fix(app): guard store creation and tidy the setup screens

- createStore refuses a non-empty store folder (only .git allowed), so a
  restored, cloned store keeps its .gpg-id
- failed store creation cleans up with deleteWithoutFollowingLinks, which
  also removes a fresh .git
- PGP keys screen: Later goes through the guarded leave path
- Import SSH key row launches via the result launcher so the public key
  row refreshes
- GitServerViewModel.changeUrl always refits the auth mode, also for an
  empty URL

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

4 files changed, 9 insertions, 5 deletions

diff --git a/app/src/main/java/app/passwordstore/ui/settings/RepositorySettings.kt b/app/src/main/java/app/passwordstore/ui/settings/RepositorySettings.kt
index 4b60aae8..af50b3ea 100644
--- a/app/src/main/java/app/passwordstore/ui/settings/RepositorySettings.kt
+++ b/app/src/main/java/app/passwordstore/ui/settings/RepositorySettings.kt
@@ -94,7 +94,7 @@ class RepositorySettings(private val activity: FragmentActivity) : SettingsProvi
         titleRes = R.string.pref_import_ssh_key_title
         visible = PasswordRepository.isGitRepo()
         onClick {
-          activity.startActivity(MainActivity.setupIntent(activity, SetupStart.Ssh))
+          generateSshKey.launch(MainActivity.setupIntent(activity, SetupStart.Ssh))
           true
         }
       }
diff --git a/app/src/main/java/app/passwordstore/ui/setup/GitServerViewModel.kt b/app/src/main/java/app/passwordstore/ui/setup/GitServerViewModel.kt
index d549624e..5995bf5b 100644
--- a/app/src/main/java/app/passwordstore/ui/setup/GitServerViewModel.kt
+++ b/app/src/main/java/app/passwordstore/ui/setup/GitServerViewModel.kt
@@ -68,7 +68,7 @@ constructor(
 
   fun changeUrl(value: String) {
     url = value
-    if (value.isNotEmpty()) authMode = fitAuthMode(value.trim(), authMode)
+    authMode = fitAuthMode(value.trim(), authMode)
   }
 
   fun clearHostKey() {
diff --git a/app/src/main/java/app/passwordstore/ui/setup/PgpKeysScreen.kt b/app/src/main/java/app/passwordstore/ui/setup/PgpKeysScreen.kt
index 1f0c9599..9ba96bbb 100644
--- a/app/src/main/java/app/passwordstore/ui/setup/PgpKeysScreen.kt
+++ b/app/src/main/java/app/passwordstore/ui/setup/PgpKeysScreen.kt
@@ -292,7 +292,7 @@ fun PgpKeysDestination(
       onImport = { picker.launch(arrayOf("*/*")) },
       onSelect = ::choose,
       onDelete = viewModel::deleteKey,
-      onLater = onDone,
+      onLater = ::leave,
       onBack = ::leave,
     )
     when (val result = viewModel.importResult) {
diff --git a/app/src/main/java/app/passwordstore/ui/setup/PgpKeysViewModel.kt b/app/src/main/java/app/passwordstore/ui/setup/PgpKeysViewModel.kt
index ed7fcf37..afb65265 100644
--- a/app/src/main/java/app/passwordstore/ui/setup/PgpKeysViewModel.kt
+++ b/app/src/main/java/app/passwordstore/ui/setup/PgpKeysViewModel.kt
@@ -21,6 +21,7 @@ import app.passwordstore.crypto.PGPKeyManager
 import app.passwordstore.crypto.errors.KeyAlreadyExistsException
 import app.passwordstore.crypto.errors.KeyDowngradeException
 import app.passwordstore.data.repo.PasswordRepository
+import app.passwordstore.ui.list.deleteWithoutFollowingLinks
 import app.passwordstore.util.coroutines.DispatcherProvider
 import com.github.michaelbull.result.onSuccess
 import dagger.hilt.android.lifecycle.HiltViewModel
@@ -211,6 +212,9 @@ constructor(
    */
   suspend fun createStore(root: File, row: KeyRow): String? =
     withContext(dispatcherProvider.io()) {
+      // A restored, already-cloned store must keep its .gpg-id.
+      if (root.isDirectory && cloneTarget(root) == CloneTarget.Occupied)
+        return@withContext "the folder is not empty"
       try {
         check(root.isDirectory || root.mkdirs()) { "Could not create $root" }
         PasswordRepository.createRepository(root)
@@ -229,8 +233,8 @@ constructor(
 
   private fun failed(root: File, e: Exception): String {
     logcat(ERROR) { e.asLog() }
-    // Only removes the folder while it is still empty, as the old onboarding did.
-    root.delete()
+    // Removes what this attempt made, including a fresh .git, without following links.
+    root.deleteWithoutFollowingLinks()
     return e.message.orEmpty()
   }