SFTP"),
    ("smb", "SMB / CIFS"), ("http", "HTTP(S) download"),
]
# SSH transport choice per connection. "ssh" (exec/tar, today's default) needs
# a shell on the server; "sftp" works on SFTP-only endpoints (no exec channel,
# e.g. managed gateways); "both" is the classic hybrid (SFTP large + tar small).
SSH_PROTOCOLS = [
    ("ssh", "SSH only — tar over exec (fastest, needs shell)"),
    ("sftp", "SFTP only — no shell needed (managed/restricted servers)"),
    ("both", "SSH + SFTP — hybrid (SFTP large files, tar small)"),
]


class CookieSourceRow(QWidget):
    """One cookie source: a text field plus a picker that fills it in.

    The engine takes either a cookies.txt path or a browser name in the same
    string, and works out which is which. Typing that blind is the part nobody
    guesses, so the picker offers a file chooser and the browser list, and the
    field stays editable for a hand-typed value."""

    def __init__(self, parent=None, value=""):
        super().__init__(parent)
        lay = QHBoxLayout(self)
        lay.setContentsMargins(0, 0, 0, 0)
        lay.setSpacing(8)
        self.edit = QLineEdit(value or "")
        self.edit.setObjectName("fieldinput")
        self.edit.setPlaceholderText(
            _tr("cookies.txt path, or a browser name like 'firefox'"))
        lay.addWidget(self.edit, 1)
        self.pick = QComboBox()
        self.pick.setObjectName("fieldinput")
        self.pick.setMinimumWidth(150)
        self.pick.addItem(_tr("Use…"), None)
        self.pick.addItem(_tr("cookies.txt file…"), "@file")
        for val, label in COOKIE_BROWSERS:
            self.pick.addItem(_tr("Live session: ") + label, val)
        self.pick.currentIndexChanged.connect(self._picked)
        lay.addWidget(self.pick)

    def _picked(self, _idx):
        data = self.pick.currentData()
        self.pick.setCurrentIndex(0)         # a menu, not a state
        if data is None:
            return
        if data == "@file":
            start = os.path.dirname(self.edit.text().strip()) or os.path.expanduser("~")
            f, _ = QFileDialog.getOpenFileName(
                self, _tr("Choose a cookies.txt file"), start,
                _tr("Cookie files (*.txt cookies*);;All files (*)"))
            if f:
                self.edit.setText(f)
            return
        self.edit.setText(data)

    def text(self):
        return self.edit.text()

    def setText(self, v):
        self.edit.setText(v or "")

    def value(self):
        """(kind, value): kind is 'file', 'browser' or None. Matches the file
        vs browser test the engine makes in _cookie_header_for()."""
        src = self.edit.text().strip()
        if not src:
            return None, ""
        looks_like_file = (os.sep in src or "/" in src
                           or src.lower().endswith(".txt")
                           or os.path.exists(os.path.expanduser(src)))
        return ("file" if looks_like_file else "browser"), src


class HttpAuthDialog(QDialog):
    """Sign-in for ONE http(s):// source that has no saved connection.

    The saved-connection route (Connections → HTTP(S) download) stays the way
    to make a host's login permanent; this is the one-off equivalent, for a URL
    you are downloading once and do not want in the credentials file."""

    def __init__(self, parent, host, cur):
        super().__init__(parent)
        self.setWindowTitle(_tr("HTTP sign-in"))
        self.setModal(True)
        self.setFixedWidth(430)
        lay = QVBoxLayout(self)
        lay.setContentsMargins(24, 22, 24, 22)
        lay.setSpacing(0)

        t = QLabel(_tr("HTTP sign-in"))
        t.setObjectName("sheettitle")
        lay.addWidget(t)
        lay.addSpacing(8)
        s = QLabel(_tr("For this run only, for downloads behind a login on ")
                   + f"<b>{host or '—'}</b>. "
                   + _tr("Leave everything blank for a public URL. Nothing "
                         "here is saved — use Connections for that."))
        s.setObjectName("sub")
        s.setWordWrap(True)
        s.setTextFormat(Qt.RichText)
        lay.addWidget(s)
        lay.addSpacing(14)

        lay.addWidget(self._lbl(_tr("Cookies / browser session")))
        lay.addSpacing(5)
        self.cookies = CookieSourceRow(self, cur.get("cookies", ""))
        lay.addWidget(self.cookies)
        lay.addSpacing(13)

        lay.addWidget(self._lbl(_tr("User (blank = none)")))
        lay.addSpacing(5)
        self.user = QLineEdit(cur.get("user", ""))
        self.user.setObjectName("fieldinput")
        lay.addWidget(self.user)
        lay.addSpacing(13)

        lay.addWidget(self._lbl(_tr("Password")))
        lay.addSpacing(5)
        self.password = QLineEdit(cur.get("password", ""))
        self.password.setObjectName("fieldinput")
        self.password.setEchoMode(QLineEdit.Password)
        lay.addWidget(self.password)
        lay.addSpacing(13)

        lay.addWidget(self._lbl(_tr("Extra header (blank = none)")))
        lay.addSpacing(5)
        self.header = QLineEdit(cur.get("header", ""))
        self.header.setObjectName("fieldinput")
        self.header.setPlaceholderText("Authorization: Bearer …")
        self.header.setEchoMode(QLineEdit.Password)
        lay.addWidget(self.header)
        lay.addSpacing(8)
        note = QLabel(_tr("The password and header reach the engine through "
                          "the environment, not the command line, so they do "
                          "not show up in the process list."))
        note.setObjectName("sub")
        note.setWordWrap(True)
        lay.addWidget(note)
        lay.addSpacing(16)

        row = QHBoxLayout()
        clear = textbtn(_tr("Clear"), oid="btn")
        clear.clicked.connect(self._clear)
        row.addWidget(clear)
        row.addStretch(1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(self.reject)
        save = textbtn(_tr("Use"), "check", oid="btnprimary")
        save.clicked.connect(self._ok)
        row.addWidget(cancel)
        row.addWidget(save)
        lay.addLayout(row)
        self.data = None

    def _lbl(self, text):
        l = QLabel(text)
        l.setObjectName("fieldlbl")
        return l

    def _clear(self):
        self.cookies.setText("")
        self.user.clear()
        self.password.clear()
        self.header.clear()
        self.data = {}
        self.accept()

    def _ok(self):
        hdr = self.header.text().strip()
        if hdr and ":" not in hdr:
            # Same rule as the engine: it splits on the first ':'.
            QMessageBox.warning(self, _tr("HTTP sign-in"),
                                _tr("Header must be 'Name: value'"))
            return
        kind, cookies = self.cookies.value()
        self.data = {k: v for k, v in (
            ("cookies", cookies), ("cookies_kind", kind or ""),
            ("user", self.user.text().strip()),
            ("password", self.password.text()),
            ("header", hdr),
        ) if v}
        self.accept()


class ConnectionDialog(QDialog):
    """Add / edit connection sheet (matches #modal)."""

    def __init__(self, parent, name, conn):
        super().__init__(parent)
        self.setModal(True)
        self.setFixedWidth(440)
        self.editing = name
        outer = QVBoxLayout(self)
        outer.setContentsMargins(0, 0, 0, 0)

        scroll = QScrollArea()
        scroll.setWidgetResizable(True)
        outer.addWidget(scroll)
        self.body = body = QWidget()
        scroll.setWidget(body)
        lay = QVBoxLayout(body)
        lay.setContentsMargins(24, 22, 24, 22)
        lay.setSpacing(0)

        title = QLabel(("Edit " + name) if name else "Add connection")
        title.setObjectName("sheettitle")
        lay.addWidget(title)
        lay.addSpacing(16)

        lay.addWidget(self._lbl("Name"))
        lay.addSpacing(5)
        self.f_name = self._inp(name or "")
        lay.addWidget(self.f_name)
        lay.addSpacing(13)

        lay.addWidget(self._lbl("Type"))
        lay.addSpacing(5)
        self.f_type = QComboBox()
        self.f_type.setObjectName("fieldinput")
        for val, label in TYPE_LABELS:
            self.f_type.addItem(label, val)
        lay.addWidget(self.f_type)
        lay.addSpacing(13)

        c = conn or {"type": "s3"}
        ctype = c.get("type", "s3")
        # field widgets per type
        self.fieldsets = {}
        self.fields = {}
        for t, specs in FIELDSETS.items():
            box = QWidget()
            bl = QVBoxLayout(box)
            bl.setContentsMargins(0, 0, 0, 0)
            bl.setSpacing(0)
            for key, label, ph, pw in specs:
                bl.addWidget(self._lbl(label))
                bl.addSpacing(5)
                if (t, key) == ("http", "cookies"):
                    # Field + picker (file chooser / browser list), so the two
                    # accepted forms are visible instead of placeholder-only.
                    row = CookieSourceRow(self)
                    bl.addWidget(row)
                    bl.addSpacing(13)
                    self.fields[(t, key)] = row
                    continue
                inp = self._inp("", ph)
                if pw:
                    inp.setEchoMode(QLineEdit.Password)
                bl.addWidget(inp)
                bl.addSpacing(13)
                self.fields[(t, key)] = inp
            if t == "ssh":
                bl.addWidget(self._lbl("Protocol"))
                bl.addSpacing(5)
                self.f_proto = QComboBox()
                self.f_proto.setObjectName("fieldinput")
                for val, label in SSH_PROTOCOLS:
                    self.f_proto.addItem(label, val)
                bl.addWidget(self.f_proto)
                bl.addSpacing(13)
            self.fieldsets[t] = box
            lay.addWidget(box)

        self._load_values(ctype, c)
        idx = [v for v, _ in TYPE_LABELS].index(ctype)
        self.f_type.setCurrentIndex(idx)
        self.f_type.currentIndexChanged.connect(self._sync_type)
        self._sync_type()

        lay.addStretch(1)
        row = QHBoxLayout()
        row.addStretch(1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(self.reject)
        save = textbtn(_tr("Save"), "device-floppy", oid="btnprimary")
        save.clicked.connect(self.accept)
        row.addWidget(cancel)
        row.addWidget(save)
        lay.addLayout(row)
        self._fit_height()

    def _fit_height(self):
        # Grow the dialog to show every field of the selected type PLUS the
        # Cancel/Save buttons (no scrolling to reach them), capped at the
        # available screen height — only a type taller than the screen scrolls.
        self.body.layout().activate()
        needed = self.body.sizeHint().height() + 6   # + scroll-area frame
        avail = 1000
        scr = self.screen()
        if scr is not None:
            avail = scr.availableGeometry().height() - 60
        self.setMaximumHeight(avail)
        self.resize(self.width(), min(needed, avail))

    def _lbl(self, text):
        l = QLabel(text)
        l.setObjectName("fieldlbl")
        return l

    def _inp(self, val, ph=""):
        e = QLineEdit(val)
        e.setObjectName("fieldinput")
        if ph:
            e.setPlaceholderText(ph)
        return e

    def _load_values(self, ctype, c):
        for (t, key), inp in self.fields.items():
            if t != ctype:
                if t == "ssh" and key == "port":
                    inp.setText("22")
                continue
            if key == "port":
                dp = 445 if ctype == "smb" else 22
                inp.setText(str(c.get("port", dp) or dp))
            else:
                inp.setText(str(c.get(key, "") or ""))
        # missing/unknown protocol on a saved conn = "ssh" (today's behavior)
        proto = c.get("protocol", "ssh") if ctype == "ssh" else "ssh"
        vals = [v for v, _ in SSH_PROTOCOLS]
        self.f_proto.setCurrentIndex(vals.index(proto if proto in vals else "ssh"))

    def _sync_type(self):
        t = self.f_type.currentData()
        for key, box in self.fieldsets.items():
            box.setVisible(key == t)
        self._fit_height()

    def result_data(self):
        """Return (name, conn_dict) or (None, error_message)."""
        name = self.f_name.text().strip()
        if not name:
            return None, "Name is required"
        t = self.f_type.currentData()
        e = {"type": t}

        def put(k, src_key):
            v = self.fields[(t, src_key)].text().strip()
            if v:
                e[k] = v

        if t == "s3":
            if not self.fields[(t, "access_key_id")].text().strip() or \
               not self.fields[(t, "secret_access_key")].text():
                return None, "S3 needs key + secret"
            put("endpoint_url", "endpoint_url")
            put("access_key_id", "access_key_id")
            put("secret_access_key", "secret_access_key")
            put("region", "region")
            put("container", "container")
            if e.get("container"):
                put("prefix", "prefix")
        elif t == "az":
            if self.fields[(t, "connection_string")].text().strip():
                put("connection_string", "connection_string")
            elif self.fields[(t, "account")].text().strip() and self.fields[(t, "key")].text():
                put("account", "account")
                put("key", "key")
            else:
                return None, "Azure needs conn string or account+key"
            put("container", "container")
            if e.get("container"):
                put("prefix", "prefix")
        elif t == "gs":
            if not self.fields[(t, "project")].text().strip():
                return None, "GCS needs a project"
            put("project", "project")
            put("credentials", "credentials")
            put("container", "container")
            if e.get("container"):
                put("prefix", "prefix")
        elif t == "ssh":
            if not self.fields[(t, "host")].text().strip():
                return None, "SSH needs a host"
            put("host", "host")
            e["user"] = self.fields[(t, "user")].text().strip() or "root"
            _pt = self.fields[(t, "port")].text().strip()
            try:
                # Default ONLY when the field is empty — a typed value (even 0)
                # must pass through, not be silently rewritten by `or 22`.
                e["port"] = int(_pt) if _pt else 22
            except ValueError:
                e["port"] = 22
            if self.fields[(t, "key")].text().strip():
                put("key", "key")
            elif self.fields[(t, "password")].text():
                e["password"] = self.fields[(t, "password")].text()
            put("path", "path")
            e["protocol"] = self.f_proto.currentData()
        elif t == "smb":
            if not self.fields[(t, "host")].text().strip():
                return None, "SMB needs a host"
            put("host", "host")
            put("user", "user")
            if self.fields[(t, "password")].text():
                e["password"] = self.fields[(t, "password")].text()
            put("domain", "domain")
            put("share", "share")
            _pt = self.fields[(t, "port")].text().strip()
            try:
                # Default ONLY when empty — a typed value (even 0) passes through.
                e["port"] = int(_pt) if _pt else 445
            except ValueError:
                e["port"] = 445
        elif t == "http":
            if not self.fields[(t, "host")].text().strip():
                return None, "HTTP needs a host"
            put("host", "host")
            put("user", "user")
            if self.fields[(t, "user")].text().strip() \
                    and self.fields[(t, "password")].text():
                e["password"] = self.fields[(t, "password")].text()
            hdr = self.fields[(t, "header")].text().strip()
            if hdr:
                # The engine splits on the first ':' — reject a malformed line
                # here rather than letting it become a header named after the
                # whole string.
                if ":" not in hdr:
                    return None, "Header must be 'Name: value'"
                e["header"] = hdr
            put("cookies", "cookies")
        return name, e


class TextPromptDialog(QDialog):
    """Small single-line prompt (exclude pattern)."""

    def __init__(self, parent, title):
        super().__init__(parent)
        self.setModal(True)
        self.setFixedWidth(360)
        lay = QVBoxLayout(self)
        lay.setContentsMargins(24, 22, 24, 22)
        t = QLabel(title)
        t.setObjectName("sheettitle")
        lay.addWidget(t)
        lay.addSpacing(12)
        self.input = QLineEdit()
        self.input.setObjectName("fieldinput")
        self.input.returnPressed.connect(self.accept)
        lay.addWidget(self.input)
        lay.addSpacing(16)
        row = QHBoxLayout()
        row.addStretch(1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(self.reject)
        ok = textbtn(_tr("Add"), oid="btnprimary")
        ok.clicked.connect(self.accept)
        row.addWidget(cancel)
        row.addWidget(ok)
        lay.addLayout(row)
        QTimer.singleShot(40, self.input.setFocus)


class RemoteBrowseDialog(QDialog):
    """Popup to browse an SSH server or cloud bucket and pick a path."""

    def __init__(self, gui, kind, start_conn=None):
        super().__init__(gui)
        self.gui = gui
        self.kind = kind                       # 'ssh' or 'cloud'
        self.result_path = None
        self.conn = None
        self.cwd = "/"
        self.selected = None
        self._want_req = None             # listing request this dialog waits for
        self._shown = None                # ((name, cwd), entries, err, total)
        self.setModal(True)
        self.setWindowTitle(_tr("Browse SSH") if kind == "ssh" else _tr("Browse cloud"))
        self.resize(580, 580)

        lay = QVBoxLayout(self)
        lay.setContentsMargins(20, 18, 20, 18)
        lay.setSpacing(0)
        title = QLabel(_tr("Browse SSH server") if kind == "ssh" else _tr("Browse cloud storage"))
        title.setObjectName("sheettitle")
        lay.addWidget(title)
        lay.addSpacing(12)

        self.sel = QComboBox()
        self.sel.setObjectName("fieldinput")
        names = gui._conns_of_kind(kind)
        for n in names:
            self.sel.addItem(f"{n} · {gui.conns[n].get('type')}", n)
        lay.addWidget(self.sel)
        lay.addSpacing(10)

        self.crumb = QFrame()
        self.crumb.setObjectName("crumb")
        self.crumb_lay = QHBoxLayout(self.crumb)
        self.crumb_lay.setContentsMargins(12, 9, 12, 9)
        self.crumb_lay.setSpacing(7)
        lay.addWidget(self.crumb)
        lay.addSpacing(10)

        self.scroll = QScrollArea()
        self.scroll.setWidgetResizable(True)
        self.scroll.setFrameShape(QFrame.NoFrame)
        self.scroll.setHorizontalScrollBarPolicy(Qt.ScrollBarAlwaysOff)
        inner = QWidget()
        self.files_lay = QVBoxLayout(inner)
        self.files_lay.setContentsMargins(0, 0, 0, 0)
        self.files_lay.setSpacing(6)
        self.files_lay.addStretch(1)
        self.scroll.setWidget(inner)
        lay.addWidget(self.scroll, 1)
        lay.addSpacing(10)

        self.pathlbl = QLabel("")
        self.pathlbl.setObjectName("connmeta")
        self.pathlbl.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
        lay.addWidget(self.pathlbl)
        lay.addSpacing(10)

        row = QHBoxLayout()
        row.addStretch(1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(self.reject)
        self.okbtn = textbtn(_tr("Select this path"), "check", oid="btnprimary")
        self.okbtn.clicked.connect(self._accept)
        row.addWidget(cancel)
        row.addWidget(self.okbtn)
        lay.addLayout(row)

        if start_conn and start_conn in names:
            self.sel.setCurrentIndex(names.index(start_conn))
        self.sel.currentIndexChanged.connect(self._on_sel)
        self._set_conn()
        self._render()

    def _set_conn(self):
        name = self.sel.currentData()
        self.conn = {"name": name, **self.gui.conns[name]}
        self.cwd = (self.conn.get("path") or "/") if self.conn["type"] == "ssh" else "/"
        self.selected = None

    def _on_sel(self, *_):
        self._set_conn()
        self._render()

    def done(self, r):
        self.gui._cancel_listing(self)        # a late answer finds nobody waiting
        super().done(r)

    def _render(self, refresh=True):
        """refresh=False re-draws from the last listing (picking a file)."""
        is_ssh = self.conn["type"] == "ssh"
        # breadcrumb
        while self.crumb_lay.count():
            it = self.crumb_lay.takeAt(0)
            if it.widget():
                it.widget().deleteLater()
        cico = QLabel(ic("server-2" if is_ssh else "bucket"))
        cico.setObjectName("crumbico")
        self.crumb_lay.addWidget(cico)
        root = self.conn.get("host", self.conn["name"]) if is_ssh \
            else self.conn.get("container", "bucket")
        crumbs = [(root, "/")]
        acc = ""
        for p in ([] if self.cwd == "/" else [x for x in self.cwd.split("/") if x]):
            acc += "/" + p
            crumbs.append((p, acc))
        for i, (label, target) in enumerate(crumbs):
            if i:
                sep = QLabel(ic("chevron-right"))
                sep.setObjectName("crumbsep")
                self.crumb_lay.addWidget(sep)
            pb = QPushButton(label)
            pb.setObjectName("crumbc")
            pb.setCursor(Qt.PointingHandCursor)
            pb.clicked.connect(lambda _=False, t=target: self._goto(t))
            self.crumb_lay.addWidget(pb)
        self.crumb_lay.addStretch(1)
        # files
        while self.files_lay.count() > 1:
            it = self.files_lay.takeAt(0)
            if it.widget():
                it.widget().deleteLater()
        if self.cwd != "/":
            self._add_item(self._mk_item("..", "up", up=True))
        key = (self.conn["name"], self.cwd)
        if not refresh and self._shown and self._shown[0] == key:
            for row in self.gui._listing_rows(*self._shown[1:]):
                if row[0] == "msg":
                    self._add_msg(row[1])
                else:
                    self._add_item(self._mk_item(row[1], row[2]))
        else:
            self._shown = None
            self._add_item(self.gui._loading_row(self.gui._list_label(self.conn),
                                                 self._cancel))
            self.gui._start_listing(self, self.conn, self.cwd,
                                    lambda e, er, t, k=key: self._listed(k, e, er, t))
        self.pathlbl.setText(self.gui._compose_path(self.conn, self.cwd, self.selected))

    def _listed(self, key, entries, err, total):
        self._shown = (key, entries, err, total)
        if (self.conn["name"], self.cwd) == key:
            self._render(refresh=False)

    def _cancel(self):
        self.gui._cancel_listing(self)
        self._shown = ((self.conn["name"], self.cwd), None, _tr("Cancelled."), None)
        self._render(refresh=False)

    def _add_item(self, w):
        self.files_lay.insertWidget(self.files_lay.count() - 1, w)

    def _add_msg(self, text):
        l = QLabel(text)
        l.setObjectName("sub")
        l.setWordWrap(True)
        self._add_item(l)

    def _mk_item(self, name, meta, up=False):
        is_dir = up or meta in ("dir", "drive")
        item = ClickFrame()
        item.setObjectName("fitem")
        item.setProperty("sel", (not is_dir and name == self.selected))
        il = QHBoxLayout(item)
        il.setContentsMargins(10, 11, 10, 11)
        il.setSpacing(11)
        iconname = "corner-left-up" if up else "folder" if is_dir else \
            ("file-text" if name.endswith(".json") else "file-zip")
        fi = QLabel(ic(iconname))
        fi.setObjectName("fidir" if is_dir else "fi")
        fn = QLabel(name + ("/" if is_dir and not up else ""))
        fn.setObjectName("fn")
        fs = QLabel("" if up else (_tr("folder") if is_dir else meta))
        fs.setObjectName("fs")
        il.addWidget(fi)
        il.addWidget(fn, 1)
        il.addWidget(fs)
        if up:
            item.clicked.connect(self._up)
        elif is_dir:
            item.clicked.connect(lambda n=name: self._enter(n))
        else:
            item.clicked.connect(lambda n=name: self._pick(n))
            item.doubleClicked.connect(lambda n=name: self._accept_file(n))
        return item

    def _goto(self, path):
        self.cwd = path
        self.selected = None
        self._render()

    def _enter(self, name):
        self.cwd = ("" if self.cwd == "/" else self.cwd) + "/" + name
        self.selected = None
        self._render()

    def _up(self):
        self.cwd = "/".join(self.cwd.split("/")[:-1]) or "/"
        self.selected = None
        self._render()

    def _pick(self, name):
        self.selected = name
        self._render(refresh=False)

    def _accept_file(self, name):
        self.selected = name
        self._accept()

    def _accept(self):
        self.result_path = self.gui._compose_path(self.conn, self.cwd, self.selected)
        self.accept()


def _engine_auto_update_enabled():
    """The engine owns this setting so the CLI and the GUI cannot disagree.
    Unanswered means off here: the GUI checkbox has to show a definite state,
    and defaulting an unasked question to "yes" is how tools end up phoning
    home without consent."""
    try:
        return bool(fc._load_settings().get("auto_update_check", False))
    except Exception:
        return False


def _set_engine_auto_update(on):
    try:
        st = fc._load_settings()
        st["auto_update_check"] = bool(on)
        fc._save_settings(st)
    except Exception:
        pass


def _auto_update_due():
    """True when an automatic check is allowed AND a day has passed. Mirrors
    the engine's own throttle so launching the GUI ten times does not mean ten
    requests."""
    try:
        if os.environ.get("BLITCP_NO_UPDATE_CHECK") or \
                os.environ.get("FAST_COPY_NO_UPDATE_CHECK"):
            return False
        st = fc._load_settings()
        if not st.get("auto_update_check"):
            return False
        import time as _t
        return (_t.time() - float(st.get("last_update_check") or 0)
                >= fc._AUTO_CHECK_EVERY)
    except Exception:
        return False


def _mark_auto_update_checked():
    try:
        st = fc._load_settings()
        import time as _t
        st["last_update_check"] = _t.time()
        fc._save_settings(st)
    except Exception:
        pass


class _UpdateCheckWorker(QThread):
    """Queries GitHub releases off the UI thread via the engine's fetcher."""
    done = Signal(object)

    def run(self):
        try:
            releases = fc._fetch_releases()
            if releases is None:
                self.done.emit({"err": "network"})
                return
            cur = fc._parse_version(fc.__version__)
            newer = [r for r in releases
                     if fc._parse_version(r.get("tag_name", "")) and
                     fc._parse_version(r["tag_name"]) > cur]
            newer.sort(key=lambda r: fc._parse_version(r["tag_name"]), reverse=True)
            if newer:
                self.done.emit({"latest": newer[0]["tag_name"],
                                "current": fc.__version__, "releases": newer})
            else:
                self.done.emit({"uptodate": fc.__version__})
        except Exception as e:
            msg = str(e).strip().splitlines()[0] if str(e).strip() else e.__class__.__name__
            self.done.emit({"err": msg})


BROWSE_MAX_ENTRIES = 5000   # rows a remote listing shows; the rest are counted
SSH_BROWSE_TIMEOUT = 8      # s, each of connect / banner / auth
SMB_BROWSE_TIMEOUT = 10     # s, SMB connection set-up


class _ListWorker(QThread):
    """One remote directory listing, off the UI thread. fn(cancelled) returns
    (entries, err, total); done(req, entries, err, total) carries it back with
    the request id, so the browser can drop an answer it no longer wants."""
    done = Signal(int, object, object, object)

    def __init__(self, req, fn):
        super().__init__()
        self.req, self.fn = req, fn
        self.cancel = threading.Event()

    def run(self):
        try:
            entries, err, total = self.fn(self.cancel.is_set)
        except Exception as e:                  # the browser waits for an answer
            entries, err, total = None, BlitcpGUI._clean_err(e), None
        self.done.emit(self.req, entries, err, total)


class _OnUIThread(QObject):
    """Run a callable on the UI thread and wait for its result: the one dialog a
    listing worker can need is the unknown-SSH-host-key prompt."""
    _call = Signal(object)

    def __init__(self):
        super().__init__()
        self._call.connect(self._run, Qt.BlockingQueuedConnection)

    @Slot(object)
    def _run(self, box):
        try:
            box[1] = box[0]()
        except BaseException as e:              # re-raised in the worker
            box[2] = e

    def __call__(self, fn):
        if QThread.currentThread() == self.thread():
            return fn()
        box = [fn, None, None]
        self._call.emit(box)
        if box[2] is not None:
            raise box[2]
        return box[1]


class _DownloadWorker(QThread):
    """Downloads a release asset off the UI thread. Emits done(ok, path_or_err).

    When expected_size is given, a size mismatch fails the download — the same
    integrity guard the CLI self-update applies before replacing a binary."""
    done = Signal(bool, str)

    def __init__(self, url, dest, expected_size=None):
        super().__init__()
        self.url, self.dest = url, dest
        self.expected_size = expected_size

    def run(self):
        import urllib.request
        try:
            ctx = fc._get_ssl_context() if (FC_OK and hasattr(fc, "_get_ssl_context")) else None
            # Accept: octet-stream => the API asset endpoint returns the binary
            # (redirecting to the CDN) instead of the asset JSON metadata.
            headers = {"User-Agent": "blitcp-gui",
                       "Accept": "application/octet-stream"}
            tok = fc._update_token() if (FC_OK and hasattr(fc, "_update_token")) else ""
            if tok:                       # private-repo release assets need auth
                headers["Authorization"] = f"Bearer {tok}"
            req = urllib.request.Request(self.url, headers=headers)
            written = 0
            with urllib.request.urlopen(req, timeout=60, context=ctx) as r, \
                    open(self.dest, "wb") as f:
                while True:
                    chunk = r.read(262144)
                    if not chunk:
                        break
                    f.write(chunk)
                    written += len(chunk)
            if self.expected_size and written != self.expected_size:
                raise OSError(f"size mismatch — expected {self.expected_size}, "
                              f"got {written} bytes")
            self.done.emit(True, self.dest)
        except Exception as e:
            try:
                if os.path.exists(self.dest):
                    os.remove(self.dest)
            except OSError:
                pass
            self.done.emit(False, str(e).splitlines()[0] if str(e).strip() else e.__class__.__name__)


class UpdateDialog(QDialog):
    """Startup 'new version available' popup. Shows the categorized release notes
    (the same sections the CLI's --check-update prints, via the engine's
    _classify_release_sections), a 'don't show again for this version' checkbox,
    and Close / Download only / Download & install."""
    CLOSE, DOWNLOAD_ONLY, DOWNLOAD_INSTALL = 0, 1, 2

    def __init__(self, parent, latest, current, releases, can_install, theme=None):
        super().__init__(parent)
        self._v = theme or DARK
        self.setModal(True)
        self.setWindowTitle(_tr("Update available"))
        self.setMinimumWidth(520)
        self.action = self.CLOSE
        lay = QVBoxLayout(self)
        lay.setContentsMargins(24, 22, 24, 20)
        lay.setSpacing(0)

        title = QLabel(f"blitcp {latest} is available")
        title.setObjectName("sheettitle")
        lay.addWidget(title)
        lay.addSpacing(4)
        sub = QLabel(f"You're on v{current}. Here's what's new:")
        sub.setObjectName("fieldlbl")
        lay.addWidget(sub)
        lay.addSpacing(12)

        notes = QTextBrowser()
        notes.setOpenExternalLinks(True)
        notes.setMinimumHeight(230)
        notes.setStyleSheet(
            f"QTextBrowser{{background:{self._v['panel']};color:{self._v['txt']};"
            f"border:1px solid {self._v['line']};border-radius:8px;padding:6px;}}")
        notes.setHtml(self._build_html(releases, self._v))
        lay.addWidget(notes, 1)
        lay.addSpacing(12)

        self.skip_cb = QCheckBox(f"Don't show this again for {latest}")
        lay.addWidget(self.skip_cb)
        lay.addSpacing(14)

        row = QHBoxLayout()
        close = textbtn(_tr("Close"), oid="btn")
        close.clicked.connect(self.reject)
        row.addWidget(close)
        row.addStretch(1)
        dlonly = textbtn(_tr("Download only"), "arrow-down-circle", oid="btn")
        dlonly.clicked.connect(lambda: self._choose(self.DOWNLOAD_ONLY))
        row.addWidget(dlonly)
        install = textbtn(_tr("Download & install"), "arrow-down-circle", oid="btnprimary")
        install.clicked.connect(lambda: self._choose(self.DOWNLOAD_INSTALL))
        if not can_install:
            install.setToolTip("In-place install needs a frozen Linux/Windows build "
                               "— use Download only here.")
        row.addWidget(install)
        lay.addLayout(row)

    def _choose(self, action):
        self.action = action
        self.accept()

    @staticmethod
    def _build_html(releases, v=None):
        import html, re
        v = v or DARK
        def md(s):                       # escape + light markdown (bold / `code`)
            s = html.escape(s)
            s = re.sub(r"\*\*(.+?)\*\*", r"<b>\1</b>", s)
            s = re.sub(r"`([^`]+)`", r"<code>\1</code>", s)
            return s
        # Semantic theme colors so the sections read well in BOTH themes.
        labels = [
            ("security", "Security Fixes", v["danger"]),
            ("new_features", "New Features", v["ok"]),
            ("bug_fixes", "Bug Fixes", v["warn"]),
            ("performance", "Performance", v["accent"]),
            ("improvements", "Improvements", v["accenth"]),
        ]
        parts = []
        for rel in releases:
            tag = html.escape(rel.get("tag_name", ""))
            body = rel.get("body", "") or ""
            secs = fc._classify_release_sections(body) if FC_OK else {}
            parts.append(f"<h3 style='margin:8px 0 2px'>{tag}</h3>")
            shown = False
            for key, label, color in labels:
                if secs.get(key):
                    shown = True
                    parts.append(f"<p style='margin:7px 0 1px;color:{color};"
                                 f"font-weight:600'>{label}</p><ul style='margin:0 0 4px 0'>")
                    for bullet in secs[key]:
                        parts.append("<li>" + md(bullet.lstrip("-").strip()) + "</li>")
                    parts.append("</ul>")
            if not shown:
                raw = md(body.strip()[:800]) or "No release notes."
                parts.append(f"<p style='white-space:pre-wrap'>{raw}</p>")
        return "<div style='font-size:13px;line-height:1.4'>" + "".join(parts) + "</div>"


class _ConfirmHostKeyPolicy:
    """paramiko host-key policy: instead of silently auto-adding an unknown host
    key (a MITM risk), prompt the user to verify the fingerprint — OpenSSH-style
    TOFU. Known hosts are checked by paramiko before this runs, so a CHANGED key
    raises BadHostKeyException (rejected). SSH browsing connects on a listing
    worker, so the dialog is handed to the UI thread (parent._on_ui) and the
    worker waits for the answer. Declining raises SSHException (connection
    rejected)."""

    def __init__(self, parent, known_hosts_path):
        self.parent = parent
        self.known_hosts_path = known_hosts_path

    def missing_host_key(self, client, hostname, key):
        import paramiko
        import hashlib
        fp = "SHA256:" + base64.b64encode(
            hashlib.sha256(key.asbytes()).digest()).decode().rstrip("=")

        def ask():
            m = QMessageBox(self.parent)
            m.setWindowTitle(_tr("Unknown SSH host"))
            m.setIcon(QMessageBox.Warning)
            m.setText(f"The authenticity of host '{hostname}' can't be established.")
            m.setInformativeText(
                f"{key.get_name()} key fingerprint:\n{fp}\n\n"
                "Trust this host and save it to ~/.ssh/known_hosts?")
            trust = m.addButton("Trust", QMessageBox.AcceptRole)
            m.addButton("Cancel", QMessageBox.RejectRole)
            m.exec()
            return m.clickedButton() is trust

        on_ui = getattr(self.parent, "_on_ui", None)
        if not (on_ui(ask) if on_ui else ask()):
            raise paramiko.SSHException(
                f"Host key for {hostname} was not trusted by the user")
        # Trusted: accept for this session and append a single entry to known_hosts.
        client.get_host_keys().add(hostname, key.get_name(), key)
        try:
            os.makedirs(os.path.dirname(self.known_hosts_path), exist_ok=True)
            with open(self.known_hosts_path, "a", encoding="utf-8") as f:
                f.write(f"{hostname} {key.get_name()} {key.get_base64()}\n")
        except OSError:
            pass


# ───────────────────────────────────────────────────────── main window ──
class BlitcpGUI(QWidget):
    def __init__(self):
        super().__init__()
        self.dark = True       # dark is the default theme
        self.setWindowTitle("blitcp — " + GUI_VERSION)
        self.resize(1000, 780)

        # ── data model (mirrors the JS state) ──
        self.sources = [
            {"p": r"C:\projects\backups\data", "t": "Local"},
        ]
        self.dest_type = "Local"
        # One-off sign-in for a Web source (set from HttpAuthDialog). A saved
        # HTTP connection covers a host permanently; this covers a single run
        # and is deliberately never written to disk.
        self.http_auth = {}
        self._http_auth_host = ""        # host it was entered for
        # Demo fallback — replaced by the real credentials.json when blitcp.py
        # is available (see _init_credentials()).
        self._demo_conns = {
            "aws-dev": {"type": "s3", "access_key_id": "AKIAEXAMPLE7",
                        "secret_access_key": "wJalrXUtnFEMI", "region": "eu-central-1",
                        "container": "backups"},
            "r2-archive": {"type": "s3", "endpoint_url": "https://acct.r2.cloudflarestorage.com",
                           "access_key_id": "R2KEY123", "secret_access_key": "r2secretval"},
            "k3s-01": {"type": "ssh", "host": "k3s-01", "user": "deploy", "port": 22,
                       "key": "~/.ssh/id_ed25519", "path": "/data"},
        }
        self.conns = {}
        self.conn_state = {}
        self.exclude_patterns = [".venv", ".git*", "*.bat"]
        self.index_existing_paths = []
        self.running = False

        # ── credentials.json state ──
        self.creds_path = fc.default_credentials_path() if FC_OK else None
        self.creds_encrypted = False     # file on disk is AES-256-GCM
        self.creds_loaded = False        # real entries are in self.conns
        self.creds_pw = None             # cached passphrase (bytes) once unlocked
        self.creds_tamper = False        # file bound to a different blitcp.py

        # browse state
        self.browse_conn = None
        self.cwd = "/"
        self.selected_file = None
        self.local_home = os.path.expanduser("~")
        self._ssh_clients = {}           # name -> [SSHClient, SFTPClient|None]
        self._ssh_no_sftp = set()        # conns whose server has no SFTP subsystem
        # remote listings run on _ListWorker threads (never on the UI thread)
        self._on_ui = _OnUIThread()
        self._browse_seq = 0             # last listing request id handed out
        self._want_req = None            # the request the main browser waits for
        self._list_waiters = {}          # req -> (owner, callback)
        self._browse_workers = set()     # running _ListWorker threads
        self._browse_backends = {}       # name -> (fingerprint, backend, its lock)
        self._browse_locks = {}          # one listing per connection (SMB: per host)
        self._shown = None               # ((name, cwd), entries, err, total)
        self._sudo_pw = None             # cached sudo password for this session
        self._build_trees()

        self._build_ui()
        self.toast = Toast(self)
        self.apply_theme()

        self._init_credentials()
        self.render_sources()
        self.render_dest()
        self.render_conns()
        self.fill_conn_sel()
        self.render_browse()
        self.render_history()

    # ───────────────────────────────────────────── credentials.json ──
    def _init_credentials(self):
        """At startup: load an unencrypted file immediately; leave an encrypted
        one locked (unlocked on first visit to Connections). No blitcp.py or
        no file → fall back to the demo connections."""
        if not FC_OK or not self.creds_path or not os.path.isfile(self.creds_path):
            self.conns = dict(self._demo_conns)
            return
        try:
            raw = open(self.creds_path, "rb").read()
        except OSError:
            self.conns = dict(self._demo_conns)
            return
        if fc._is_encrypted(raw):
            self.creds_encrypted = True
            self.conns = {}              # locked until the user enters the passphrase
            # tamper check: the binary hash bound into the file (plaintext AAD)
            # vs this blitcp.py — visible even while locked.
            try:
                stored, cur = fc._stored_binhash(raw), fc._self_hash()
                self.creds_tamper = bool(stored and cur and stored != cur)
            except Exception:
                self.creds_tamper = False
        else:
            self.conns = self._parse_plain_creds(raw)
            self.creds_loaded = True

    def _parse_plain_creds(self, raw):
        import json
        try:
            data = json.loads(raw)
        except ValueError:
            return {}
        conns = data.get("connections", data) if isinstance(data, dict) else {}
        return conns if isinstance(conns, dict) else {}

    def unlock_credentials(self):
        """Prompt for the passphrase and load the real entries. No-op if already
        loaded or the file isn't encrypted."""
        if not FC_OK or self.creds_loaded or not self.creds_encrypted:
            return
        dlg = PasswordDialog(
            self, _tr("Unlock credentials.json"), "", _tr("Enter passphrase"))
        if not dlg.exec():
            return
        pw = dlg.input.text().encode("utf-8")
        try:
            raw = open(self.creds_path, "rb").read()
            conns, _ = fc.decrypt_conns(raw, pw)
        except SystemExit as e:
            self.show_toast(str(e).replace("Error: ", "").split(",")[0])
            return
        except Exception as e:
            self.show_toast(_tr("Could not read credentials:") + " " + str(e).splitlines()[0])
            return
        self.conns = conns if isinstance(conns, dict) else {}
        self.creds_pw = pw
        self.creds_loaded = True
        self.render_conns()
        self.fill_conn_sel()
        self.show_toast(f"Unlocked — {len(self.conns)} connection(s)")

    def reload_credentials(self):
        """Forget the cached passphrase and re-read the file from disk."""
        self.creds_loaded = False
        self.creds_pw = None
        self.conns = {}
        if FC_OK:
            fc._creds_cache.clear()
        self._init_credentials()
        if self.creds_encrypted and not self.creds_loaded:
            self.unlock_credentials()
        self.render_conns()
        self.fill_conn_sel()

    # ── trees for the browser ──
    def _build_trees(self):
        self.cloud_tree = {
            "/": [["database-dumps", "dir"], ["2026", "dir"], ["manifest.json", "12 KB"]],
            "/2026": [["q1", "dir"], ["q2", "dir"]],
            "/2026/q1": [["alpha-vbr-01.tar.gz", "4.2 GB"], ["artesca.img", "61 GB"]],
            "/database-dumps": [["piraeus-01.dump", "9.1 GB"], ["alpha-01.dump", "7.4 GB"]],
        }
        self.ssh_tree = {
            "/": [["data", "dir"], ["var", "dir"], ["home", "dir"]],
            "/data": [["backups", "dir"], ["dump-2026-01.tar.gz", "12 GB"]],
            "/data/backups": [["longhorn-replica.img", "61 GB"], ["pg-base.tar", "8 GB"]],
            "/var": [["log", "dir"], ["lib", "dir"]],
            "/var/log": [["syslog", "88 MB"], ["nginx.access", "210 MB"]],
            "/home": [["deploy", "dir"]],
            "/home/deploy": [[".ssh", "dir"], ["scripts", "dir"]],
        }
        self.local_tree = {
            "/": [["C:", "drive"], ["D:", "drive"], ["E:", "drive"]],
            "/C:": [["Users", "dir"], ["projects", "dir"]],
            "/C:/projects": [["backups", "dir"], ["blitcp", "dir"]],
            "/C:/projects/backups": [["2026", "dir"], ["db-2026-01.dump", "4.2 GB"], ["notes.txt", "3 KB"]],
            "/D:": [["archive", "dir"], ["Projects", "dir"]],
            "/D:/Projects": [["src.tar.gz", "820 MB"], ["node_modules", "dir"], ["README.md", "8 KB"]],
            "/E:": [["vmdumps", "dir"]],
            "/E:/vmdumps": [["images", "dir"], ["vol-001.img", "61 GB"]],
        }

    # ─────────────────────────────────────────────────────── UI build ──
    def _build_ui(self):
        self.setObjectName("root")
        root = QHBoxLayout(self)
        root.setContentsMargins(0, 0, 0, 0)
        root.setSpacing(0)
        root.addWidget(self._build_sidebar())

        # content area in a scroll
        self.stack = QStackedWidget()
        self.screens = {}
        for key, builder in [
            ("transfer", self._screen_transfer), ("connections", self._screen_connections),
            ("cloud", self._screen_cloud), ("history", self._screen_history),
            ("settings", self._screen_settings),
        ]:
            scroll = QScrollArea()
            scroll.setWidgetResizable(True)
            scroll.setFrameShape(QFrame.NoFrame)
            scroll.setHorizontalScrollBarPolicy(Qt.ScrollBarAlwaysOff)
            inner = QWidget()
            wrap = QVBoxLayout(inner)
            wrap.setContentsMargins(24, 22, 24, 22)
            builder(wrap)
            wrap.addStretch(1)
            scroll.setWidget(inner)
            self.stack.addWidget(scroll)
            self.screens[key] = self.stack.count() - 1
        root.addWidget(self.stack, 1)

    def _build_sidebar(self):
        side = QWidget()
        side.setObjectName("side")
        side.setFixedWidth(196)
        lay = QVBoxLayout(side)
        lay.setContentsMargins(0, 0, 0, 0)
        lay.setSpacing(0)

        # brand
        brand = QHBoxLayout()
        brand.setContentsMargins(14, 16, 10, 16)
        brand.setSpacing(8)
        logo_png = os.path.join(HERE, "assets", "blitcp-logo.png")
        if os.path.exists(logo_png):
            # exact wordmark supplied by the user — show it as a single lockup
            from PySide6.QtGui import QPixmap
            logo = QLabel()
            logo.setObjectName("brandWordmark")
            pm = QPixmap(logo_png)
            logo.setPixmap(pm.scaledToHeight(26, Qt.SmoothTransformation))
            ver = QLabel(GUI_VERSION)
            ver.setObjectName("brandVer")
            brand.addWidget(logo)
            brand.addStretch(1)
            brand.addWidget(ver)
        else:
            logo = QLabel(ic("bolt"))
            logo.setObjectName("brandLogo")
            logo.setFont(QFont(ICON_FAMILY, 18))
            nm = QLabel(_tr("BLITCP"))
            nm.setObjectName("brandName")
            brand.addWidget(logo)
            brand.addWidget(nm)
            brand.addStretch(1)
        lay.addLayout(brand)

        # nav
        nav = QVBoxLayout()
        nav.setContentsMargins(10, 6, 10, 6)
        nav.setSpacing(2)
        self.nav_items = {}
        items = [
            ("transfer", "arrows-exchange", _tr("Transfer")),
            ("connections", "key", _tr("Connections")),
            ("cloud", "folders", _tr("Browse files")),
            ("history", "history", _tr("History")),
            ("settings", "settings", _tr("Settings")),
        ]
        for key, icon, label in items:
            b = QPushButton("   " + ic(icon) + "    " + label)
            b.setObjectName("navitem")
            b.setCursor(Qt.PointingHandCursor)
            b.setProperty("active", key == "transfer")
            b.clicked.connect(lambda _=False, k=key: self.navigate(k))
            self.nav_items[key] = b
            nav.addWidget(b)
        lay.addLayout(nav)
        lay.addStretch(1)

        self.doc_btn = QPushButton("  " + ic("book") + "   " + _tr("Documentation"))
        self.doc_btn.setObjectName("themebtn")
        self.doc_btn.setCursor(Qt.PointingHandCursor)
        self.doc_btn.clicked.connect(self.open_docs)
        wrap1 = QHBoxLayout()
        wrap1.setContentsMargins(10, 0, 10, 10)
        wrap1.addWidget(self.doc_btn)
        lay.addLayout(wrap1)

        self.theme_btn = QPushButton(
            "  " + (ic("sun") + "   " + _tr("Light mode") if self.dark
                    else ic("moon") + "   " + _tr("Dark mode")))
        self.theme_btn.setObjectName("themebtn")
        self.theme_btn.setCursor(Qt.PointingHandCursor)
        self.theme_btn.clicked.connect(self.toggle_theme)
        wrap2 = QHBoxLayout()
        wrap2.setContentsMargins(10, 0, 10, 10)
        wrap2.addWidget(self.theme_btn)
        lay.addLayout(wrap2)

        foot = QLabel("block-order copy · dedup\nssh · s3 / az / gs")
        foot.setObjectName("sfoot")
        fwrap = QHBoxLayout()
        fwrap.setContentsMargins(16, 12, 16, 14)
        fwrap.addWidget(foot)
        lay.addLayout(fwrap)
        return side

    # ── small header helper ──
    def _header(self, lay, title, sub):
        h = QLabel(title)
        h.setObjectName("h2")
        lay.addWidget(h)
        s = QLabel(sub)
        s.setObjectName("sub")
        s.setWordWrap(True)
        lay.addWidget(s)
        lay.addSpacing(14)

    # ───────────────────────────────────────────── TRANSFER screen ──
    def _screen_transfer(self, lay):
        self._header(lay, _tr("New transfer"),
                     _tr("Many sources → one destination. With more than one "
                         "source, local only."))

        # sources label + multi pill
        lblrow = QHBoxLayout()
        srclbl = QLabel(_tr("SOURCES"))
        srclbl.setObjectName("lbl")
        self.multi_pill = QLabel(ic("folder") + " " + _tr("local only when multiple"))
        self.multi_pill.setObjectName("pill")
        self.multi_pill.hide()
        lblrow.addWidget(srclbl)
        lblrow.addSpacing(8)
        srchint = QLabel(_tr("example — edit before running"))
        srchint.setObjectName("sub")
        lblrow.addWidget(srchint)
        lblrow.addSpacing(8)
        lblrow.addWidget(self.multi_pill)
        lblrow.addStretch(1)
        lay.addLayout(lblrow)
        lay.addSpacing(8)

        self.sources_box = QVBoxLayout()
        self.sources_box.setSpacing(8)
        lay.addLayout(self.sources_box)

        add = textbtn(ic("plus") + " " + _tr("Add source"), oid="add")
        add.setCursor(Qt.PointingHandCursor)
        add.clicked.connect(self.add_source)
        lay.addWidget(add)
        lay.addSpacing(4)

        self.warn_wrap = QVBoxLayout()
        lay.addLayout(self.warn_wrap)

        arrow = QLabel(ic("arrow-down"))
        arrow.setObjectName("arrow")
        arrow.setAlignment(Qt.AlignCenter)
        lay.addWidget(arrow)
        lay.addSpacing(6)

        # destination
        drow = QHBoxLayout()
        dl = QLabel(_tr("DESTINATION"))
        dl.setObjectName("lbl")
        dh = QLabel(_tr("single · local / SSH / cloud"))
        dh.setObjectName("sub")
        drow.addWidget(dl)
        drow.addSpacing(8)
        drow.addWidget(dh)
        drow.addSpacing(8)
        dhint = QLabel(_tr("example — edit before running"))
        dhint.setObjectName("sub")
        drow.addWidget(dhint)
        drow.addStretch(1)
        lay.addLayout(drow)
        lay.addSpacing(8)

        self.dst_row = QFrame()
        self.dst_row.setObjectName("row")
        self.dst_row.setFixedHeight(42)
        dlay = QHBoxLayout(self.dst_row)
        dlay.setContentsMargins(12, 0, 9, 0)
        dlay.setSpacing(9)
        self.dst_icon = ClickLabel(ic("folder"))
        self.dst_icon.setObjectName("rowicon")
        self.dst_icon.setCursor(Qt.PointingHandCursor)
        self.dst_icon.setToolTip(_tr("Browse…"))
        self.dst_icon.clicked.connect(self.browse_dest_path)
        self.dst_input = QLineEdit("F:\\consolidated\\")
        self.dst_input.setObjectName("path")
        self.dst_input.editingFinished.connect(self._normalize_dest)
        dlay.addWidget(self.dst_icon)
        dlay.addWidget(self.dst_input, 1)
        self.dst_tags = {}
        for k in ("Local", "SSH", "Cloud"):
            t = QPushButton(_tr(k))
            t.setObjectName("tag")
            t.setCursor(Qt.PointingHandCursor)
            t.setProperty("state", "on" if k == "Local" else "off")
            t.clicked.connect(lambda _=False, key=k: self.set_dest_type(key))
            self.dst_tags[k] = t
            dlay.addWidget(t)
        lay.addWidget(self.dst_row)
        lay.addSpacing(8)

        # options row
        opts = QHBoxLayout()
        opts.setSpacing(8)
        self.transfer_opts = {}
        for name, active in [("dedup", True), ("verify", True)]:
            o = self._opt(_tr(name), active)
            self.transfer_opts[name] = o
            opts.addWidget(o)
        hlbl = QLabel(_tr("hash"))
        hlbl.setObjectName("optlbl")
        opts.addWidget(hlbl)
        self.hash_sel = QComboBox()
        self.hash_sel.setObjectName("mini")
        self.hash_sel.addItems(["auto", "xxh128", "sha256"])
        self.hash_sel.setCurrentText("xxh128")
        opts.addWidget(self.hash_sel)
        tlbl = QLabel(_tr("threads"))
        tlbl.setObjectName("optlbl")
        opts.addWidget(tlbl)
        self.thread_sel = QComboBox()
        self.thread_sel.setObjectName("mini")
        # "auto" = let the CLI size from the CPU (logical processors,
        # floor 4 / cap 16). Explicit numbers are for experimentation —
        # SSD/SSH/cloud destinations reward 32+, USB HDDs don't.
        self.thread_sel.addItems(["auto", "2", "4", "8", "16", "32", "64", "128"])
        self.thread_sel.setCurrentText("auto")
        opts.addWidget(self.thread_sel)
        opts.addStretch(1)
        self.adv_toggle = self._opt(ic("adjustments") + " " + _tr("Advanced"), False)
        self.adv_toggle.clicked.disconnect()
        self.adv_toggle.clicked.connect(self.toggle_advanced)
        opts.addWidget(self.adv_toggle)
        lay.addSpacing(7)
        lay.addLayout(opts)
        lay.addSpacing(11)

        # advanced panel
        self.adv = self._build_advanced()
        self.adv.hide()
        lay.addWidget(self.adv)
        lay.addSpacing(7)

        # actions
        actions = QHBoxLayout()
        actions.setSpacing(9)
        self.start_btn = textbtn(_tr("Start transfer"), "player-play", oid="btnprimary")
        self.start_btn.clicked.connect(lambda: self.run_transfer(False))
        self.preview_btn = textbtn(_tr("Preview plan"), "eye", oid="btn")
        self.preview_btn.clicked.connect(lambda: self.run_transfer(True))
        actions.addWidget(self.start_btn, 1)
        actions.addWidget(self.preview_btn)
        lay.addLayout(actions)
        lay.addSpacing(11)

        # progress panel
        lay.addWidget(self._build_progress())

    def _opt(self, text, active):
        o = QPushButton(text)
        o.setObjectName("opt")
        o.setCursor(Qt.PointingHandCursor)
        o.setProperty("active", active)
        o.clicked.connect(lambda: self._toggle_opt(o))
        return o

    def _toggle_opt(self, o):
        o.setProperty("active", not o.property("active"))
        repolish(o)

    def _build_advanced(self):
        adv = QFrame()
        adv.setObjectName("adv")
        lay = QVBoxLayout(adv)
        lay.setContentsMargins(16, 16, 16, 16)
        lay.setSpacing(0)

        lay.addWidget(self._gl(_tr("COPY")))
        lay.addSpacing(9)
        grid = QGridLayout()
        grid.setHorizontalSpacing(15)
        grid.setVerticalSpacing(5)
        grid.addWidget(self._advlbl(_tr("Buffer (MB)")), 0, 0)
        grid.addWidget(self._advlbl(_tr("Cloud concurrency")), 0, 1)
        grid.addWidget(self._advlbl(_tr("SSH chunk (MB)")), 0, 2)
        grid.addWidget(self._advlbl(_tr("Small files")), 0, 3)
        self.buf_input = QLineEdit("64")
        self.buf_input.setObjectName("advinput")
        self.conc_input = QLineEdit("16")
        self.conc_input.setObjectName("advinput")
        self.chunk_input = QLineEdit("100")
        self.chunk_input.setObjectName("advinput")
        self.chunk_input.setToolTip(_tr("Tar batch size for SSH (--ssh-no-sftp) "
                                        "transfers. Not the same as Buffer."))
        self.small_sel = QComboBox()
        self.small_sel.setObjectName("mini")
        self.small_sel.addItems([_tr("parallel workers"), _tr("stream")])
        self.small_sel.setToolTip(_tr("How <1MB files are copied on local "
                                      "transfers: a parallel worker pool "
                                      "(default, fastest) or the classic "
                                      "single-threaded tar block-stream."))
        grid.addWidget(self.buf_input, 1, 0)
        grid.addWidget(self.conc_input, 1, 1)
        grid.addWidget(self.chunk_input, 1, 2)
        grid.addWidget(self.small_sel, 1, 3)
        lay.addLayout(grid)
        lay.addSpacing(16)

        lay.addWidget(self._gl(_tr("PRESERVE METADATA")))
        lay.addSpacing(9)
        meta = QHBoxLayout()
        meta.setSpacing(8)
        self.meta_opts = {}
        for name, active in [("mode", True), ("times", True), ("owner", False),
                             ("xattr", False), ("acl", False)]:
            o = self._opt(_tr(name), active)
            self.meta_opts[name] = o
            meta.addWidget(o)
        meta.addStretch(1)
        lay.addLayout(meta)
        lay.addSpacing(16)

        lay.addWidget(self._gl(_tr("FLAGS")))
        lay.addSpacing(9)
        flags = QHBoxLayout()
        flags.setSpacing(8)
        self.flag_opts = {}
        for name in ["overwrite all", "force", "no hash cache", "--use-sudo",
                     "dedup existing", "include node_modules"]:
            o = self._opt(_tr(name), False)
            self.flag_opts[name] = o
            flags.addWidget(o)
        flags.addStretch(1)
        lay.addLayout(flags)
        lay.addSpacing(15)

        lay.addWidget(self._gl(_tr("EXCLUDE PATTERNS")))
        lay.addSpacing(9)
        self.chips_frame = QFrame()
        self.chips_frame.setObjectName("chips")
        self.chips_lay = QHBoxLayout(self.chips_frame)
        self.chips_lay.setContentsMargins(11, 9, 11, 9)
        self.chips_lay.setSpacing(7)
        lay.addWidget(self.chips_frame)
        self.render_chips()
        lay.addSpacing(15)

        lay.addWidget(self._gl(_tr("INDEX EXISTING (reflink dedup vs pre-existing files)")))
        lay.addSpacing(9)
        self.idx_chips_frame = QFrame()
        self.idx_chips_frame.setObjectName("chips")
        self.idx_chips_lay = QHBoxLayout(self.idx_chips_frame)
        self.idx_chips_lay.setContentsMargins(11, 9, 11, 9)
        self.idx_chips_lay.setSpacing(7)
        lay.addWidget(self.idx_chips_frame)
        self.render_idx_chips()
        return adv

    def _gl(self, text):
        l = QLabel(text)
        l.setObjectName("gl")
        return l

    def _advlbl(self, text):
        l = QLabel(text)
        l.setObjectName("advlbl")
        return l

    def render_chips(self):
        while self.chips_lay.count():
            item = self.chips_lay.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        for pat in self.exclude_patterns:
            chip = QFrame()
            chip.setObjectName("chip")
            cl = QHBoxLayout(chip)
            cl.setContentsMargins(9, 4, 7, 4)
            cl.setSpacing(5)
            txt = QLabel(pat)
            txt.setObjectName("chiptext")
            x = QPushButton(ic("x"))
            x.setObjectName("chipx")
            x.setCursor(Qt.PointingHandCursor)
            x.clicked.connect(lambda _=False, p=pat: self.remove_chip(p))
            cl.addWidget(txt)
            cl.addWidget(x)
            self.chips_lay.addWidget(chip)
        add = QPushButton(_tr("+ add…"))
        add.setObjectName("chipadd")
        add.setCursor(Qt.PointingHandCursor)
        add.clicked.connect(self.add_chip)
        self.chips_lay.addWidget(add)
        self.chips_lay.addStretch(1)

    def remove_chip(self, pat):
        if pat in self.exclude_patterns:
            self.exclude_patterns.remove(pat)
            self.render_chips()

    def add_chip(self):
        dlg = TextPromptDialog(self, "Exclude pattern")
        if dlg.exec() and dlg.input.text().strip():
            self.exclude_patterns.append(dlg.input.text().strip())
            self.render_chips()

    def render_idx_chips(self):
        while self.idx_chips_lay.count():
            item = self.idx_chips_lay.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        for path in self.index_existing_paths:
            chip = QFrame()
            chip.setObjectName("chip")
            cl = QHBoxLayout(chip)
            cl.setContentsMargins(9, 4, 7, 4)
            cl.setSpacing(5)
            txt = QLabel(path)
            txt.setObjectName("chiptext")
            txt.setToolTip(path)
            x = QPushButton(ic("x"))
            x.setObjectName("chipx")
            x.setCursor(Qt.PointingHandCursor)
            x.clicked.connect(lambda _=False, p=path: self.remove_idx_path(p))
            cl.addWidget(txt)
            cl.addWidget(x)
            self.idx_chips_lay.addWidget(chip)
        add = QPushButton(_tr("+ add folder…"))
        add.setObjectName("chipadd")
        add.setCursor(Qt.PointingHandCursor)
        add.clicked.connect(self.add_idx_path)
        self.idx_chips_lay.addWidget(add)
        self.idx_chips_lay.addStretch(1)

    def remove_idx_path(self, path):
        if path in self.index_existing_paths:
            self.index_existing_paths.remove(path)
            self.render_idx_chips()

    def add_idx_path(self):
        # Must be a real directory on the destination filesystem; the engine
        # warns and skips any path not under the destination mount.
        d = QFileDialog.getExistingDirectory(self, "Index existing folder")
        if d and d not in self.index_existing_paths:
            self.index_existing_paths.append(d)
            self.render_idx_chips()

    def _build_progress(self):
        prog = QFrame()
        prog.setObjectName("prog")
        lay = QVBoxLayout(prog)
        lay.setContentsMargins(17, 17, 17, 17)
        lay.setSpacing(0)

        top = QHBoxLayout()
        self.pstate = QLabel(_tr("Ready"))
        self.pstate.setObjectName("pstate")
        self.pfiles = QLabel(_tr("0 / 0 files"))
        self.pfiles.setObjectName("pfiles")
        top.addWidget(self.pstate)
        top.addStretch(1)
        top.addWidget(self.pfiles)
        lay.addLayout(top)
        lay.addSpacing(11)

        self.bar = QFrame()
        self.bar.setObjectName("bar")
        self.bar.setFixedHeight(9)
        barlay = QHBoxLayout(self.bar)
        barlay.setContentsMargins(0, 0, 0, 0)
        self.barf = QFrame()
        self.barf.setObjectName("barf")
        self.barf.setFixedWidth(0)
        barlay.addWidget(self.barf)
        barlay.addStretch(1)
        # Indeterminate "breathing" pulse for phases with no known total (the
        # existing-files indexing walk doesn't know its file count up front, so
        # a percentage bar would sit stuck at 0% — pulse instead of pretending).
        self._pulse = QTimer(self)
        self._pulse.setInterval(33)
        self._pulse.timeout.connect(self._pulse_tick)
        self._pulse_x = 0.0
        lay.addWidget(self.bar)
        lay.addSpacing(15)

        stats = QGridLayout()
        stats.setHorizontalSpacing(11)
        self.stat_vals = {}
        cols = [("Progress", "0%", False), ("Speed", "—", True),
                ("ETA", "—", False), ("Dedup saved", "—", False)]
        for i, (k, v, okc) in enumerate(cols):
            kl = QLabel(_tr(k).upper())
            kl.setObjectName("statk")
            vl = QLabel(v)
            vl.setObjectName("statvok" if okc else "statv")
            stats.addWidget(kl, 0, i)
            stats.addWidget(vl, 1, i)
            self.stat_vals[k] = vl
        lay.addLayout(stats)
        # Current-file line: which file (or stage) the engine is writing right
        # now, with its own progress — so a multi-GB file doesn't look like a
        # frozen counter. Fed by the "current" fields of --progress-json.
        self.pcur = QLabel("")
        self.pcur.setObjectName("statk")
        lay.addSpacing(4)
        lay.addWidget(self.pcur)
        lay.addSpacing(9)

        self.log_box = QFrame()
        self.log_box.setObjectName("logbox")
        # Taller log so more copy lines + phase banners are visible; grows with
        # the window.
        self.log_box.setMinimumHeight(500)
        self.log_box.setSizePolicy(QSizePolicy.Preferred, QSizePolicy.Expanding)
        logwrap = QVBoxLayout(self.log_box)
        logwrap.setContentsMargins(0, 0, 0, 0)
        # One text view with a block cap, not a QLabel per line: an engine
        # that prints a line per file (refusals, unreadable names) grew the
        # GUI by ~20 KB a line until the OOM killer took it.
        self.log_view = QPlainTextEdit()
        self.log_view.setObjectName("logview")
        self.log_view.setReadOnly(True)
        self.log_view.setFrameShape(QFrame.NoFrame)
        self.log_view.setMaximumBlockCount(LOG_MAX_LINES)
        # Wrap instead of running off the panel. An engine error puts what to
        # do at the END of the line ("Fix: chmod go-w …"), and without this the
        # log showed the complaint and clipped the remedy.
        self.log_view.setLineWrapMode(QPlainTextEdit.LineWrapMode.WidgetWidth)
        self.log_view.setWordWrapMode(QTextOption.WrapMode.WrapAtWordBoundaryOrAnywhere)
        self.log_view.setHorizontalScrollBarPolicy(Qt.ScrollBarAlwaysOff)
        # A burst of lines arms one scroll-to-bottom, not one timer per line.
        self._log_scroll_timer = QTimer(self)
        self._log_scroll_timer.setSingleShot(True)
        self._log_scroll_timer.setInterval(0)
        self._log_scroll_timer.timeout.connect(
            lambda: self.log_view.verticalScrollBar().setValue(
                self.log_view.verticalScrollBar().maximum()))
        logwrap.addWidget(self.log_view)
        lay.addWidget(self.log_box)
        return prog

    # ───────────────────────────────────────── CONNECTIONS screen ──
    def _screen_connections(self, lay):
        self._header(lay, _tr("Connections"),
                     _tr("Read from / saved to credentials.json. Double-click "
                         "to edit."))
        addrow = QHBoxLayout()
        addrow.addStretch(1)
        self.reload_btn = textbtn(_tr("Reload"), "refresh", oid="btnsm")
        self.reload_btn.clicked.connect(self.reload_credentials)
        self.rekey_btn = textbtn(_tr("Rekey"), "key", oid="btnsm")
        self.rekey_btn.clicked.connect(self.rekey_credentials)
        addc = textbtn(_tr("Add connection"), "plus", oid="btnsmprimary")
        addc.clicked.connect(lambda: self.open_conn_modal(None))
        addrow.addWidget(self.reload_btn)
        addrow.addWidget(self.rekey_btn)
        addrow.addWidget(addc)
        lay.addLayout(addrow)
        lay.addSpacing(8)

        # banner: locked / loaded / demo status
        self.creds_banner = QVBoxLayout()
        lay.addLayout(self.creds_banner)

        cl = QLabel(_tr("CLOUD"))
        cl.setObjectName("sectl")
        lay.addWidget(cl)
        lay.addSpacing(8)
        self.cloud_conns = QVBoxLayout()
        self.cloud_conns.setSpacing(9)
        lay.addLayout(self.cloud_conns)
        lay.addSpacing(8)

        sl = QLabel(_tr("SSH"))
        sl.setObjectName("sectl")
        lay.addWidget(sl)
        lay.addSpacing(8)
        self.ssh_conns = QVBoxLayout()
        self.ssh_conns.setSpacing(9)
        lay.addLayout(self.ssh_conns)

    # ───────────────────────────────────────────── CLOUD/browse screen ──
    def _screen_cloud(self, lay):
        self._header(lay, _tr("Browse files"),
                     _tr("Folder = navigate · file = click to select · "
                         "double-click = set as source."))
        self.conn_sel = QComboBox()
        self.conn_sel.setObjectName("mini")
        self.conn_sel.setMinimumHeight(34)
        self.conn_sel.currentIndexChanged.connect(self.on_conn_sel)
        lay.addWidget(self.conn_sel)
        lay.addSpacing(12)

        self.crumb = QFrame()
        self.crumb.setObjectName("crumb")
        self.crumb_lay = QHBoxLayout(self.crumb)
        self.crumb_lay.setContentsMargins(12, 9, 12, 9)
        self.crumb_lay.setSpacing(7)
        lay.addWidget(self.crumb)
        lay.addSpacing(12)

        self.files_box = QVBoxLayout()
        self.files_box.setSpacing(6)
        lay.addLayout(self.files_box)
        lay.addSpacing(14)

        bts = QHBoxLayout()
        bts.setSpacing(9)
        setsrc = textbtn(_tr("Set as source"), "arrow-down-circle", oid="btn")
        setsrc.clicked.connect(self.browse_set_source)
        setdst = textbtn(_tr("Set as destination"), "arrow-up-circle", oid="btn")
        setdst.clicked.connect(self.browse_set_dest)
        bts.addWidget(setsrc, 1)
        bts.addWidget(setdst, 1)
        lay.addLayout(bts)

    # ───────────────────────────────────────────── HISTORY screen ──
    def _screen_history(self, lay):
        self._header(lay, _tr("History"),
                     _tr("Past transfers from the saved JSON logs."))
        self.history_box = QVBoxLayout()
        self.history_box.setSpacing(9)
        lay.addLayout(self.history_box)

    # ───────────────────────────────────────────── SETTINGS screen ──
    def _screen_settings(self, lay):
        self._header(lay, _tr("Settings"),
                     _tr("Language, dependencies, version, updates."))

        ll = QLabel(_tr("LANGUAGE"))
        ll.setObjectName("sectl")
        lay.addWidget(ll)
        lay.addSpacing(8)
        lang_card = QFrame()
        lang_card.setObjectName("conn")
        lcl = QHBoxLayout(lang_card)
        lcl.setContentsMargins(14, 12, 14, 12)
        lcl.setSpacing(13)
        lic = QLabel(ic("world"))
        lic.setObjectName("connicon")
        llab = QLabel(_tr("Interface language"))
        llab.setObjectName("connname")
        self.lang_sel = QComboBox()
        self.lang_sel.setObjectName("mini")
        for code, native in I18N_CHOICES:
            self.lang_sel.addItem(native, code)
        saved_lang = self._load_gui_settings().get("language", "en")
        idx = next((i for i, (c, _n) in enumerate(I18N_CHOICES)
                    if c == saved_lang), 0)
        self.lang_sel.setCurrentIndex(idx)
        self.lang_sel.currentIndexChanged.connect(self._on_language_changed)
        lcl.addWidget(lic)
        lcl.addWidget(llab, 1)
        lcl.addWidget(self.lang_sel)
        lay.addWidget(lang_card)
        lay.addSpacing(14)

        dl = QLabel(_tr("DEPENDENCIES"))
        dl.setObjectName("sectl")
        lay.addWidget(dl)
        lay.addSpacing(8)
        # (icon, label, meta, [import names], [pip specs]) — checked live
        deps = [
            ("brand-python", "paramiko", "SSH transfers",
             ["paramiko"], ["paramiko"]),
            ("bolt", "xxhash", "~10× faster hashing",
             ["xxhash"], ["xxhash"]),
            ("cloud", "boto3 / azure / gcs", "object storage backends",
             ["boto3", "azure.storage.blob", "google.cloud.storage"],
             ["boto3", "azure-storage-blob", "google-cloud-storage"]),
        ]
        self._dep_box = QVBoxLayout()
        self._dep_box.setSpacing(9)
        lay.addLayout(self._dep_box)
        self._dep_specs = deps
        self._render_deps()

        vl = QLabel(_tr("VERSION"))
        vl.setObjectName("sectl")
        lay.addWidget(vl)
        lay.addSpacing(8)
        card = QFrame()
        card.setObjectName("conn")
        cl = QHBoxLayout(card)
        cl.setContentsMargins(14, 12, 14, 12)
        cl.setSpacing(13)
        cic = QLabel(ic("arrows-exchange"))
        cic.setObjectName("connicon")
        col = QVBoxLayout()
        col.setSpacing(2)
        nm = QLabel("blitcp " + GUI_VERSION)
        nm.setObjectName("connname")
        mt = QLabel(GUI_REPO)
        mt.setObjectName("connmeta")
        sp = QLabel(_tr("Support development: {url}").format(url=SUPPORT_URL + " · " + SUPPORT_URL_ALT))
        sp.setObjectName("connmeta")
        sp.setTextInteractionFlags(Qt.TextSelectableByMouse)
        col.addWidget(nm)
        col.addWidget(mt)
        col.addWidget(sp)
        cl.addWidget(cic)
        cl.addLayout(col, 1)
        self.upd_btn = textbtn(_tr("Check for updates"), oid="btnsm")
        self.upd_btn.clicked.connect(self._update_btn_clicked)
        cl.addWidget(self.upd_btn)
        lay.addWidget(card)

        # Automatic checks are the user's call, not ours. The engine stores the
        # same answer in settings.json, so saying yes here also settles the
        # question the CLI would otherwise ask on its next interactive run.
        self.auto_upd_cb = QCheckBox(
            _tr("Check for updates automatically, once a day"))
        self.auto_upd_cb.setChecked(_engine_auto_update_enabled())
        self.auto_upd_cb.toggled.connect(_set_engine_auto_update)
        lay.addSpacing(6)
        lay.addWidget(self.auto_upd_cb)

    @staticmethod
    def _have_module(name):
        import importlib.util
        try:
            return importlib.util.find_spec(name) is not None
        except Exception:
            return False

    def _render_deps(self):
        # clear and rebuild the dependency cards (called on open + after install)
        while self._dep_box.count():
            it = self._dep_box.takeAt(0)
            w = it.widget()
            if w:
                w.deleteLater()
        for icon, name, meta, imports, pips in self._dep_specs:
            have = [m for m in imports if self._have_module(m)]
            missing = [pips[i] for i, m in enumerate(imports) if not self._have_module(m)]
            self._dep_box.addWidget(self._dep_card(icon, name, meta, len(have),
                                                   len(imports), missing))

    def _dep_card(self, icon, name, meta, n_have, n_total, missing):
        card = QFrame()
        card.setObjectName("conn")
        outer = QVBoxLayout(card)
        outer.setContentsMargins(14, 12, 14, 12)
        outer.setSpacing(8)
        row = QHBoxLayout()
        row.setSpacing(13)
        cic = QLabel(ic(icon))
        cic.setObjectName("connicon")
        col = QVBoxLayout()
        col.setSpacing(2)
        nm = QLabel(name)
        nm.setObjectName("connname")
        mt = QLabel(meta)
        mt.setObjectName("connmeta")
        col.addWidget(nm)
        col.addWidget(mt)
        if not missing:
            b = QLabel(ic("check") + " installed")
            b.setObjectName("badgeok")
        elif n_have == 0:
            b = QLabel(_tr("not installed"))
            b.setObjectName("badgeidle")
        else:
            b = QLabel(f"partial · {n_have}/{n_total}")
            b.setObjectName("badgeidle")
        row.addWidget(cic)
        row.addLayout(col, 1)
        row.addWidget(b)
        outer.addLayout(row)
        if missing:
            cmd = "python -m pip install " + " ".join(missing)
            crow = QHBoxLayout()
            crow.setSpacing(8)
            cmd_lbl = QLineEdit(cmd)
            cmd_lbl.setReadOnly(True)
            cmd_lbl.setObjectName("path")
            cmd_lbl.setCursor(Qt.IBeamCursor)
            crow.addWidget(cmd_lbl, 1)
            btn = textbtn(_tr("Install"), oid="btnsm")
            btn.clicked.connect(lambda _=False, m=list(missing): self._pip_install_deps(m))
            crow.addWidget(btn)
            outer.addLayout(crow)
        return card

    # ───────────────────────────────── core engine (blitcp.py) ──
    def _ensure_core(self):
        """If the GUI was launched WITHOUT blitcp.py next to it (and isn't a
        bundled build), offer to download the version that matches this GUI."""
        if FC_OK or getattr(sys, "frozen", False):
            return
        m = QMessageBox(self)
        m.setWindowTitle(_tr("Core engine missing"))
        m.setIcon(QMessageBox.Warning)
        m.setText(_tr("blitcp.py (the copy engine) was not found next to the GUI."))
        m.setInformativeText(
            f"The GUI needs it to run transfers. Download the matching "
            f"version (v{_GUI_PIN}) from {GUI_REPO}?")
        dl = m.addButton("Download v" + _GUI_PIN, QMessageBox.AcceptRole)
        m.addButton("Not now", QMessageBox.RejectRole)
        m.exec()
        if m.clickedButton() is dl:
            self._download_core()

    def _download_core(self):
        import urllib.request
        self.show_toast(_tr("Downloading blitcp.py") + " v" + _GUI_PIN + " …")
        QApplication.processEvents()
        base = "https://raw.githubusercontent.com/" + GUI_REPO
        # blitcp.py on current tags; blitcp.py covers pre-rename tags.
        urls = [base + "/v" + _GUI_PIN + "/blitcp.py",
                base + "/" + _GUI_PIN + "/blitcp.py",
                base + "/main/blitcp.py",
                base + "/v" + _GUI_PIN + "/fast_copy.py",
                base + "/main/fast_copy.py"]
        dest = os.path.join(HERE, "blitcp.py")
        err = "no source reachable"
        for u in urls:
            try:
                with urllib.request.urlopen(u, timeout=25) as r:
                    data = r.read()
                if b"__version__" in data and b"def main" in data:
                    with open(dest, "wb") as f:
                        f.write(data)
                    self._core_downloaded(dest)
                    return
                err = "unexpected file contents"
            except Exception as e:
                err = str(e)
        QMessageBox.critical(self, _tr("Download failed"),
                             _tr("Could not download blitcp.py:") + "\n" + err +
                             "\n\nGet it manually from:\n"
                             "https://github.com/" + GUI_REPO + "/releases")

    def _core_downloaded(self, dest):
        m = QMessageBox(self)
        m.setWindowTitle(_tr("Core engine installed"))
        m.setIcon(QMessageBox.Information)
        m.setText("Downloaded blitcp.py to:\n" + dest)
        m.setInformativeText("Restart the GUI to load it now?")
        r = m.addButton("Restart now", QMessageBox.AcceptRole)
        m.addButton("Later", QMessageBox.RejectRole)
        m.exec()
        if m.clickedButton() is r:
            QProcess.startDetached(sys.executable, [os.path.abspath(__file__)])
            self.close()

    def _pip_install_deps(self, specs):
        """Install the missing pip packages into the running interpreter, then
        refresh the dependency panel."""
        if getattr(sys, "frozen", False):
            # In the packaged (PyInstaller) build, sys.executable is THIS app,
            # not a Python interpreter — running it with "-m pip install" just
            # relaunches the GUI in a second window, and a frozen process can't
            # import packages added at runtime anyway. Explain instead of
            # spawning another window.
            cmd = "pip install " + " ".join(specs)
            try:
                QApplication.clipboard().setText(cmd)
                copied = "\n\n(The command was copied to your clipboard.)"
            except Exception:
                copied = ""
            m = QMessageBox(self)
            m.setWindowTitle(_tr("Can't install into the packaged app"))
            m.setIcon(QMessageBox.Information)
            m.setText("This standalone blitcp build can't add Python "
                      "packages to itself at runtime.")
            m.setInformativeText(
                "To use these optional integrations, run blitcp from the "
                "Python source and install them into that environment:\n\n  "
                + cmd + copied)
            m.exec()
            return
        if getattr(self, "_pip_proc", None) is not None:
            self.show_toast(_tr("Install already running…"))
            return
        self.show_toast(_tr("Installing") + " " + ", ".join(specs) + " …")
        proc = QProcess(self)
        self._pip_proc = proc

        def _done(*_):
            ok = (proc.exitCode() == 0)
            self.show_toast(_tr("Installed ✓") if ok else _tr("Install failed — see terminal"))
            self._pip_proc = None
            self._render_deps()
            proc.deleteLater()
        proc.finished.connect(_done)
        proc.setProgram(sys.executable)
        proc.setArguments(["-m", "pip", "install", *specs])
        proc.start()

    # ─────────────────────────────────────────────────────── nav/theme ──
    def navigate(self, key):
        for k, b in self.nav_items.items():
            b.setProperty("active", k == key)
            repolish(b)
        self.stack.setCurrentIndex(self.screens[key])
        # First visit to Connections with an encrypted file → ask for the passphrase.
        if key == "connections" and self.creds_encrypted and not self.creds_loaded:
            QTimer.singleShot(60, self.unlock_credentials)
        # Refresh history each time it's opened so new runs show up.
        if key == "history":
            self.render_history()

    def toggle_theme(self):
        self.dark = not self.dark
        self.theme_btn.setText(
            "  " + (ic("sun") + "   " + _tr("Light mode") if self.dark
                    else ic("moon") + "   " + _tr("Dark mode")))
        self.apply_theme()

    def apply_theme(self):
        v = DARK if self.dark else LIGHT
        self.setStyleSheet(stylesheet(v))
        # progress bar fill gradient + barf color (needs explicit set)
        self.barf.setStyleSheet(
            f"background: qlineargradient(x1:0,y1:0,x2:1,y2:0,"
            f"stop:0 {v['accent']}, stop:1 {v['accenth']}); border-radius:5px;")

    def open_docs(self):
        import webbrowser
        # webbrowser takes no env; it spawns from os.environ, so swap it in
        # for the call (_host_env: the browser must not inherit our GIO hook).
        saved = dict(os.environ)
        os.environ.clear()
        os.environ.update(_host_env())
        try:
            webbrowser.open("https://blitcp.dev/#docs")
        finally:
            os.environ.clear()
            os.environ.update(saved)

    # ─────────────────────────────────────────────────────── sources ──
    def add_source(self):
        self.sources.append({"p": r"G:\new\folder" + str(len(self.sources)), "t": "Local"})
        self.render_sources()

    def render_sources(self):
        while self.sources_box.count():
            item = self.sources_box.takeAt(0)
            if item.widget():
                item.widget().deleteLater()

        multi = len(self.sources) > 1
        self.multi_pill.setVisible(multi)
        counts = {}
        for s in self.sources:
            b = base(s["p"])
            counts[b] = counts.get(b, 0) + 1

        for i, s in enumerate(self.sources):
            b = base(s["p"])
            dup = counts[b] > 1
            row = QFrame()
            row.setObjectName("row")
            row.setProperty("warn", dup)
            row.setFixedHeight(42)
            rl = QHBoxLayout(row)
            rl.setContentsMargins(12, 0, 9, 0)
            rl.setSpacing(9)
            icon = ClickLabel(ic(self._src_icon(s["t"])))
            icon.setObjectName("rowicon")
            icon.setCursor(Qt.PointingHandCursor)
            icon.setToolTip(_tr("Browse…"))
            icon.clicked.connect(lambda idx=i: self.browse_source_path(idx))
            rl.addWidget(icon)
            path = QLineEdit(s["p"])
            path.setObjectName("path")
            path.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
            path.editingFinished.connect(lambda le=path, idx=i: self.edit_source_path(idx, le.text()))
            rl.addWidget(path, 1)
            # Web is source-only — plain HTTP has no generic upload, so the
            # destination chips below stay Local/SSH/Cloud.
            for k in ("Local", "SSH", "Cloud", "Web"):
                rl.addWidget(self._src_tag(s, multi, k, i))
            rm = QPushButton(ic("x"))
            rm.setObjectName("rm")
            rm.setCursor(Qt.PointingHandCursor)
            rm.clicked.connect(lambda _=False, idx=i: self.remove_source(idx))
            rl.addWidget(rm)
            self.sources_box.addWidget(row)

        self._render_source_warnings(counts, multi)
        self._render_http_auth_bar()

    # ── http(s) source sign-in (cookies / browser session / header) ──
    @staticmethod
    def _url_host(url):
        try:
            return urllib.parse.urlsplit(url.strip()).hostname or ""
        except ValueError:                   # malformed URL, e.g. bad IPv6
            return ""

    def _web_source(self):
        """The single Web source URL, or "" when there is none."""
        for s in self.sources:
            if s["t"] == "Web" and s["p"].strip():
                return s["p"].strip()
        return ""

    def _match_http_conn(self, host):
        """Name of a saved HTTP connection for this host, if any. Mirrors the
        engine's host match (_http_creds_by_host), which is what actually
        applies the saved cookies/header."""
        if not host:
            return None
        for n, c in self.conns.items():
            if isinstance(c, dict) and c.get("type") == "http" \
                    and (c.get("host") or "").strip().lower() == host.lower():
                return n
        return None

    def _valid_http_auth(self, host):
        """The one-off sign-in, dropped if the URL has moved to another host.
        Cookies and a Bearer token belong to the host they were given for;
        replaying them at a different server is a leak, not a convenience."""
        if not self.http_auth or not host:
            return self.http_auth
        if not self._http_auth_host:
            # Entered before the URL was typed (the source field still held the
            # example path, say). Pin it to the first host it is seen with —
            # leaving it unpinned meant the guard below never fired, and the
            # token followed whatever host was pasted next.
            self._http_auth_host = host
        elif self._http_auth_host.lower() != host.lower():
            self.http_auth = {}
            self._http_auth_host = ""
        return self.http_auth

    def _http_auth_summary(self, host):
        bits = []
        a = self._valid_http_auth(host)
        if a.get("cookies"):
            bits.append((_tr("live session: ") if a.get("cookies_kind") == "browser"
                         else _tr("cookies file: ")) + a["cookies"])
        if a.get("user"):
            bits.append(a["user"] + ("+password" if a.get("password") else ""))
        if a.get("header"):
            bits.append(_tr("header"))
        if bits:
            return _tr("This run: ") + ", ".join(bits)
        saved = self._match_http_conn(host)
        if saved:
            return _tr("Using saved connection ") + f"'{saved}'"
        # Name the two things that work here. "No sign-in" alone told nobody
        # that a cookies.txt export or a live browser login is what goes in.
        return _tr("No sign-in yet — add cookies or a browser session if this "
                   "download needs a login")

    def _render_http_auth_bar(self):
        url = self._web_source()
        if not url:
            return
        host = self._url_host(url)
        bar = QFrame()
        bar.setObjectName("row")
        bar.setFixedHeight(42)
        bl = QHBoxLayout(bar)
        bl.setContentsMargins(12, 0, 9, 0)
        bl.setSpacing(9)
        ki = QLabel(ic("key"))
        ki.setObjectName("rowicon")
        bl.addWidget(ki)
        txt = QLabel(self._http_auth_summary(host))
        txt.setObjectName("connmeta" if self.http_auth else "warntext")
        txt.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
        bl.addWidget(txt, 1)
        btn = QPushButton(_tr("Cookies / sign-in…"))
        btn.setObjectName("tag")
        btn.setCursor(Qt.PointingHandCursor)
        # Always "on": an "off" tag reads as disabled, and this one is the only
        # route to the sign-in sheet — it has to look like something to press.
        btn.setProperty("state", "on")
        btn.setToolTip(_tr("Use a cookies.txt export or a live browser "
                           "session for this download"))
        btn.clicked.connect(self.open_http_auth)
        bl.addWidget(btn)
        self.warn_wrap.addWidget(bar)
        spacer = QWidget()
        spacer.setFixedHeight(4)
        self.warn_wrap.addWidget(spacer)

    def open_http_auth(self):
        url = self._web_source()
        dlg = HttpAuthDialog(self, self._url_host(url), dict(self.http_auth))
        if dlg.exec() and dlg.data is not None:
            self.http_auth = dlg.data
            self._http_auth_host = self._url_host(url)
            self.render_sources()

    def _http_auth_flags(self, url):
        """(extra_argv, env) for a Web source. Secrets go through the
        environment — a token or password in argv is readable by any other
        user via `ps`, which is why the SSH path does the same."""
        extra, env = [], {}
        a = self._valid_http_auth(self._url_host(url))
        if not a:
            return extra, env            # saved connection (if any) still applies
        kind = a.get("cookies_kind")
        if a.get("cookies"):
            extra += (["--cookies", a["cookies"]] if kind == "file"
                      else ["--cookies-from-browser", a["cookies"]])
        if a.get("user"):
            extra += ["--http-user", a["user"]]
            if a.get("password"):
                env["FC_HTTP_PW"] = a["password"]
                extra += ["--http-password-env", "FC_HTTP_PW"]
        if a.get("header"):
            env["FC_HTTP_HDR"] = a["header"]
            extra += ["--http-header-env", "FC_HTTP_HDR"]
        return extra, env

    def _src_tag(self, s, multi, k, idx):
        t = QPushButton(_tr(k))
        t.setObjectName("tag")
        t.setCursor(Qt.PointingHandCursor)
        if multi and k != "Local":
            t.setProperty("state", "dis")
            t.setEnabled(False)
        else:
            t.setProperty("state", "on" if s["t"] == k else "off")
            t.clicked.connect(lambda _=False, i=idx, key=k: self.set_source_type(i, key))
        return t

    def _src_icon(self, t):
        # NOTE: only the names in TI exist; anything else renders "?" (as
        # ic("world") on the language card already does).
        return ("folder" if t == "Local" else "server-2" if t == "SSH"
                else "arrow-down-circle" if t == "Web" else "cloud")

    def set_source_type(self, idx, k):
        self.sources[idx]["t"] = k
        self.render_sources()

    def edit_source_path(self, idx, text):
        if idx < len(self.sources):
            if self.sources[idx]["t"] == "Local":
                text = self._normalize_local(text)
            if self.sources[idx]["p"] != text:
                self.sources[idx]["p"] = text
                self.render_sources()

    @staticmethod
    def _normalize_local(path):
        """Local paths → native separator (e.g. E:/test3 → E:\\test3 on Windows).
        Leaves SSH (user@host:) and cloud (scheme://) paths untouched."""
        p = (path or "").strip()
        if not p or "://" in p or re.search(r"@[^/\\]+:", p):
            return path
        return p.replace("/", os.sep) if os.sep != "/" else p

    def _normalize_dest(self):
        if self.dest_type == "Local":
            norm = self._normalize_local(self.dst_input.text())
            if norm != self.dst_input.text():
                self.dst_input.setText(norm)

    def _conns_of_kind(self, kind):
        """Names of loaded connections matching a browse kind ('ssh'/'cloud')."""
        wanted = ("ssh",) if kind == "ssh" else ("s3", "az", "gs")
        return [n for n, c in self.conns.items()
                if isinstance(c, dict) and c.get("type") in wanted]

    def _match_conn(self, kind, path):
        """Best-effort: pre-select the connection a typed remote path refers to."""
        if kind == "ssh":
            m = re.match(r"(?:[^@/]+@)?([^:/]+):", path or "")
            host = m.group(1) if m else None
            for n, c in self.conns.items():
                if isinstance(c, dict) and c.get("type") == "ssh" and c.get("host") == host:
                    return n
        else:
            m = re.match(r"\w+://([^@/]+)@", path or "")
            if m and m.group(1) in self.conns:
                return m.group(1)
        return None

    def _open_remote_browser(self, kind, path, on_pick):
        # Locked credentials → ask for the passphrase right here instead of
        # bouncing the user to Connections.
        if self.creds_encrypted and not self.creds_loaded:
            self.unlock_credentials()
            if not self.creds_loaded:
                return                       # cancelled / wrong passphrase
        if not self._conns_of_kind(kind):
            label = "SSH" if kind == "ssh" else "cloud"
            self.show_toast(f"No {label} connections — add one in Connections")
            return
        dlg = RemoteBrowseDialog(self, kind, start_conn=self._match_conn(kind, path))
        if dlg.exec() and dlg.result_path:
            on_pick(dlg.result_path)

    def browse_source_path(self, idx):
        if idx >= len(self.sources):
            return
        s = self.sources[idx]
        if s["t"] == "Local":
            start = s["p"] if os.path.isdir(s["p"]) else self.local_home
            d = QFileDialog.getExistingDirectory(self, "Choose source folder", start)
            if d:
                # Qt returns forward-slash paths even on Windows; show native form.
                self.sources[idx]["p"] = self._normalize_local(d)
                self.render_sources()
        elif s["t"] == "Web":
            # No listing exists for a download URL — the address IS the file.
            self.show_toast(_tr("Paste the direct download URL "
                                "(https://host/path/file)"))
        else:
            kind = "ssh" if s["t"] == "SSH" else "cloud"

            def pick(path, i=idx):
                if i < len(self.sources):
                    self.sources[i]["p"] = path
                    self.render_sources()
            self._open_remote_browser(kind, s["p"], pick)

    def browse_dest_path(self):
        if self.dest_type == "Local":
            cur = self.dst_input.text()
            start = cur if os.path.isdir(cur) else self.local_home
            d = QFileDialog.getExistingDirectory(self, "Choose destination folder", start)
            if d:
                # Qt returns forward-slash paths even on Windows; show native form.
                self.dst_input.setText(self._normalize_local(d))
        else:
            kind = "ssh" if self.dest_type == "SSH" else "cloud"
            self._open_remote_browser(kind, self.dst_input.text(),
                                      lambda path: self.dst_input.setText(path))

    def remove_source(self, idx):
        del self.sources[idx]
        self.render_sources()

    def _render_source_warnings(self, counts, multi):
        while self.warn_wrap.count():
            item = self.warn_wrap.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        dups = [k for k, n in counts.items() if n > 1]
        remote = multi and any(is_remote(s["p"]) for s in self.sources)
        msgs = []
        if remote:
            msgs.append("Multi-source μόνο για local — τα SSH/cloud sources θα απορριφθούν.")
        if dups:
            msgs.append("Ίδιο basename <b>" + ", ".join(dups) +
                        "</b> σε >1 source → merge στο destination.")
        if msgs:
            bar = QFrame()
            bar.setObjectName("warnbar")
            bl = QHBoxLayout(bar)
            bl.setContentsMargins(12, 10, 12, 10)
            bl.setSpacing(9)
            wi = QLabel(ic("alert-triangle"))
            wi.setObjectName("warnicon")
            wi.setAlignment(Qt.AlignTop)
            wt = QLabel("<br>".join(msgs))
            wt.setObjectName("warntext")
            wt.setWordWrap(True)
            wt.setTextFormat(Qt.RichText)
            bl.addWidget(wi)
            bl.addWidget(wt, 1)
            self.warn_wrap.addWidget(bar)
            spacer = QWidget()
            spacer.setFixedHeight(4)
            self.warn_wrap.addWidget(spacer)

    # ─────────────────────────────────────────────── destination ──
    def set_dest_type(self, k):
        self.dest_type = k
        self.render_dest()
        self._normalize_dest()           # switching to Local → fix E:/ → E:\

    def render_dest(self):
        self.dst_icon.setText(ic(self._src_icon(self.dest_type)))
        for k, t in self.dst_tags.items():
            t.setProperty("state", "on" if k == self.dest_type else "off")
            repolish(t)

    def toggle_advanced(self):
        self.adv.setVisible(not self.adv.isVisible())
        self.adv_toggle.setProperty("active", self.adv.isVisible())
        repolish(self.adv_toggle)

    # ─────────────────────────────────────────── real transfer ──
    def _sudo_active(self):
        return self.flag_opts["--use-sudo"].property("active")

    def _fc_script_path(self):
        for name in ("blitcp.py", "fast_copy.py"):
            cand = os.path.join(HERE, name)
            if os.path.isfile(cand):
                return cand
        return getattr(fc, "__file__", None) if FC_OK else None

    def _build_argv(self, dry, sources, dest):
        argv = list(sources) + [dest, "--progress-json"]
        if not self.transfer_opts["dedup"].property("active"):
            argv.append("--no-dedup")
        if not self.transfer_opts["verify"].property("active"):
            argv.append("--no-verify")
        if dry:
            argv.append("--dry-run")
        h = self.hash_sel.currentText().strip()
        if h:
            argv += ["--hash", h]
        tsel = self.thread_sel.currentText().strip()
        if tsel and tsel != "auto":
            argv += ["--threads", tsel]
        # "auto": omit --threads entirely — the CLI derives it from the CPU.
        # Index-based (labels are translated): 0 = parallel (CLI default),
        # 1 = tar block-stream.
        if self.small_sel.currentIndex() == 1:
            argv += ["--small-files", "stream"]
        if self.buf_input.text().strip():
            argv += ["--buffer", self.buf_input.text().strip()]
        if self.conc_input.text().strip():
            argv += ["--cloud-concurrency", self.conc_input.text().strip()]
        if self.chunk_input.text().strip():
            argv += ["--chunk-size", self.chunk_input.text().strip()]
        for p in self.exclude_patterns:
            argv += ["--exclude", p]
        # Always send an explicit --preserve so deselecting every chip means
        # "preserve nothing" (--preserve none). Omitting the flag would let the
        # engine fall back to its mode,times default — the opposite of intent.
        preserve = [k for k, o in self.meta_opts.items() if o.property("active")]
        argv += ["--preserve", ",".join(preserve) if preserve else "none"]
        if self.flag_opts["overwrite all"].property("active"):
            argv.append("--overwrite")
        if self.flag_opts["force"].property("active"):
            argv.append("--force")
        if self.flag_opts["no hash cache"].property("active"):
            argv.append("--no-cache")
        if self.flag_opts["--use-sudo"].property("active"):
            argv.append("--use-sudo")
        for p in self.index_existing_paths:
            argv += ["--index-existing", p]
        if self.flag_opts["dedup existing"].property("active"):
            argv.append("--dedup-existing")
        if self.flag_opts["include node_modules"].property("active"):
            argv.append("--include-node-modules")
        return argv

    def _ssh_protocol(self, path):
        """Effective transport for a remote endpoint: 'ssh' | 'sftp' | 'both'.
        Saved connections carry an explicit choice; missing/unknown values and
        ad-hoc hosts default to 'ssh' (the behavior before this setting)."""
        matched = self._match_conn("ssh", path)
        proto = self.conns[matched].get("protocol") if matched else None
        return proto if proto in ("ssh", "sftp", "both") else "ssh"

    def _sudo_needs_password(self):
        """True when sudo would prompt. `sudo -n` never prompts: it succeeds if
        a cached or passwordless rule covers us, and fails otherwise."""
        try:
            r = subprocess.run(["sudo", "-n", "true"], capture_output=True,
                               timeout=10)
            return r.returncode != 0
        except (OSError, subprocess.SubprocessError):
            return True          # can't tell → ask, rather than stall later

    def _sudo_askpass_env(self):
        """Extra env that lets the elevated child get its password from us:
        {} when sudo needs none, None if the user cancelled.

        The password goes in a variable read by a 0700 helper script rather
        than onto sudo's stdin, because the engine re-execs itself and its
        stdin belongs to the transfer. This is the same exposure the SSH
        password flags already accept (--ssh-password-env)."""
        if not self._sudo_needs_password():
            return {}
        dlg = PasswordDialog(
            self, _tr("Administrator password"),
            _tr("This transfer runs with <b>--use-sudo</b>. Enter your "
                "password so the elevated copy can start — it is passed "
                "straight to sudo and never written to disk."),
            _tr("Password"))
        if not dlg.exec():
            return None
        pw = dlg.input.text()
        if not pw:
            return None
        d = tempfile.mkdtemp(prefix="blitcp_askpass_")
        os.chmod(d, 0o700)
        helper = os.path.join(d, "askpass.sh")
        with open(helper, "w") as f:
            f.write("#!/bin/sh\nprintf '%s\\n' \"$BLITCP_SUDO_PW\"\n")
        os.chmod(helper, 0o700)
        self._askpass_dir = d                # removed when the process ends
        return {"SUDO_ASKPASS": helper, "BLITCP_SUDO_PW": pw}

    def _clear_askpass(self):
        """Delete the helper as soon as the transfer is over."""
        d = getattr(self, "_askpass_dir", None)
        if d:
            self._askpass_dir = None
            shutil.rmtree(d, ignore_errors=True)

    def _ssh_auth_flags(self, path, which):
        """SSH auth for one endpoint. which='dst'|'src'.
        Returns (extra_argv, env_dict), or None if the user cancelled.
        A matched saved connection supplies key/password/port directly; an
        ad-hoc host gets a password prompt (leave blank to use key/agent)."""
        prefix = "--ssh-" + which
        var = "FC_SSH_" + which.upper() + "_PW"
        extra, env = [], {}
        matched = self._match_conn("ssh", path)
        if matched:
            c = self.conns[matched]
            if c.get("key"):
                extra += [prefix + "-key", os.path.expanduser(c["key"])]
            if c.get("password"):
                env[var] = str(c["password"])
                extra += [prefix + "-password-env", var]
            try:
                # Default ONLY when the saved value is missing/empty — a stored
                # port (even 0) must pass through, not be rewritten by `or 22`.
                _pt = c.get("port", 22)
                port = int(_pt) if _pt not in (None, "") else 22
            except (ValueError, TypeError):
                port = 22
            if port != 22:
                extra += [prefix + "-port", str(port)]
            return extra, env
        # ad-hoc host (not saved) — offer a password, blank = use key/agent
        m = re.match(r"(?:([^@]+)@)?([^:/]+):", path or "")
        who = ((m.group(1) + "@") if m and m.group(1) else "") + \
              (m.group(2) if m else path)
        dlg = PasswordDialog(
            self, "SSH password",
            f"Password or key-passphrase for <span style='font-family:monospace'>{who}</span>. "
            "Leave blank for an unencrypted key / ssh-agent.",
            "Password / key passphrase", allow_empty=True)
        if not dlg.exec():
            return None
        pw = dlg.input.text()
        if pw:
            env[var] = pw
            extra += [prefix + "-password-env", var]
        return extra, env

    def run_transfer(self, dry):
        if self.running:
            return
        if not FC_OK or not self._fc_script_path():
            self.show_toast(_tr("blitcp.py not found next to the GUI"))
            return
        self._normalize_dest()                # E:/test3 → E:\test3 before we run
        sources = [s["p"].strip() for s in self.sources if s["p"].strip()]
        dest = self.dst_input.text().strip()
        if self.dest_type == "Local":
            dest = self._normalize_local(dest)
        if not sources:
            self.show_toast(_tr("Add at least one source"))
            return
        if not dest:
            self.show_toast(_tr("Set a destination"))
            return

        # --use-sudo re-execs the engine under sudo, and sudo with no terminal
        # cannot prompt at all — it either fails with "a terminal is required"
        # or, worse, goes hunting for the terminal the GUI was launched from
        # and silently waits there while this window shows an empty log. Ask
        # here instead and hand the answer to sudo through SUDO_ASKPASS.
        sudo_env = {}
        if self.flag_opts["--use-sudo"].property("active"):
            r = self._sudo_askpass_env()
            if r is None:
                return                       # user cancelled
            sudo_env = r

        # An http(s):// URL is never a destination: plain HTTP has no generic
        # upload. The chips offer no Web destination, but the field is free
        # text, so a pasted URL has to be caught here too — the engine refuses
        # it as well, just one process launch later.
        if dest.lower().startswith(("http://", "https://")):
            self.show_toast(_tr("An http(s):// URL can only be the source — "
                                "there is no generic HTTP upload"))
            return

        # ── http(s):// source rules, checked here so a mistake is a toast
        # rather than a launched process that fails a second later. These
        # mirror run_http_transfer() in the engine exactly.
        web = [i for i, sc in enumerate(self.sources)
               if sc["t"] == "Web" and sc["p"].strip()]
        if web:
            if len(sources) > 1:
                self.show_toast(_tr("A web source takes a single URL"))
                return
            url = sources[0]
            if not url.lower().startswith(("http://", "https://")):
                self.show_toast(_tr("A web source must be an http:// or "
                                    "https:// URL"))
                return
            # The name comes from the URL path, never from the server, so a
            # URL that ends at a directory names nothing to save.
            tail = url.split("?")[0].split("#")[0].rstrip()
            if not tail.rsplit("/", 1)[-1]:
                self.show_toast(_tr("The URL names no file "
                                    "(https://host/dir/file expected)"))
                return
            if self.dest_type == "Local":
                self.show_toast(_tr("A web source needs an SSH or SMB "
                                    "destination — it streams, it does not "
                                    "download locally"))
                return
            if dest.lower().startswith(("s3://", "az://", "gs://")):
                self.show_toast(_tr("Web → cloud is not supported yet — "
                                    "relay via SSH or SMB"))
                return

        # Sign-in for the Web source: the one-off sheet if it was filled in,
        # otherwise nothing — a saved HTTP connection is matched by the engine
        # itself, by host, with no flags from here.
        http_extra, http_env = self._http_auth_flags(sources[0]) if web else ([], {})

        # Resolve SSH auth (key / password) for remote endpoints.
        ssh_extra, ssh_env = [], {}
        involves_ssh = False
        ssh_endpoints = []                   # remote path strings, for protocol lookup
        if self.dest_type == "SSH":
            r = self._ssh_auth_flags(dest, "dst")
            if r is None:
                return                       # user cancelled
            ssh_extra += r[0]
            ssh_env.update(r[1])
            ssh_endpoints.append(dest)
            involves_ssh = True
        if len(sources) == 1 and self.sources and self.sources[0]["t"] == "SSH":
            r = self._ssh_auth_flags(sources[0], "src")
            if r is None:
                return
            ssh_extra += r[0]
            ssh_env.update(r[1])
            involves_ssh = True
            ssh_endpoints.append(sources[0])
        if involves_ssh:
            # Transport per the saved connection's Protocol choice.
            # Ad-hoc (unsaved) hosts keep today's default: plain SSH.
            protos = {self._ssh_protocol(p) for p in ssh_endpoints}
            if "ssh" in protos and "sftp" in protos:
                self.show_toast(_tr("Source and destination connections need "
                                    "compatible SSH protocols"))
                return
            if "sftp" in protos:
                ssh_extra.append("--sftp-only")
            elif "ssh" in protos:
                ssh_extra.append("--ssh-no-sftp")
            # all "both": no flag — classic hybrid (SFTP large + tar small)

        proc = QProcess(self)
        env = QProcessEnvironment.systemEnvironment()
        # Pass the unlocked credentials passphrase so the child can decrypt
        # credentials.json for named cloud/SSH connections without prompting.
        if self.creds_pw:
            pw = bytes(self.creds_pw).decode("utf-8", "replace")
            env.insert("BLITCP_CREDS_PASSPHRASE", pw)
            # A pre-rename engine (fallback in _fc_script_path) only knows the
            # old name; the engine scrubs both from child environments.
            env.insert("FAST_COPY_CREDS_PASSPHRASE", pw)
        for k, v in ssh_env.items():
            env.insert(k, v)
        for k, v in http_env.items():
            env.insert(k, v)
        for k, v in sudo_env.items():
            env.insert(k, v)
        env.insert("PYTHONUNBUFFERED", "1")
        env.insert("NO_COLOR", "1")
        proc.setProcessEnvironment(env)
        core_argv = self._build_argv(dry, sources, dest) + ssh_extra + http_extra
        if getattr(sys, "frozen", False):
            # bundled single-file build: re-invoke ourselves as the engine
            proc.setProgram(sys.executable)
            proc.setArguments(["--fc-core"] + core_argv)
        else:
            proc.setProgram(sys.executable)
            proc.setArguments([self._fc_script_path()] + core_argv)

        self._run_meta = {
            "dry": dry, "cfg": self._current_config(), "last": None,
            "dedup_bytes": None, "files_total": None, "bytes_written": None,
            "speed_bps": None, "outbuf": "", "errtail": "", "in_tb": False,
            # Memory-bounded transcript keeping head + tail (see _BoundedLog):
            # bounds memory on huge runs without dropping the earliest lines,
            # which is where the root-cause error usually is.
            "t0": time.monotonic(), "verified": None,
            "fulllog": _BoundedLog(),
            "skipped_unreadable": 0,
        }
        self.running = True
        self.start_btn.setEnabled(False)
        self.preview_btn.setEnabled(False)
        self.pstate.setText("Dry run…" if dry else "Copying…")
        self._clear_log()
        self._stop_indeterminate()
        self.barf.setFixedWidth(0)
        self.stat_vals["Progress"].setText("0%")
        self.stat_vals["Speed"].setText("—")
        self.stat_vals["ETA"].setText("—")
        self.stat_vals["Dedup saved"].setText("—")
        self.pcur.setText("")
        self.pfiles.setText(_tr("0 / 0 files"))

        proc.readyReadStandardOutput.connect(self._on_proc_stdout)
        proc.readyReadStandardError.connect(self._on_proc_stderr)
        proc.finished.connect(self._on_proc_finished)
        proc.errorOccurred.connect(self._on_proc_error)
        self._proc = proc
        proc.start()

    @staticmethod
    def _strip_ansi(s):
        return re.sub(r"\x1b\[[0-9;]*m", "", s)

    @staticmethod
    def _last_cr_segment(partial):
        """An unterminated line keeps only what a terminal would still show:
        the text after its last \\r. Engine progress such as 'Hashing existing
        [N]: <path>' rewrites one line with \\r per file and sends the \\n
        only when the phase ends, so the raw buffer grew by a path per file and
        was re-copied on every read. A trailing \\r is kept as is — it can be
        the first half of a CRLF split across two reads."""
        cut = partial.rstrip("\r").rfind("\r")
        return partial[cut:] if cut > 0 else partial

    def _on_proc_stdout(self):
        data = bytes(self._proc.readAllStandardOutput()).decode("utf-8", "replace")
        buf = self._run_meta["outbuf"] + data
        parts = buf.split("\n")
        self._run_meta["outbuf"] = self._last_cr_segment(parts.pop())
        self._run_meta["fulllog"].extend(parts)   # raw, for the diagnostic log file
        for line in parts:
            self._handle_out_line(line)

    def _on_proc_stderr(self):
        data = bytes(self._proc.readAllStandardError()).decode("utf-8", "replace")
        for line in data.splitlines():
            self._run_meta["fulllog"].append("[stderr] " + line)  # raw, for the log file
            line = self._strip_ansi(line).rstrip()
            if line.strip():
                self._add_log(line)
                self._run_meta["errtail"] = line

    # Every "Phase N — <name>" the engine can print has to match one of these,
    # or the header keeps whatever it said last. It used to end at "block
    # copy", so every SSH transfer sat on "Hashing…" from the end of
    # deduplication until the run finished — while it was in fact copying.
    # "copy" covers the block copy and all four remote copy phases.
    _PHASE_LABELS = (
        ("scanning", "Scanning…"), ("indexing", "Indexing…"),
        ("dedup", "Hashing…"), ("incremental", "Checking…"),
        ("space check", "Checking space…"),
        ("mapping", "Mapping…"), ("copy", "Copying…"),
        ("verif", "Verifying…"),
    )

    def _phase_label(self, line):
        """Map a 'Phase N — <name>' banner to a friendly active-state header label
        (so it tracks the real work, e.g. 'Hashing…' during dedup). Returns None for
        non-banner lines and for the end-of-run timing block (those carry a time)."""
        m = re.search(r"Phase\s+[\w.]+\s*[—-]\s*(.+)", line)
        if not m:
            return None
        name = m.group(1).strip().lower()
        if any(c.isdigit() for c in name):   # skip the timing block ("… 6.6s")
            return None
        for key, label in self._PHASE_LABELS:
            if key in name:
                return label
        return None

    def _start_indeterminate(self):
        if not self._pulse.isActive():
            self._pulse_x = 0.0
            self._pulse.start()

    def _stop_indeterminate(self):
        if self._pulse.isActive():
            self._pulse.stop()

    def _pulse_tick(self):
        # Triangle wave 0→1→0 so the fill breathes between 12% and 100% width —
        # a clear "working" signal without a fake percentage.
        self._pulse_x = (self._pulse_x + 0.02) % 1.0
        tri = 1.0 - abs(2.0 * self._pulse_x - 1.0)
        self.barf.setFixedWidth(int(self.bar.width() * (0.12 + 0.88 * tri)))

    def _handle_out_line(self, line):
        # A line can carry several \r-overwritten progress updates ("Scanning…
        # 1000", "…2000", "…3000"); a terminal shows only the last. rstrip FIRST
        # so a trailing \r (Windows \r\n line endings, after splitting on \n)
        # is removed BEFORE we take the last \r-segment — otherwise every line
        # collapses to "" and the log goes blank on Windows.
        line = self._strip_ansi(line).rstrip()
        if "\r" in line:
            line = line.split("\r")[-1]
        if not line.strip():
            return
        if line.lstrip().startswith("{"):
            import json
            try:
                ev = json.loads(line)
            except ValueError:
                self._add_log(line)
                return
            if ev.get("t") == "phase":
                # pre-copy phase (hashing / mapping / indexing): label the header
                # with the phase and show its live N/total so it never reads a
                # stuck "Copying… 0/0".
                self.pstate.setText((ev.get("phase") or "Working") + "…")
                fd = int(ev.get("files_done", 0))
                ft = int(ev.get("files_total", 0))
                if ft:
                    self._stop_indeterminate()
                    pct = ev.get("pct", 0) or 0
                    self.barf.setFixedWidth(int(self.bar.width() * min(pct, 100) / 100))
                    self.stat_vals["Progress"].setText(f"{round(pct)}%")
                    self.pfiles.setText(f"{fd:,} / {ft:,} files")
                else:
                    # Unknown total (discovery walk, e.g. indexing existing) —
                    # pulse the bar and show the running count, not a stuck 0%.
                    self._start_indeterminate()
                    self.stat_vals["Progress"].setText("—")
                    self.pfiles.setText(f"{fd:,} files")
                # Prefer MB/s when the engine sends a byte rate (hashing large
                # files) — "10 files/s" reads as slow while the disk is actually
                # maxed out; the real throughput tells the true story.
                brate = ev.get("bytes_rate", 0) or 0
                rate = ev.get("rate", 0) or 0
                if brate:
                    self.stat_vals["Speed"].setText(fmt_size(brate) + "/s")
                elif rate:
                    self.stat_vals["Speed"].setText(f"{rate:,.0f} files/s")
                else:
                    self.stat_vals["Speed"].setText("—")
                self.stat_vals["ETA"].setText("—")
                return
            if ev.get("t") == "verify":
                # verify phase: bar now shows how many files are verified
                self._stop_indeterminate()
                self.pstate.setText(_tr("Verifying…"))
                pct = ev.get("pct", 0) or 0
                self.barf.setFixedWidth(int(self.bar.width() * min(pct, 100) / 100))
                self.stat_vals["Progress"].setText(f"{round(pct)}%")
                self.pfiles.setText(
                    f"{int(ev.get('files_done', 0)):,} / {int(ev.get('files_total', 0)):,} verified")
                self.stat_vals["ETA"].setText("—")
                return
            if ev.get("t") in ("progress", "done"):
                self._stop_indeterminate()
                pct = ev.get("pct", 0) or 0
                self.barf.setFixedWidth(int(self.bar.width() * min(pct, 100) / 100))
                self.stat_vals["Progress"].setText(f"{round(pct)}%")
                self.pfiles.setText(
                    f"{int(ev.get('files_done', 0)):,} / {int(ev.get('files_total', 0)):,} files")
                self.stat_vals["Speed"].setText(fmt_size(ev.get("speed_bps", 0) or 0) + "/s")
                # eta_s null = "not enough history yet" (fresh stage) — show a
                # dash, never a fake number.
                _es = ev.get("eta_s")
                self.stat_vals["ETA"].setText(
                    "0s" if ev.get("t") == "done"
                    else ("—" if _es is None else fmt_time(_es)))
                cur = ev.get("current")
                if cur and ev.get("t") != "done":
                    name = cur if len(cur) <= 72 else "…" + cur[-71:]
                    ct = ev.get("current_total", 0) or 0
                    if ct >= 64 * 1024 * 1024:  # per-file progress only where it means anything
                        cd = ev.get("current_done", 0) or 0
                        self.pcur.setText(f"{name}   {fmt_size(cd)} / {fmt_size(ct)}")
                    else:
                        self.pcur.setText(name)
                else:
                    self.pcur.setText("")
                self._run_meta["last"] = ev
            return
        # plain text → log (collapsing Python tracebacks to one clean line)
        self._emit_log(line)
        ph = self._phase_label(line)
        if ph:
            self.pstate.setText(ph)
        if re.search(r"Verified:?\s+(?:all\s+)?\d+\s+(?:files?|objects?)", line):
            self._run_meta["verified"] = True
        elif re.search(r"Verification failed|verify mismatch|MISSING:|SIZE MISMATCH",
                       line):
            self._run_meta["verified"] = False
        ms = re.search(r"(\d+) file\(s\) could NOT be read", line)
        if ms:
            self._run_meta["skipped_unreadable"] = int(ms.group(1))
        m = re.search(r"saved:?\s+([\d.]+\s*[KMGTP]?i?B)", line)
        if m:
            self._run_meta["dedup_bytes"] = parse_size(m.group(1))
            self.stat_vals["Dedup saved"].setText(m.group(1).strip())
        mf = re.search(r"Files:\s*([\d,]+)\s*total", line)
        if mf:
            n = int(mf.group(1).replace(",", ""))
            self._run_meta["files_total"] = n
            self.pfiles.setText(f"{n:,} / {n:,} files")
        md = re.search(r"Data:\s*([\d.]+\s*[KMGTP]?i?B)\s+written", line)
        if md:
            self._run_meta["bytes_written"] = parse_size(md.group(1))
        ms = re.search(r"Speed:\s*([\d.]+\s*[KMGTP]?i?B)/s", line)
        if ms:
            self._run_meta["speed_bps"] = parse_size(ms.group(1))
            self.stat_vals["Speed"].setText(ms.group(1).strip() + "/s")

    @staticmethod
    def _friendly(msg):
        """Turn a raw engine error into a clean, single-line message."""
        low = msg.lower()
        if any(k in low for k in ("channel closed", "open_sftp", "invoke_subsystem",
                                  "subsystem", "sftpclient")):
            return ("SFTP is not available on the SSH server. Enable SFTP "
                    "(Synology: Control Panel → File Services → FTP → tick "
                    "“Enable SFTP service”).")
        # drop noisy exception-class prefixes like 'paramiko.ssh_exception.X: '
        msg = re.sub(r"^([\w.]+(Error|Exception)):\s*", "", msg)
        return msg.replace("Error: ", "")

    def _emit_log(self, line):
        """Append a log line, but fold multi-line Python tracebacks into a single
        clean message (the user never wants raw tracebacks)."""
        rm = self._run_meta
        stripped = line.strip()
        if stripped.startswith("Traceback (most recent call last)"):
            rm["in_tb"] = True
            return
        if rm.get("in_tb"):
            # suppress frame lines / caret markers; the first non-indented line
            # is the exception message that ends the traceback.
            if (line[:1] in (" ", "\t") or stripped.startswith("File ")
                    or (stripped and set(stripped) <= set("^~ "))):
                return
            rm["in_tb"] = False
            msg = self._friendly(stripped)
            self._add_log(msg)
            rm["errtail"] = msg
            return
        self._add_log(line)
        if re.match(r"\s*(Error|Fatal|Authentication failed)", stripped):
            rm["errtail"] = self._friendly(stripped)

    def _on_proc_error(self, err):
        if not self.running:
            return
        self.running = False
        self.pstate.setText(_tr("Failed"))
        self.start_btn.setEnabled(True)
        self.preview_btn.setEnabled(True)
        self.show_toast(_tr("Could not start blitcp.py"))

    def _on_proc_finished(self, code, status):
        self._clear_askpass()   # the password helper outlives nothing
        # Drain anything still buffered in the pipe (finished can fire before the
        # last readyRead), then flush the trailing partial line.
        tail = bytes(self._proc.readAllStandardOutput()).decode("utf-8", "replace")
        if tail:
            buf = self._run_meta["outbuf"] + tail
            parts = buf.split("\n")
            self._run_meta["outbuf"] = self._last_cr_segment(parts.pop())
            for line in parts:
                self._handle_out_line(line)
        err = bytes(self._proc.readAllStandardError()).decode("utf-8", "replace")
        for line in err.splitlines():
            line = self._strip_ansi(line).rstrip()
            if line.strip():
                self._emit_log(line)
        if self._run_meta["outbuf"].strip():
            self._handle_out_line(self._run_meta["outbuf"])
            self._run_meta["outbuf"] = ""
        self.running = False
        self.start_btn.setEnabled(True)
        self.preview_btn.setEnabled(True)
        rm = self._run_meta
        dry = rm["dry"]
        ok = (code == 0)
        skipped = (code == 3)   # engine EXIT_SOURCE_UNREADABLE: only unreadable
        n_skip = rm.get("skipped_unreadable", 0)   # source files skipped, rest OK
        last = rm["last"] or {}
        elapsed = time.monotonic() - rm.get("t0", time.monotonic())
        vtxt = (" · ✓ verified" if rm["verified"] is True
                else " · ✗ verify failed" if rm["verified"] is False else "")
        self._stop_indeterminate()
        if ok or skipped:
            self.barf.setFixedWidth(self.bar.width())
            self.stat_vals["Progress"].setText("100%")
            self.stat_vals["ETA"].setText("0s")
        if ok:
            self.pstate.setText("Plan ready" if dry
                                else f"Done · {fmt_time(elapsed)}{vtxt}")
        elif skipped:
            self.pstate.setText(f"Completed · {fmt_time(elapsed)} · "
                                f"{n_skip} skipped (unreadable)")
        else:
            self.pstate.setText(f"Failed · {fmt_time(elapsed)}")

        # Record EVERY real (non-dry) run — success or failure — so history is
        # never silently empty. Dry runs / previews are not recorded.
        if not dry:
            files = rm["files_total"] or int(last.get("files_total")
                                             or last.get("files_done", 0))
            nbytes = rm["bytes_written"]
            if not nbytes:
                nbytes = int(last.get("bytes_total") or last.get("bytes_done", 0))
            speed = rm["speed_bps"] or (last.get("speed_bps", 0) or 0)
            self._write_history({
                "config": rm["cfg"],
                "status": "ok" if ok else "partial" if skipped else "failed",
                "error": (None if ok else
                          f"{n_skip} source file(s) unreadable — skipped" if skipped
                          else (rm["errtail"] or f"exit code {code}")),
                "stats": {
                    "files": files, "bytes": nbytes,
                    "dedup_saved_bytes": rm["dedup_bytes"],
                    "speed_bps": speed,
                    "elapsed_s": last.get("elapsed_s") or elapsed,
                    "verified": rm["verified"],
                },
            })

        if dry:
            self.show_toast(_tr("Dry run complete") if ok else _tr("Dry run failed — see log"))
        elif ok:
            self.show_toast(f"Transfer complete in {fmt_time(elapsed)}"
                            + (" · verified" if rm["verified"] else ""))
        elif skipped:
            self.show_toast(f"Completed — {n_skip} file(s) unreadable, skipped "
                            f"(everything else copied)")
        else:
            logpath = self._write_transfer_log()
            tail = rm["errtail"]
            msg = "Transfer failed" + (": " + tail if tail else f" (exit {code})")
            self.show_toast(msg + ("  ·  full log saved for diagnosis" if logpath else ""))

    def _write_transfer_log(self):
        """Persist the full RAW engine output of the last run to a file, so a
        failure stays diagnosable even though the UI keeps errors to one clean
        line (no tracebacks). Returns the path, or None on error."""
        try:
            os.makedirs(self._config_dir(), exist_ok=True)
            path = os.path.join(self._config_dir(), "last-transfer.log")
            fl = self._run_meta.get("fulllog")
            lines = fl.lines() if fl is not None else []
            with open(path, "w", encoding="utf-8") as f:
                f.write("\n".join(lines) + "\n")
            return path
        except OSError:
            return None

    def _clear_log(self):
        self.log_view.clear()

    def _add_log(self, text, link=False):
        v = DARK if self.dark else LIGHT
        fmt = QTextCharFormat()     # no foreground → the stylesheet's colour
        if link:
            text = "linked 312 duplicates (8.3 GB saved)"
            fmt.setForeground(QColor(v["ok"]))
        else:
            # Colour like the terminal: dim rules, cyan phase banners, green ✓,
            # red errors — so the GUI log reads like the CLI output, not flat grey.
            s = text.strip()
            color = None
            if s and set(s) <= set("─—-=_ "):
                color = v["faint"]
            elif re.match(r"\s*Phase\b", text):
                color = v["accent"]
            elif "✓" in text:
                color = v["ok"]
            elif re.search(r"✗|\bError\b|\bFailed\b|FAILED|mismatch", text):
                color = v["danger"]
            if color:
                fmt.setForeground(QColor(color))
        # Plain text with its own format per block: leading spaces keep the
        # column alignment of progress and summary lines, and nothing is parsed
        # as markup. setMaximumBlockCount drops the oldest blocks.
        doc = self.log_view.document()
        cur = QTextCursor(doc)
        cur.movePosition(QTextCursor.End)
        if not doc.isEmpty():
            cur.insertBlock()
        cur.setCharFormat(fmt)
        cur.insertText(text, fmt)
        if not self._log_scroll_timer.isActive():
            self._log_scroll_timer.start()

    # ───────────────────────────────────────────────── connections ──
    def _conn_summary(self, c):
        t = c.get("type", "s3")
        if t == "s3":
            r = f"endpoint={c.get('endpoint_url', 'AWS')}  key={mask(c.get('access_key_id'))}"
            if c.get("container"):
                r += f"  default={c['container']}"
            return r
        if t == "az":
            if c.get("connection_string"):
                return f"conn={mask(c['connection_string'])}"
            return f"account={c.get('account')}  key={mask(c.get('key'))}"
        if t == "gs":
            return f"project={c.get('project')}  creds={c.get('credentials', 'ADC')}"
        if t == "ssh":
            a = (f"key={c['key']}" if c.get("key")
                 else "password=***" if c.get("password") else "agent")
            return f"{c.get('user')}@{c.get('host')}:{c.get('port', 22)}  {a}"
        if t == "http":
            auth = []
            if c.get("user"):
                auth.append(c["user"] + ("+password=***" if c.get("password") else ""))
            if c.get("header"):
                auth.append("header=***")
            if c.get("cookies"):
                auth.append(f"cookies={c['cookies']}")
            return f"host={c.get('host')}  " + (" ".join(auth) or "no auth")
        return ""

    def _conn_card(self, name, c):
        card = QFrame()
        card.setObjectName("conn")
        cl = QHBoxLayout(card)
        cl.setContentsMargins(14, 12, 14, 12)
        cl.setSpacing(13)
        ctype = c.get("type", "s3")
        iconname = ("server-2" if ctype == "ssh" else "brand-google" if ctype == "gs"
                    else "brand-azure" if ctype == "az"
                    else "arrow-down-circle" if ctype == "http" else "brand-aws")
        cic = QLabel(ic(iconname))
        cic.setObjectName("connicon")
        col = QVBoxLayout()
        col.setSpacing(2)
        nm = QLabel(name)
        nm.setObjectName("connname")
        mt = QLabel(self._conn_summary(c))
        mt.setObjectName("connmeta")
        mt.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
        col.addWidget(nm)
        col.addWidget(mt)

        st = self.conn_state.get(name, "idle")
        if st == "ok":
            badge = QLabel(ic("check") + " tested")
            badge.setObjectName("badgeok")
        elif st == "test":
            badge = QLabel(_tr("testing…"))
            badge.setObjectName("badgetest")
        else:
            badge = QLabel(_tr("untested"))
            badge.setObjectName("badgeidle")

        test = iconbtn("flask", "ib")
        test.clicked.connect(lambda _=False, n=name: self.test_conn(n))
        edit = iconbtn("pencil", "ib")
        edit.clicked.connect(lambda _=False, n=name: self.open_conn_modal(n))
        delete = iconbtn("trash", "ibdel")
        delete.clicked.connect(lambda _=False, n=name: self.delete_conn(n))

        cl.addWidget(cic)
        cl.addLayout(col, 1)
        cl.addWidget(badge)
        cl.addWidget(test)
        cl.addWidget(edit)
        cl.addWidget(delete)

        card.doubleClicked = None  # frames aren't ClickFrame; double-click via event filter
        card.mouseDoubleClickEvent = lambda e, n=name: self.open_conn_modal(n)
        return card

    def render_conns(self):
        self._render_creds_banner()
        for box in (self.cloud_conns, self.ssh_conns):
            while box.count():
                item = box.takeAt(0)
                if item.widget():
                    item.widget().deleteLater()
        # Locked: don't show anything until the user unlocks the file.
        if self.creds_encrypted and not self.creds_loaded:
            self._empty(self.cloud_conns)
            self._empty(self.ssh_conns)
            return
        cloud = [(n, c) for n, c in self.conns.items()
                 if isinstance(c, dict) and c.get("type") != "ssh"]
        ssh = [(n, c) for n, c in self.conns.items()
               if isinstance(c, dict) and c.get("type") == "ssh"]
        if cloud:
            for n, c in cloud:
                self.cloud_conns.addWidget(self._conn_card(n, c))
        else:
            self._empty(self.cloud_conns)
        if ssh:
            for n, c in ssh:
                self.ssh_conns.addWidget(self._conn_card(n, c))
        else:
            self._empty(self.ssh_conns)

    def _render_creds_banner(self):
        if not hasattr(self, "creds_banner"):
            return
        while self.creds_banner.count():
            item = self.creds_banner.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        # tamper / re-bind note — shown until a successful Rekey re-binds the file
        if self.creds_tamper:
            bar = QFrame()
            bar.setObjectName("warnbar")
            bl = QHBoxLayout(bar)
            bl.setContentsMargins(12, 10, 12, 10)
            bl.setSpacing(9)
            wi = QLabel(ic("alert-triangle"))
            wi.setObjectName("warnicon")
            wi.setAlignment(Qt.AlignTop)
            wt = QLabel(_tr("This <b>credentials.json</b> was bound to a different "
                            "blitcp.py (tamper check). If you just updated "
                            "blitcp, press <b>Rekey</b> to re-bind it."))
            wt.setObjectName("warntext")
            wt.setWordWrap(True)
            wt.setTextFormat(Qt.RichText)
            wt.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
            rk = textbtn(_tr("Rekey"), "key", oid="btnsm")
            rk.clicked.connect(self.rekey_credentials)
            bl.addWidget(wi)
            bl.addWidget(wt, 1)
            bl.addWidget(rk)
            self.creds_banner.addWidget(bar)
            self.creds_banner.addSpacing(8)
        if self.creds_encrypted and not self.creds_loaded:
            card = QFrame()
            card.setObjectName("conn")
            cl = QHBoxLayout(card)
            cl.setContentsMargins(14, 12, 14, 12)
            cl.setSpacing(13)
            icon = QLabel(ic("key"))
            icon.setObjectName("connicon")
            col = QVBoxLayout()
            col.setSpacing(2)
            nm = QLabel(_tr("credentials.json is locked"))
            nm.setObjectName("connname")
            mt = QLabel(self.creds_path or "")
            mt.setObjectName("connmeta")
            mt.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
            col.addWidget(nm)
            col.addWidget(mt)
            unlock = textbtn(_tr("Unlock"), "lock-open", oid="btnsmprimary")
            unlock.clicked.connect(self.unlock_credentials)
            cl.addWidget(icon)
            cl.addLayout(col, 1)
            cl.addWidget(unlock)
            self.creds_banner.addWidget(card)
            self.creds_banner.addSpacing(8)
        elif not FC_OK:
            l = QLabel(ic("alert-triangle") + "  blitcp.py not found — showing demo connections")
            l.setObjectName("sub")
            self.creds_banner.addWidget(l)
            self.creds_banner.addSpacing(8)
        elif self.creds_loaded or (self.creds_path and os.path.isfile(self.creds_path)):
            n = len([c for c in self.conns.values() if isinstance(c, dict)])
            l = QLabel(ic("check") + f"  {self.creds_path}  ·  {n} connection(s)")
            l.setObjectName("sub")
            l.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
            self.creds_banner.addWidget(l)
            self.creds_banner.addSpacing(8)

    def _empty(self, box):
        l = QLabel("—")
        l.setObjectName("sub")
        box.addWidget(l)

    def test_conn(self, name):
        self.conn_state[name] = "test"
        self.render_conns()
        QTimer.singleShot(1000, lambda: self._test_done(name))

    def _test_done(self, name):
        self.conn_state[name] = "ok"
        self.render_conns()
        self.show_toast(name + ": connection OK")

    def open_conn_modal(self, name):
        dlg = ConnectionDialog(self, name, self.conns.get(name) if name else None)
        while dlg.exec():
            rname, data = dlg.result_data()
            if rname is None:
                self.show_toast(data)
                continue
            if rname != name and rname in self.conns:
                self.show_toast(_tr("Name already exists"))
                continue
            snapshot = dict(self.conns)           # for rollback if the write fails
            if name and name != rname:
                del self.conns[name]
                self.conn_state.pop(name, None)
            self.conns[rname] = data
            ok, err = self._persist_credentials()
            if not ok:
                self.conns = snapshot             # keep memory == disk
                self.show_toast(_tr("Could not save:") + " " + err)
                break
            self.render_conns()
            self.fill_conn_sel()
            self.show_toast(("Updated " if name else "Added ") + rname)
            break

    def delete_conn(self, name):
        snapshot = dict(self.conns)
        self.conns.pop(name, None)
        self.conn_state.pop(name, None)
        ok, err = self._persist_credentials()
        if not ok:
            self.conns = snapshot
            self.show_toast(_tr("Could not save:") + " " + err)
            return
        self.render_conns()
        self.fill_conn_sel()
        self.show_toast(_tr("Removed") + " " + name)

    def _persist_credentials(self):
        """Write self.conns to credentials.json — re-encrypting with the unlocked
        passphrase, and transparently clearing a read-only / immutable lock
        (handled by the engine's _save_credentials_file). Returns (ok, error)."""
        if not FC_OK or not self.creds_path or not hasattr(fc, "_save_credentials_file"):
            return True, None                     # demo / no engine → in-memory only
        if self.creds_encrypted and not self.creds_pw:
            return False, _tr("Unlock credentials.json first")
        # Encrypt by default: the first time a secret would be written to a
        # not-yet-encrypted file, offer to set a passphrase and switch to
        # AES-256-GCM.
        if not self.creds_encrypted and self._has_secret_entries():
            self._offer_encryption()
            # Encryption is mandatory for secret-bearing credentials. If the
            # user cancelled the passphrase prompt (or left it blank), refuse
            # the write rather than persist passwords/keys in cleartext. The
            # caller rolls back the in-memory change, so nothing — on disk or
            # in memory — is left holding plaintext secrets.
            if not self.creds_encrypted:
                return False, ("Encryption required: enter a passphrase to "
                               "save passwords or keys. Nothing was written.")
        try:
            if self.creds_encrypted:
                fc._creds_passphrase_cache = bytearray(bytes(self.creds_pw))
            # read-only → writable (Windows attrib / Unix chmod) so the rewrite
            # isn't blocked; the engine also clears its own immutable lock.
            try:
                if os.path.exists(self.creds_path):
                    os.chmod(self.creds_path, 0o600)
            except OSError:
                pass
            fc._save_credentials_file(self.creds_path, self.conns,
                                      encrypt=bool(self.creds_encrypted))
            if hasattr(fc, "_creds_cache"):
                fc._creds_cache.clear()
            self.creds_tamper = False    # any save re-binds to this blitcp.py
            return True, None
        except SystemExit as e:
            return False, str(e).replace("Error: ", "").strip() or "write failed"
        except Exception as e:
            msg = str(e).strip().splitlines()[0] if str(e).strip() else e.__class__.__name__
            return False, msg.replace("Error: ", "")

    def _has_secret_entries(self):
        """True if any connection holds a cleartext secret value worth encrypting
        (mirrors the engine's _entry_has_secret)."""
        has = getattr(fc, "_entry_has_secret", None)
        if not has:
            return False
        return any(isinstance(c, dict) and has(c) for c in self.conns.values())

    def _offer_encryption(self):
        """Mandatory-encryption prompt: ask for a new passphrase and switch the
        file to AES-256-GCM. No-op if the user cancels — and the caller
        (_persist_credentials) then refuses the write, so secrets are never
        persisted in cleartext."""
        dlg = PasswordDialog(
            self, "Encrypt credentials",
            "Protect your saved passwords and keys with a passphrase "
            "(AES-256-GCM). You'll need it to unlock credentials.json later. "
            "Cancelling will not save your passwords or keys.",
            "New passphrase", confirm=True, generator=True)
        if not dlg.exec():
            return                       # declined → falls through to plaintext write
        pw = dlg.input.text().encode("utf-8")
        if not pw:
            return
        self.creds_pw = pw
        self.creds_encrypted = True
        self.creds_loaded = True

    def rekey_credentials(self):
        """Re-bind credentials.json to this blitcp.py (engine `creds rekey`).
        Re-encrypts with the SAME passphrase — does not change it."""
        if not FC_OK or not self.creds_path or not hasattr(fc, "_save_credentials_file"):
            self.show_toast(_tr("Rekey needs blitcp.py"))
            return
        if not (os.path.isfile(self.creds_path) and self.creds_encrypted):
            self.show_toast(_tr("credentials.json is not encrypted — nothing to rekey"))
            return
        if not self.creds_loaded or not self.creds_pw:   # must be unlocked to re-encrypt
            self.unlock_credentials()
            if not self.creds_loaded or not self.creds_pw:
                return
        ok, err = self._persist_credentials()            # writes → re-binds to this binary
        if not ok:
            self.show_toast(_tr("Rekey failed:") + " " + err)
            return
        self.creds_tamper = False
        self.render_conns()
        self.show_toast(_tr("Re-bound credentials.json to this blitcp.py"))

    # ──────────────────────────────────────────────── file browser ──
    def fill_conn_sel(self):
        self.conn_sel.blockSignals(True)
        self.conn_sel.clear()
        self.conn_sel.addItem(_tr("This PC · local files"), "__local")
        for n, c in self.conns.items():
            if isinstance(c, dict):
                self.conn_sel.addItem(f"{n} · {c.get('type', '?')}", n)
        self.conn_sel.blockSignals(False)
        self._set_browse_conn(self.conn_sel.currentData())

    def _set_browse_conn(self, val):
        prev = (self.browse_conn or {}).get("name")
        if prev and prev != val and prev in self._browse_backends:
            self._browse_close(prev)          # don't keep the old SMB session open
        self._shown = None
        if val == "__local" or val not in self.conns:
            self.browse_conn = {"name": "local", "type": "local"}
            # start in the user's home folder, browsing the real filesystem
            self.cwd = self.local_home if os.path.isdir(self.local_home) else os.path.abspath(os.sep)
        else:
            self.browse_conn = {"name": val, **self.conns[val]}
            # SSH starts at its default remote path; cloud at the bucket root
            if self.browse_conn.get("type") == "ssh":
                self.cwd = self.browse_conn.get("path") or "/"
            else:
                self.cwd = "/"
        self.selected_file = None

    def on_conn_sel(self):
        self._set_browse_conn(self.conn_sel.currentData())
        self.render_browse(refresh=True)

    def _local_entries(self, path):
        """Real directory listing. Returns (entries, denied):
        entries = folders first (alpha) then files with sizes;
        denied = True when the folder needs elevated privileges."""
        try:
            scanned = list(os.scandir(path))
        except PermissionError:
            return [], True
        except OSError:
            return [], False
        dirs, files = [], []
        for e in scanned:
            try:
                if e.is_dir(follow_symlinks=False) or (e.is_symlink() and os.path.isdir(e.path)):
                    dirs.append((e.name, "dir"))
                else:
                    try:
                        meta = fmt_size(e.stat(follow_symlinks=False).st_size)
                    except OSError:
                        meta = "—"
                    files.append((e.name, meta))
            except OSError:
                files.append((e.name, "—"))
        dirs.sort(key=lambda x: x[0].lower())
        files.sort(key=lambda x: x[0].lower())
        return dirs + files, False

    # listing helper run under sudo to read root-only directories
    _SUDO_LS = (
        "import os,sys\n"
        "for e in os.scandir(sys.argv[1]):\n"
        " try:\n"
        "  d=e.is_dir(follow_symlinks=False)\n"
        " except OSError:\n"
        "  d=False\n"
        " try:\n"
        "  s=0 if d else e.stat(follow_symlinks=False).st_size\n"
        " except OSError:\n"
        "  s=-1\n"
        " sys.stdout.write('%d\\t%d\\t%s\\n'%(1 if d else 0,s,e.name))\n"
    )

    def _sudo_entries(self, path):
        """List a directory via `sudo`. Returns the entries list, or None if the
        password is wrong / sudo is unavailable."""
        if not self._sudo_pw:
            return None
        try:
            proc = subprocess.run(
                ["sudo", "-S", "-p", "", sys.executable, "-c", self._SUDO_LS, path],
                input=(self._sudo_pw + "\n").encode(),
                capture_output=True, timeout=20)
        except Exception:
            return None
        if proc.returncode != 0:
            return None
        dirs, files = [], []
        for line in proc.stdout.decode("utf-8", "replace").splitlines():
            parts = line.split("\t", 2)
            if len(parts) != 3:
                continue
            isdir, size, name = parts
            if isdir == "1":
                dirs.append((name, "dir"))
            else:
                try:
                    files.append((name, fmt_size(int(size)) if int(size) >= 0 else "—"))
                except ValueError:
                    files.append((name, "—"))
        dirs.sort(key=lambda x: x[0].lower())
        files.sort(key=lambda x: x[0].lower())
        return dirs + files

    def elevate_local(self):
        """Prompt for the sudo/admin password to browse a protected folder."""
        if sys.platform.startswith("win"):
            self.show_toast(_tr("Access denied — run as Administrator to browse this folder"))
            return
        dlg = PasswordDialog(
            self, "Administrator access",
            f"Ο φάκελος <span style='font-family:monospace'>{self.cwd}</span> χρειάζεται "
            "δικαιώματα root. Δώσε το <span style='font-family:monospace'>sudo</span> "
            "password για να εμφανιστεί το περιεχόμενο.",
            "Password for sudo")
        if not dlg.exec():
            return
        self._sudo_pw = dlg.input.text()
        if self._sudo_entries(self.cwd) is None:
            self._sudo_pw = None
            self.show_toast(_tr("sudo: authentication failed"))
            return
        self.show_toast(_tr("sudo authenticated"))
        self.render_browse()

    @staticmethod
    def _clean_err(e):
        msg = str(e).strip()
        msg = msg.splitlines()[0] if msg else e.__class__.__name__
        msg = re.sub(r"^\[Errno [^\]]*\]\s*", "", msg)
        return msg.replace("Error: ", "")

    def _ssh_close(self, name):
        pair = self._ssh_clients.pop(name, None)
        if pair:
            for obj in pair:
                try:
                    obj.close()
                except Exception:
                    pass

    def _ssh_client(self, conn):
        """Return a live cached SSH client for this connection (no SFTP yet),
        connecting if needed."""
        name = conn["name"]
        pair = self._ssh_clients.get(name)
        if pair:
            tr = pair[0].get_transport()
            if tr and tr.is_active():
                return pair[0]
            self._ssh_close(name)
        import paramiko
        cli = paramiko.SSHClient()
        # Verify host keys (no silent MITM): load known hosts so a CHANGED key on
        # a known host is rejected (paramiko raises BadHostKeyException), and an
        # unknown host triggers an explicit fingerprint-confirmation prompt
        # (TOFU, like OpenSSH) instead of auto-adding.
        known = os.path.expanduser("~/.ssh/known_hosts")
        try:
            cli.load_system_host_keys()
        except Exception:
            pass
        try:
            cli.load_host_keys(known)
        except (OSError, IOError):
            pass
        cli.set_missing_host_key_policy(_ConfirmHostKeyPolicy(self, known))
        # Default ONLY when the saved value is missing/empty — a stored port
        # (even 0) must pass through, not be rewritten by `or 22`.
        _pt = conn.get("port", 22)
        try:
            _port = int(_pt) if _pt not in (None, "") else 22
        except (ValueError, TypeError):
            _port = 22
        kw = dict(hostname=conn.get("host"), port=_port,
                  username=conn.get("user") or None,
                  timeout=SSH_BROWSE_TIMEOUT, banner_timeout=SSH_BROWSE_TIMEOUT,
                  auth_timeout=SSH_BROWSE_TIMEOUT)
        if conn.get("key"):
            kw["key_filename"] = os.path.expanduser(conn["key"])
        if conn.get("password"):
            kw["password"] = conn["password"]
        cli.connect(**kw)
        tr = cli.get_transport()
        if tr:
            tr.set_keepalive(15)
        self._ssh_clients[name] = [cli, None]
        return cli

    def _sftp_hint(self, msg):
        """Friendlier text for 'server has no SFTP subsystem'."""
        low = msg.lower()
        if any(k in low for k in ("channel closed", "administratively prohibited",
                                  "eof", "sftp", "subsystem")):
            return (msg + " — the server has no SFTP subsystem (and the shell "
                    "fallback also failed). Enable SFTP on the server — Synology: "
                    "Control Panel → File Services → FTP → tick “Enable SFTP "
                    "service”.")
        return msg

    def _ssh_entries(self, conn, path, cancelled=None):
        """List a remote dir. Tries SFTP; if the server has no SFTP subsystem,
        falls back to listing over the shell (`ls`). Runs on a _ListWorker.
        Returns (entries, error, total) — entries capped at BROWSE_MAX_ENTRIES."""
        entries, err = self._ssh_entries_all(conn, path)
        if err:
            return None, err, None
        return entries[:BROWSE_MAX_ENTRIES], None, len(entries)

    def _ssh_entries_all(self, conn, path):
        import stat as statmod
        try:
            import paramiko  # noqa: F401
        except ImportError:
            return None, "paramiko is not installed"
        name = conn["name"]
        try:
            cli = self._ssh_client(conn)
        except Exception as e:
            self._ssh_close(name)
            msg = self._clean_err(e)
            # paramiko, no banner in time: which of the two a silent host
            # produces depends on which thread notices first.
            if msg in ("No existing session", "Error reading SSH protocol banner"):
                msg = (f"{conn.get('host')} port {conn.get('port') or 22}: no SSH "
                       f"answer within {SSH_BROWSE_TIMEOUT} s")
            return None, msg

        sftp_err = None
        if name not in self._ssh_no_sftp:
            try:
                pair = self._ssh_clients.get(name)
                sftp = pair[1] if pair and pair[1] else cli.open_sftp()
                if pair:
                    pair[1] = sftp
                attrs = sftp.listdir_attr(path or "/")
                dirs, files = [], []
                for a in attrs:
                    if statmod.S_ISDIR(a.st_mode):
                        dirs.append((a.filename, "dir"))
                    else:
                        files.append((a.filename, fmt_size(a.st_size or 0)))
                dirs.sort(key=lambda x: x[0].lower())
                files.sort(key=lambda x: x[0].lower())
                return dirs + files, None
            except Exception as e:
                sftp_err = e
                if self._ssh_clients.get(name):
                    self._ssh_clients[name][1] = None   # drop dead SFTP
                # remember SFTP is unavailable → skip straight to shell next time
                self._ssh_no_sftp.add(name)

        # shell fallback
        try:
            return self._ssh_ls(cli, path), None
        except Exception as e:
            base = sftp_err if sftp_err is not None else e
            return None, self._sftp_hint(self._clean_err(base))

    def _ssh_ls(self, cli, path):
        """List a remote directory via `ls` (works without an SFTP subsystem).
        Dirs end with '/' thanks to -p; sizes are omitted in this mode."""
        import shlex
        cmd = "LC_ALL=C ls -1ApL -- " + shlex.quote(path or "/")
        _in, out, errs = cli.exec_command(cmd, timeout=15)
        data = out.read().decode("utf-8", "replace")
        rc = out.channel.recv_exit_status()
        if rc != 0:
            emsg = errs.read().decode("utf-8", "replace").strip()
            raise OSError(emsg or f"ls exited {rc}")
        dirs, files = [], []
        for line in data.splitlines():
            nm = line.rstrip("\r")
            if not nm or nm in ("./", "../", ".", ".."):
                continue
            if nm.endswith("/"):
                dirs.append((nm[:-1], "dir"))
            else:
                files.append((nm, ""))
        dirs.sort(key=lambda x: x[0].lower())
        files.sort(key=lambda x: x[0].lower())
        return dirs + files

    def _cloud_entries(self, conn, cwd, cancelled=None):
        """One level of a bucket / share under cwd — never the whole tree under
        it (list_dir, not list_objects). Runs on a _ListWorker; the backend is
        reused while browsing. Returns (entries, error, total)."""
        if not FC_OK:
            return None, "blitcp.py is required for cloud browsing", None
        is_smb = conn.get("type") == "smb"
        if not (conn.get("share") if is_smb
                else conn.get("container") or conn.get("bucket")):
            kind = "share" if is_smb else "bucket/container"
            return None, f"no default {kind} set on this connection", None
        prefix = "" if cwd in ("/", "") else cwd.strip("/") + "/"
        try:
            backend = self._browse_backend(conn)
            dirs, files, total = backend.list_dir(
                prefix, limit=BROWSE_MAX_ENTRIES, cancelled=cancelled)
        except (Exception, SystemExit) as e:  # backends SystemExit on bad creds
            self._browse_close(conn["name"])  # reconnect on the next try
            return None, self._clean_err(e), None
        entries = [(d, "dir") for d in sorted(dirs)] + \
            [(f, fmt_size(sz or 0)) for f, sz in sorted(files, key=lambda x: x[0].lower())]
        return entries, None, total

    def _browse_backend(self, conn):
        """The cached backend for a cloud/SMB connection, built on first use
        (and again if the saved connection changed)."""
        import types
        name, ctype = conn["name"], conn.get("type")
        fp = repr(sorted((k, str(v)) for k, v in conn.items()))
        hit = self._browse_backends.get(name)
        if hit and hit[0] == fp:
            return hit[1]
        if hit:
            self._browse_close(name)
        backend_cls = {"s3": fc.S3Backend, "az": fc.AzureBackend,
                       "gs": fc.GCSBackend, "smb": fc.SMBBackend}.get(ctype)
        if not backend_cls:
            raise ValueError(f"unsupported connection type {ctype!r}")
        bucket = conn.get("share") if ctype == "smb" \
            else conn.get("container") or conn.get("bucket")
        creds = {k: v for k, v in conn.items() if k not in ("type", "name")}
        if ctype == "smb":
            spec = fc.SMBSpec(scheme="smb", container=bucket, prefix="",
                              connection=name, host=conn.get("host"),
                              port=int(conn.get("port", 445)),
                              user=conn.get("user"))
        else:
            spec = fc.CloudSpec(scheme=ctype, container=bucket, prefix="",
                                connection=name)
        args = types.SimpleNamespace(smb_connect_timeout=SMB_BROWSE_TIMEOUT)
        backend = backend_cls(spec, args, creds=creds)
        self._browse_backends[name] = (fp, backend, self._browse_lock(conn))
        return backend

    def _browse_lock(self, conn):
        """One listing at a time per connection. SMB sessions are pooled per
        host:port by smbclient, so SMB connections lock per host:port."""
        key = conn["name"]
        if conn.get("type") == "smb":
            key = ("smb", str(conn.get("host", "")).lower(), str(conn.get("port", 445)))
        return self._browse_locks.setdefault(key, threading.Lock())

    def _browse_close(self, name):
        """Forget a cached cloud/SMB backend and close it in the background —
        close() waits for the backend's own lock, never on the UI thread."""
        hit = self._browse_backends.pop(name, None)
        close = getattr(hit[1], "close", None) if hit else None
        if close:
            lock = hit[2]

            def _bg():
                with lock:
                    try:
                        close()
                    except Exception:
                        pass
            threading.Thread(target=_bg, daemon=True).start()

    def _list_job(self, conn, cwd):
        conn = dict(conn)
        lock = self._browse_lock(conn)
        lister = self._ssh_entries if conn["type"] == "ssh" else self._cloud_entries

        def job(cancelled):
            with lock:
                if cancelled():
                    return None, _tr("Cancelled."), None
                return lister(conn, cwd, cancelled)
        return job

    def _start_listing(self, owner, conn, cwd, on_done):
        """List conn:cwd on a _ListWorker. on_done(entries, err, total) runs on
        the UI thread, and only if `owner` (the main browser or a picker
        dialog) still wants this request — navigating on drops it."""
        prev = getattr(owner, "_list_worker", None)
        if prev is not None:
            prev.cancel.set()
        self._browse_seq += 1
        req = owner._want_req = self._browse_seq
        w = _ListWorker(req, self._list_job(conn, cwd))
        w.done.connect(self._on_listing)
        w.finished.connect(self._on_list_finished)
        self._list_waiters[req] = (owner, on_done)
        self._browse_workers.add(w)
        owner._list_worker = w
        w.start()

    def _cancel_listing(self, owner):
        owner._want_req = None
        w = getattr(owner, "_list_worker", None)
        if w is not None:
            w.cancel.set()

    def _on_listing(self, req, entries, err, total):
        owner, cb = self._list_waiters.pop(req, (None, None))
        if cb is not None and getattr(owner, "_want_req", None) == req:
            owner._want_req = None
            cb(entries, err, total)

    def _on_list_finished(self):
        w = self.sender()
        self._browse_workers.discard(w)
        if w is not None:
            w.deleteLater()

    def _list_label(self, conn):
        live = (conn["name"] in self._ssh_clients if conn["type"] == "ssh"
                else conn["name"] in self._browse_backends)
        return _tr("Loading…") if live else \
            _tr("Connecting to {0}…").format(conn.get("host") or conn["name"])

    def _loading_row(self, text, on_cancel):
        row = QFrame()
        row.setObjectName("fitem")
        rl = QHBoxLayout(row)
        rl.setContentsMargins(10, 8, 10, 8)
        rl.setSpacing(11)
        lbl = QLabel(text)
        lbl.setObjectName("sub")
        rl.addWidget(lbl, 1)
        cancel = textbtn(_tr("Cancel"), oid="btn")
        cancel.clicked.connect(on_cancel)
        rl.addWidget(cancel)
        return row

    @staticmethod
    def _listing_rows(entries, err, total):
        """What a finished listing shows: ('msg', text) / ('item', name, meta)."""
        if err:
            return [("msg", ic("alert-triangle") + "  " + err)]
        if not entries:
            return [("msg", "— empty —")]
        rows = []
        if total and total > len(entries):
            rows.append(("msg", _tr("Showing the first {0} of {1} entries").format(
                f"{len(entries):,}", f"{total:,}")))
        return rows + [("item", n, m) for n, m in entries]

    def _browse_shutdown(self, wait_s=2.0):
        """App exit: close the browse connections (which also ends a listing
        that is reading from one) and give running workers wait_s to finish.
        False if one is still stuck — the caller then exits without letting Qt
        destroy a running QThread, which aborts the process."""
        self._want_req = None
        for w in list(self._browse_workers):
            w.cancel.set()
        for name in list(self._ssh_clients):
            self._ssh_close(name)
        for name in list(self._browse_backends):
            self._browse_close(name)
        deadline = time.monotonic() + wait_s
        for w in list(self._browse_workers):
            w.wait(max(0, int((deadline - time.monotonic()) * 1000)))
        return not any(w.isRunning() for w in list(self._browse_workers))

    def _src_type(self):
        t = self.browse_conn["type"]
        return ("SSH" if t == "ssh" else "Local" if t == "local"
                else "Web" if t == "http" else "Cloud")

    def _active_tree(self):
        t = self.browse_conn["type"]
        return self.local_tree if t == "local" else self.ssh_tree if t == "ssh" else self.cloud_tree

    def _compose_path(self, conn, cwd, selected):
        """Build the display/transfer path for a (conn, cwd, selected-file)."""
        if conn["type"] == "local":
            return os.path.join(cwd, selected) if selected else cwd
        if selected:
            sub = ("/" + selected if cwd == "/" else cwd + "/" + selected)
        else:
            sub = cwd
        if conn["type"] == "ssh":
            return f"{conn.get('user', 'user')}@{conn.get('host', conn['name'])}:{sub}"
        if conn["type"] == "smb":
            # Reference the saved connection by name so credentials resolve
            # (the SMB analogue of the cloud name@bucket form); expands to
            # smb://host/share/<rel> with its password via resolve_named_endpoint.
            rel = sub.lstrip("/")
            return f"{conn['name']}:{rel}" if rel else conn["name"]
        bucket = conn.get("container", "backups")
        scheme = "az" if conn["type"] == "az" else "gs" if conn["type"] == "gs" else "s3"
        return f"{scheme}://{conn['name']}@{bucket}{sub}"

    def _cur_path(self):
        return self._compose_path(self.browse_conn, self.cwd, self.selected_file)

    def render_browse(self, refresh=False):
        """refresh=False re-draws a remote folder from its last listing (a click
        that only selects a file); a new folder is always listed afresh."""
        if not self.browse_conn:
            self.fill_conn_sel()
        bc = self.browse_conn
        is_ssh = bc["type"] == "ssh"
        is_local = bc["type"] == "local"

        # breadcrumb
        while self.crumb_lay.count():
            item = self.crumb_lay.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        cico = QLabel(ic("device-desktop" if is_local else "server-2" if is_ssh else "bucket"))
        cico.setObjectName("crumbico")
        self.crumb_lay.addWidget(cico)

        if is_local:
            crumbs = self._local_crumbs(self.cwd)   # list of (label, abspath)
        else:
            root = (bc.get("host", bc["name"]) if is_ssh else bc.get("container", "backups"))
            crumbs = [(root, "/")]
            acc = ""
            for p in ([] if self.cwd == "/" else [x for x in self.cwd.split("/") if x]):
                acc += "/" + p
                crumbs.append((p, acc))
        for i, (label, target) in enumerate(crumbs):
            if i:
                sep = QLabel(ic("chevron-right"))
                sep.setObjectName("crumbsep")
                self.crumb_lay.addWidget(sep)
            pb = QPushButton(label)
            pb.setObjectName("crumbc")
            pb.setCursor(Qt.PointingHandCursor)
            pb.clicked.connect(lambda _=False, t=target: self._crumb_to(t))
            self.crumb_lay.addWidget(pb)
        self.crumb_lay.addStretch(1)

        # file list
        while self.files_box.count():
            item = self.files_box.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        if is_local:
            if os.path.dirname(self.cwd) != self.cwd:
                self.files_box.addWidget(self._file_item("..", "up", up=True))
            entries, denied = self._local_entries(self.cwd)
            if denied:
                sudo_entries = self._sudo_entries(self.cwd)
                if sudo_entries is not None:
                    for name, meta in sudo_entries:
                        self.files_box.addWidget(self._file_item(name, meta))
                else:
                    self.files_box.addWidget(self._locked_folder_row())
            elif not entries:
                self._files_message("— empty —")
            else:
                for name, meta in entries:
                    self.files_box.addWidget(self._file_item(name, meta))
        else:
            if self.cwd != "/":
                self.files_box.addWidget(self._file_item("..", "up", up=True))
            key = (bc["name"], self.cwd)
            if not refresh and self._shown and self._shown[0] == key:
                for row in self._listing_rows(*self._shown[1:]):
                    if row[0] == "msg":
                        self._files_message(row[1])
                    else:
                        self.files_box.addWidget(self._file_item(row[1], row[2]))
            else:
                self._shown = None
                self.files_box.addWidget(self._loading_row(
                    self._list_label(bc), self._cancel_browse))
                self._start_listing(self, bc, self.cwd,
                                    lambda e, er, t, k=key: self._browse_listed(k, e, er, t))

    def _browse_listed(self, key, entries, err, total):
        self._shown = (key, entries, err, total)
        if self.browse_conn and (self.browse_conn["name"], self.cwd) == key:
            self.render_browse()

    def _cancel_browse(self):
        self._cancel_listing(self)
        if self.browse_conn and self.browse_conn["type"] != "local":
            self._shown = ((self.browse_conn["name"], self.cwd), None,
                           _tr("Cancelled."), None)
            self.render_browse()

    def _files_message(self, text):
        l = QLabel(text)
        l.setObjectName("sub")
        l.setWordWrap(True)
        self.files_box.addWidget(l)

    def _locked_folder_row(self):
        """A clickable row prompting for sudo/admin to read a protected folder."""
        item = ClickFrame()
        item.setObjectName("fitem")
        il = QHBoxLayout(item)
        il.setContentsMargins(10, 11, 10, 11)
        il.setSpacing(11)
        fi = QLabel(ic("key"))
        fi.setObjectName("fidir")
        fn = QLabel(_tr("Permission denied — click to unlock with sudo"))
        fn.setObjectName("fn")
        fs = QLabel(_tr("locked"))
        fs.setObjectName("fs")
        il.addWidget(fi)
        il.addWidget(fn, 1)
        il.addWidget(fs)
        item.clicked.connect(self.elevate_local)
        return item

    def _local_crumbs(self, path):
        """Return [(label, abspath), …] for a real local path."""
        from pathlib import Path
        p = Path(path)
        parts = list(p.parts)            # ('/', 'home', 'kai') or ('C:\\', 'Users', …)
        if not parts:
            return [(path, path)]
        crumbs = [(parts[0], parts[0])]
        acc = parts[0]
        for part in parts[1:]:
            acc = os.path.join(acc, part)
            crumbs.append((part, acc))
        return crumbs

    def _file_item(self, name, meta, up=False):
        is_dir = up or meta in ("dir", "drive")
        item = ClickFrame()
        item.setObjectName("fitem")
        sel = (not is_dir and name == self.selected_file)
        item.setProperty("sel", sel)
        il = QHBoxLayout(item)
        il.setContentsMargins(10, 11, 10, 11)
        il.setSpacing(11)
        if up:
            iconname = "corner-left-up"
        elif meta == "drive":
            iconname = "device-desktop"
        elif is_dir:
            iconname = "folder"
        elif name.endswith(".json"):
            iconname = "file-text"
        else:
            iconname = "file-zip"
        fi = QLabel(ic(iconname))
        fi.setObjectName("fidir" if is_dir else "fi")
        fn = QLabel(name + ("/" if is_dir and not up else ""))
        fn.setObjectName("fn")
        fs = QLabel("" if up else (_tr("drive") if meta == "drive" else _tr("folder") if is_dir else meta))
        fs.setObjectName("fs")
        il.addWidget(fi)
        il.addWidget(fn, 1)
        il.addWidget(fs)

        if up:
            item.clicked.connect(self._go_up)
        elif is_dir:
            item.clicked.connect(lambda n=name: self._enter_dir(n))
        else:
            item.clicked.connect(lambda n=name: self._select_file(n))
            item.doubleClicked.connect(lambda n=name: self._dblclick_file(n))
        return item

    def _crumb_to(self, path):
        self.cwd = path
        self.selected_file = None
        self.render_browse(refresh=True)       # a crumb click re-lists

    def _go_up(self):
        if self.browse_conn["type"] == "local":
            self.cwd = os.path.dirname(self.cwd) or self.cwd
        else:
            self.cwd = "/".join(self.cwd.split("/")[:-1]) or "/"
        self.selected_file = None
        self.render_browse()

    def _enter_dir(self, name):
        if self.browse_conn["type"] == "local":
            self.cwd = os.path.join(self.cwd, name)
        else:
            self.cwd = ("" if self.cwd == "/" else self.cwd) + "/" + name
        self.selected_file = None
        self.render_browse()

    def _select_file(self, name):
        self.selected_file = name
        self.render_browse()

    def _dblclick_file(self, name):
        self.selected_file = name
        self.sources.append({"p": self._cur_path(), "t": self._src_type()})
        self.render_sources()
        self.show_toast(_tr("Added {0} as source").format(name))

    def browse_set_source(self):
        self.sources.append({"p": self._cur_path(), "t": self._src_type()})
        self.render_sources()
        self.show_toast(("Added " + self.selected_file + " as source")
                        if self.selected_file else "Added as source")

    def browse_set_dest(self):
        self.dest_type = self._src_type()
        path = self._cur_path()
        if self.dest_type == "Local":
            path = self._normalize_local(path)
        self.dst_input.setText(path)
        self.render_dest()
        self.show_toast(_tr("Set as destination"))

    # ───────────────────────────────────────────────── history ──
    HISTORY_KEEP = 100   # retention: keep the last N runs

    def _config_dir(self):
        """Per-user config dir, matching where credentials.json is stored.
        An existing pre-rename blitcp dir (gui_settings.json, history/) is
        renamed in place on first touch — same migration as the engine's."""
        if sys.platform.startswith("win"):
            base = os.environ.get("APPDATA") or os.path.expanduser("~")
        else:
            base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
                os.path.expanduser("~"), ".config")
        old = os.path.join(base, "fast_copy")
        new = os.path.join(base, "blitcp")
        if os.path.isdir(old) and not os.path.isdir(new):
            try:
                os.replace(old, new)
            except OSError:
                return old
        return new

    def history_dir(self):
        return os.path.join(self._config_dir(), "history")

    def _current_config(self):
        """Snapshot of the transfer form — enough to display and to re-run."""
        return {
            "sources": [dict(s) for s in self.sources],
            "dest": self.dst_input.text(),
            "dest_type": self.dest_type,
            "dedup": self.transfer_opts["dedup"].property("active"),
            "verify": self.transfer_opts["verify"].property("active"),
            "hash": self.hash_sel.currentText(),
            "threads": self.thread_sel.currentText(),
            "buffer_mb": self.buf_input.text(),
            "cloud_concurrency": self.conc_input.text(),
            "chunk_mb": self.chunk_input.text(),
            "small_files": "stream" if self.small_sel.currentIndex() == 1
                           else "parallel",
            "preserve": [k for k, o in self.meta_opts.items() if o.property("active")],
            "flags": [k for k, o in self.flag_opts.items() if o.property("active")],
            "exclude": list(self.exclude_patterns),
            "index_existing": list(self.index_existing_paths),
        }

    def _write_history(self, record):
        import json, datetime
        record["timestamp"] = datetime.datetime.now(datetime.timezone.utc).isoformat()
        try:
            d = self.history_dir()
            os.makedirs(d, exist_ok=True)
            # sortable, collision-resistant filename
            stamp = datetime.datetime.now().strftime("%Y%m%d-%H%M%S-%f")
            with open(os.path.join(d, f"run-{stamp}.json"), "w", encoding="utf-8") as f:
                json.dump(record, f, indent=2)
            self._prune_history()
        except OSError as e:
            self.show_toast(_tr("Could not save history:") + " " + str(e).splitlines()[0])

    def _prune_history(self):
        """Keep only the most recent HISTORY_KEEP run files."""
        try:
            files = sorted(f for f in os.listdir(self.history_dir())
                           if f.startswith("run-") and f.endswith(".json"))
        except OSError:
            return
        for old in files[:-self.HISTORY_KEEP]:
            try:
                os.remove(os.path.join(self.history_dir(), old))
            except OSError:
                pass

    def load_history(self):
        import json
        out = []
        try:
            files = sorted((f for f in os.listdir(self.history_dir())
                            if f.startswith("run-") and f.endswith(".json")), reverse=True)
        except OSError:
            return out
        for name in files:
            try:
                with open(os.path.join(self.history_dir(), name), encoding="utf-8") as f:
                    out.append(json.load(f))
            except (OSError, ValueError):
                continue
        return out

    def render_history(self):
        while self.history_box.count():
            item = self.history_box.takeAt(0)
            if item.widget():
                item.widget().deleteLater()
        records = self.load_history()
        if not records:
            empty = QLabel("Δεν υπάρχουν ακόμη μεταφορές. Ολοκλήρωσε ένα transfer "
                           "για να εμφανιστεί εδώ.")
            empty.setObjectName("sub")
            empty.setWordWrap(True)
            self.history_box.addWidget(empty)
            return
        for rec in records:
            self.history_box.addWidget(self._hist_card(rec))

    def _hist_summary(self, cfg):
        srcs = cfg.get("sources", [])
        dest = cfg.get("dest", "")
        if len(srcs) == 1:
            left = srcs[0].get("p", "")
        elif srcs:
            left = f"{len(srcs)} sources"
        else:
            left = "—"
        return f"{left} → {dest}"

    def _hist_when(self, iso):
        import datetime
        try:
            dt = datetime.datetime.fromisoformat(iso)
            if dt.tzinfo:
                dt = dt.astimezone()
            return dt.strftime("%Y-%m-%d %H:%M")
        except (ValueError, TypeError):
            return iso or ""

    def _hist_card(self, rec):
        cfg = rec.get("config", {})
        st = rec.get("stats", {})
        files = int(st.get("files", 0) or 0)
        data = fmt_size(st.get("bytes", 0) or 0)
        saved = st.get("dedup_saved_bytes")
        saved = fmt_size(saved) if saved else "—"
        speed = fmt_size(st.get("speed_bps", 0) or 0) + "/s"
        tm = fmt_time(st.get("elapsed_s", 0) or 0)
        when = self._hist_when(rec.get("timestamp", ""))

        card = QFrame()
        card.setObjectName("hrun")
        lay = QVBoxLayout(card)
        lay.setContentsMargins(15, 13, 15, 13)
        lay.setSpacing(7)
        failed = rec.get("status") == "failed"
        top = QHBoxLayout()
        hp = QLabel(self._hist_summary(cfg))
        hp.setObjectName("hp")
        hp.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
        if failed:
            badge = QLabel(ic("alert-triangle") + " " + _tr("failed"))
            badge.setObjectName("badgetest")
        again = textbtn(_tr("Run again"), "refresh", oid="btnsm")
        again.clicked.connect(lambda _=False, c=cfg: self._run_again(c))
        top.addWidget(hp, 1)
        if failed:
            top.addWidget(badge)
        top.addWidget(again)
        lay.addLayout(top)
        if failed:
            stats = (f"<span style='color:#9ca3af'>{rec.get('error') or 'transfer failed'}"
                     f"</span>     <span style='color:#9ca3af'>{when}</span>")
        else:
            stats = (f"files <b>{files:,}</b>     data <b>{data}</b>     "
                     f"dedup <b>{saved}</b>     speed <b>{speed}</b>     "
                     f"time <b>{tm}</b>     <span style='color:#9ca3af'>{when}</span>")
        hs = QLabel(stats)
        hs.setObjectName("hs")
        hs.setTextFormat(Qt.RichText)
        hs.setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Preferred)
        lay.addWidget(hs)
        return card

    def _run_again(self, cfg):
        """Restore a saved transfer's form and jump to the Transfer screen."""
        if cfg.get("sources"):
            self.sources = [dict(s) for s in cfg["sources"]]
        self.dst_input.setText(cfg.get("dest", ""))
        self.dest_type = cfg.get("dest_type", "Local")
        for key, on in (("dedup", cfg.get("dedup")), ("verify", cfg.get("verify"))):
            if key in self.transfer_opts and on is not None:
                self.transfer_opts[key].setProperty("active", bool(on))
                repolish(self.transfer_opts[key])
        if cfg.get("hash"):
            self.hash_sel.setCurrentText(cfg["hash"])
        if cfg.get("threads"):
            self.thread_sel.setCurrentText(cfg["threads"])
        if "buffer_mb" in cfg:
            self.buf_input.setText(str(cfg["buffer_mb"]))
        if "cloud_concurrency" in cfg:
            self.conc_input.setText(str(cfg["cloud_concurrency"]))
        if "chunk_mb" in cfg:
            self.chunk_input.setText(str(cfg["chunk_mb"]))
        if cfg.get("small_files"):
            self.small_sel.setCurrentIndex(
                1 if cfg["small_files"] == "stream" else 0)
        for k, o in self.meta_opts.items():
            o.setProperty("active", k in cfg.get("preserve", []))
            repolish(o)
        for k, o in self.flag_opts.items():
            o.setProperty("active", k in cfg.get("flags", []))
            repolish(o)
        if "exclude" in cfg:
            self.exclude_patterns = list(cfg["exclude"])
            self.render_chips()
        if "index_existing" in cfg:
            self.index_existing_paths = list(cfg["index_existing"])
            self.render_idx_chips()
        self.render_sources()
        self.render_dest()
        self.navigate("transfer")
        self.nav_items["transfer"].setProperty("active", True)
        repolish(self.nav_items["transfer"])
        self.show_toast(_tr("Loaded transfer — review and Start"))

    def check_update(self):
        if not FC_OK or not hasattr(fc, "_fetch_releases"):
            self.show_toast(_tr("Update check needs blitcp.py"))
            return
        if getattr(self, "_upd_running", False):
            return
        self.upd_btn.setText(_tr("Checking…"))
        self.upd_btn.setEnabled(False)
        self._upd_running = True
        self._upd_thread = _UpdateCheckWorker()
        self._upd_thread.done.connect(self._on_update_result)
        self._upd_thread.finished.connect(self._upd_cleanup)
        self._upd_thread.start()

    def _upd_cleanup(self):
        self._upd_running = False
        t, self._upd_thread = getattr(self, "_upd_thread", None), None
        if t:
            t.deleteLater()

    def _on_update_result(self, res):
        self.upd_btn.setEnabled(True)
        startup = getattr(self, "_startup_check", False)
        self._startup_check = False
        if res.get("err"):
            self.upd_btn.setText(_tr("Check for updates"))
            if not startup:
                self.show_toast(_tr("Could not check for updates")
                                + (": " + res["err"] if res["err"] != "network" else ""))
        elif res.get("uptodate"):
            self.upd_btn.setText(_tr("Up to date"))
            if not startup:
                self.show_toast(f"blitcp is up to date (v{res['uptodate']})")
        elif res.get("latest"):
            self._update_tag = res["latest"]
            self._update_releases = res.get("releases", [])
            self.upd_btn.setText("Download " + res["latest"])
            if startup:
                # Don't nag if the user dismissed this exact version before.
                if res["latest"] in self._load_gui_settings().get("skip_versions", []):
                    return
                self._show_update_dialog(res["latest"], res["current"],
                                         self._update_releases)
            else:
                self.show_toast(f"Update available: {res['latest']} "
                                f"(you have v{res['current']}) — click to download")

    def _on_language_changed(self, idx):
        """Persist the language choice and offer an immediate restart — a
        full live retranslate would need every constructed widget re-texted,
        so a one-click relaunch is the honest way to apply it everywhere."""
        code = self.lang_sel.itemData(idx) or "en"
        s = self._load_gui_settings()
        s["language"] = code
        self._save_gui_settings(s)
        set_language(code)
        if getattr(self, "running", False):
            # never relaunch mid-transfer
            self.show_toast(_tr("Language saved — restart to apply everywhere"))
            return
        m = QMessageBox(self)
        m.setWindowTitle(_tr("Language"))
        m.setIcon(QMessageBox.Question)
        m.setText(_tr("Restart blitcp to apply the new language everywhere?"))
        r = m.addButton(_tr("Restart now"), QMessageBox.AcceptRole)
        m.addButton(_tr("Later"), QMessageBox.RejectRole)
        m.exec()
        if m.clickedButton() is r:
            if getattr(sys, "frozen", False):
                QProcess.startDetached(sys.executable, [])
            else:
                QProcess.startDetached(sys.executable, [os.path.abspath(__file__)])
            self.close()

    # ── startup update popup ─────────────────────────────────────────────
    def _gui_settings_path(self):
        return os.path.join(self._config_dir(), "gui_settings.json")

    def _load_gui_settings(self):
        import json
        try:
            with open(self._gui_settings_path()) as f:
                return json.load(f)
        except (OSError, ValueError):
            return {}

    def _save_gui_settings(self, data):
        import json
        try:
            os.makedirs(self._config_dir(), exist_ok=True)
            with open(self._gui_settings_path(), "w") as f:
                json.dump(data, f, indent=2)
        except OSError:
            pass

    def _startup_update_check(self):
        """Quietly check for a newer release at launch; if one exists (and the
        user hasn't dismissed that version), pop the UpdateDialog. Silent on
        errors / when running without the engine."""
        if not FC_OK or not hasattr(fc, "_fetch_releases"):
            return
        if getattr(self, "_upd_running", False):
            return
        # Opt-in, and at most once a day. Before this, every launch hit the
        # network whether or not the user had ever been asked.
        if not _auto_update_due():
            return
        _mark_auto_update_checked()
        self._startup_check = True
        self._upd_running = True
        self._upd_thread = _UpdateCheckWorker()
        self._upd_thread.done.connect(self._on_update_result)
        self._upd_thread.finished.connect(self._upd_cleanup)
        self._upd_thread.start()

    def _show_update_dialog(self, latest, current, releases):
        dlg = UpdateDialog(self, latest, current, releases, self._can_auto_install(),
                           DARK if self.dark else LIGHT)
        dlg.exec()
        if dlg.skip_cb.isChecked():
            s = self._load_gui_settings()
            skip = set(s.get("skip_versions", []))
            skip.add(latest)
            s["skip_versions"] = sorted(skip)
            self._save_gui_settings(s)
        if dlg.action == UpdateDialog.DOWNLOAD_ONLY:
            self.download_update(install=False)
        elif dlg.action == UpdateDialog.DOWNLOAD_INSTALL:
            self.download_update(install=True)

    def _update_btn_clicked(self):
        """One button: check first, then become a real downloader once an update
        is known."""
        if getattr(self, "_update_tag", None):
            self.download_update()
        else:
            self.check_update()

    def _gui_asset_name(self):
        """The release asset for THIS GUI build/platform."""
        import platform as _pf
        if sys.platform.startswith("win"):
            return "blitcp_gui-windows.exe"
        if sys.platform == "darwin":
            if _pf.machine().lower() in ("x86_64", "i386"):
                return "blitcp_gui-macos-intel.app.zip"
            return "blitcp_gui-macos-arm64.app.zip"
        return "blitcp_gui-linux"

    def _can_auto_install(self):
        """Whether the GUI can replace its own binary in place — like the CLI's
        self-update. Supported only on frozen Linux/Windows builds with write
        access to the binary's directory. A running-from-source (.py) launch has
        no binary to swap, and a running macOS .app bundle can't be safely
        replaced in place, so both fall back to a download + manual handoff."""
        if not getattr(sys, "frozen", False):
            return False
        if sys.platform == "darwin":
            return False
        try:
            return os.access(os.path.dirname(sys.executable), os.W_OK)
        except OSError:
            return False

    def download_update(self, install=True):
        """Fetch the matching GUI asset for the available release. With
        install=True on a frozen Linux/Windows build the new binary replaces the
        running one in place (mirroring the CLI self-update), then the GUI offers
        to relaunch. install=False (Download only), macOS .app bundles, and
        source runs download to ~/Downloads and hand off to the user. Never runs
        while a copy is in progress."""
        tag = getattr(self, "_update_tag", None)
        if not tag or not FC_OK or getattr(self, "_dl_running", False):
            return
        # Do not touch the binary while any copy/transfer is running: an
        # in-place swap mid-job could destabilise the running engine.
        if self.running:
            self.show_toast(_tr("Finish or cancel the running copy before updating"))
            return
        asset = self._gui_asset_name()
        url, size = None, None
        try:
            for rel in (fc._fetch_releases() or []):
                if rel.get("tag_name") == tag:
                    for a in rel.get("assets", []):
                        if a.get("name") == asset:
                            # API asset url (a["url"]) works for PRIVATE repos with
                            # a Bearer token; browser_download_url 404s there.
                            url = a.get("url")
                            size = a.get("size")
                            break
                    break
        except Exception:
            url = None
        if not url:
            QMessageBox.warning(
                self, _tr("Update"),
                _tr("Couldn't find {asset} in release {tag}.").format(asset=asset, tag=tag) + "\n\n" + _tr("Download manually:") + "\n"
                f"https://github.com/{GUI_REPO}/releases/tag/{tag}")
            return
        # Defence in depth: only download from GitHub over HTTPS (the URL comes
        # from the GitHub release API, but verify before replacing a binary).
        from urllib.parse import urlparse
        parsed = urlparse(url)
        allowed = {"api.github.com", "github.com", "objects.githubusercontent.com",
                   "github-releases.githubusercontent.com",
                   "release-assets.githubusercontent.com"}
        if parsed.scheme != "https" or parsed.hostname not in allowed:
            QMessageBox.critical(self, _tr("Update"),
                                 _tr("Unexpected download URL (not HTTPS GitHub):") + "\n" + url)
            return

        if install and self._can_auto_install():
            # Download beside the running binary so the swap is an atomic,
            # same-filesystem replace.
            dest = sys.executable + ".update_tmp"
            self._update_inplace_target = sys.executable
        else:
            downloads = os.path.join(os.path.expanduser("~"), "Downloads")
            if not os.path.isdir(downloads):
                downloads = os.path.expanduser("~")
            dest = os.path.join(downloads, asset)
            self._update_inplace_target = None
        self._dl_running = True
        self.upd_btn.setEnabled(False)
        self.upd_btn.setText(_tr("Downloading…"))
        self.show_toast(_tr("Downloading") + " " + asset + " …")
        self._dl_thread = _DownloadWorker(url, dest, expected_size=size)
        self._dl_thread.done.connect(self._on_download_done)
        self._dl_thread.finished.connect(lambda: setattr(self, "_dl_thread", None))
        self._dl_thread.start()

    def _on_download_done(self, ok, info):
        self._dl_running = False
        self.upd_btn.setEnabled(True)
        self.upd_btn.setText("Download " + getattr(self, "_update_tag", "update"))
        target = getattr(self, "_update_inplace_target", None)
        if not ok:
            if target:                       # clean a partial .update_tmp
                try:
                    os.remove(target + ".update_tmp")
                except OSError:
                    pass
            QMessageBox.critical(self, _tr("Download failed"),
                                 _tr("Could not download the update:") + "\n" + info)
            return
        dest = info

        # In-place install (frozen Linux/Windows): replace the running binary
        # and offer to relaunch — the GUI equivalent of `blitcp --update`.
        if target:
            if self.running:                 # a copy started during the download
                self.show_toast(_tr("Copy in progress — update not applied"))
                try:
                    os.remove(dest)
                except OSError:
                    pass
                return
            ok2, msg = self._install_inplace(dest, target)
            if not ok2:
                try:
                    os.remove(dest)
                except OSError:
                    pass
                QMessageBox.critical(
                    self, _tr("Update failed"),
                    _tr("Could not replace the application:") + "\n" + msg)
                return
            self._prompt_relaunch()
            return

        if dest.endswith(".app.zip"):
            hint = ("Quit blitcp, unzip the file, and drag blitcp.app into "
                    "Applications (replacing the old one).")
        elif sys.platform.startswith("win"):
            hint = ("Close blitcp, then replace your current "
                    "blitcp_gui.exe with the downloaded file.")
        else:
            hint = ("Close blitcp, then replace your current binary with the "
                    "downloaded file (chmod +x it).")
        m = QMessageBox(self)
        m.setWindowTitle(_tr("Update downloaded"))
        m.setIcon(QMessageBox.Information)
        m.setText("Downloaded to:\n" + dest)
        m.setInformativeText(hint)
        reveal = m.addButton("Reveal in folder", QMessageBox.AcceptRole)
        m.addButton("Close", QMessageBox.RejectRole)
        m.exec()
        if m.clickedButton() is reveal:
            self._reveal(dest)

    def _install_inplace(self, downloaded_path, target):
        """Replace the running GUI binary with the freshly downloaded asset,
        mirroring the CLI self-update swap: Windows renames the locked .exe out
        of the way (current -> .old) then moves the new one in; Linux does an
        atomic os.replace and restores the executable bit. Returns (ok, msg)."""
        try:
            if sys.platform.startswith("win"):
                old = target + ".old"
                try:
                    os.remove(old)
                except OSError:
                    pass
                os.rename(target, old)
                try:
                    os.rename(downloaded_path, target)
                except OSError:
                    # Swap-in failed (AV/lock on the fresh temp). Restore the
                    # original from .old so the app isn't left with NO binary at
                    # its own path, then report the failure.
                    try:
                        os.rename(old, target)
                    except OSError:
                        pass
                    raise
            else:
                try:
                    mode = os.stat(target).st_mode
                except OSError:
                    mode = 0o755
                os.replace(downloaded_path, target)
                os.chmod(target, mode)
            return True, target
        except OSError as e:
            return False, str(e)

    def _prompt_relaunch(self):
        """After an in-place update, offer to restart into the new binary."""
        tag = getattr(self, "_update_tag", "update")
        m = QMessageBox(self)
        m.setWindowTitle(_tr("Update installed"))
        m.setIcon(QMessageBox.Information)
        m.setText(f"blitcp was updated to {tag}.")
        m.setInformativeText("Restart now to use the new version?")
        r = m.addButton("Restart now", QMessageBox.AcceptRole)
        m.addButton("Later", QMessageBox.RejectRole)
        m.exec()
        # update is applied either way; reset the button out of "Download" state
        self._update_tag = None
        self._update_inplace_target = None
        self.upd_btn.setText(_tr("Up to date"))
        if m.clickedButton() is r:
            args = [] if getattr(sys, "frozen", False) else [os.path.abspath(__file__)]
            QProcess.startDetached(sys.executable, args)
            self.close()

    def _reveal(self, path):
        try:
            if sys.platform.startswith("win"):
                subprocess.Popen(["explorer", "/select,", os.path.normpath(path)])
            elif sys.platform == "darwin":
                subprocess.Popen(["open", "-R", path])
            else:
                subprocess.Popen(["xdg-open", os.path.dirname(path)], env=_host_env())
        except Exception:
            pass

    # ───────────────────────────────────────────────────── toast ──
    def show_toast(self, msg):
        self.toast.show_msg(msg)

    def resizeEvent(self, e):
        super().resizeEvent(e)
        if hasattr(self, "toast"):
            self.toast._reposition()


def main():
    # Single-file bundled build: when invoked as the engine, dispatch to
    # blitcp.main() instead of launching the GUI. (No-op for plain .py runs,
    # which shell out to blitcp.py directly.)
    if len(sys.argv) > 1 and sys.argv[1] == "--fc-core":
        if not FC_OK:
            sys.stderr.write("blitcp engine not bundled\n")
            raise SystemExit(2)
        sys.argv = [sys.argv[0]] + sys.argv[2:]
        # Full CLI entry (version/creds/ls/deps/update + copies); fall back to
        # main() for older engines that predate cli_entry().
        entry = getattr(fc, "cli_entry", fc.main)
        raise SystemExit(entry())

    # Windows: give the app its own taskbar identity so it uses OUR icon
    # instead of grouping under the python/pythonw launcher icon.
    if sys.platform.startswith("win"):
        # Clean up the .old binary left by a previous in-place update — the
        # running .exe can't be deleted during the swap, only renamed, so we
        # remove it on the next launch (mirrors the CLI's cli_entry cleanup).
        if getattr(sys, "frozen", False):
            try:
                old = sys.executable + ".old"
                if os.path.exists(old):
                    os.remove(old)
            except OSError:
                pass
        try:
            import ctypes
            ctypes.windll.shell32.SetCurrentProcessExplicitAppUserModelID(
                "gekap.blitcp.gui")
        except Exception:
            pass

    _early_gui_language()
    app = QApplication(sys.argv)
    app.setApplicationName("blitcp")
    app.setApplicationDisplayName("blitcp")
    app.setDesktopFileName("blitcp")     # Wayland/GNOME taskbar association
    if not load_icon_font():
        sys.stderr.write("warning: icon font failed to load; icons may show as boxes\n")
    # window/taskbar icon for the main window and every dialog
    app.setWindowIcon(make_app_icon())
    # prefer Inter if available, else fall back to a clean system UI font
    ui = "Inter"
    if "Inter" not in QFontDatabase.families():
        ui = "Segoe UI" if sys.platform.startswith("win") else \
             ("Helvetica Neue" if sys.platform == "darwin" else "")
    base_font = QFont(ui, 10) if ui else QFont()
    if not ui:
        base_font.setPointSize(10)
    app.setFont(base_font)
    w = BlitcpGUI()
    w.show()
    # If blitcp.py isn't next to the GUI, offer to fetch the matching version.
    QTimer.singleShot(300, w._ensure_core)
    # Quietly check for a new release shortly after launch; pops a popup with the
    # release notes + Download only / Download & install if one is available.
    QTimer.singleShot(1800, w._startup_update_check)
    rc = app.exec()
    if not w._browse_shutdown():
        # A listing is still stuck in a connect: Qt aborts the process if a
        # running QThread is destroyed, so leave without destroying it.
        sys.stdout.flush()
        sys.stderr.flush()
        os._exit(rc)
    sys.exit(rc)


if __name__ == "__main__":
    main()