lsshm.sh

#!/usr/bin/env bash
# =============================================================================
# LSSHM - Local SSH Manager
# Version: 0.4.1
# Built:   2026-07-30T18:14:36Z
#
# This file is generated by scripts/build.sh from the modules in src/.
# Do not edit it by hand; edit the modules and rebuild.
#
# A simple local OpenSSH server, client, user access and key management tool
# for Linux (Windows support is planned through lsshm.ps1).
# =============================================================================

set -euo pipefail


# ===== src/common.sh ===================================================
# shellcheck shell=bash
# =============================================================================
# common.sh - shared helpers: version, paths, logging, prompts, temp files
# =============================================================================
# This module has no dependencies on other LSSHM modules and must be sourced
# (or concatenated) first.

# The build script replaces the token below with the content of the VERSION
# file. When running directly from src/ the token stays literal and the guard
# below falls back to a development version string.
LSSHM_VERSION="0.4.1"
case "$LSSHM_VERSION" in
    *@@*) LSSHM_VERSION="0.4.1-dev" ;;
esac

LSSHM_NAME="LSSHM"
LSSHM_LONG_NAME="LSSHM - Local SSH Manager"
LSSHM_REPO_RAW="${LSSHM_REPO_RAW:-https://raw.githubusercontent.com/sannier3/lsshm/preview}"

# -----------------------------------------------------------------------------
# XDG base directories
# -----------------------------------------------------------------------------
lsshm_init_paths() {
    LSSHM_HOME="${HOME:-/root}"
    LSSHM_XDG_CONFIG="${XDG_CONFIG_HOME:-$LSSHM_HOME/.config}"
    LSSHM_XDG_DATA="${XDG_DATA_HOME:-$LSSHM_HOME/.local/share}"
    LSSHM_XDG_STATE="${XDG_STATE_HOME:-$LSSHM_HOME/.local/state}"
    LSSHM_XDG_CACHE="${XDG_CACHE_HOME:-$LSSHM_HOME/.cache}"
    LSSHM_BIN_DIR="$LSSHM_HOME/.local/bin"

    LSSHM_CONFIG_DIR="$LSSHM_XDG_CONFIG/lsshm"
    LSSHM_DATA_DIR="$LSSHM_XDG_DATA/lsshm"
    LSSHM_STATE_DIR="$LSSHM_XDG_STATE/lsshm"
    LSSHM_CACHE_DIR="$LSSHM_XDG_CACHE/lsshm"

    LSSHM_CONFIG_FILE="$LSSHM_CONFIG_DIR/config"
    LSSHM_BACKUP_DIR="$LSSHM_STATE_DIR/backups"
    LSSHM_LOG_FILE="$LSSHM_STATE_DIR/lsshm.log"
    LSSHM_INSTALL_TARGET="$LSSHM_DATA_DIR/lsshm.sh"
    LSSHM_BIN_LINK="$LSSHM_BIN_DIR/lsshm"
}

# -----------------------------------------------------------------------------
# Colors (disabled when not writing to a terminal or NO_COLOR is set)
# -----------------------------------------------------------------------------
lsshm_init_colors() {
    if [ -t 1 ] && [ -z "${NO_COLOR:-}" ] && [ "${LSSHM_NO_COLOR:-0}" != "1" ] \
        && [ "${LSSHM_UI_MODE:-0}" != "1" ]; then
        LSSHM_C_RESET="$(printf '\033[0m')"
        LSSHM_C_BOLD="$(printf '\033[1m')"
        LSSHM_C_DIM="$(printf '\033[2m')"
        LSSHM_C_RED="$(printf '\033[31m')"
        LSSHM_C_GREEN="$(printf '\033[32m')"
        LSSHM_C_YELLOW="$(printf '\033[33m')"
    else
        LSSHM_C_RESET=""; LSSHM_C_BOLD=""; LSSHM_C_DIM=""
        LSSHM_C_RED=""; LSSHM_C_GREEN=""; LSSHM_C_YELLOW=""
    fi
}

# Remove ANSI escape sequences (dialog and programbox do not render them).
lsshm_strip_ansi() {
    sed $'s/\033\\[[0-9;]*[a-zA-Z]//g'
}

lsshm_strip_ansi_file() {
    local f="$1" tmp
    tmp="$(lsshm_mktemp)"
    lsshm_strip_ansi <"$f" >"$tmp" && mv "$tmp" "$f"
}

# -----------------------------------------------------------------------------
# Logging
# -----------------------------------------------------------------------------
lsshm_log() {
    # lsshm_log LEVEL MESSAGE...
    local level="$1"; shift
    local msg="$*"
    if [ -n "${LSSHM_LOG_FILE:-}" ]; then
        local dir; dir="$(dirname "$LSSHM_LOG_FILE")"
        if [ -d "$dir" ] || mkdir -p "$dir" 2>/dev/null; then
            printf '%s [%s] %s\n' "$(date '+%Y-%m-%dT%H:%M:%S%z')" "$level" "$msg" \
                >>"$LSSHM_LOG_FILE" 2>/dev/null || true
        fi
    fi
}

# These helpers take a translatable format string (English msgid) followed by
# optional printf arguments, e.g. lsshm_ok 'Key added for %s.' "$user".
# The message is translated via lsshm_t and formatted with the given arguments.
lsshm_info()  { local m; m="$(lsshm_tf "$@")"; printf '%s\n' "$m"; lsshm_log INFO "$m"; }
lsshm_note()  { local m; m="$(lsshm_tf "$@")"; printf '%s%s%s\n' "${LSSHM_C_DIM:-}" "$m" "${LSSHM_C_RESET:-}" >&2; lsshm_log INFO "$m"; }
lsshm_ok()    { local m; m="$(lsshm_tf "$@")"; printf '%s%s%s\n' "${LSSHM_C_GREEN:-}" "$m" "${LSSHM_C_RESET:-}"; lsshm_log OK "$m"; }
lsshm_warn()  { local m; m="$(lsshm_tf "$@")"; printf '%s%s%s\n' "${LSSHM_C_YELLOW:-}" "$m" "${LSSHM_C_RESET:-}" >&2; lsshm_log WARN "$m"; }
lsshm_error() { local m; m="$(lsshm_tf "$@")"; printf '%s%s%s\n' "${LSSHM_C_RED:-}" "$m" "${LSSHM_C_RESET:-}" >&2; lsshm_log ERROR "$m"; }

lsshm_die() {
    lsshm_error "$@"
    exit 1
}

lsshm_header() {
    printf '%s%s%s\n' "${LSSHM_C_BOLD:-}" "$LSSHM_LONG_NAME" "${LSSHM_C_RESET:-}"
    printf '%sv%s%s\n\n' "${LSSHM_C_DIM:-}" "$LSSHM_VERSION" "${LSSHM_C_RESET:-}"
}

# -----------------------------------------------------------------------------
# Prompts
# -----------------------------------------------------------------------------
# True when stdin/stdout is a TTY, or when /dev/tty is available (IDE
# terminals, sudo, Git Bash on Windows often lack -t 0 but still have /dev/tty).
lsshm_have_tty() {
    [ -e /dev/tty ] 2>/dev/null && [ -r /dev/tty ] && [ -w /dev/tty ]
}

lsshm_is_interactive() {
    [ "${LSSHM_ASSUME_YES:-0}" != "1" ] || return 1
    [ -t 0 ] && [ -t 1 ] && return 0
    lsshm_have_tty && return 0
    return 1
}

lsshm_require_interactive() {
    if lsshm_is_interactive; then
        return 0
    fi
    lsshm_error 'An interactive terminal is required for the menu.'
    lsshm_info 'Without a menu: lsshm status | lsshm doctor | lsshm server status | lsshm key list'
    lsshm_info 'To install: curl -fsSL .../lsshm.sh | bash -s -- install'
    exit 1
}

lsshm_tty_restore() {
    stty sane 2>/dev/null || true
}

lsshm_uses_dialog_ui() {
    [ "${LSSHM_UI_MODE:-0}" = "1" ] && lsshm_have dialog
}

# Read one line from stdin or /dev/tty. Sets the named variable on success.
lsshm_read_line() {
    local __var="$1" __prompt="$2" __line=""
    if [ -t 0 ]; then
        IFS= read -r -p "$__prompt" __line || return 1
    elif lsshm_have_tty; then
        IFS= read -r -p "$__prompt" __line </dev/tty || return 1
    else
        return 1
    fi
    printf -v "$__var" '%s' "$__line"
    return 0
}

lsshm_prompt() {
    # lsshm_prompt PROMPT [DEFAULT] -> echoes answer
    local prompt="$1" default="${2:-}" answer="" msg=""
    if ! lsshm_is_interactive; then
        [ -n "$default" ] && { printf '%s' "$default"; return 0; }
        return 1
    fi
    if lsshm_uses_dialog_ui; then
        lsshm_tty_restore
        answer="$(dialog --inputbox "$prompt" 10 70 "$default" 3>&1 1>&2 2>&3)" || answer="$default"
        printf '%s' "${answer:-$default}"
        return 0
    fi
    if [ -n "$default" ]; then
        msg="${prompt} [${default}]: "
    else
        msg="${prompt}: "
    fi
    if lsshm_read_line answer "$msg"; then
        printf '%s' "${answer:-$default}"
    else
        printf '%s' "$default"
    fi
}

lsshm_confirm() {
    # lsshm_confirm PROMPT [default_yes] -> return 0 for yes
    local prompt="$1" default="${2:-no}" answer="" hint="[y/N]"
    if [ "${LSSHM_ASSUME_YES:-0}" = "1" ]; then
        return 0
    fi
    if ! lsshm_is_interactive; then
        [ "$default" = "yes" ]
        return
    fi
    if lsshm_uses_dialog_ui; then
        lsshm_tty_restore
        if dialog --backtitle "$LSSHM_LONG_NAME v$LSSHM_VERSION" \
            --yesno "$prompt" 10 70 3>&1 1>&2 2>&3; then
            return 0
        fi
        return 1
    fi
    [ "$default" = "yes" ] && hint="[Y/n]"
    if ! lsshm_read_line answer "${prompt} ${hint} "; then
        [ "$default" = "yes" ]
        return
    fi
    answer="$(printf '%s' "$answer" | tr '[:upper:]' '[:lower:]')"
    # Accept English, French and Spanish affirmatives/negatives.
    case "$answer" in
        y|yes|o|oui|s|si|sí) return 0 ;;
        n|no|non)            return 1 ;;
        "")                  [ "$default" = "yes" ] ;;
        *)                   return 1 ;;
    esac
}

lsshm_pause() {
    if lsshm_uses_dialog_ui; then
        return 0
    fi
    lsshm_is_interactive || return 0
    lsshm_read_line _ "$(lsshm_t 'Press Enter to continue... ')" || true
}

# Run a command from a menu without aborting the loop under set -e.
lsshm_menu_try() {
    "$@" || true
    return 0
}

# Interactive menu action: run (ignore failure/cancel), then pause in CLI mode.
lsshm_menu_action() {
    "$@" || true
    if ! lsshm_uses_dialog_ui; then
        lsshm_pause
    fi
    return 0
}

# -----------------------------------------------------------------------------
# Temporary files (tracked and cleaned on exit)
# -----------------------------------------------------------------------------
LSSHM_TMPFILES=()
# Side-channel list so temps created inside $(...) still get cleaned on EXIT.
LSSHM_TMPTRACK=""

lsshm_mktemp() {
    # Usage: lsshm_mktemp [persist]
    # "persist" skips cleanup tracking (rollback helper scripts must survive EXIT).
    local mode="${1:-}" tmp
    tmp="$(mktemp "${TMPDIR:-/tmp}/lsshm.XXXXXX")" || lsshm_die 'Unable to create a temporary file.'
    if [ "$mode" != "persist" ]; then
        LSSHM_TMPFILES+=("$tmp")
        if [ -n "${LSSHM_TMPTRACK:-}" ]; then
            printf '%s\n' "$tmp" >>"$LSSHM_TMPTRACK" 2>/dev/null || true
        fi
    fi
    printf '%s' "$tmp"
}

lsshm_cleanup() {
    local f
    for f in "${LSSHM_TMPFILES[@]:-}"; do
        [ -n "$f" ] && rm -f "$f" 2>/dev/null || true
    done
    if [ -n "${LSSHM_TMPTRACK:-}" ] && [ -f "$LSSHM_TMPTRACK" ]; then
        while IFS= read -r f || [ -n "$f" ]; do
            [ -n "$f" ] && rm -f "$f" 2>/dev/null || true
        done <"$LSSHM_TMPTRACK"
        rm -f "$LSSHM_TMPTRACK" 2>/dev/null || true
    fi
}

# -----------------------------------------------------------------------------
# Small utilities
# -----------------------------------------------------------------------------
lsshm_have() { command -v "$1" >/dev/null 2>&1; }

lsshm_yesno_label() {
    case "$1" in
        yes|true|on|1) lsshm_t 'yes' ;;
        no|false|off|0) lsshm_t 'no' ;;
        "") lsshm_t 'not set' ;;
        *) printf '%s' "$1" ;;
    esac
}

# Ensure the runtime directories exist.
lsshm_ensure_dirs() {
    local d
    for d in "$LSSHM_CONFIG_DIR" "$LSSHM_DATA_DIR" "$LSSHM_STATE_DIR" \
             "$LSSHM_CACHE_DIR" "$LSSHM_BACKUP_DIR"; do
        [ -d "$d" ] || mkdir -p "$d" 2>/dev/null || true
    done
    # Init temp tracking file once state dir is available (survives subshells).
    if [ -z "${LSSHM_TMPTRACK:-}" ] && [ -d "$LSSHM_STATE_DIR" ]; then
        LSSHM_TMPTRACK="$LSSHM_STATE_DIR/tmpfiles.$$"
        : >"$LSSHM_TMPTRACK" 2>/dev/null || LSSHM_TMPTRACK=""
    fi
}

# ===== src/i18n.sh =====================================================
# shellcheck shell=bash
# =============================================================================
# i18n.sh - internationalization (message catalogs + language selection)
# =============================================================================
# LSSHM source strings are written in English (the msgid). Translations are
# stored in per-language associative arrays keyed by the English msgid.
# A missing translation falls back to English, so the tool is always usable
# even with an incomplete catalog.
#
# Adding a language:
#   1. Add its code to LSSHM_LANGS and a native name in lsshm_lang_native_name.
#   2. Declare LSSHM_MSG_<code> and populate it below (mirror the fr catalog).
#   3. Handle it in lsshm_t and lsshm_detect_lang.
# This module must be sourced (or concatenated) right after common.sh.

# Supported language codes (space separated). English is the built-in default.
LSSHM_LANGS="en fr es"
LSSHM_LANG="${LSSHM_LANG:-en}"

# Global catalogs (must use -g: i18n.sh is sourced from functions in tests/build).
declare -gA LSSHM_MSG_fr
declare -gA LSSHM_MSG_es

# -----------------------------------------------------------------------------
# Lookup helpers
# -----------------------------------------------------------------------------
# lsshm_t MSGID -> prints the translated string (no newline). English falls
# back to the msgid itself, as does any missing translation.
lsshm_t() {
    local msgid="${1-}" out="" nounset_was=0
    # Bash + set -u treats missing associative-array keys as unbound variables.
    # Disable nounset only for the catalog lookup.
    case "${LSSHM_LANG-}" in
        fr|es)
            [[ $- == *u* ]] && nounset_was=1
            set +u
            if [ "${LSSHM_LANG}" = "fr" ]; then
                out="${LSSHM_MSG_fr[$msgid]}"
            else
                out="${LSSHM_MSG_es[$msgid]}"
            fi
            [ "$nounset_was" = 1 ] && set -u
            ;;
    esac
    if [ -n "${out}" ]; then
        printf '%s' "$out"
    else
        printf '%s' "$msgid"
    fi
}

# lsshm_tf MSGID [ARGS...] -> printf the translated format string with ARGS.
lsshm_tf() {
    local fmt; fmt="$(lsshm_t "$1")"; shift
    # shellcheck disable=SC2059
    printf "$fmt" "$@"
}

# lsshm_out MSGID [ARGS...] -> like lsshm_tf but appends a newline (stdout).
lsshm_out() {
    local fmt; fmt="$(lsshm_t "$1")"; shift
    # shellcheck disable=SC2059
    printf "$fmt\n" "$@"
}

# -----------------------------------------------------------------------------
# Language codes and names
# -----------------------------------------------------------------------------
lsshm_lang_is_supported() {
    case " $LSSHM_LANGS " in
        *" $1 "*) return 0 ;;
        *) return 1 ;;
    esac
}

lsshm_lang_native_name() {
    case "$1" in
        en) printf 'English' ;;
        fr) printf 'Français' ;;
        es) printf 'Español' ;;
        *)  printf '%s' "$1" ;;
    esac
}

# Detect the preferred language from the environment locale.
lsshm_detect_lang() {
    local l="${LC_ALL:-${LC_MESSAGES:-${LANG:-}}}"
    l="${l%%.*}"       # drop encoding (fr_FR.UTF-8 -> fr_FR)
    l="${l%%@*}"       # drop modifier
    l="${l%%_*}"       # drop territory (fr_FR -> fr)
    l="$(printf '%s' "$l" | tr '[:upper:]' '[:lower:]')"
    case "$l" in
        fr) printf 'fr' ;;
        es) printf 'es' ;;
        en) printf 'en' ;;
        *)  printf 'en' ;;
    esac
}

# Resolve the active language: explicit override > config > locale detection.
lsshm_i18n_init() {
    local want=""
    if [ -n "${LSSHM_LANG_OVERRIDE:-}" ]; then
        want="$LSSHM_LANG_OVERRIDE"
    elif [ -n "${LSSHM_CFG_LANG:-}" ]; then
        want="$LSSHM_CFG_LANG"
    else
        want="$(lsshm_detect_lang)"
    fi
    if lsshm_lang_is_supported "$want"; then
        LSSHM_LANG="$want"
    else
        LSSHM_LANG="en"
    fi
    export LSSHM_LANG
}

# True when the user has never chosen a language (no value stored in config).
lsshm_i18n_configured() {
    [ -n "${LSSHM_CFG_LANG:-}" ]
}

# Interactive language picker. Preselects the detected system language.
# Persists the choice to the configuration file when possible.
lsshm_i18n_choose() {
    local detected def i=0 code choice
    detected="$(lsshm_detect_lang)"

    printf '\n' >&2
    printf 'Language / Langue / Idioma:\n' >&2
    local -a codes=()
    for code in $LSSHM_LANGS; do
        i=$((i + 1))
        codes+=("$code")
        printf '  %d. %s\n' "$i" "$(lsshm_lang_native_name "$code")" >&2
        [ "$code" = "$detected" ] && def="$i"
    done
    def="${def:-1}"

    # || true: a failed prompt under set -e must not abort LSSHM.
    choice="$(lsshm_prompt "Choice / Choix / Elección" "$def" || true)"
    [ -n "$choice" ] || choice="$def"

    local picked=""
    if [[ "$choice" =~ ^[0-9]+$ ]] && [ "$choice" -ge 1 ] && [ "$choice" -le "${#codes[@]}" ]; then
        picked="${codes[$((choice - 1))]}"
    elif lsshm_lang_is_supported "$choice"; then
        picked="$choice"
    else
        picked="$detected"
    fi

    LSSHM_LANG="$picked"
    export LSSHM_LANG
    LSSHM_CFG_LANG="$picked"
    lsshm_config_set language "$picked" 2>/dev/null || true
    lsshm_out 'Language set to: %s' "$(lsshm_lang_native_name "$picked")"
}

# =============================================================================
# French catalog (fr)
# =============================================================================
declare -gA LSSHM_MSG_fr=(
    # --- common.sh -----------------------------------------------------------
    ["Press Enter to continue... "]="Appuyez sur Entrée pour continuer... "
    ["An interactive terminal is required for the menu."]="Un terminal interactif est requis pour le menu."
    ["Without a menu: lsshm status | lsshm doctor | lsshm server status | lsshm key list"]="Sans menu : lsshm status | lsshm doctor | lsshm server status | lsshm key list"
    ["To install: curl -fsSL .../lsshm.sh | bash -s -- install"]="Pour installer : curl -fsSL .../lsshm.sh | bash -s -- install"
    ["Unable to create a temporary file."]="Impossible de créer un fichier temporaire."
    ["yes"]="oui"
    ["no"]="non"
    ["not set"]="non défini"

    # --- i18n.sh -------------------------------------------------------------
    ["Language set to: %s"]="Langue définie sur : %s"

    # --- platform.sh ---------------------------------------------------------
    ["Distribution        : %s"]="Distribution        : %s"
    ["Identifier          : %s"]="Identifiant         : %s"
    ["Package manager     : %s"]="Gestionnaire paquet : %s"
    ["Service manager     : %s"]="Gestionnaire service: %s"
    ["systemd             : %s"]="systemd             : %s"
    ["Virtualization      : %s"]="Virtualisation      : %s"
    ["sshd binary         : %s"]="Binaire sshd        : %s"
    ["SSH service         : %s"]="Service SSH         : %s"
    ["present"]="présent"
    ["absent"]="absent"
    ["not detected"]="non détecté"

    # --- privileges.sh -------------------------------------------------------
    ["This operation requires root privileges, but sudo was not found."]="Cette opération nécessite les privilèges root, mais sudo est introuvable."
    ["sudo authentication required (non-interactive session)."]="Authentification sudo requise (session non interactive)."
    ["Administrator authentication (sudo) — once for this session."]="Authentification administrateur (sudo) — une seule fois pour cette session."
    ["sudo authentication failed."]="Échec de l'authentification sudo."
    ["Privileged operation not possible: run LSSHM as root or install sudo."]="Opération privilégiée impossible : exécutez LSSHM en root ou installez sudo."
    ["Empty username."]="Nom d'utilisateur vide."
    ["Unknown user: %s"]="Utilisateur inconnu : %s"
    ["Managed user: %s (%s/.ssh)"]="Utilisateur administré : %s (%s/.ssh)"
    ["Available local users:"]="Utilisateurs locaux disponibles :"
    ["No local user detected."]="Aucun utilisateur local détecté."
    ["User to manage (number or name)"]="Utilisateur à administrer (numéro ou nom)"
    ["Number out of range (1-%s)."]="Numéro hors plage (1-%s)."
    ["%s is running with sudo."]="%s est exécuté avec sudo."
    ["Calling user   : %s"]="Utilisateur appelant  : %s"
    ["Privileged user: root"]="Utilisateur privilégié: root"
    ["Whose personal SSH files should be managed?"]="Les fichiers SSH personnels de quel utilisateur faut-il gérer ?"
    ["  1. %s (recommended)"]="  1. %s (recommandé)"
    ["  2. %s"]="  2. %s"
    ["  2. root"]="  2. root"
    ["  3. Choose another user"]="  3. Choisir un autre utilisateur"
    ["%s is running as root."]="%s est exécuté en root."
    ["You can manage another user's SSH (keys, access, hosts)."]="Vous pouvez administrer le SSH d'un autre utilisateur (clés, accès, hosts)."
    ["  1. root"]="  1. root"
    ["  2. Choose another user"]="  2. Choisir un autre utilisateur"

    # --- users.sh ------------------------------------------------------------
    ["Local users:"]="Utilisateurs locaux :"

    # --- server.sh -----------------------------------------------------------
    ["Automatic enable/disable is not handled for SysV here."]="Activation/désactivation automatique non gérée pour SysV ici."
    ["Unknown service manager: cannot run '%s'."]="Gestionnaire de service inconnu : impossible d'exécuter '%s'."
    ["SSH service started."]="Service SSH démarré."
    ["SSH service stopped."]="Service SSH arrêté."
    ["SSH service restarted."]="Service SSH redémarré."
    ["Automatic startup enabled."]="Démarrage automatique activé."
    ["Automatic startup disabled."]="Démarrage automatique désactivé."
    ["Invalid configuration: reload cancelled."]="Configuration invalide : rechargement annulé."
    ["SSH service reloaded."]="Service SSH rechargé."
    ["OpenSSH Server is not installed (sshd binary not found)."]="OpenSSH Server n'est pas installé (binaire sshd introuvable)."
    ["SSH server status : %s"]="État du serveur SSH : %s"
    ["Auto-start        : %s"]="Démarrage auto      : %s"
    ["Port              : %s"]="Port                : %s"
    ["Address family    : %s"]="Famille d'adresses  : %s"
    ["Listen addresses  : %s"]="Adresses d'écoute   : %s"
    ["Root access       : %s"]="Accès root          : %s"
    ["Password auth.    : %s"]="Auth. mot de passe  : %s"
    ["Key auth.         : %s"]="Auth. par clé       : %s"
    ["active"]="actif"
    ["inactive"]="inactif"
    ["OpenSSH Server is already installed: %s"]="OpenSSH Server est déjà installé : %s"
    ["Installing OpenSSH Server..."]="Installation d'OpenSSH Server..."
    ["Unsupported package manager: %s"]="Gestionnaire de paquets non pris en charge : %s"
    ["OpenSSH Server installed."]="OpenSSH Server installé."
    ["The installation appears to have failed."]="L'installation semble avoir échoué."
    ["No SSH log source detected."]="Aucune source de journaux SSH détectée."

    # --- server_config.sh ----------------------------------------------------
    ["sshd binary not found: validation not possible."]="Binaire sshd introuvable : validation impossible."
    ["sshd -t reported an error:"]="sshd -t a signalé une erreur :"
    ["The main config file does not include sshd_config.d/."]="Le fichier principal n'inclut pas sshd_config.d/."
    ["The file managed by LSSHM might be ignored."]="Le fichier géré par LSSHM pourrait être ignoré."
    ["'%s' is defined in %s before the Include."]="'%s' est défini dans %s avant l'Include."
    ["This value will take precedence over the file managed by LSSHM."]="Cette valeur prévaudra sur le fichier géré par LSSHM."
    ["Comment out this definition in the main file?"]="Commenter cette définition dans le fichier principal ?"
    ["New configuration invalid: rolling back."]="Nouvelle configuration invalide : annulation."
    ["Directive applied: %s %s"]="Directive appliquée : %s %s"
    ["Effective value (sshd -T): %s"]="Valeur effective (sshd -T) : %s"
    ["Expected: %s - another definition may still take precedence."]="Attendu : %s - une autre définition peut encore prévaloir."
    ["forbidden"]="interdit"
    ["key only"]="clé uniquement"
    ["key or password"]="clé ou mot de passe"
    ["forced commands only"]="commandes imposées"
    ["SSH root login"]="Connexion SSH de root"
    ["  1. Forbid root entirely"]="  1. Interdire totalement root"
    ["  2. Allow root with a key only"]="  2. Autoriser root uniquement avec une clé"
    ["  3. Allow root with a key or a password"]="  3. Autoriser root avec une clé ou un mot de passe"
    ["  4. Allow root only for forced commands"]="  4. Autoriser root uniquement pour des commandes imposées"
    ["Recommendation: allow root with a key only,"]="Recommandation : autoriser root uniquement avec une clé,"
    ["or use a normal user with sudo."]="ou utiliser un utilisateur normal possédant sudo."
    ["No change."]="Aucun changement."
    ["root access change"]="modification de l'accès root"
    ["Current password authentication: %s"]="Authentification par mot de passe actuelle : %s"
    ["Allow password authentication?"]="Autoriser l'authentification par mot de passe ?"
    ["Disabling passwords may lock you out without a valid key."]="Désactiver les mots de passe peut vous verrouiller sans clé valide."
    ["disabling passwords"]="désactivation des mots de passe"
    ["Allow public key authentication?"]="Autoriser l'authentification par clé publique ?"
    ["Disabling key authentication may lock you out."]="Désactiver l'authentification par clé peut vous verrouiller."
    ["disabling key authentication"]="désactivation de l'authentification par clé"
    ["New SSH port"]="Nouveau port SSH"
    ["Invalid port."]="Port invalide."
    ["Port out of range (1-65535)."]="Port hors plage (1-65535)."
    ["Check your firewall before changing the port."]="Vérifiez votre pare-feu avant de changer le port."
    ["port change"]="changement du port"
    ["address family change"]="changement de famille d'adresses"
    ["listen address change"]="changement des adresses d'écoute"
    ["SSH address family (AddressFamily)"]="Famille d'adresses SSH (AddressFamily)"
    ["Current: %s"]="Actuel : %s"
    ["  1. any   (IPv4 + IPv6, OpenSSH default)"]="  1. any   (IPv4 + IPv6, défaut OpenSSH)"
    ["  2. inet  (IPv4 only)"]="  2. inet  (IPv4 uniquement)"
    ["  3. inet6 (IPv6 only)"]="  3. inet6 (IPv6 uniquement)"
    ["SSH listen addresses (ListenAddress)"]="Adresses d'écoute SSH (ListenAddress)"
    ["Examples: 0.0.0.0   ::   192.168.1.10   0.0.0.0 ::"]="Exemples : 0.0.0.0   ::   192.168.1.10   0.0.0.0 ::"
    ["Empty input restores OpenSSH defaults (all interfaces)."]="Une saisie vide restaure les défauts OpenSSH (toutes les interfaces)."
    ["Listen addresses (space-separated)"]="Adresses d'écoute (séparées par des espaces)"
    ["Directive removed from managed file: %s"]="Directive retirée du fichier géré : %s"
    ["Directive applied: %s (%s)"]="Directive appliquée : %s (%s)"
    ["Current AllowUsers: %s"]="AllowUsers actuel : %s"
    ["Allowed users (space-separated, empty = remove)"]="Utilisateurs autorisés (séparés par des espaces, vide = supprimer)"
    ["Removing AllowUsers is not handled automatically (edit the managed file)."]="Suppression de AllowUsers non gérée automatiquement (éditez le fichier géré)."
    ["AllowUsers change"]="modification de AllowUsers"
    ["Current AllowGroups: %s"]="AllowGroups actuel : %s"
    ["Allowed groups (space-separated)"]="Groupes autorisés (séparés par des espaces)"
    ["AllowGroups change"]="modification de AllowGroups"
    ["sshd -T unavailable. Detected configuration files:"]="sshd -T indisponible. Fichiers de configuration détectés :"

    # --- rollback.sh ---------------------------------------------------------
    ["Sensitive change not possible without an interactive terminal: %s"]="Changement sensible impossible sans terminal interactif : %s"
    ["A TTY is required to confirm the new SSH session works."]="Un TTY est requis pour confirmer que la nouvelle session SSH fonctionne."
    ["Sensitive change: %s"]="Changement sensible : %s"
    ["Continue with an automatic safety rollback?"]="Continuer avec une restauration automatique de sécurité ?"
    ["Cancelled."]="Annulé."
    ["Change application cancelled."]="Application annulée."
    ["The SSH port is listening."]="Le port SSH écoute."
    ["Unable to confirm the SSH port is listening."]="Impossible de confirmer que le port SSH écoute."
    ["The new configuration is active."]="La nouvelle configuration est active."
    ["An automatic rollback will occur in %s seconds."]="Une restauration automatique aura lieu dans %s secondes."
    ["Open a second SSH connection before confirming."]="Ouvrez une seconde connexion SSH avant de confirmer."
    ["  1. The new connection works"]="  1. La nouvelle connexion fonctionne"
    ["  2. Restore immediately"]="  2. Restaurer immédiatement"
    ["Automatic rollback cancelled. Change kept."]="Restauration automatique annulée. Changement conservé."
    ["Restoring immediately..."]="Restauration immédiate..."
    ["Previous configuration restored."]="Configuration précédente restaurée."

    # --- backup.sh -----------------------------------------------------------
    ["No server configuration to back up."]="Aucune configuration serveur à sauvegarder."
    ["Backup created: %s"]="Sauvegarde créée : %s"
    ["Server configuration backup failed."]="Échec de la sauvegarde de la configuration serveur."
    ["No backups recorded."]="Aucune sauvegarde enregistrée."
    ["Backups in %s:"]="Sauvegardes dans %s :"
    ["Backup archive not found: %s"]="Archive introuvable : %s"
    ["Restoring server configuration from: %s"]="Restauration de la configuration serveur depuis : %s"
    ["Confirm the restore?"]="Confirmer la restauration ?"
    ["Configuration restored."]="Configuration restaurée."
    ["Restore failed."]="Échec de la restauration."
    ["Backup and restore"]="Sauvegarde et restauration"
    ["  1. Back up the SSH server configuration"]="  1. Sauvegarder la configuration du serveur SSH"
    ["  2. Back up authorized keys (authorized_keys)"]="  2. Sauvegarder les clés autorisées (authorized_keys)"
    ["Back up authorized keys (authorized_keys)"]="Sauvegarder les clés autorisées (authorized_keys)"
    ["  3. List backups"]="  3. Lister les sauvegardes"
    ["  4. Restore a server configuration"]="  4. Restaurer une configuration serveur"
    ["  5. Back"]="  5. Retour"
    ["Archive name to restore"]="Nom de l'archive à restaurer"

    # --- authorized_keys.sh --------------------------------------------------
    ["User : %s"]="Utilisateur : %s"
    ["File : %s"]="Fichier     : %s"
    ["No authorized key."]="Aucune clé autorisée."
    ["DISABLED"]="DÉSACTIVÉE"
    ["no comment"]="sans commentaire"
    ["   Type        : %s (%s bits)"]="   Type       : %s (%s bits)"
    ["   Fingerprint : %s"]="   Empreinte  : %s"
    ["   Restriction : %s"]="   Restriction : %s"
    ["   Command     : %s"]="   Commande    : %s"
    ["   Forwarding  : forbidden"]="   Transfert  : interdit"
    ["unknown"]="inconnue"
    ["Paste the public key (one line), then Enter:"]="Collez la clé publique (une ligne), puis Entrée :"
    ["No key provided."]="Aucune clé fournie."
    ["The provided key is not a valid public key."]="La clé fournie n'est pas une clé publique valide."
    ["This key already exists (disabled, fingerprint %s)."]="Cette clé existe déjà (désactivée, empreinte %s)."
    ["Re-enable it via the Disable / re-enable a key entry."]="Réactivez-la via « Désactiver / réactiver une clé »."
    ["This key is already authorized (fingerprint %s)."]="Cette clé est déjà autorisée (empreinte %s)."
    ["Key added for %s."]="Clé ajoutée pour %s."
    ["No key to remove."]="Aucune clé à supprimer."
    ["SHA256 fingerprint or number to remove"]="Empreinte SHA256 ou numéro à supprimer"
    ["No matching key found."]="Aucune clé correspondante trouvée."
    ["Key removed for %s."]="Clé supprimée pour %s."
    ["%s does not exist."]="%s n'existe pas."
    ["Permissions repaired for %s:"]="Permissions réparées pour %s :"
    ["  .ssh 700, authorized_keys 600, private keys 600, public keys 644"]="  .ssh 700, authorized_keys 600, clés privées 600, clés publiques 644"
    ["No key to disable."]="Aucune clé à désactiver."
    ["SHA256 fingerprint or number to disable/re-enable"]="Empreinte SHA256 ou numéro à désactiver/réactiver"
    ["Key state updated for %s."]="État de la clé mis à jour pour %s."
    ["No key."]="Aucune clé."
    ["Duplicate detected: %s"]="Doublon détecté : %s"
    ["Duplicate analysis complete."]="Analyse des doublons terminée."

    # --- local_keys.sh -------------------------------------------------------
    ["Directory: %s"]="Répertoire : %s"
    ["No key pair detected."]="Aucune paire de clés détectée."
    ["   Public key  : %s"]="   Clé publique : %s"
    ["   Private key : %s"]="   Clé privée   : %s"
    ["present"]="présente"
    ["absent"]="absente"
    ["Choose a key"]="Choisir une clé"
    ["%s (number)"]="%s (numéro)"
    ["Private key not found: %s"]="Clé privée introuvable : %s"
    ["Key not found: %s"]="Clé introuvable : %s"
    ["Invalid choice: %s"]="Choix invalide : %s"
    ["Private key missing for %s."]="Clé privée absente pour %s."
    ["Key type (ed25519/rsa)"]="Type de clé (ed25519/rsa)"
    ["Unknown type, using ed25519."]="Type inconnu, utilisation de ed25519."
    ["File name"]="Nom du fichier"
    ["The file %s already exists."]="Le fichier %s existe déjà."
    ["Overwrite?"]="Écraser ?"
    ["Comment"]="Commentaire"
    ["A passphrase is strongly recommended."]="Une phrase secrète est fortement recommandée."
    ["Key generated: %s (user %s)"]="Clé générée : %s (utilisateur %s)"
    ["Public key:"]="Clé publique :"
    ["Generation failed."]="Échec de la génération."
    ["Key to inspect"]="Clé à inspecter"
    ["File not found: %s"]="Fichier introuvable : %s"
    ["Fingerprint:"]="Empreinte :"
    ["Random art:"]="Art aléatoire :"
    ["Key to export"]="Clé à exporter"
    ["Public key not found: %s"]="Clé publique introuvable : %s"
    ["Public key (%s):"]="Clé publique (%s) :"
    ["Key whose passphrase to change"]="Clé dont la phrase secrète doit être modifiée"
    ["Changing the passphrase of %s"]="Modification de la phrase secrète de %s"
    ["Key to delete"]="Clé à supprimer"
    ["No key file found for: %s"]="Aucun fichier de clé trouvé pour : %s"
    ["Deleting the key pair:"]="Suppression de la paire de clés :"
    ["A backup will be created. Confirm deletion?"]="Une sauvegarde sera créée. Confirmer la suppression ?"
    ["Key pair deleted (backup kept)."]="Paire de clés supprimée (sauvegarde conservée)."

    # --- ssh_agent.sh --------------------------------------------------------
    ["No ssh-agent detected (SSH_AUTH_SOCK not set)."]="Aucun ssh-agent détecté (SSH_AUTH_SOCK non défini)."
    ['Start an agent, e.g.: eval $(ssh-agent -s)']='Démarrez un agent, ex. : eval $(ssh-agent -s)'
    ["Keys loaded in ssh-agent:"]="Clés chargées dans ssh-agent :"
    ["Key to add to ssh-agent"]="Clé à ajouter à ssh-agent"
    ["Key added to ssh-agent."]="Clé ajoutée à ssh-agent."
    ["Remove all keys from the agent?"]="Retirer toutes les clés de l'agent ?"
    ["All keys removed."]="Toutes les clés retirées."
    ["Key to remove from ssh-agent"]="Clé à retirer de ssh-agent"
    ["Key removed from ssh-agent."]="Clé retirée de ssh-agent."

    # --- hosts.sh ------------------------------------------------------------
    ["No ~/.ssh/config file."]="Aucun fichier ~/.ssh/config."
    ["Registered remote hosts (%s):"]="Machines distantes enregistrées (%s) :"
    ["  (none)"]="  (aucune)"
    ["Host alias name"]="Nom (alias) de la machine"
    ["Name required."]="Nom requis."
    ["A host named '%s' already exists."]="Un hôte nommé '%s' existe déjà."
    ["Address (HostName)"]="Adresse (HostName)"
    ["User"]="Utilisateur"
    ["Port"]="Port"
    ["Key file (IdentityFile)"]="Fichier de clé (IdentityFile)"
    ["ProxyJump (empty = none)"]="ProxyJump (vide = aucun)"
    ["Host '%s' added to %s"]="Hôte '%s' ajouté à %s"
    ["Host name to delete"]="Nom de l'hôte à supprimer"
    ["No config file."]="Aucun fichier config."
    ["Host not found: %s"]="Hôte introuvable : %s"
    ["Host '%s' deleted."]="Hôte '%s' supprimé."
    ["Host name to edit"]="Nom de l'hôte à modifier"
    ["Current configuration of '%s':"]="Configuration actuelle de '%s' :"
    ["Editing replaces the whole block."]="L'édition remplace le bloc complet."
    ["Continue?"]="Continuer ?"
    ["Unable to back up %s."]="Impossible de sauvegarder %s."
    ["Edit cancelled: host '%s' has been restored."]="Édition annulée : l'hôte '%s' a été restauré."
    ["Host name"]="Nom de l'hôte"
    ["ssh not found."]="ssh introuvable."
    ["Effective configuration (ssh -G %s):"]="Configuration effective (ssh -G %s) :"
    ["Host name to test"]="Nom de l'hôte à tester"
    ["Resolving %s..."]="Test de résolution de %s..."
    ["DNS resolution succeeded."]="Résolution DNS réussie."
    ["DNS resolution uncertain."]="Résolution DNS incertaine."
    ["Testing port %s..."]="Test du port %s..."
    ["Port %s open."]="Port %s ouvert."
    ["Port %s unreachable."]="Port %s injoignable."
    ["SSH authentication test (BatchMode)..."]="Test d'authentification SSH (BatchMode)..."
    ["Authentication succeeded."]="Authentification réussie."
    ["Automatic authentication failed (missing key or password required)."]="Authentification non automatique (clé manquante ou mot de passe requis)."
    ["Remote host identification has changed (known_hosts conflict)."]="L'identification de l'hôte distant a changé (conflit known_hosts)."
    ["This can happen after a reinstall, or indicate a MITM risk."]="Cela peut arriver après une réinstallation, ou indiquer un risque MITM."
    ["Remove the old host key for %s from known_hosts?"]="Supprimer l'ancienne clé d'hôte de %s dans known_hosts ?"
    ["Fetch and accept the new host key now?"]="Récupérer et accepter la nouvelle clé d'hôte maintenant ?"
    ["New host key(s) for %s added to known_hosts."]="Nouvelle(s) clé(s) d'hôte pour %s ajoutée(s) à known_hosts."
    ["Unable to fetch host keys from %s."]="Impossible de récupérer les clés d'hôte de %s."
    ["Re-run the host test after updating known_hosts."]="Relancez le test de l'hôte après la mise à jour de known_hosts."
    ["Connecting to %s..."]="Connexion à %s..."
    ["ssh-copy-id not found."]="ssh-copy-id introuvable."
    ["Copying %s to %s..."]="Copie de %s vers %s..."
    ["Empty public key body."]="Corps de clé publique vide."
    ["Invalid key body (unexpected characters)."]="Corps de clé invalide (caractères inattendus)."
    ["Removing the key on %s (requires authorized access)."]="Retrait de la clé sur %s (nécessite un accès autorisé)."
    ["Key removed on %s."]="Clé retirée sur %s."
    ["Removal failed."]="Échec du retrait."

    # --- known_hosts.sh ------------------------------------------------------
    ["No known_hosts file."]="Aucun fichier known_hosts."
    ["Known fingerprints (%s):"]="Empreintes connues (%s) :"
    ["Host fingerprint for %s:"]="Empreinte hôte pour %s :"
    ["No entry for %s."]="Aucune entrée pour %s."
    ["Server name or address"]="Nom ou adresse du serveur"
    ["Host to remove from known_hosts"]="Hôte à supprimer de known_hosts"
    ["Fingerprint of %s removed."]="Empreinte de %s supprimée."
    ["Removal failed for %s."]="Échec de la suppression pour %s."
    ["Host to scan"]="Hôte à scanner"
    ["ssh-keyscan not found."]="ssh-keyscan introuvable."
    ["Fingerprint announced by %s:"]="Empreinte annoncée par %s :"

    # --- logs.sh -------------------------------------------------------------
    ["Active SSH sessions:"]="Sessions SSH actives :"
    ["'who' unavailable."]="'who' indisponible."
    ["Recent logins:"]="Connexions récentes :"
    ["'last' unavailable."]="'last' indisponible."
    ["Recent failed login attempts:"]="Tentatives de connexion échouées récentes :"
    ["  (none or not accessible)"]="  (aucune ou non accessible)"
    ["No source of failed attempts available."]="Aucune source de tentatives échouées disponible."
    ["SSH service logs:"]="Journaux du service SSH :"
    ["Connections and logs"]="Connexions et journaux"
    ["  1. Active sessions"]="  1. Sessions actives"
    ["  2. Recent logins"]="  2. Connexions récentes"
    ["  3. Failed attempts"]="  3. Tentatives échouées"
    ["  4. SSH service logs"]="  4. Journaux du service SSH"
    ["Recent logins"]="Connexions récentes"
    ["SSH service logs"]="Journaux du service SSH"

    # --- audit.sh ------------------------------------------------------------
    ["WARN"]="AVERT"
    ["FAIL"]="ÉCHEC"
    ["Local SSH security audit"]="Audit de sécurité SSH local"
    ["SSH server"]="Serveur SSH"
    ["OpenSSH Server installed."]="OpenSSH Server installé."
    ["OpenSSH Server not installed."]="OpenSSH Server non installé."
    ["PermitRootLogin = no (root forbidden)."]="PermitRootLogin = no (root interdit)."
    ["PermitRootLogin = key only."]="PermitRootLogin = clé uniquement."
    ["PermitRootLogin = yes (root with password allowed)."]="PermitRootLogin = yes (root avec mot de passe autorisé)."
    ["PermitRootLogin = %s."]="PermitRootLogin = %s."
    ["Password authentication disabled."]="Authentification par mot de passe désactivée."
    ["Password authentication enabled."]="Authentification par mot de passe activée."
    ["PasswordAuthentication = %s."]="PasswordAuthentication = %s."
    ["MaxAuthTries = %s."]="MaxAuthTries = %s."
    ["MaxAuthTries = %s (recommended <= 4)."]="MaxAuthTries = %s (recommandé <= 4)."
    ["default"]="défaut"
    ["sshd -t: configuration valid."]="sshd -t : configuration valide."
    ["sshd -t: configuration invalid."]="sshd -t : configuration invalide."
    ["Local permissions (%s)"]="Permissions locales (%s)"
    ["The .ssh directory has 700 permissions."]="Le dossier .ssh a les permissions 700."
    ["The .ssh directory has %s permissions (expected 700)."]="Le dossier .ssh a les permissions %s (attendu 700)."
    ["authorized_keys 600."]="authorized_keys 600."
    ["authorized_keys %s (expected 600)."]="authorized_keys %s (attendu 600)."
    ["%s 600."]="%s 600."
    ["%s %s (private key must be 600)."]="%s %s (clé privée doit être 600)."
    ["No .ssh directory for %s."]="Aucun répertoire .ssh pour %s."
    ["Listening port"]="Port d'écoute"
    ["The configured SSH port is listening."]="Le port SSH configuré écoute."
    ["Unable to confirm the SSH port is listening."]="Impossible de confirmer l'écoute du port SSH."
    ["Summary"]="Résumé"
    ["%d OK, %d warnings, %d failures"]="%d OK, %d avertissements, %d échecs"
    ["LSSHM diagnostics (doctor)"]="Diagnostic LSSHM (doctor)"
    ["SSH tools:"]="Outils SSH :"
    ["LSSHM paths:"]="Chemins LSSHM :"
    ["PATH:"]="PATH :"
    ["%s is in PATH"]="%s est dans le PATH"
    ["%s is not in PATH"]="%s absent du PATH"

    # --- updater.sh ----------------------------------------------------------
    ["Neither curl nor wget available for download."]="Ni curl ni wget disponibles pour le téléchargement."
    ["Installed version: %s"]="Version installée : %s"
    ["Available version: %s"]="Version disponible : %s"
    ["An update is available."]="Une mise à jour est disponible."
    ["Install now?"]="Installer maintenant ?"
    ["LSSHM does not seem to be installed in %s."]="LSSHM ne semble pas installé dans %s."
    ["Use: curl -fsSL %s/lsshm.sh | bash -s -- install"]="Utilisez : curl -fsSL %s/lsshm.sh | bash -s -- install"
    ["Remote version : %s"]="Version distante  : %s"
    ["Downloading the new version..."]="Téléchargement de la nouvelle version..."
    ["Download failed."]="Échec du téléchargement."
    ["The downloaded script has syntax errors. Aborting."]="Le script téléchargé contient des erreurs de syntaxe. Abandon."
    ["SHA-256 verification failed. Aborting."]="Vérification SHA-256 échouée. Abandon."
    ["The downloaded file does not look like LSSHM. Aborting."]="Le fichier téléchargé ne ressemble pas à LSSHM. Abandon."
    ["Update installed. Previous version kept: %s"]="Mise à jour installée. Version précédente conservée : %s"
    ["Use 'lsshm update rollback' to revert."]="Utilisez 'lsshm update rollback' pour revenir en arrière."
    ["File replacement failed."]="Échec du remplacement du fichier."
    ["File to verify not found."]="Fichier à vérifier introuvable."
    ["SHA256SUMS unavailable: cannot verify (aborting)."]="SHA256SUMS indisponible : vérification impossible (abandon)."
    ["lsshm.sh checksum missing from SHA256SUMS (aborting)."]="Empreinte lsshm.sh absente de SHA256SUMS (abandon)."
    ["No SHA-256 tool (sha256sum/shasum): cannot verify (aborting)."]="Aucun outil SHA-256 (sha256sum/shasum) : vérification impossible (abandon)."
    ["Incorrect SHA-256 checksum."]="Empreinte SHA-256 incorrecte."
    ["  expected: %s"]="  attendu : %s"
    ["  actual:   %s"]="  obtenu  : %s"
    ["SHA-256 checksum verified."]="Empreinte SHA-256 vérifiée."
    ["No previous version available (%s)."]="Aucune version précédente disponible (%s)."
    ["Restore the previous version of LSSHM?"]="Restaurer la version précédente de LSSHM ?"
    ["Previous version restored."]="Version précédente restaurée."

    # --- cli.sh / dialog.sh (menus + status) ---------------------------------
    ["Managed user: %s"]="Utilisateur administré : %s"
    ["SSH server status: %s"]="État du serveur SSH : %s"
    ["Port: %s"]="Port : %s"
    ["Root access: %s"]="Accès root : %s"
    ["Password authentication: %s"]="Authentification par mot de passe : %s"
    ["Authorized keys for root: %s"]="Clés autorisées pour root : %s"
    ["Private keys of %s: %s"]="Clés privées de %s : %s"
    ["Registered remote hosts: %s"]="Machines distantes enregistrées : %s"
    ["Invalid choice."]="Choix invalide."
    ["Choice"]="Choix"
    ["Main menu"]="Menu principal"
    ["1. Manage the local SSH server"]="1. Gérer le serveur SSH local"
    ["2. Manage access to this machine"]="2. Gérer les accès à cette machine"
    ["3. Manage my SSH keys"]="3. Gérer mes clés SSH"
    ["4. Manage remote hosts"]="4. Gérer les machines distantes"
    ["5. View connections and logs"]="5. Consulter les connexions et journaux"
    ["6. Run a security audit"]="6. Effectuer un audit de sécurité"
    ["7. Back up or restore"]="7. Sauvegarder ou restaurer"
    ["8. LSSHM settings"]="8. Paramètres de LSSHM"
    ["9. Quit"]="9. Quitter"
    ["Manage the local SSH server"]="Gérer le serveur SSH local"
    ["Manage access to this machine"]="Gérer les accès à cette machine"
    ["Manage my SSH keys"]="Gérer mes clés SSH"
    ["Manage remote hosts"]="Gérer les machines distantes"
    ["View connections and logs"]="Consulter les connexions et journaux"
    ["Run a security audit"]="Effectuer un audit de sécurité"
    ["Back up or restore"]="Sauvegarder ou restaurer"
    ["LSSHM settings"]="Paramètres de LSSHM"
    ["Quit"]="Quitter"
    ["Back"]="Retour"

    ["Local SSH server"]="Serveur SSH local"
    ["Install OpenSSH Server"]="Installer OpenSSH Server"
    ["Start the service"]="Démarrer le service"
    ["Stop the service"]="Arrêter le service"
    ["Restart the service"]="Redémarrer le service"
    ["Reload the service"]="Recharger le service"
    ["Enable at boot"]="Activer au démarrage"
    ["Disable at boot"]="Désactiver au démarrage"
    ["Change the port"]="Changer le port"
    ["Address family (AddressFamily)"]="Famille d'adresses (AddressFamily)"
    ["Listen addresses (ListenAddress)"]="Adresses d'écoute (ListenAddress)"
    ["Manage root access"]="Gérer l'accès root"
    ["Password authentication"]="Authentification par mot de passe"
    ["Key authentication"]="Authentification par clé"
    ["Allowed users (AllowUsers)"]="Utilisateurs autorisés (AllowUsers)"
    ["Allowed groups (AllowGroups)"]="Groupes autorisés (AllowGroups)"
    ["Test the configuration (sshd -t)"]="Tester la configuration (sshd -t)"
    ["Show the effective configuration (sshd -T)"]="Afficher la configuration effective (sshd -T)"
    ["View the logs"]="Voir les journaux"
    ["OpenSSH Server installation"]="Installation OpenSSH Server"
    ["Starting SSH"]="Démarrage SSH"
    ["Stopping SSH"]="Arrêt SSH"
    ["Restarting SSH"]="Redémarrage SSH"
    ["Reloading SSH"]="Rechargement SSH"
    ["Enabling at boot"]="Activation au démarrage"
    ["Disabling at boot"]="Désactivation au démarrage"
    ["sshd -t test"]="Test sshd -t"
    ["Effective configuration"]="Configuration effective"
    ["SSH logs"]="Journaux SSH"
    ["Configuration valid."]="Configuration valide."

    ["Access to this machine (keys allowed to connect HERE)"]="Accès à cette machine (clés autorisées pour se connecter ICI)"
    ["Target user: %s"]="Utilisateur ciblé : %s"
    ["List users"]="Lister les utilisateurs"
    ["List authorized keys"]="Lister les clés autorisées"
    ["Add a key (paste or import a .pub)"]="Ajouter une clé (coller ou importer un .pub)"
    ["Remove a key"]="Supprimer une clé"
    ["Disable / re-enable a key"]="Désactiver / réactiver une clé"
    ["Repair ~/.ssh permissions"]="Réparer les permissions ~/.ssh"
    ["Detect duplicates"]="Détecter les doublons"
    ["Change target user"]="Changer d'utilisateur ciblé"
    ["Local users"]="Utilisateurs locaux"
    ["Authorized keys"]="Clés autorisées"
    ["Permission repair"]="Réparation permissions"
    ["Duplicates"]="Doublons"

    ["SSH keys of %s (to connect ELSEWHERE)"]="Clés SSH de %s (pour se connecter AILLEURS)"
    ["List key pairs"]="Lister les paires de clés"
    ["Generate a new key (ED25519 by default)"]="Générer une nouvelle clé (ED25519 par défaut)"
    ["Inspect a key"]="Inspecter une clé"
    ["Show / export a public key"]="Afficher / exporter une clé publique"
    ["Change the passphrase"]="Changer la phrase secrète"
    ["Delete a key pair"]="Supprimer une paire de clés"
    ["ssh-agent: list"]="ssh-agent : lister"
    ["ssh-agent: add a key"]="ssh-agent : ajouter une clé"
    ["ssh-agent: remove a key"]="ssh-agent : retirer une clé"
    ["Key pairs"]="Paires de clés"
    ["Public key"]="Clé publique"

    ["Remote hosts (~/.ssh/config) - optional"]="Machines distantes (~/.ssh/config) - facultatif"
    ["User: %s"]="Utilisateur : %s"
    ["Remote hosts"]="Machines distantes"
    ["List hosts"]="Lister les machines"
    ["Add a host"]="Ajouter une machine"
    ["Edit a host"]="Modifier une machine"
    ["Delete a host"]="Supprimer une machine"
    ["Test a host (resolution, port, auth)"]="Tester une machine (résolution, port, auth)"
    ["Effective configuration (ssh -G)"]="Configuration effective (ssh -G)"
    ["Connect to a host"]="Se connecter à une machine"
    ["Copy a key (ssh-copy-id)"]="Copier une clé (ssh-copy-id)"
    ["Revoke a remote key"]="Retirer une clé distante"
    ["known_hosts: list"]="known_hosts : lister"
    ["known_hosts: remove a fingerprint"]="known_hosts : supprimer une empreinte"
    ["Host test"]="Test machine"

    ["LSSHM settings"]="Paramètres de LSSHM"
    ["Managed user        : %s"]="Utilisateur administré        : %s"
    ["Update check        : %s"]="Vérification des mises à jour : %s"
    ["Update channel      : %s"]="Canal de mise à jour          : %s"
    ["Language            : %s"]="Langue                        : %s"
    ["Configuration file  : %s"]="Fichier de configuration      : %s"
    ["1. Update check: always"]="1. Vérification : toujours"
    ["2. Update check: once a day"]="2. Vérification : une fois par jour"
    ["3. Update check: never"]="3. Vérification : jamais"
    ["4. Check for updates now"]="4. Vérifier les mises à jour maintenant"
    ["5. Show diagnostics (doctor)"]="5. Afficher le diagnostic (doctor)"
    ["6. Change the language"]="6. Changer la langue"
    ["7. Change managed user"]="7. Changer d'utilisateur administré"
    ["8. Back"]="8. Retour"
    ["Update check: always"]="Vérification : toujours"
    ["Update check: once a day"]="Vérification : une fois par jour"
    ["Update check: never"]="Vérification : jamais"
    ["Check for updates now"]="Vérifier les mises à jour maintenant"
    ["Show diagnostics (doctor)"]="Afficher le diagnostic (doctor)"
    ["Change the language"]="Changer la langue"
    ["Change managed user"]="Changer d'utilisateur administré"
    ["Channel: %s"]="Canal : %s"
    ["File: %s"]="Fichier : %s"
    ["LSSHM diagnostics"]="Diagnostic LSSHM"
    ["Security audit"]="Audit de sécurité"

    ["Connections and logs"]="Connexions et journaux"
    ["Consult SSH activity"]="Consulter l'activité SSH"
    ["Active sessions"]="Sessions actives"
    ["Failed attempts"]="Tentatives échouées"

    ["Backup and restore"]="Sauvegarde et restauration"
    ["Back up or restore the SSH configuration"]="Sauvegarder ou restaurer la configuration SSH"
    ["Back up the SSH server configuration"]="Sauvegarder la configuration du serveur SSH"
    ["List backups"]="Lister les sauvegardes"
    ["Restore a server configuration"]="Restaurer une configuration serveur"
    ["SSH server backup"]="Sauvegarde serveur SSH"
    ["authorized_keys backup"]="Sauvegarde authorized_keys"
    ["Available backups"]="Sauvegardes disponibles"
    ["Backups"]="Sauvegardes"

    # --- dialog.sh -----------------------------------------------------------
    ["The terminal GUI requires the dialog package."]="L'interface graphique en terminal nécessite le paquet dialog."
    ["1. Install dialog"]="1. Installer dialog"
    ["2. Continue with the CLI interface"]="2. Continuer avec l'interface CLI"
    ["3. Cancel"]="3. Annuler"
    ["dialog could not be installed. Falling back to the CLI interface."]="dialog n'a pas pu être installé. Passage à l'interface CLI."
    ["(no output)"]="(aucune sortie)"
    ["Result"]="Résultat"

    # --- main.sh -------------------------------------------------------------
    ["To use lsshm right away (no restart or re-login):"]="Pour utiliser lsshm tout de suite (sans redémarrage ni reconnexion) :"
    ["Or in one command:"]="Ou en une commande :"
    ["New SSH sessions will load ~/.profile automatically."]="Les nouvelles sessions SSH chargeront ~/.profile automatiquement."
    ["%s is not in your PATH."]="%s n'est pas dans votre PATH."
    ["Add the PATH export to ~/.profile?"]="Ajouter l'export PATH dans ~/.profile ?"
    ["Also added to %s (interactive shell)."]="Ajouté aussi à %s (shell interactif)."
    ["PATH configured in %s for future logins."]="PATH configuré dans %s pour les prochaines connexions."
    ["PATH already configured in %s."]="PATH déjà configuré dans %s."
    ["PATH activated for this session."]="PATH activé pour cette session."
    ["PATH was updated for future sessions; open a new terminal if the command is not found."]="Le PATH a été mis à jour pour les prochaines sessions ; ouvrez un nouveau terminal si la commande est introuvable."
    ['Add manually: export PATH="$HOME/.local/bin:$PATH"']='Ajoutez manuellement : export PATH="$HOME/.local/bin:$PATH"'
    ["Installing LSSHM into the user directory..."]="Installation de LSSHM dans le répertoire utilisateur..."
    ["Downloading lsshm.sh from the repository..."]="Téléchargement de lsshm.sh depuis le dépôt..."
    ["The downloaded script is invalid."]="Le script téléchargé est invalide."
    ["SHA-256 verification failed: installation aborted."]="Vérification SHA-256 échouée : installation annulée."
    ["Installed:"]="Installé :"
    ["Installation complete."]="Installation terminée."
    ["The lsshm command is not active in THIS terminal yet."]="La commande lsshm n'est pas encore active dans CE terminal."
    ["Run: lsshm"]="Lancez : lsshm"
    ["Uninstalling LSSHM."]="Désinstallation de LSSHM."
    ["Binary and link removed."]="Binaire et lien supprimés."
    ["Also remove configuration and state (%s, %s)?"]="Supprimer aussi la configuration et l'état (%s, %s) ?"
    ["Configuration and state removed."]="Configuration et état supprimés."
    ["Configuration kept: %s"]="Configuration conservée : %s"
    ["Note: LSSHM does not modify your SSH configuration on uninstall."]="Note : LSSHM ne modifie pas votre configuration SSH lors de la désinstallation."
    ["Remember to remove the PATH line from ~/.profile if necessary."]="N'oubliez pas de retirer la ligne PATH de ~/.profile si nécessaire."
    # --- usage / help --------------------------------------------------------
    ["Usage:"]="Utilisation :"
    ["Open the CLI menu"]="Ouvrir le menu CLI"
    ["Open the dialog interface"]="Ouvrir l'interface dialog"
    ["Show local SSH status"]="Afficher l'état SSH local"
    ["Environment diagnostics"]="Diagnostic de l'environnement"
    ["Update LSSHM (or roll back)"]="Mettre à jour LSSHM (ou restaurer)"
    ["Install LSSHM into ~/.local"]="Installer LSSHM dans ~/.local"
    ["Uninstall LSSHM"]="Désinstaller LSSHM"
    ["Show the version"]="Afficher la version"
    ["Show this help"]="Afficher cette aide"
    ["Global options:"]="Options globales :"
    ["Manage NAME's SSH files (access, keys, hosts)"]="Gérer les fichiers SSH de NAME (accès, clés, hôtes)"
    ["Interface language (%s)"]="Langue de l'interface (%s)"
    ["Force the dialog interface"]="Forcer l'interface dialog"
    ["Answer yes automatically (non-interactive)"]="Répondre oui automatiquement (non interactif)"
    ["Disable color"]="Désactiver la couleur"
    ["Local SSH server:"]="Serveur SSH local :"
    ["Incoming access (keys allowed HERE):"]="Accès entrants (clés autorisées ICI) :"
    ["Local keys (to connect ELSEWHERE):"]="Clés locales (pour se connecter AILLEURS) :"
    ["Remote hosts:"]="Machines distantes :"
    ["Unknown server subcommand: %s"]="Sous-commande server inconnue : %s"
    ["Unknown access subcommand: %s"]="Sous-commande access inconnue : %s"
    ["Unknown key subcommand: %s"]="Sous-commande key inconnue : %s"
    ["Unknown agent subcommand: %s"]="Sous-commande agent inconnue : %s"
    ["Unknown host subcommand: %s"]="Sous-commande host inconnue : %s"
    ["Unknown command: %s"]="Commande inconnue : %s"
)

# =============================================================================
# Spanish catalog (es)
# =============================================================================
declare -gA LSSHM_MSG_es=(
    # --- common.sh -----------------------------------------------------------
    ["Press Enter to continue... "]="Pulse Intro para continuar... "
    ["An interactive terminal is required for the menu."]="Se requiere un terminal interactivo para el menú."
    ["Without a menu: lsshm status | lsshm doctor | lsshm server status | lsshm key list"]="Sin menú: lsshm status | lsshm doctor | lsshm server status | lsshm key list"
    ["To install: curl -fsSL .../lsshm.sh | bash -s -- install"]="Para instalar: curl -fsSL .../lsshm.sh | bash -s -- install"
    ["Unable to create a temporary file."]="No se pudo crear un archivo temporal."
    ["yes"]="sí"
    ["no"]="no"
    ["not set"]="sin definir"

    # --- i18n.sh -------------------------------------------------------------
    ["Language set to: %s"]="Idioma establecido en: %s"

    # --- platform.sh ---------------------------------------------------------
    ["Distribution        : %s"]="Distribución        : %s"
    ["Identifier          : %s"]="Identificador       : %s"
    ["Package manager     : %s"]="Gestor de paquetes  : %s"
    ["Service manager     : %s"]="Gestor de servicios : %s"
    ["systemd             : %s"]="systemd             : %s"
    ["Virtualization      : %s"]="Virtualización      : %s"
    ["sshd binary         : %s"]="Binario sshd        : %s"
    ["SSH service         : %s"]="Servicio SSH        : %s"
    ["present"]="presente"
    ["absent"]="ausente"
    ["not detected"]="no detectado"

    # --- privileges.sh -------------------------------------------------------
    ["This operation requires root privileges, but sudo was not found."]="Esta operación requiere privilegios de root, pero no se encontró sudo."
    ["sudo authentication required (non-interactive session)."]="Se requiere autenticación sudo (sesión no interactiva)."
    ["Administrator authentication (sudo) — once for this session."]="Autenticación de administrador (sudo) — una sola vez en esta sesión."
    ["sudo authentication failed."]="Falló la autenticación sudo."
    ["Privileged operation not possible: run LSSHM as root or install sudo."]="Operación privilegiada imposible: ejecute LSSHM como root o instale sudo."
    ["Empty username."]="Nombre de usuario vacío."
    ["Unknown user: %s"]="Usuario desconocido: %s"
    ["Managed user: %s (%s/.ssh)"]="Usuario administrado: %s (%s/.ssh)"
    ["Available local users:"]="Usuarios locales disponibles:"
    ["No local user detected."]="No se detectó ningún usuario local."
    ["User to manage (number or name)"]="Usuario a administrar (número o nombre)"
    ["Number out of range (1-%s)."]="Número fuera de rango (1-%s)."
    ["%s is running with sudo."]="%s se ejecuta con sudo."
    ["Calling user   : %s"]="Usuario que llama   : %s"
    ["Privileged user: root"]="Usuario privilegiado: root"
    ["Whose personal SSH files should be managed?"]="¿Qué archivos SSH personales de usuario administrar?"
    ["  1. %s (recommended)"]="  1. %s (recomendado)"
    ["  2. %s"]="  2. %s"
    ["  2. root"]="  2. root"
    ["  3. Choose another user"]="  3. Elegir otro usuario"
    ["%s is running as root."]="%s se ejecuta como root."
    ["You can manage another user's SSH (keys, access, hosts)."]="Puede administrar el SSH de otro usuario (claves, acceso, hosts)."
    ["  1. root"]="  1. root"
    ["  2. Choose another user"]="  2. Elegir otro usuario"

    # --- users.sh ------------------------------------------------------------
    ["Local users:"]="Usuarios locales:"

    # --- server.sh -----------------------------------------------------------
    ["Automatic enable/disable is not handled for SysV here."]="La activación/desactivación automática no se gestiona para SysV aquí."
    ["Unknown service manager: cannot run '%s'."]="Gestor de servicios desconocido: no se puede ejecutar '%s'."
    ["SSH service started."]="Servicio SSH iniciado."
    ["SSH service stopped."]="Servicio SSH detenido."
    ["SSH service restarted."]="Servicio SSH reiniciado."
    ["Automatic startup enabled."]="Arranque automático activado."
    ["Automatic startup disabled."]="Arranque automático desactivado."
    ["Invalid configuration: reload cancelled."]="Configuración no válida: recarga cancelada."
    ["SSH service reloaded."]="Servicio SSH recargado."
    ["OpenSSH Server is not installed (sshd binary not found)."]="OpenSSH Server no está instalado (binario sshd no encontrado)."
    ["SSH server status : %s"]="Estado del servidor SSH: %s"
    ["Auto-start        : %s"]="Arranque automático  : %s"
    ["Port              : %s"]="Puerto               : %s"
    ["Address family    : %s"]="Familia de direcciones: %s"
    ["Listen addresses  : %s"]="Direcciones de escucha: %s"
    ["Root access       : %s"]="Acceso root          : %s"
    ["Password auth.    : %s"]="Auth. contraseña     : %s"
    ["Key auth.         : %s"]="Auth. por clave      : %s"
    ["active"]="activo"
    ["inactive"]="inactivo"
    ["OpenSSH Server is already installed: %s"]="OpenSSH Server ya está instalado: %s"
    ["Installing OpenSSH Server..."]="Instalando OpenSSH Server..."
    ["Unsupported package manager: %s"]="Gestor de paquetes no compatible: %s"
    ["OpenSSH Server installed."]="OpenSSH Server instalado."
    ["The installation appears to have failed."]="La instalación parece haber fallado."
    ["No SSH log source detected."]="No se detectó ninguna fuente de registros SSH."

    # --- server_config.sh ----------------------------------------------------
    ["sshd binary not found: validation not possible."]="Binario sshd no encontrado: validación imposible."
    ["sshd -t reported an error:"]="sshd -t informó de un error:"
    ["The main config file does not include sshd_config.d/."]="El archivo principal no incluye sshd_config.d/."
    ["The file managed by LSSHM might be ignored."]="El archivo gestionado por LSSHM podría ignorarse."
    ["'%s' is defined in %s before the Include."]="'%s' está definido en %s antes del Include."
    ["This value will take precedence over the file managed by LSSHM."]="Este valor prevalecerá sobre el archivo gestionado por LSSHM."
    ["Comment out this definition in the main file?"]="¿Comentar esta definición en el archivo principal?"
    ["New configuration invalid: rolling back."]="Nueva configuración no válida: revirtiendo."
    ["Directive applied: %s %s"]="Directiva aplicada: %s %s"
    ["Effective value (sshd -T): %s"]="Valor efectivo (sshd -T): %s"
    ["Expected: %s - another definition may still take precedence."]="Esperado: %s - otra definición aún puede prevalecer."
    ["forbidden"]="prohibido"
    ["key only"]="solo clave"
    ["key or password"]="clave o contraseña"
    ["forced commands only"]="solo comandos forzados"
    ["SSH root login"]="Inicio de sesión SSH de root"
    ["  1. Forbid root entirely"]="  1. Prohibir root por completo"
    ["  2. Allow root with a key only"]="  2. Permitir root solo con una clave"
    ["  3. Allow root with a key or a password"]="  3. Permitir root con clave o contraseña"
    ["  4. Allow root only for forced commands"]="  4. Permitir root solo para comandos forzados"
    ["Recommendation: allow root with a key only,"]="Recomendación: permitir root solo con una clave,"
    ["or use a normal user with sudo."]="o usar un usuario normal con sudo."
    ["No change."]="Sin cambios."
    ["root access change"]="cambio de acceso root"
    ["Current password authentication: %s"]="Autenticación por contraseña actual: %s"
    ["Allow password authentication?"]="¿Permitir la autenticación por contraseña?"
    ["Disabling passwords may lock you out without a valid key."]="Desactivar contraseñas puede bloquearlo sin una clave válida."
    ["disabling passwords"]="desactivación de contraseñas"
    ["Allow public key authentication?"]="¿Permitir la autenticación por clave pública?"
    ["Disabling key authentication may lock you out."]="Desactivar la autenticación por clave puede bloquearlo."
    ["disabling key authentication"]="desactivación de la autenticación por clave"
    ["New SSH port"]="Nuevo puerto SSH"
    ["Invalid port."]="Puerto no válido."
    ["Port out of range (1-65535)."]="Puerto fuera de rango (1-65535)."
    ["Check your firewall before changing the port."]="Verifique su firewall antes de cambiar el puerto."
    ["port change"]="cambio de puerto"
    ["address family change"]="cambio de familia de direcciones"
    ["listen address change"]="cambio de direcciones de escucha"
    ["SSH address family (AddressFamily)"]="Familia de direcciones SSH (AddressFamily)"
    ["Current: %s"]="Actual: %s"
    ["  1. any   (IPv4 + IPv6, OpenSSH default)"]="  1. any   (IPv4 + IPv6, predeterminado OpenSSH)"
    ["  2. inet  (IPv4 only)"]="  2. inet  (solo IPv4)"
    ["  3. inet6 (IPv6 only)"]="  3. inet6 (solo IPv6)"
    ["SSH listen addresses (ListenAddress)"]="Direcciones de escucha SSH (ListenAddress)"
    ["Examples: 0.0.0.0   ::   192.168.1.10   0.0.0.0 ::"]="Ejemplos: 0.0.0.0   ::   192.168.1.10   0.0.0.0 ::"
    ["Empty input restores OpenSSH defaults (all interfaces)."]="Una entrada vacía restaura los valores predeterminados de OpenSSH (todas las interfaces)."
    ["Listen addresses (space-separated)"]="Direcciones de escucha (separadas por espacios)"
    ["Directive removed from managed file: %s"]="Directiva eliminada del archivo gestionado: %s"
    ["Directive applied: %s (%s)"]="Directiva aplicada: %s (%s)"
    ["Current AllowUsers: %s"]="AllowUsers actual: %s"
    ["Allowed users (space-separated, empty = remove)"]="Usuarios permitidos (separados por espacios, vacío = eliminar)"
    ["Removing AllowUsers is not handled automatically (edit the managed file)."]="La eliminación de AllowUsers no es automática (edite el archivo gestionado)."
    ["AllowUsers change"]="cambio de AllowUsers"
    ["Current AllowGroups: %s"]="AllowGroups actual: %s"
    ["Allowed groups (space-separated)"]="Grupos permitidos (separados por espacios)"
    ["AllowGroups change"]="cambio de AllowGroups"
    ["sshd -T unavailable. Detected configuration files:"]="sshd -T no disponible. Archivos de configuración detectados:"

    # --- rollback.sh ---------------------------------------------------------
    ["Sensitive change not possible without an interactive terminal: %s"]="Cambio sensible imposible sin terminal interactivo: %s"
    ["A TTY is required to confirm the new SSH session works."]="Se requiere un TTY para confirmar que la nueva sesión SSH funciona."
    ["Sensitive change: %s"]="Cambio sensible: %s"
    ["Continue with an automatic safety rollback?"]="¿Continuar con una reversión automática de seguridad?"
    ["Cancelled."]="Cancelado."
    ["Change application cancelled."]="Aplicación del cambio cancelada."
    ["The SSH port is listening."]="El puerto SSH está escuchando."
    ["Unable to confirm the SSH port is listening."]="No se puede confirmar que el puerto SSH escuche."
    ["The new configuration is active."]="La nueva configuración está activa."
    ["An automatic rollback will occur in %s seconds."]="Se realizará una reversión automática en %s segundos."
    ["Open a second SSH connection before confirming."]="Abra una segunda conexión SSH antes de confirmar."
    ["  1. The new connection works"]="  1. La nueva conexión funciona"
    ["  2. Restore immediately"]="  2. Restaurar de inmediato"
    ["Automatic rollback cancelled. Change kept."]="Reversión automática cancelada. Cambio conservado."
    ["Restoring immediately..."]="Restaurando de inmediato..."
    ["Previous configuration restored."]="Configuración anterior restaurada."

    # --- backup.sh -----------------------------------------------------------
    ["No server configuration to back up."]="No hay configuración de servidor para respaldar."
    ["Backup created: %s"]="Copia de seguridad creada: %s"
    ["Server configuration backup failed."]="Falló la copia de seguridad de la configuración del servidor."
    ["No backups recorded."]="No hay copias de seguridad registradas."
    ["Backups in %s:"]="Copias de seguridad en %s:"
    ["Backup archive not found: %s"]="Archivo de copia no encontrado: %s"
    ["Restoring server configuration from: %s"]="Restaurando la configuración del servidor desde: %s"
    ["Confirm the restore?"]="¿Confirmar la restauración?"
    ["Configuration restored."]="Configuración restaurada."
    ["Restore failed."]="Falló la restauración."
    ["Backup and restore"]="Copia de seguridad y restauración"
    ["  1. Back up the SSH server configuration"]="  1. Respaldar la configuración del servidor SSH"
    ["  2. Back up authorized keys (authorized_keys)"]="  2. Respaldar las claves autorizadas (authorized_keys)"
    ["Back up authorized keys (authorized_keys)"]="Respaldar las claves autorizadas (authorized_keys)"
    ["  3. List backups"]="  3. Listar las copias de seguridad"
    ["  4. Restore a server configuration"]="  4. Restaurar una configuración de servidor"
    ["  5. Back"]="  5. Volver"
    ["Archive name to restore"]="Nombre del archivo a restaurar"

    # --- authorized_keys.sh --------------------------------------------------
    ["User : %s"]="Usuario: %s"
    ["File : %s"]="Archivo: %s"
    ["No authorized key."]="Ninguna clave autorizada."
    ["DISABLED"]="DESACTIVADA"
    ["no comment"]="sin comentario"
    ["   Type        : %s (%s bits)"]="   Tipo        : %s (%s bits)"
    ["   Fingerprint : %s"]="   Huella      : %s"
    ["   Restriction : %s"]="   Restricción : %s"
    ["   Command     : %s"]="   Comando     : %s"
    ["   Forwarding  : forbidden"]="   Reenvío     : prohibido"
    ["unknown"]="desconocida"
    ["Paste the public key (one line), then Enter:"]="Pegue la clave pública (una línea), luego Intro:"
    ["No key provided."]="No se proporcionó ninguna clave."
    ["The provided key is not a valid public key."]="La clave proporcionada no es una clave pública válida."
    ["This key already exists (disabled, fingerprint %s)."]="Esta clave ya existe (desactivada, huella %s)."
    ["Re-enable it via the Disable / re-enable a key entry."]="Reactívela con «Desactivar / reactivar una clave»."
    ["This key is already authorized (fingerprint %s)."]="Esta clave ya está autorizada (huella %s)."
    ["Key added for %s."]="Clave añadida para %s."
    ["No key to remove."]="Ninguna clave para eliminar."
    ["SHA256 fingerprint or number to remove"]="Huella SHA256 o número a eliminar"
    ["No matching key found."]="No se encontró ninguna clave coincidente."
    ["Key removed for %s."]="Clave eliminada para %s."
    ["%s does not exist."]="%s no existe."
    ["Permissions repaired for %s:"]="Permisos reparados para %s:"
    ["  .ssh 700, authorized_keys 600, private keys 600, public keys 644"]="  .ssh 700, authorized_keys 600, claves privadas 600, claves públicas 644"
    ["No key to disable."]="Ninguna clave para desactivar."
    ["SHA256 fingerprint or number to disable/re-enable"]="Huella SHA256 o número a desactivar/reactivar"
    ["Key state updated for %s."]="Estado de la clave actualizado para %s."
    ["No key."]="Ninguna clave."
    ["Duplicate detected: %s"]="Duplicado detectado: %s"
    ["Duplicate analysis complete."]="Análisis de duplicados completado."

    # --- local_keys.sh -------------------------------------------------------
    ["Directory: %s"]="Directorio: %s"
    ["No key pair detected."]="No se detectó ningún par de claves."
    ["   Public key  : %s"]="   Clave pública : %s"
    ["   Private key : %s"]="   Clave privada : %s"
    ["present"]="presente"
    ["absent"]="ausente"
    ["Choose a key"]="Elegir una clave"
    ["%s (number)"]="%s (número)"
    ["Private key not found: %s"]="Clave privada no encontrada: %s"
    ["Key not found: %s"]="Clave no encontrada: %s"
    ["Invalid choice: %s"]="Elección no válida: %s"
    ["Private key missing for %s."]="Falta la clave privada para %s."
    ["Key type (ed25519/rsa)"]="Tipo de clave (ed25519/rsa)"
    ["Unknown type, using ed25519."]="Tipo desconocido, usando ed25519."
    ["File name"]="Nombre del archivo"
    ["The file %s already exists."]="El archivo %s ya existe."
    ["Overwrite?"]="¿Sobrescribir?"
    ["Comment"]="Comentario"
    ["A passphrase is strongly recommended."]="Se recomienda encarecidamente una frase de contraseña."
    ["Key generated: %s (user %s)"]="Clave generada: %s (usuario %s)"
    ["Public key:"]="Clave pública:"
    ["Generation failed."]="Falló la generación."
    ["Key to inspect"]="Clave a inspeccionar"
    ["File not found: %s"]="Archivo no encontrado: %s"
    ["Fingerprint:"]="Huella:"
    ["Random art:"]="Arte aleatorio:"
    ["Key to export"]="Clave a exportar"
    ["Public key not found: %s"]="Clave pública no encontrada: %s"
    ["Public key (%s):"]="Clave pública (%s):"
    ["Key whose passphrase to change"]="Clave cuya frase de contraseña cambiar"
    ["Changing the passphrase of %s"]="Cambiando la frase de contraseña de %s"
    ["Key to delete"]="Clave a eliminar"
    ["No key file found for: %s"]="No se encontró ningún archivo de clave para: %s"
    ["Deleting the key pair:"]="Eliminando el par de claves:"
    ["A backup will be created. Confirm deletion?"]="Se creará una copia de seguridad. ¿Confirmar la eliminación?"
    ["Key pair deleted (backup kept)."]="Par de claves eliminado (copia conservada)."

    # --- ssh_agent.sh --------------------------------------------------------
    ["No ssh-agent detected (SSH_AUTH_SOCK not set)."]="No se detectó ssh-agent (SSH_AUTH_SOCK sin definir)."
    ['Start an agent, e.g.: eval $(ssh-agent -s)']='Inicie un agente, p. ej.: eval $(ssh-agent -s)'
    ["Keys loaded in ssh-agent:"]="Claves cargadas en ssh-agent:"
    ["Key to add to ssh-agent"]="Clave a añadir a ssh-agent"
    ["Key added to ssh-agent."]="Clave añadida a ssh-agent."
    ["Remove all keys from the agent?"]="¿Quitar todas las claves del agente?"
    ["All keys removed."]="Todas las claves quitadas."
    ["Key to remove from ssh-agent"]="Clave a quitar de ssh-agent"
    ["Key removed from ssh-agent."]="Clave quitada de ssh-agent."

    # --- hosts.sh ------------------------------------------------------------
    ["No ~/.ssh/config file."]="No hay archivo ~/.ssh/config."
    ["Registered remote hosts (%s):"]="Máquinas remotas registradas (%s):"
    ["  (none)"]="  (ninguna)"
    ["Host alias name"]="Nombre (alias) de la máquina"
    ["Name required."]="Nombre obligatorio."
    ["A host named '%s' already exists."]="Ya existe un host llamado '%s'."
    ["Address (HostName)"]="Dirección (HostName)"
    ["User"]="Usuario"
    ["Port"]="Puerto"
    ["Key file (IdentityFile)"]="Archivo de clave (IdentityFile)"
    ["ProxyJump (empty = none)"]="ProxyJump (vacío = ninguno)"
    ["Host '%s' added to %s"]="Host '%s' añadido a %s"
    ["Host name to delete"]="Nombre del host a eliminar"
    ["No config file."]="No hay archivo config."
    ["Host not found: %s"]="Host no encontrado: %s"
    ["Host '%s' deleted."]="Host '%s' eliminado."
    ["Host name to edit"]="Nombre del host a modificar"
    ["Current configuration of '%s':"]="Configuración actual de '%s':"
    ["Editing replaces the whole block."]="La edición reemplaza el bloque completo."
    ["Continue?"]="¿Continuar?"
    ["Unable to back up %s."]="No se pudo respaldar %s."
    ["Edit cancelled: host '%s' has been restored."]="Edición cancelada: el host '%s' se ha restaurado."
    ["Host name"]="Nombre del host"
    ["ssh not found."]="ssh no encontrado."
    ["Effective configuration (ssh -G %s):"]="Configuración efectiva (ssh -G %s):"
    ["Host name to test"]="Nombre del host a probar"
    ["Resolving %s..."]="Resolviendo %s..."
    ["DNS resolution succeeded."]="Resolución DNS correcta."
    ["DNS resolution uncertain."]="Resolución DNS incierta."
    ["Testing port %s..."]="Probando el puerto %s..."
    ["Port %s open."]="Puerto %s abierto."
    ["Port %s unreachable."]="Puerto %s inaccesible."
    ["SSH authentication test (BatchMode)..."]="Prueba de autenticación SSH (BatchMode)..."
    ["Authentication succeeded."]="Autenticación correcta."
    ["Automatic authentication failed (missing key or password required)."]="Autenticación no automática (falta clave o se requiere contraseña)."
    ["Remote host identification has changed (known_hosts conflict)."]="La identificación del host remoto ha cambiado (conflicto known_hosts)."
    ["This can happen after a reinstall, or indicate a MITM risk."]="Puede ocurrir tras una reinstalación, o indicar un riesgo MITM."
    ["Remove the old host key for %s from known_hosts?"]="¿Eliminar la clave de host antigua de %s en known_hosts?"
    ["Fetch and accept the new host key now?"]="¿Obtener y aceptar ahora la nueva clave de host?"
    ["New host key(s) for %s added to known_hosts."]="Nueva(s) clave(s) de host para %s añadida(s) a known_hosts."
    ["Unable to fetch host keys from %s."]="No se pudieron obtener las claves de host de %s."
    ["Re-run the host test after updating known_hosts."]="Vuelva a probar el host tras actualizar known_hosts."
    ["Connecting to %s..."]="Conectando a %s..."
    ["ssh-copy-id not found."]="ssh-copy-id no encontrado."
    ["Copying %s to %s..."]="Copiando %s a %s..."
    ["Empty public key body."]="Cuerpo de clave pública vacío."
    ["Invalid key body (unexpected characters)."]="Cuerpo de clave no válido (caracteres inesperados)."
    ["Removing the key on %s (requires authorized access)."]="Quitando la clave en %s (requiere acceso autorizado)."
    ["Key removed on %s."]="Clave quitada en %s."
    ["Removal failed."]="Falló la eliminación."

    # --- known_hosts.sh ------------------------------------------------------
    ["No known_hosts file."]="No hay archivo known_hosts."
    ["Known fingerprints (%s):"]="Huellas conocidas (%s):"
    ["Host fingerprint for %s:"]="Huella del host para %s:"
    ["No entry for %s."]="Ninguna entrada para %s."
    ["Server name or address"]="Nombre o dirección del servidor"
    ["Host to remove from known_hosts"]="Host a eliminar de known_hosts"
    ["Fingerprint of %s removed."]="Huella de %s eliminada."
    ["Removal failed for %s."]="Falló la eliminación para %s."
    ["Host to scan"]="Host a escanear"
    ["ssh-keyscan not found."]="ssh-keyscan no encontrado."
    ["Fingerprint announced by %s:"]="Huella anunciada por %s:"

    # --- logs.sh -------------------------------------------------------------
    ["Active SSH sessions:"]="Sesiones SSH activas:"
    ["'who' unavailable."]="'who' no disponible."
    ["Recent logins:"]="Conexiones recientes:"
    ["'last' unavailable."]="'last' no disponible."
    ["Recent failed login attempts:"]="Intentos de conexión fallidos recientes:"
    ["  (none or not accessible)"]="  (ninguno o no accesible)"
    ["No source of failed attempts available."]="No hay fuente de intentos fallidos disponible."
    ["SSH service logs:"]="Registros del servicio SSH:"
    ["Connections and logs"]="Conexiones y registros"
    ["  1. Active sessions"]="  1. Sesiones activas"
    ["  2. Recent logins"]="  2. Conexiones recientes"
    ["  3. Failed attempts"]="  3. Intentos fallidos"
    ["  4. SSH service logs"]="  4. Registros del servicio SSH"
    ["Recent logins"]="Conexiones recientes"
    ["SSH service logs"]="Registros del servicio SSH"

    # --- audit.sh ------------------------------------------------------------
    ["WARN"]="AVISO"
    ["FAIL"]="FALLO"
    ["Local SSH security audit"]="Auditoría de seguridad SSH local"
    ["SSH server"]="Servidor SSH"
    ["OpenSSH Server installed."]="OpenSSH Server instalado."
    ["OpenSSH Server not installed."]="OpenSSH Server no instalado."
    ["PermitRootLogin = no (root forbidden)."]="PermitRootLogin = no (root prohibido)."
    ["PermitRootLogin = key only."]="PermitRootLogin = solo clave."
    ["PermitRootLogin = yes (root with password allowed)."]="PermitRootLogin = yes (root con contraseña permitido)."
    ["PermitRootLogin = %s."]="PermitRootLogin = %s."
    ["Password authentication disabled."]="Autenticación por contraseña desactivada."
    ["Password authentication enabled."]="Autenticación por contraseña activada."
    ["PasswordAuthentication = %s."]="PasswordAuthentication = %s."
    ["MaxAuthTries = %s."]="MaxAuthTries = %s."
    ["MaxAuthTries = %s (recommended <= 4)."]="MaxAuthTries = %s (recomendado <= 4)."
    ["default"]="predeterminado"
    ["sshd -t: configuration valid."]="sshd -t: configuración válida."
    ["sshd -t: configuration invalid."]="sshd -t: configuración no válida."
    ["Local permissions (%s)"]="Permisos locales (%s)"
    ["The .ssh directory has 700 permissions."]="El directorio .ssh tiene permisos 700."
    ["The .ssh directory has %s permissions (expected 700)."]="El directorio .ssh tiene permisos %s (se esperaba 700)."
    ["authorized_keys 600."]="authorized_keys 600."
    ["authorized_keys %s (expected 600)."]="authorized_keys %s (se esperaba 600)."
    ["%s 600."]="%s 600."
    ["%s %s (private key must be 600)."]="%s %s (la clave privada debe ser 600)."
    ["No .ssh directory for %s."]="No hay directorio .ssh para %s."
    ["Listening port"]="Puerto de escucha"
    ["The configured SSH port is listening."]="El puerto SSH configurado está escuchando."
    ["Unable to confirm the SSH port is listening."]="No se puede confirmar la escucha del puerto SSH."
    ["Summary"]="Resumen"
    ["%d OK, %d warnings, %d failures"]="%d OK, %d avisos, %d fallos"
    ["LSSHM diagnostics (doctor)"]="Diagnóstico LSSHM (doctor)"
    ["SSH tools:"]="Herramientas SSH:"
    ["LSSHM paths:"]="Rutas LSSHM:"
    ["PATH:"]="PATH:"
    ["%s is in PATH"]="%s está en el PATH"
    ["%s is not in PATH"]="%s no está en el PATH"

    # --- updater.sh ----------------------------------------------------------
    ["Neither curl nor wget available for download."]="Ni curl ni wget disponibles para la descarga."
    ["Installed version: %s"]="Versión instalada: %s"
    ["Available version: %s"]="Versión disponible: %s"
    ["An update is available."]="Hay una actualización disponible."
    ["Install now?"]="¿Instalar ahora?"
    ["LSSHM does not seem to be installed in %s."]="LSSHM no parece estar instalado en %s."
    ["Use: curl -fsSL %s/lsshm.sh | bash -s -- install"]="Use: curl -fsSL %s/lsshm.sh | bash -s -- install"
    ["Remote version : %s"]="Versión remota    : %s"
    ["Downloading the new version..."]="Descargando la nueva versión..."
    ["Download failed."]="Falló la descarga."
    ["The downloaded script has syntax errors. Aborting."]="El script descargado tiene errores de sintaxis. Abortando."
    ["SHA-256 verification failed. Aborting."]="Falló la verificación SHA-256. Abortando."
    ["The downloaded file does not look like LSSHM. Aborting."]="El archivo descargado no parece LSSHM. Abortando."
    ["Update installed. Previous version kept: %s"]="Actualización instalada. Versión anterior conservada: %s"
    ["Use 'lsshm update rollback' to revert."]="Use 'lsshm update rollback' para revertir."
    ["File replacement failed."]="Falló el reemplazo del archivo."
    ["File to verify not found."]="Archivo a verificar no encontrado."
    ["SHA256SUMS unavailable: cannot verify (aborting)."]="SHA256SUMS no disponible: no se puede verificar (abortando)."
    ["lsshm.sh checksum missing from SHA256SUMS (aborting)."]="Falta la suma de lsshm.sh en SHA256SUMS (abortando)."
    ["No SHA-256 tool (sha256sum/shasum): cannot verify (aborting)."]="Sin herramienta SHA-256 (sha256sum/shasum): no se puede verificar (abortando)."
    ["Incorrect SHA-256 checksum."]="Suma SHA-256 incorrecta."
    ["  expected: %s"]="  esperado: %s"
    ["  actual:   %s"]="  obtenido: %s"
    ["SHA-256 checksum verified."]="Suma SHA-256 verificada."
    ["No previous version available (%s)."]="No hay versión anterior disponible (%s)."
    ["Restore the previous version of LSSHM?"]="¿Restaurar la versión anterior de LSSHM?"
    ["Previous version restored."]="Versión anterior restaurada."

    # --- cli.sh / dialog.sh (menus + status) ---------------------------------
    ["Managed user: %s"]="Usuario administrado: %s"
    ["SSH server status: %s"]="Estado del servidor SSH: %s"
    ["Port: %s"]="Puerto: %s"
    ["Root access: %s"]="Acceso root: %s"
    ["Password authentication: %s"]="Autenticación por contraseña: %s"
    ["Authorized keys for root: %s"]="Claves autorizadas para root: %s"
    ["Private keys of %s: %s"]="Claves privadas de %s: %s"
    ["Registered remote hosts: %s"]="Máquinas remotas registradas: %s"
    ["Invalid choice."]="Elección no válida."
    ["Choice"]="Elección"
    ["Main menu"]="Menú principal"
    ["1. Manage the local SSH server"]="1. Gestionar el servidor SSH local"
    ["2. Manage access to this machine"]="2. Gestionar el acceso a esta máquina"
    ["3. Manage my SSH keys"]="3. Gestionar mis claves SSH"
    ["4. Manage remote hosts"]="4. Gestionar las máquinas remotas"
    ["5. View connections and logs"]="5. Ver conexiones y registros"
    ["6. Run a security audit"]="6. Realizar una auditoría de seguridad"
    ["7. Back up or restore"]="7. Copiar o restaurar"
    ["8. LSSHM settings"]="8. Configuración de LSSHM"
    ["9. Quit"]="9. Salir"
    ["Manage the local SSH server"]="Gestionar el servidor SSH local"
    ["Manage access to this machine"]="Gestionar el acceso a esta máquina"
    ["Manage my SSH keys"]="Gestionar mis claves SSH"
    ["Manage remote hosts"]="Gestionar las máquinas remotas"
    ["View connections and logs"]="Ver conexiones y registros"
    ["Run a security audit"]="Realizar una auditoría de seguridad"
    ["Back up or restore"]="Copiar o restaurar"
    ["LSSHM settings"]="Configuración de LSSHM"
    ["Quit"]="Salir"
    ["Back"]="Volver"

    ["Local SSH server"]="Servidor SSH local"
    ["Install OpenSSH Server"]="Instalar OpenSSH Server"
    ["Start the service"]="Iniciar el servicio"
    ["Stop the service"]="Detener el servicio"
    ["Restart the service"]="Reiniciar el servicio"
    ["Reload the service"]="Recargar el servicio"
    ["Enable at boot"]="Activar en el arranque"
    ["Disable at boot"]="Desactivar en el arranque"
    ["Change the port"]="Cambiar el puerto"
    ["Address family (AddressFamily)"]="Familia de direcciones (AddressFamily)"
    ["Listen addresses (ListenAddress)"]="Direcciones de escucha (ListenAddress)"
    ["Manage root access"]="Gestionar el acceso root"
    ["Password authentication"]="Autenticación por contraseña"
    ["Key authentication"]="Autenticación por clave"
    ["Allowed users (AllowUsers)"]="Usuarios permitidos (AllowUsers)"
    ["Allowed groups (AllowGroups)"]="Grupos permitidos (AllowGroups)"
    ["Test the configuration (sshd -t)"]="Probar la configuración (sshd -t)"
    ["Show the effective configuration (sshd -T)"]="Mostrar la configuración efectiva (sshd -T)"
    ["View the logs"]="Ver los registros"
    ["OpenSSH Server installation"]="Instalación de OpenSSH Server"
    ["Starting SSH"]="Inicio de SSH"
    ["Stopping SSH"]="Detención de SSH"
    ["Restarting SSH"]="Reinicio de SSH"
    ["Reloading SSH"]="Recarga de SSH"
    ["Enabling at boot"]="Activación en el arranque"
    ["Disabling at boot"]="Desactivación en el arranque"
    ["sshd -t test"]="Prueba sshd -t"
    ["Effective configuration"]="Configuración efectiva"
    ["SSH logs"]="Registros SSH"
    ["Configuration valid."]="Configuración válida."

    ["Access to this machine (keys allowed to connect HERE)"]="Acceso a esta máquina (claves autorizadas para conectarse AQUÍ)"
    ["Target user: %s"]="Usuario objetivo: %s"
    ["List users"]="Listar los usuarios"
    ["List authorized keys"]="Listar las claves autorizadas"
    ["Add a key (paste or import a .pub)"]="Añadir una clave (pegar o importar un .pub)"
    ["Remove a key"]="Eliminar una clave"
    ["Disable / re-enable a key"]="Desactivar / reactivar una clave"
    ["Repair ~/.ssh permissions"]="Reparar los permisos ~/.ssh"
    ["Detect duplicates"]="Detectar duplicados"
    ["Change target user"]="Cambiar de usuario objetivo"
    ["Local users"]="Usuarios locales"
    ["Authorized keys"]="Claves autorizadas"
    ["Permission repair"]="Reparación de permisos"
    ["Duplicates"]="Duplicados"

    ["SSH keys of %s (to connect ELSEWHERE)"]="Claves SSH de %s (para conectarse EN OTRO LUGAR)"
    ["List key pairs"]="Listar los pares de claves"
    ["Generate a new key (ED25519 by default)"]="Generar una nueva clave (ED25519 por defecto)"
    ["Inspect a key"]="Inspeccionar una clave"
    ["Show / export a public key"]="Mostrar / exportar una clave pública"
    ["Change the passphrase"]="Cambiar la frase de contraseña"
    ["Delete a key pair"]="Eliminar un par de claves"
    ["ssh-agent: list"]="ssh-agent: listar"
    ["ssh-agent: add a key"]="ssh-agent: añadir una clave"
    ["ssh-agent: remove a key"]="ssh-agent: quitar una clave"
    ["Key pairs"]="Pares de claves"
    ["Public key"]="Clave pública"

    ["Remote hosts (~/.ssh/config) - optional"]="Máquinas remotas (~/.ssh/config) - opcional"
    ["User: %s"]="Usuario: %s"
    ["Remote hosts"]="Máquinas remotas"
    ["List hosts"]="Listar las máquinas"
    ["Add a host"]="Añadir una máquina"
    ["Edit a host"]="Modificar una máquina"
    ["Delete a host"]="Eliminar una máquina"
    ["Test a host (resolution, port, auth)"]="Probar una máquina (resolución, puerto, auth)"
    ["Effective configuration (ssh -G)"]="Configuración efectiva (ssh -G)"
    ["Connect to a host"]="Conectarse a una máquina"
    ["Copy a key (ssh-copy-id)"]="Copiar una clave (ssh-copy-id)"
    ["Revoke a remote key"]="Revocar una clave remota"
    ["known_hosts: list"]="known_hosts: listar"
    ["known_hosts: remove a fingerprint"]="known_hosts: eliminar una huella"
    ["Host test"]="Prueba de máquina"

    ["Managed user        : %s"]="Usuario administrado          : %s"
    ["Update check        : %s"]="Comprobación de actualización : %s"
    ["Update channel      : %s"]="Canal de actualización        : %s"
    ["Language            : %s"]="Idioma                        : %s"
    ["Configuration file  : %s"]="Archivo de configuración      : %s"
    ["1. Update check: always"]="1. Comprobación: siempre"
    ["2. Update check: once a day"]="2. Comprobación: una vez al día"
    ["3. Update check: never"]="3. Comprobación: nunca"
    ["4. Check for updates now"]="4. Buscar actualizaciones ahora"
    ["5. Show diagnostics (doctor)"]="5. Mostrar el diagnóstico (doctor)"
    ["6. Change the language"]="6. Cambiar el idioma"
    ["7. Change managed user"]="7. Cambiar de usuario administrado"
    ["8. Back"]="8. Volver"
    ["Update check: always"]="Comprobación: siempre"
    ["Update check: once a day"]="Comprobación: una vez al día"
    ["Update check: never"]="Comprobación: nunca"
    ["Check for updates now"]="Buscar actualizaciones ahora"
    ["Show diagnostics (doctor)"]="Mostrar el diagnóstico (doctor)"
    ["Change the language"]="Cambiar el idioma"
    ["Change managed user"]="Cambiar de usuario administrado"
    ["Channel: %s"]="Canal: %s"
    ["File: %s"]="Archivo: %s"
    ["LSSHM diagnostics"]="Diagnóstico LSSHM"
    ["Security audit"]="Auditoría de seguridad"

    ["Connections and logs"]="Conexiones y registros"
    ["Consult SSH activity"]="Consultar la actividad SSH"
    ["Active sessions"]="Sesiones activas"
    ["Failed attempts"]="Intentos fallidos"

    ["Backup and restore"]="Copia de seguridad y restauración"
    ["Back up or restore the SSH configuration"]="Copiar o restaurar la configuración SSH"
    ["Back up the SSH server configuration"]="Respaldar la configuración del servidor SSH"
    ["List backups"]="Listar las copias de seguridad"
    ["Restore a server configuration"]="Restaurar una configuración de servidor"
    ["SSH server backup"]="Copia del servidor SSH"
    ["authorized_keys backup"]="Copia de authorized_keys"
    ["Available backups"]="Copias de seguridad disponibles"
    ["Backups"]="Copias de seguridad"

    # --- dialog.sh -----------------------------------------------------------
    ["The terminal GUI requires the dialog package."]="La interfaz gráfica en terminal requiere el paquete dialog."
    ["1. Install dialog"]="1. Instalar dialog"
    ["2. Continue with the CLI interface"]="2. Continuar con la interfaz CLI"
    ["3. Cancel"]="3. Cancelar"
    ["dialog could not be installed. Falling back to the CLI interface."]="No se pudo instalar dialog. Volviendo a la interfaz CLI."
    ["(no output)"]="(sin salida)"
    ["Result"]="Resultado"

    # --- main.sh -------------------------------------------------------------
    ["To use lsshm right away (no restart or re-login):"]="Para usar lsshm de inmediato (sin reiniciar ni volver a conectarse):"
    ["Or in one command:"]="O en un solo comando:"
    ["New SSH sessions will load ~/.profile automatically."]="Las nuevas sesiones SSH cargarán ~/.profile automáticamente."
    ["%s is not in your PATH."]="%s no está en su PATH."
    ["Add the PATH export to ~/.profile?"]="¿Añadir la exportación de PATH en ~/.profile?"
    ["Also added to %s (interactive shell)."]="Añadido también a %s (shell interactivo)."
    ["PATH configured in %s for future logins."]="PATH configurado en %s para las próximas conexiones."
    ["PATH already configured in %s."]="PATH ya configurado en %s."
    ["PATH activated for this session."]="PATH activado para esta sesión."
    ["PATH was updated for future sessions; open a new terminal if the command is not found."]="El PATH se actualizó para las próximas sesiones; abra un terminal nuevo si no se encuentra el comando."
    ['Add manually: export PATH="$HOME/.local/bin:$PATH"']='Añada manualmente: export PATH="$HOME/.local/bin:$PATH"'
    ["Installing LSSHM into the user directory..."]="Instalando LSSHM en el directorio del usuario..."
    ["Downloading lsshm.sh from the repository..."]="Descargando lsshm.sh del repositorio..."
    ["The downloaded script is invalid."]="El script descargado no es válido."
    ["SHA-256 verification failed: installation aborted."]="Falló la verificación SHA-256: instalación abortada."
    ["Installed:"]="Instalado:"
    ["Installation complete."]="Instalación completada."
    ["The lsshm command is not active in THIS terminal yet."]="El comando lsshm aún no está activo en ESTE terminal."
    ["Run: lsshm"]="Ejecute: lsshm"
    ["Uninstalling LSSHM."]="Desinstalando LSSHM."
    ["Binary and link removed."]="Binario y enlace eliminados."
    ["Also remove configuration and state (%s, %s)?"]="¿Eliminar también la configuración y el estado (%s, %s)?"
    ["Configuration and state removed."]="Configuración y estado eliminados."
    ["Configuration kept: %s"]="Configuración conservada: %s"
    ["Note: LSSHM does not modify your SSH configuration on uninstall."]="Nota: LSSHM no modifica su configuración SSH al desinstalar."
    ["Remember to remove the PATH line from ~/.profile if necessary."]="Recuerde quitar la línea PATH de ~/.profile si es necesario."
    # --- usage / help --------------------------------------------------------
    ["Usage:"]="Uso:"
    ["Open the CLI menu"]="Abrir el menú CLI"
    ["Open the dialog interface"]="Abrir la interfaz dialog"
    ["Show local SSH status"]="Mostrar el estado SSH local"
    ["Environment diagnostics"]="Diagnóstico del entorno"
    ["Update LSSHM (or roll back)"]="Actualizar LSSHM (o restaurar)"
    ["Install LSSHM into ~/.local"]="Instalar LSSHM en ~/.local"
    ["Uninstall LSSHM"]="Desinstalar LSSHM"
    ["Show the version"]="Mostrar la versión"
    ["Show this help"]="Mostrar esta ayuda"
    ["Global options:"]="Opciones globales:"
    ["Manage NAME's SSH files (access, keys, hosts)"]="Administrar los archivos SSH de NAME (acceso, claves, hosts)"
    ["Interface language (%s)"]="Idioma de la interfaz (%s)"
    ["Force the dialog interface"]="Forzar la interfaz dialog"
    ["Answer yes automatically (non-interactive)"]="Responder sí automáticamente (no interactivo)"
    ["Disable color"]="Desactivar el color"
    ["Local SSH server:"]="Servidor SSH local:"
    ["Incoming access (keys allowed HERE):"]="Acceso entrante (claves permitidas AQUÍ):"
    ["Local keys (to connect ELSEWHERE):"]="Claves locales (para conectarse EN OTRO LUGAR):"
    ["Remote hosts:"]="Máquinas remotas:"
    ["Unknown server subcommand: %s"]="Subcomando server desconocido: %s"
    ["Unknown access subcommand: %s"]="Subcomando access desconocido: %s"
    ["Unknown key subcommand: %s"]="Subcomando key desconocido: %s"
    ["Unknown agent subcommand: %s"]="Subcomando agent desconocido: %s"
    ["Unknown host subcommand: %s"]="Subcomando host desconocido: %s"
    ["Unknown command: %s"]="Comando desconocido: %s"
)

# ===== src/platform.sh =================================================
# shellcheck shell=bash
# =============================================================================
# platform.sh - detect distribution, package manager, service manager, virt
# =============================================================================

lsshm_detect_platform() {
    LSSHM_OS_ID="unknown"
    LSSHM_OS_NAME="Unknown"
    LSSHM_OS_LIKE=""
    LSSHM_OS_VERSION=""

    if [ -r /etc/os-release ]; then
        # shellcheck disable=SC1091
        . /etc/os-release
        LSSHM_OS_ID="${ID:-unknown}"
        LSSHM_OS_NAME="${PRETTY_NAME:-${NAME:-Unknown}}"
        LSSHM_OS_LIKE="${ID_LIKE:-}"
        LSSHM_OS_VERSION="${VERSION_ID:-}"
    fi

    LSSHM_PKG_MGR="$(lsshm_detect_pkg_mgr)"
    LSSHM_SVC_MGR="$(lsshm_detect_svc_mgr)"
    LSSHM_HAS_SYSTEMD=0
    [ "$LSSHM_SVC_MGR" = "systemd" ] && LSSHM_HAS_SYSTEMD=1

    LSSHM_VIRT="$(lsshm_detect_virt)"
    LSSHM_SSHD_BIN="$(lsshm_detect_sshd_bin)"
    LSSHM_SSH_SERVICE="$(lsshm_detect_ssh_service)"
}

lsshm_detect_pkg_mgr() {
    if lsshm_have apt-get; then printf 'apt'
    elif lsshm_have apk; then printf 'apk'
    elif lsshm_have dnf; then printf 'dnf'
    elif lsshm_have yum; then printf 'yum'
    elif lsshm_have pacman; then printf 'pacman'
    elif lsshm_have zypper; then printf 'zypper'
    else printf 'unknown'
    fi
}

lsshm_detect_svc_mgr() {
    if lsshm_have systemctl && [ -d /run/systemd/system ]; then printf 'systemd'
    elif lsshm_have rc-service; then printf 'openrc'
    elif lsshm_have service; then printf 'sysv'
    else printf 'unknown'
    fi
}

lsshm_detect_virt() {
    if lsshm_have systemd-detect-virt; then
        systemd-detect-virt 2>/dev/null || printf 'none'
    elif [ -f /run/systemd/container ]; then
        cat /run/systemd/container 2>/dev/null || printf 'container'
    elif grep -qa 'container=lxc' /proc/1/environ 2>/dev/null; then
        printf 'lxc'
    else
        printf 'unknown'
    fi
}

lsshm_detect_sshd_bin() {
    local candidate
    for candidate in /usr/sbin/sshd /usr/bin/sshd /sbin/sshd; do
        [ -x "$candidate" ] && { printf '%s' "$candidate"; return 0; }
    done
    if lsshm_have sshd; then
        command -v sshd
        return 0
    fi
    printf ''
}

lsshm_detect_ssh_service() {
    # Debian/Ubuntu use "ssh", most RPM/Arch use "sshd".
    case "$LSSHM_OS_ID" in
        debian|ubuntu|raspbian|linuxmint|pop) printf 'ssh' ;;
        *) printf 'sshd' ;;
    esac
}

lsshm_platform_summary() {
    lsshm_out 'Distribution        : %s' "$LSSHM_OS_NAME"
    lsshm_out 'Identifier          : %s' "$LSSHM_OS_ID ${LSSHM_OS_VERSION:+($LSSHM_OS_VERSION)}"
    lsshm_out 'Package manager     : %s' "$LSSHM_PKG_MGR"
    lsshm_out 'Service manager     : %s' "$LSSHM_SVC_MGR"
    lsshm_out 'systemd             : %s' "$([ "$LSSHM_HAS_SYSTEMD" = 1 ] && lsshm_t present || lsshm_t absent)"
    lsshm_out 'Virtualization      : %s' "$LSSHM_VIRT"
    lsshm_out 'sshd binary         : %s' "${LSSHM_SSHD_BIN:-$(lsshm_t 'not detected')}"
    lsshm_out 'SSH service         : %s' "$LSSHM_SSH_SERVICE"
}

# Is the current distribution supported for full management in this version?
lsshm_platform_is_primary() {
    case "$LSSHM_OS_ID" in
        debian) return 0 ;;
        ubuntu|raspbian|linuxmint|pop) return 0 ;;
        *)
            case " $LSSHM_OS_LIKE " in
                *debian*) return 0 ;;
                *) return 1 ;;
            esac
            ;;
    esac
}

# ===== src/privileges.sh ===============================================
# shellcheck shell=bash
# =============================================================================
# privileges.sh - privilege elevation and calling-user resolution
# =============================================================================

lsshm_init_privileges() {
    LSSHM_EUID="$(id -u)"
    LSSHM_IS_ROOT=0
    [ "$LSSHM_EUID" = "0" ] && LSSHM_IS_ROOT=1

    # Default target for personal SSH files until resolve_target_user runs:
    # sudo → original user; direct root → root; otherwise the current user.
    LSSHM_CALLING_USER="${LSSHM_TARGET_USER:-${SUDO_USER:-${USER:-$(id -un)}}}"
    if [ -z "${LSSHM_TARGET_USER:-}" ] && [ "$LSSHM_IS_ROOT" = "1" ] \
        && { [ -z "${SUDO_USER:-}" ] || [ "$SUDO_USER" = "root" ]; }; then
        LSSHM_CALLING_USER="root"
    fi

    if lsshm_have sudo && [ "$LSSHM_IS_ROOT" = "0" ]; then
        LSSHM_SUDO="sudo"
    else
        LSSHM_SUDO=""
    fi
    # Set after a successful sudo -v / privileged auth in this process.
    LSSHM_SUDO_PRIMED="${LSSHM_SUDO_PRIMED:-0}"
}

# Home directory of a given user.
lsshm_user_home() {
    local user="$1" home
    home="$(getent passwd "$user" 2>/dev/null | cut -d: -f6)"
    if [ -z "$home" ]; then
        if [ "$user" = "${USER:-}" ]; then
            home="$HOME"
        else
            home="/home/$user"
        fi
    fi
    printf '%s' "$home"
}

# The .ssh directory for the managed (calling) user.
lsshm_target_ssh_dir() {
    printf '%s/.ssh' "$(lsshm_user_home "$LSSHM_CALLING_USER")"
}

# Expand a leading ~/ using the managed user's home (not the process $HOME).
lsshm_expand_user_path() {
    local path="$1" user="${2:-$LSSHM_CALLING_USER}"
    if [ "${path#~/}" != "$path" ]; then
        printf '%s/%s' "$(lsshm_user_home "$user")" "${path#~/}"
    else
        printf '%s' "$path"
    fi
}

# True if a non-interactive sudo would succeed (cached credentials).
lsshm_sudo_ready() {
    [ "$LSSHM_IS_ROOT" = "1" ] && return 0
    [ -n "${LSSHM_SUDO:-}" ] || return 1
    sudo -n true >/dev/null 2>&1
}

# Ask for the sudo password at most once per session (when needed).
lsshm_sudo_ensure() {
    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        return 0
    fi
    if [ -z "${LSSHM_SUDO:-}" ]; then
        lsshm_error 'This operation requires root privileges, but sudo was not found.'
        return 1
    fi
    if lsshm_sudo_ready; then
        LSSHM_SUDO_PRIMED=1
        return 0
    fi
    if ! lsshm_is_interactive || [ ! -t 0 ]; then
        lsshm_error 'sudo authentication required (non-interactive session).'
        return 1
    fi
    lsshm_note 'Administrator authentication (sudo) — once for this session.'
    if sudo -v; then
        LSSHM_SUDO_PRIMED=1
        return 0
    fi
    lsshm_error 'sudo authentication failed.'
    return 1
}

# Run a command that requires root. Uses sudo only when necessary.
# Authenticates once via lsshm_sudo_ensure, then reuses the sudo ticket.
lsshm_run_privileged() {
    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        "$@"
    elif [ -n "$LSSHM_SUDO" ]; then
        lsshm_sudo_ensure || return 1
        # Do not fall back to an interactive sudo on command failure (that would
        # re-prompt for the password when sshd -t / systemctl simply return 1).
        if lsshm_sudo_ready; then
            sudo -n "$@"
        else
            sudo "$@"
        fi
    else
        lsshm_error 'This operation requires root privileges, but sudo was not found.'
        return 1
    fi
}

# Run several shell commands under a single sudo (one password prompt max).
# Usage: lsshm_run_privileged_sh 'cmd1 && cmd2'
lsshm_run_privileged_sh() {
    local script="$1"
    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        sh -c "$script"
    elif [ -n "$LSSHM_SUDO" ]; then
        lsshm_sudo_ensure || return 1
        if lsshm_sudo_ready; then
            sudo -n sh -c "$script"
        else
            sudo sh -c "$script"
        fi
    else
        lsshm_error 'This operation requires root privileges, but sudo was not found.'
        return 1
    fi
}

# True if we can obtain root (already root or sudo available).
lsshm_can_elevate() {
    [ "$LSSHM_IS_ROOT" = "1" ] || [ -n "$LSSHM_SUDO" ]
}

lsshm_require_root() {
    if ! lsshm_can_elevate; then
        lsshm_die 'Privileged operation not possible: run LSSHM as root or install sudo.'
    fi
}

# Validate and set the user whose personal SSH files are managed.
lsshm_set_target_user() {
    local user="$1"
    if [ -z "$user" ]; then
        lsshm_error 'Empty username.'
        return 1
    fi
    if ! lsshm_user_exists "$user"; then
        lsshm_error 'Unknown user: %s' "$user"
        return 1
    fi
    LSSHM_CALLING_USER="$user"
    LSSHM_TARGET_USER="$user"
    lsshm_ok 'Managed user: %s (%s/.ssh)' "$LSSHM_CALLING_USER" "$(lsshm_user_home "$LSSHM_CALLING_USER")"
}

# Ensure ~/.ssh exists with correct ownership for a target user (root admin case).
lsshm_ensure_user_ssh_dir() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local home ssh_dir uid gid
    home="$(lsshm_user_home "$user")"
    ssh_dir="$home/.ssh"
    uid="$(id -u "$user" 2>/dev/null || echo 0)"
    gid="$(id -g "$user" 2>/dev/null || echo 0)"

    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        mkdir -p "$ssh_dir"
        chmod 700 "$ssh_dir"
        chown "$uid:$gid" "$ssh_dir"
    elif mkdir -p "$ssh_dir" 2>/dev/null; then
        chmod 700 "$ssh_dir" 2>/dev/null || true
    else
        lsshm_run_privileged mkdir -p "$ssh_dir"
        lsshm_run_privileged chmod 700 "$ssh_dir"
        lsshm_run_privileged chown "$uid:$gid" "$ssh_dir"
    fi
}

# chown paths to a login user when we are root (no-op otherwise).
lsshm_chown_user() {
    local user="$1"
    shift
    [ "$LSSHM_IS_ROOT" = "1" ] || return 0
    [ "$#" -gt 0 ] || return 0
    local uid gid
    uid="$(id -u "$user" 2>/dev/null || echo 0)"
    gid="$(id -g "$user" 2>/dev/null || echo 0)"
    chown "$uid:$gid" "$@"
}

# Interactive picker: numbered login users (+ root), or typed name.
lsshm_pick_target_user() {
    local default="${1:-$LSSHM_CALLING_USER}"
    local -a names=()
    local name uid home i=0 user_list="" choice=""

    user_list="$(lsshm_users_list 2>/dev/null)" || user_list=""

    printf '\n' >&2
    lsshm_out 'Available local users:' >&2
    while IFS=: read -r name uid home || [ -n "$name" ]; do
        [ -n "$name" ] || continue
        i=$((i + 1))
        names+=("$name")
        printf '  %d. %-16s uid=%-6s %s\n' "$i" "$name" "$uid" "$home" >&2
    done <<EOF
$user_list
EOF

    if [ "$i" -eq 0 ]; then
        lsshm_error 'No local user detected.'
        return 1
    fi

    # || true: under set -e, a failed prompt inside $(...) must not abort LSSHM.
    choice="$(lsshm_prompt "$(lsshm_t 'User to manage (number or name)')" "$default" || true)"
    [ -n "$choice" ] || return 1

    if [[ "$choice" =~ ^[0-9]+$ ]]; then
        if [ "$choice" -lt 1 ] || [ "$choice" -gt "${#names[@]}" ]; then
            lsshm_error 'Number out of range (1-%s).' "${#names[@]}"
            return 1
        fi
        choice="${names[$((choice - 1))]}"
    fi

    lsshm_set_target_user "$choice"
}

# Resolve which user's personal SSH files to manage (keys, access, hosts).
lsshm_resolve_target_user() {
    # Explicit --user always wins.
    if [ -n "${LSSHM_TARGET_USER:-}" ]; then
        if ! lsshm_user_exists "$LSSHM_TARGET_USER"; then
            lsshm_die 'Unknown user: %s' "$LSSHM_TARGET_USER"
        fi
        LSSHM_CALLING_USER="$LSSHM_TARGET_USER"
        return 0
    fi

    # Non-interactive defaults: sudo → calling user; direct root → root.
    if ! lsshm_is_interactive; then
        if [ "$LSSHM_IS_ROOT" = "1" ]; then
            if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
                LSSHM_CALLING_USER="$SUDO_USER"
            else
                LSSHM_CALLING_USER="root"
            fi
        fi
        return 0
    fi

    # Interactive privileged session: pick whose personal SSH files to manage.
    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
            # Elevated via sudo: preselect the calling user; option 2 can pick
            # root or any other account.
            printf '\n'; lsshm_out '%s is running with sudo.' "$LSSHM_NAME"
            lsshm_out 'Calling user   : %s' "$SUDO_USER"
            lsshm_out 'Privileged user: root'; printf '\n'
            lsshm_out 'Whose personal SSH files should be managed?'
            lsshm_out '  1. %s (recommended)' "$SUDO_USER"
            lsshm_out '  2. Choose another user'
            local choice=""
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '1' || true)"
            case "$choice" in
                2) lsshm_pick_target_user "$SUDO_USER" || LSSHM_CALLING_USER="$SUDO_USER" ;;
                *) lsshm_set_target_user "$SUDO_USER" || LSSHM_CALLING_USER="$SUDO_USER" ;;
            esac
        else
            # Direct root login: preselect root.
            printf '\n'; lsshm_out '%s is running as root.' "$LSSHM_NAME"
            lsshm_out "You can manage another user's SSH (keys, access, hosts)."; printf '\n'
            lsshm_out 'Whose personal SSH files should be managed?'
            lsshm_out '  1. %s (recommended)' "root"
            lsshm_out '  2. Choose another user'
            local choice=""
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '1' || true)"
            case "$choice" in
                2) lsshm_pick_target_user "root" || lsshm_set_target_user "root" || true ;;
                *) lsshm_set_target_user "root" || true ;;
            esac
        fi
    fi
}

# ===== src/backup.sh ===================================================
# shellcheck shell=bash
# =============================================================================
# backup.sh - backup and restore of managed SSH files
# =============================================================================
# Backups are stored under $LSSHM_BACKUP_DIR as timestamped tar archives.

lsshm_backup_timestamp() { date '+%Y%m%d-%H%M%S'; }

# Copy a single file into a timestamped backup set, preserving path.
# Usage: lsshm_backup_file /etc/ssh/sshd_config [label]
lsshm_backup_file() {
    local src="$1" label="${2:-file}"
    [ -e "$src" ] || return 0
    lsshm_ensure_dirs
    local stamp; stamp="$(lsshm_backup_timestamp)"
    local dest="$LSSHM_BACKUP_DIR/${stamp}-${label}"
    mkdir -p "$dest" 2>/dev/null || true
    local base; base="$(basename "$src")"
    if [ -r "$src" ]; then
        cp -a "$src" "$dest/$base" 2>/dev/null || \
            lsshm_run_privileged cp -a "$src" "$dest/$base"
    else
        lsshm_run_privileged cp -a "$src" "$dest/$base"
    fi
    printf '%s' "$dest/$base"
    lsshm_log INFO "Backup of $src -> $dest/$base"
}

# Full backup of the SSH server configuration tree.
lsshm_backup_server_config() {
    lsshm_ensure_dirs
    local stamp; stamp="$(lsshm_backup_timestamp)"
    local archive="$LSSHM_BACKUP_DIR/${stamp}-sshd-config.tar.gz"
    local tmp; tmp="$(lsshm_mktemp)"
    {
        [ -f /etc/ssh/sshd_config ] && printf '/etc/ssh/sshd_config\n'
        [ -d /etc/ssh/sshd_config.d ] && printf '/etc/ssh/sshd_config.d\n'
    } >"$tmp"
    if [ ! -s "$tmp" ]; then
        lsshm_warn 'No server configuration to back up.'
        return 1
    fi
    if lsshm_run_privileged tar -czf "$archive" -T "$tmp" 2>/dev/null; then
        # When stdout is captured (rollback), emit only the path.
        # Interactively, show a human message instead.
        if [ -t 1 ]; then
            lsshm_ok 'Backup created: %s' "$archive"
        else
            printf '%s' "$archive"
        fi
        return 0
    fi
    lsshm_error 'Server configuration backup failed.'
    return 1
}

# Backup a user's authorized_keys.
lsshm_backup_authorized_keys() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local home; home="$(lsshm_user_home "$user")"
    lsshm_backup_file "$home/.ssh/authorized_keys" "authkeys-$user"
}

lsshm_backup_list() {
    lsshm_ensure_dirs
    if [ -z "$(ls -A "$LSSHM_BACKUP_DIR" 2>/dev/null)" ]; then
        lsshm_info 'No backups recorded.'
        return 0
    fi
    lsshm_info 'Backups in %s:' "$LSSHM_BACKUP_DIR"
    local entry
    for entry in "$LSSHM_BACKUP_DIR"/*; do
        [ -e "$entry" ] || continue
        printf '  %s\n' "$(basename "$entry")"
    done
}

# Restore the SSH server configuration from an archive.
lsshm_backup_restore_server() {
    local archive="$1"
    if [ ! -f "$archive" ]; then
        # Allow passing just the basename.
        archive="$LSSHM_BACKUP_DIR/$archive"
    fi
    [ -f "$archive" ] || lsshm_die 'Backup archive not found: %s' "$1"
    lsshm_warn 'Restoring server configuration from: %s' "$archive"
    lsshm_confirm "$(lsshm_t 'Confirm the restore?')" no || { lsshm_info 'Cancelled.'; return 1; }
    if lsshm_run_privileged tar -xzf "$archive" -C / ; then
        lsshm_ok 'Configuration restored.'
        lsshm_server_config_test && lsshm_server_reload
    else
        lsshm_error 'Restore failed.'
        return 1
    fi
}

lsshm_backup_menu() {
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_backup_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'Backup and restore'; printf '\n'
            lsshm_out '  1. Back up the SSH server configuration'
            lsshm_out '  2. Back up authorized keys (authorized_keys)'
            lsshm_out '  3. List backups'
            lsshm_out '  4. Restore a server configuration'
            lsshm_out '  5. Back'
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '5' || true)"
        fi
        case "$choice" in
            1) lsshm_ui_run "$(lsshm_t 'SSH server backup')" lsshm_backup_server_config ;;
            2) lsshm_ui_run "$(lsshm_t 'authorized_keys backup')" lsshm_backup_authorized_keys "$LSSHM_CALLING_USER" ;;
            3) lsshm_ui_run "$(lsshm_t 'Available backups')" lsshm_backup_list ;;
            4)
                if lsshm_uses_dialog_ui; then
                    lsshm_menu_try lsshm_ui_show "$(lsshm_t 'Backups')" lsshm_backup_list
                else
                    lsshm_menu_try lsshm_backup_list
                fi
                local a=""
                a="$(lsshm_prompt "$(lsshm_t 'Archive name to restore')" '' || true)"
                if [ -n "$a" ]; then
                    lsshm_menu_try lsshm_backup_restore_server "$a"
                fi
                lsshm_uses_dialog_ui || lsshm_pause
                ;;
            5|q|Q) break ;;
            *) lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# ===== src/server.sh ===================================================
# shellcheck shell=bash
# =============================================================================
# server.sh - OpenSSH server service management
# =============================================================================

lsshm_server_is_installed() {
    [ -n "${LSSHM_SSHD_BIN:-}" ] && [ -x "$LSSHM_SSHD_BIN" ]
}

# --- service actions ---------------------------------------------------------

lsshm_server_action() {
    # lsshm_server_action start|stop|restart|reload|enable|disable
    local action="$1"
    case "$LSSHM_SVC_MGR" in
        systemd)
            lsshm_run_privileged systemctl "$action" "$LSSHM_SSH_SERVICE"
            ;;
        openrc)
            case "$action" in
                enable)  lsshm_run_privileged rc-update add "$LSSHM_SSH_SERVICE" default ;;
                disable) lsshm_run_privileged rc-update del "$LSSHM_SSH_SERVICE" default ;;
                reload)  lsshm_run_privileged rc-service "$LSSHM_SSH_SERVICE" reload \
                             || lsshm_run_privileged rc-service "$LSSHM_SSH_SERVICE" restart ;;
                *)       lsshm_run_privileged rc-service "$LSSHM_SSH_SERVICE" "$action" ;;
            esac
            ;;
        sysv)
            case "$action" in
                enable|disable)
                    lsshm_warn 'Automatic enable/disable is not handled for SysV here.'
                    return 1 ;;
                *) lsshm_run_privileged service "$LSSHM_SSH_SERVICE" "$action" ;;
            esac
            ;;
        *)
            lsshm_error "Unknown service manager: cannot run '%s'." "$action"
            return 1
            ;;
    esac
}

lsshm_server_start()   { lsshm_server_action start   && lsshm_ok 'SSH service started.'; }
lsshm_server_stop()    { lsshm_server_action stop    && lsshm_ok 'SSH service stopped.'; }
lsshm_server_restart() { lsshm_server_action restart && lsshm_ok 'SSH service restarted.'; }
lsshm_server_enable()  { lsshm_server_action enable  && lsshm_ok 'Automatic startup enabled.'; }
lsshm_server_disable() { lsshm_server_action disable && lsshm_ok 'Automatic startup disabled.'; }

# Reload preferred over restart; validate config first.
lsshm_server_reload() {
    if ! lsshm_server_config_test; then
        lsshm_error 'Invalid configuration: reload cancelled.'
        return 1
    fi
    if lsshm_server_action reload; then
        lsshm_server_config_invalidate_cache
        lsshm_ok 'SSH service reloaded.'
    else
        return 1
    fi
}

# --- status ------------------------------------------------------------------

lsshm_server_is_active() {
    case "$LSSHM_SVC_MGR" in
        systemd) systemctl is-active --quiet "$LSSHM_SSH_SERVICE" ;;
        openrc)  rc-service "$LSSHM_SSH_SERVICE" status >/dev/null 2>&1 ;;
        sysv)    service "$LSSHM_SSH_SERVICE" status >/dev/null 2>&1 ;;
        *)       lsshm_server_port_listening ;;
    esac
}

lsshm_server_is_enabled() {
    case "$LSSHM_SVC_MGR" in
        systemd) systemctl is-enabled --quiet "$LSSHM_SSH_SERVICE" 2>/dev/null ;;
        openrc)  rc-update show default 2>/dev/null | grep -qw "$LSSHM_SSH_SERVICE" ;;
        *)       return 1 ;;
    esac
}

# Is the configured SSH port actually listening?
lsshm_server_port_listening() {
    local port; port="$(lsshm_server_config_effective_value port)"
    port="${port:-22}"
    if lsshm_have ss; then
        ss -ltn 2>/dev/null | grep -Eq "[:.]${port}[[:space:]]"
    elif lsshm_have netstat; then
        netstat -ltn 2>/dev/null | grep -Eq "[:.]${port}[[:space:]]"
    else
        return 2
    fi
}

lsshm_server_status() {
    if ! lsshm_server_is_installed; then
        lsshm_warn 'OpenSSH Server is not installed (sshd binary not found).'
        return 0
    fi
    local active enabled port rootlogin passauth pubkey family listen
    if lsshm_server_is_active; then active="$(lsshm_t active)"; else active="$(lsshm_t inactive)"; fi
    if lsshm_server_is_enabled; then enabled="$(lsshm_t yes)"; else enabled="$(lsshm_t no)"; fi
    port="$(lsshm_server_config_effective_value port)"; port="${port:-22}"
    rootlogin="$(lsshm_server_config_effective_value permitrootlogin)"
    passauth="$(lsshm_server_config_effective_value passwordauthentication)"
    pubkey="$(lsshm_server_config_effective_value pubkeyauthentication)"
    family="$(lsshm_server_config_effective_value addressfamily)"; family="${family:-any}"
    listen="$(lsshm_server_config_effective_values listenaddress | tr '\n' ' ')"
    listen="$(printf '%s' "$listen" | sed 's/[[:space:]]*$//')"
    [ -n "$listen" ] || listen="0.0.0.0 ::"

    lsshm_out 'SSH server status : %s' "$active"
    lsshm_out 'Auto-start        : %s' "$enabled"
    lsshm_out 'Port              : %s' "$port"
    lsshm_out 'Address family    : %s' "$family"
    lsshm_out 'Listen addresses  : %s' "$listen"
    lsshm_out 'Root access       : %s' "$(lsshm_rootlogin_label "$rootlogin")"
    lsshm_out 'Password auth.    : %s' "$(lsshm_yesno_label "$passauth")"
    lsshm_out 'Key auth.         : %s' "$(lsshm_yesno_label "$pubkey")"
}

# --- installation ------------------------------------------------------------

lsshm_server_install() {
    if lsshm_server_is_installed; then
        lsshm_ok 'OpenSSH Server is already installed: %s' "$LSSHM_SSHD_BIN"
        return 0
    fi
    lsshm_info 'Installing OpenSSH Server...'
    lsshm_require_root
    case "$LSSHM_PKG_MGR" in
        apt)
            lsshm_run_privileged apt-get update && \
            lsshm_run_privileged apt-get install -y openssh-server ;;
        apk)
            lsshm_run_privileged apk add openssh ;;
        dnf)
            lsshm_run_privileged dnf install -y openssh-server ;;
        yum)
            lsshm_run_privileged yum install -y openssh-server ;;
        pacman)
            lsshm_run_privileged pacman -Sy --noconfirm openssh ;;
        zypper)
            lsshm_run_privileged zypper install -y openssh ;;
        *)
            lsshm_error 'Unsupported package manager: %s' "$LSSHM_PKG_MGR"
            return 1 ;;
    esac
    # Refresh detection.
    LSSHM_SSHD_BIN="$(lsshm_detect_sshd_bin)"
    if lsshm_server_is_installed; then
        lsshm_ok 'OpenSSH Server installed.'
        lsshm_server_action enable || true
        lsshm_server_action start  || true
    else
        lsshm_error 'The installation appears to have failed.'
        return 1
    fi
}

lsshm_server_logs() {
    local lines="${1:-40}"
    if [ "$LSSHM_SVC_MGR" = "systemd" ] && lsshm_have journalctl; then
        lsshm_run_privileged journalctl -u "$LSSHM_SSH_SERVICE" -n "$lines" --no-pager
    elif [ -f /var/log/auth.log ]; then
        lsshm_run_privileged tail -n "$lines" /var/log/auth.log
    elif [ -f /var/log/secure ]; then
        lsshm_run_privileged tail -n "$lines" /var/log/secure
    else
        lsshm_warn 'No SSH log source detected.'
        return 1
    fi
}

# ===== src/server_config.sh ============================================
# shellcheck shell=bash
# =============================================================================
# server_config.sh - sshd_config parsing, effective values, managed drop-in
# =============================================================================

LSSHM_SSHD_CONFIG="/etc/ssh/sshd_config"
LSSHM_MANAGED_CONF="/etc/ssh/sshd_config.d/00-lsshm.conf"

LSSHM_MANAGED_HEADER="# Managed by LSSHM
# Local SSH Manager
# Manual changes may be overwritten."

# --- validation --------------------------------------------------------------

# sshd -t : validate configuration. Returns non-zero on error.
lsshm_server_config_test() {
    if [ -z "${LSSHM_SSHD_BIN:-}" ]; then
        lsshm_warn 'sshd binary not found: validation not possible.'
        return 0
    fi
    local out
    if out="$(lsshm_run_privileged "$LSSHM_SSHD_BIN" -t 2>&1)"; then
        return 0
    fi
    lsshm_error 'sshd -t reported an error:'
    printf '%s\n' "$out" >&2
    return 1
}

lsshm_server_config_cache_file() {
    printf '%s/sshd-T.cache' "${LSSHM_CACHE_DIR:-${TMPDIR:-/tmp}}"
}

# Invalidate the cached sshd -T dump (call after config changes).
# File-backed so the cache survives dump="$(lsshm_server_config_dump)" subshells.
lsshm_server_config_invalidate_cache() {
    LSSHM_SSHD_T_CACHE=""
    LSSHM_SSHD_T_CACHED=0
    rm -f "$(lsshm_server_config_cache_file)" 2>/dev/null || true
}

# sshd -T : dump the effective configuration (cached).
# Never prompts for a sudo password: uses an existing ticket (sudo -n) or fails
# so the status panel / menu can open without asking for admin credentials.
# Pass "refresh" to force a new privileged dump (may prompt once via sudo -v).
lsshm_server_config_dump() {
    local mode="${1:-}" cache_file dump=""
    [ -n "${LSSHM_SSHD_BIN:-}" ] || return 1
    cache_file="$(lsshm_server_config_cache_file)"

    if [ "$mode" = "refresh" ]; then
        lsshm_server_config_invalidate_cache
        if [ "$LSSHM_IS_ROOT" != "1" ] && [ -n "${LSSHM_SUDO:-}" ]; then
            lsshm_sudo_ensure || return 1
        fi
    fi

    if [ -f "$cache_file" ]; then
        cat "$cache_file"
        return 0
    fi
    if [ "${LSSHM_SSHD_T_CACHED:-0}" = "1" ] && [ -n "${LSSHM_SSHD_T_CACHE:-}" ]; then
        printf '%s\n' "$LSSHM_SSHD_T_CACHE"
        return 0
    fi

    if [ "$LSSHM_IS_ROOT" = "1" ]; then
        dump="$("$LSSHM_SSHD_BIN" -T 2>/dev/null)" || return 1
    elif [ -n "${LSSHM_SUDO:-}" ]; then
        # Read-only: never trigger a password prompt here.
        dump="$(sudo -n "$LSSHM_SSHD_BIN" -T 2>/dev/null)" || return 1
    else
        dump="$("$LSSHM_SSHD_BIN" -T 2>/dev/null)" || return 1
    fi

    LSSHM_SSHD_T_CACHE="$dump"
    LSSHM_SSHD_T_CACHED=1
    mkdir -p "$(dirname "$cache_file")" 2>/dev/null || true
    printf '%s\n' "$dump" >"$cache_file" 2>/dev/null || true
    printf '%s\n' "$dump"
}

# Effective value of a directive (lowercase key). Falls back to file parsing
# when sshd -T is unavailable (e.g. no sudo credentials yet).
lsshm_server_config_effective_value() {
    local key; key="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
    local dump val
    dump="$(lsshm_server_config_dump)" || dump=""
    if [ -n "$dump" ]; then
        val="$(printf '%s\n' "$dump" | awk -v k="$key" 'tolower($1)==k {sub($1 FS,""); print; exit}')"
        [ -n "$val" ] && { printf '%s' "$val"; return 0; }
    fi
    # Fallback: first matching non-comment line across config + includes.
    lsshm_config_parse_value "$key"
}

# Parse a directive value directly from files (first occurrence wins, like sshd).
lsshm_config_parse_value() {
    local key; key="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
    local files; files="$(lsshm_config_effective_files)"
    local f val=""
    while IFS= read -r f; do
        [ -r "$f" ] || continue
        val="$(awk -v k="$key" '
            { line=$0; sub(/#.*/,"",line);
              n=split(line,a," ");
              if (n>=2 && tolower(a[1])==k) { $1=""; sub(/^ /,""); print; exit } }' "$f")"
        [ -n "$val" ] && { printf '%s' "$val"; return 0; }
    done <<EOF
$files
EOF
    printf ''
}

# Ordered list of configuration files: main file, then Include targets in
# lexical order (a simplified model of OpenSSH include handling).
lsshm_config_effective_files() {
    [ -r "$LSSHM_SSHD_CONFIG" ] || { printf '%s\n' "$LSSHM_SSHD_CONFIG"; return; }
    local line trimmed keyword rest pattern g
    # Emit files in the order they are referenced in the main file, expanding
    # Include directives at the point where they appear. Uses bash string
    # operations only (no per-line subprocess) so it stays fast on any host.
    while IFS= read -r line; do
        trimmed="${line#"${line%%[![:space:]]*}"}"
        keyword="${trimmed%%[[:space:]]*}"
        case "$keyword" in
            [Ii]nclude)
                rest="${trimmed#"$keyword"}"
                rest="${rest#"${rest%%[![:space:]]*}"}"
                for pattern in $rest; do
                    case "$pattern" in
                        /*) : ;;
                        *) pattern="/etc/ssh/$pattern" ;;
                    esac
                    for g in $pattern; do
                        [ -f "$g" ] && printf '%s\n' "$g"
                    done
                done
                ;;
        esac
    done <"$LSSHM_SSHD_CONFIG"
    # The main file itself participates too (directives outside includes).
    printf '%s\n' "$LSSHM_SSHD_CONFIG"
}

# Detect whether the main config defines a directive BEFORE its Include line.
# Such an early definition would win over the managed drop-in.
lsshm_config_defined_before_include() {
    local key; key="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
    [ -r "$LSSHM_SSHD_CONFIG" ] || return 1
    awk -v k="$key" '
        BEGIN{seen=0; inc=0}
        {
            line=$0; sub(/#.*/,"",line);
            n=split(line,a," ");
            if (n>=1 && tolower(a[1])=="include") { inc=1 }
            if (!inc && n>=2 && tolower(a[1])==k) { seen=1 }
        }
        END{ exit (seen?0:1) }
    ' "$LSSHM_SSHD_CONFIG"
}

# --- managed drop-in ---------------------------------------------------------

lsshm_managed_ensure_include() {
    # Warn if the main config has no Include for sshd_config.d.
    [ -r "$LSSHM_SSHD_CONFIG" ] || return 0
    if ! grep -Eqi '^[[:space:]]*Include[[:space:]]+.*sshd_config\.d' "$LSSHM_SSHD_CONFIG"; then
        lsshm_warn 'The main config file does not include sshd_config.d/.'
        lsshm_warn 'The file managed by LSSHM might be ignored.'
    fi
}

# Read current value from the managed file only.
lsshm_managed_get() {
    local key; key="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
    local awk_prog='{ n=split($0,a," "); if (n>=2 && tolower(a[1])==k){ $1=""; sub(/^ /,""); print; exit } }'
    if [ -r "$LSSHM_MANAGED_CONF" ]; then
        awk -v k="$key" "$awk_prog" "$LSSHM_MANAGED_CONF" 2>/dev/null
        return 0
    fi
    [ -e "$LSSHM_MANAGED_CONF" ] || return 1
    lsshm_run_privileged awk -v k="$key" "$awk_prog" "$LSSHM_MANAGED_CONF" 2>/dev/null
}

# Upsert a directive into the managed drop-in file and validate.
# Usage: lsshm_managed_set KEY VALUE
lsshm_managed_set() {
    local key="$1" value="$2"
    lsshm_require_root
    lsshm_managed_ensure_include

    if lsshm_config_defined_before_include "$key"; then
        lsshm_warn "'%s' is defined in %s before the Include." "$key" "$LSSHM_SSHD_CONFIG"
        lsshm_warn 'This value will take precedence over the file managed by LSSHM.'
        if lsshm_confirm "$(lsshm_t 'Comment out this definition in the main file?')" no; then
            lsshm_config_comment_directive "$key"
        fi
    fi

    local tmp; tmp="$(lsshm_mktemp)"
    # Start from existing managed file or a fresh header (one sudo for the read).
    if [ -r "$LSSHM_MANAGED_CONF" ]; then
        cat "$LSSHM_MANAGED_CONF" >"$tmp" 2>/dev/null || true
    elif [ -e "$LSSHM_MANAGED_CONF" ]; then
        lsshm_run_privileged cat "$LSSHM_MANAGED_CONF" >"$tmp" 2>/dev/null || true
    fi
    if [ ! -s "$tmp" ]; then
        printf '%s\n\n' "$LSSHM_MANAGED_HEADER" >"$tmp"
    fi

    # Remove any existing line for this key, then append the new value.
    local tmp2; tmp2="$(lsshm_mktemp)"
    awk -v k="$key" '
        { n=split($0,a," "); if (n>=1 && tolower(a[1])==tolower(k)) next; print }
    ' "$tmp" >"$tmp2"
    printf '%s %s\n' "$key" "$value" >>"$tmp2"

    # Install atomically with correct permissions, then validate.
    lsshm_backup_file "$LSSHM_MANAGED_CONF" "managed-conf" >/dev/null 2>&1 || true
    lsshm_run_privileged install -m 0644 -o root -g root "$tmp2" "$LSSHM_MANAGED_CONF"
    lsshm_server_config_invalidate_cache

    if ! lsshm_server_config_test; then
        lsshm_error 'New configuration invalid: rolling back.'
        lsshm_run_privileged install -m 0644 "$tmp" "$LSSHM_MANAGED_CONF" 2>/dev/null || true
        lsshm_server_config_invalidate_cache
        return 1
    fi
    lsshm_ok 'Directive applied: %s %s' "$key" "$value"

    # Confirm the effective runtime value matches the intended choice.
    local eff_key eff_val norm_eff norm_want
    eff_key="$(printf '%s' "$key" | tr '[:upper:]' '[:lower:]')"
    # Prefer a fresh privileged dump when credentials are already warm.
    lsshm_server_config_dump >/dev/null 2>&1 || true
    eff_val="$(lsshm_server_config_effective_value "$eff_key")"
    if [ -n "$eff_val" ]; then
        norm_eff="$(printf '%s' "$eff_val" | tr '[:upper:]' '[:lower:]')"
        norm_want="$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')"
        case "$eff_key" in
            permitrootlogin)
                [ "$norm_eff" = "without-password" ] && norm_eff="prohibit-password"
                ;;
        esac
        if [ "$norm_eff" != "$norm_want" ]; then
            lsshm_warn 'Effective value (sshd -T): %s' "$eff_val"
            lsshm_warn 'Expected: %s - another definition may still take precedence.' "$value"
        fi
    fi
    return 0
}

# Comment out a directive in the main config (with backup).
lsshm_config_comment_directive() {
    local key="$1"
    lsshm_backup_file "$LSSHM_SSHD_CONFIG" "main-config" >/dev/null 2>&1 || true
    local tmp; tmp="$(lsshm_mktemp)"
    lsshm_run_privileged awk -v k="$key" '
        { n=split($0,a," ");
          if (n>=2 && tolower(a[1])==tolower(k) && a[1] !~ /^#/)
              print "# LSSHM disabled: " $0;
          else print }
    ' "$LSSHM_SSHD_CONFIG" >"$tmp"
    lsshm_run_privileged install -m 0644 "$tmp" "$LSSHM_SSHD_CONFIG"
}

# --- human-readable directives ----------------------------------------------

lsshm_rootlogin_label() {
    case "$1" in
        no)                   lsshm_t 'forbidden' ;;
        prohibit-password|without-password) lsshm_t 'key only' ;;
        yes)                  lsshm_t 'key or password' ;;
        forced-commands-only) lsshm_t 'forced commands only' ;;
        "")                   lsshm_t 'not set' ;;
        *)                    printf '%s' "$1" ;;
    esac
}

lsshm_set_root_login() {
    lsshm_header
    lsshm_out 'SSH root login'; printf '\n'
    lsshm_out '  1. Forbid root entirely'
    lsshm_out '  2. Allow root with a key only'
    lsshm_out '  3. Allow root with a key or a password'
    lsshm_out '  4. Allow root only for forced commands'; printf '\n'
    lsshm_out 'Recommendation: allow root with a key only,'
    lsshm_out 'or use a normal user with sudo.'; printf '\n'
    local choice; choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '2')"
    local value=""
    case "$choice" in
        1) value="no" ;;
        2) value="prohibit-password" ;;
        3) value="yes" ;;
        4) value="forced-commands-only" ;;
        *) lsshm_info 'No change.'; return 0 ;;
    esac
    lsshm_apply_dangerous_change "PermitRootLogin" "$value" "$(lsshm_t 'root access change')"
}

lsshm_set_password_auth() {
    local cur; cur="$(lsshm_server_config_effective_value passwordauthentication)"
    lsshm_info 'Current password authentication: %s' "$(lsshm_yesno_label "$cur")"
    if lsshm_confirm "$(lsshm_t 'Allow password authentication?')" no; then
        lsshm_managed_set "PasswordAuthentication" "yes" && lsshm_server_reload
    else
        lsshm_warn 'Disabling passwords may lock you out without a valid key.'
        lsshm_apply_dangerous_change "PasswordAuthentication" "no" "$(lsshm_t 'disabling passwords')"
    fi
}

lsshm_set_pubkey_auth() {
    if lsshm_confirm "$(lsshm_t 'Allow public key authentication?')" yes; then
        lsshm_managed_set "PubkeyAuthentication" "yes" && lsshm_server_reload
    else
        lsshm_warn 'Disabling key authentication may lock you out.'
        lsshm_apply_dangerous_change "PubkeyAuthentication" "no" "$(lsshm_t 'disabling key authentication')"
    fi
}

lsshm_set_port() {
    local cur; cur="$(lsshm_server_config_effective_value port)"; cur="${cur:-22}"
    local port; port="$(lsshm_prompt "$(lsshm_t 'New SSH port')" "$cur")"
    case "$port" in
        ''|*[!0-9]*) lsshm_error 'Invalid port.'; return 1 ;;
    esac
    if [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
        lsshm_error 'Port out of range (1-65535).'; return 1
    fi
    lsshm_warn 'Check your firewall before changing the port.'
    lsshm_apply_dangerous_change "Port" "$port" "$(lsshm_t 'port change')"
}

# All effective values for a multi-valued directive (e.g. listenaddress).
lsshm_server_config_effective_values() {
    local key; key="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
    local dump
    dump="$(lsshm_server_config_dump)" || dump=""
    if [ -n "$dump" ]; then
        printf '%s\n' "$dump" | awk -v k="$key" '
            tolower($1) == k { $1=""; sub(/^ /,""); print }
        '
        return 0
    fi
    return 1
}

# Upsert one or more lines for the same KEY (ListenAddress). Empty values → unset.
lsshm_managed_set_multi() {
    local key="$1"; shift
    local -a values=("$@")
    lsshm_require_root
    lsshm_managed_ensure_include

    if lsshm_config_defined_before_include "$key"; then
        lsshm_warn "'%s' is defined in %s before the Include." "$key" "$LSSHM_SSHD_CONFIG"
        lsshm_warn 'This value will take precedence over the file managed by LSSHM.'
        if lsshm_confirm "$(lsshm_t 'Comment out this definition in the main file?')" no; then
            lsshm_config_comment_directive "$key"
        fi
    fi

    local tmp; tmp="$(lsshm_mktemp)"
    if [ -r "$LSSHM_MANAGED_CONF" ]; then
        cat "$LSSHM_MANAGED_CONF" >"$tmp" 2>/dev/null || true
    elif [ -e "$LSSHM_MANAGED_CONF" ]; then
        lsshm_run_privileged cat "$LSSHM_MANAGED_CONF" >"$tmp" 2>/dev/null || true
    fi
    if [ ! -s "$tmp" ]; then
        printf '%s\n\n' "$LSSHM_MANAGED_HEADER" >"$tmp"
    fi

    local tmp2; tmp2="$(lsshm_mktemp)"
    awk -v k="$key" '
        { n=split($0,a," "); if (n>=1 && tolower(a[1])==tolower(k)) next; print }
    ' "$tmp" >"$tmp2"
    local v
    for v in "${values[@]}"; do
        [ -n "$v" ] || continue
        printf '%s %s\n' "$key" "$v" >>"$tmp2"
    done

    lsshm_backup_file "$LSSHM_MANAGED_CONF" "managed-conf" >/dev/null 2>&1 || true
    lsshm_run_privileged install -m 0644 -o root -g root "$tmp2" "$LSSHM_MANAGED_CONF"
    lsshm_server_config_invalidate_cache

    if ! lsshm_server_config_test; then
        lsshm_error 'New configuration invalid: rolling back.'
        lsshm_run_privileged install -m 0644 "$tmp" "$LSSHM_MANAGED_CONF" 2>/dev/null || true
        lsshm_server_config_invalidate_cache
        return 1
    fi
    if [ "${#values[@]}" -eq 0 ]; then
        lsshm_ok 'Directive removed from managed file: %s' "$key"
    else
        lsshm_ok 'Directive applied: %s (%s)' "$key" "${values[*]}"
    fi
    return 0
}

lsshm_set_address_family() {
    local cur; cur="$(lsshm_server_config_effective_value addressfamily)"; cur="${cur:-any}"
    lsshm_header
    lsshm_out 'SSH address family (AddressFamily)'
    lsshm_out 'Current: %s' "$cur"
    printf '\n'
    lsshm_out '  1. any   (IPv4 + IPv6, OpenSSH default)'
    lsshm_out '  2. inet  (IPv4 only)'
    lsshm_out '  3. inet6 (IPv6 only)'
    printf '\n'
    local choice; choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '1')"
    local value=""
    case "$choice" in
        1) value="any" ;;
        2) value="inet" ;;
        3) value="inet6" ;;
        *) lsshm_info 'No change.'; return 0 ;;
    esac
    lsshm_apply_dangerous_change "AddressFamily" "$value" "$(lsshm_t 'address family change')"
}

lsshm_set_listen_address() {
    local cur=""
    cur="$(lsshm_server_config_effective_values listenaddress | tr '\n' ' ')"
    cur="$(printf '%s' "$cur" | sed 's/[[:space:]]*$//')"
    [ -n "$cur" ] || cur="0.0.0.0 ::"
    lsshm_header
    lsshm_out 'SSH listen addresses (ListenAddress)'
    lsshm_out 'Current: %s' "$cur"
    printf '\n'
    lsshm_out 'Examples: 0.0.0.0   ::   192.168.1.10   0.0.0.0 ::'
    lsshm_out 'Empty input restores OpenSSH defaults (all interfaces).'
    printf '\n'
    local raw; raw="$(lsshm_prompt "$(lsshm_t 'Listen addresses (space-separated)')" "$cur")"
    local -a addrs=()
    local tok
    for tok in $raw; do
        addrs+=("$tok")
    done

    if ! lsshm_can_prompt_tty; then
        lsshm_error 'Sensitive change not possible without an interactive terminal: %s' "$(lsshm_t 'listen address change')"
        return 1
    fi
    lsshm_warn 'Sensitive change: %s' "$(lsshm_t 'listen address change')"
    if ! lsshm_confirm "$(lsshm_t 'Continue with an automatic safety rollback?')" no; then
        lsshm_info 'Cancelled.'
        return 1
    fi

    local archive; archive="$(lsshm_backup_server_config)" || return 1
    if ! lsshm_managed_set_multi "ListenAddress" "${addrs[@]}"; then
        lsshm_error 'Change application cancelled.'
        return 1
    fi

    local confirm_flag="$LSSHM_STATE_DIR/rollback.confirm"
    lsshm_run_privileged rm -f "$confirm_flag" 2>/dev/null || true
    local script; script="$(lsshm_rollback_build_script "$archive" "$confirm_flag" "$LSSHM_ROLLBACK_DELAY")"
    local method; method="$(lsshm_rollback_schedule "$script" "$LSSHM_ROLLBACK_DELAY")"
    lsshm_server_reload || true

    if lsshm_server_port_listening; then
        lsshm_ok 'The SSH port is listening.'
    else
        lsshm_warn 'Unable to confirm the SSH port is listening.'
    fi

    printf '\n'
    lsshm_out 'The new configuration is active.'; printf '\n'
    lsshm_out 'An automatic rollback will occur in %s seconds.' "$LSSHM_ROLLBACK_DELAY"; printf '\n'
    lsshm_out 'Open a second SSH connection before confirming.'; printf '\n'
    lsshm_out '  1. The new connection works'
    lsshm_out '  2. Restore immediately'
    local choice; choice="$(lsshm_prompt_tty "$(lsshm_t 'Choice')" '2')"
    case "$choice" in
        1)
            lsshm_rollback_cancel "$method" "$confirm_flag"
            lsshm_ok 'Automatic rollback cancelled. Change kept.'
            ;;
        *)
            lsshm_warn 'Restoring immediately...'
            lsshm_run_privileged tar -xzf "$archive" -C / 2>/dev/null || true
            lsshm_rollback_cancel "$method" "$confirm_flag"
            lsshm_server_reload || true
            lsshm_ok 'Previous configuration restored.'
            ;;
    esac
}

lsshm_set_allow_users() {
    local cur; cur="$(lsshm_server_config_effective_value allowusers)"
    lsshm_info 'Current AllowUsers: %s' "${cur:-$(lsshm_t 'not set')}"
    local users; users="$(lsshm_prompt "$(lsshm_t 'Allowed users (space-separated, empty = remove)')" "$cur")"
    if [ -z "$users" ]; then
        lsshm_info 'Removing AllowUsers is not handled automatically (edit the managed file).'
        return 0
    fi
    lsshm_apply_dangerous_change "AllowUsers" "$users" "$(lsshm_t 'AllowUsers change')"
}

lsshm_set_allow_groups() {
    local cur; cur="$(lsshm_server_config_effective_value allowgroups)"
    lsshm_info 'Current AllowGroups: %s' "${cur:-$(lsshm_t 'not set')}"
    local groups; groups="$(lsshm_prompt "$(lsshm_t 'Allowed groups (space-separated)')" "$cur")"
    [ -z "$groups" ] && { lsshm_info 'No change.'; return 0; }
    lsshm_apply_dangerous_change "AllowGroups" "$groups" "$(lsshm_t 'AllowGroups change')"
}

# Show the effective configuration (sshd -T) or a helpful message.
lsshm_server_config_show() {
    local dump
    # Explicit request: allow one sudo prompt to get the real effective dump.
    dump="$(lsshm_server_config_dump refresh)" || dump="$(lsshm_server_config_dump)" || dump=""
    if [ -n "$dump" ]; then
        printf '%s\n' "$dump" | sort
    else
        lsshm_warn 'sshd -T unavailable. Detected configuration files:'
        lsshm_config_effective_files
    fi
}

# ===== src/rollback.sh =================================================
# shellcheck shell=bash
# =============================================================================
# rollback.sh - safe application of dangerous changes with automatic rollback
# =============================================================================
# Dangerous changes (port, disabling passwords, root access, AllowUsers,
# PubkeyAuthentication, ListenAddress) can lock a remote administrator out.
# LSSHM therefore:
#   1. backs up the configuration
#   2. schedules an automatic restore
#   3. applies the change and reloads SSH
#   4. verifies the port is listening
#   5. asks for confirmation from a second session (never auto-kept via -y)
#   6. cancels the automatic restore only after confirmation

LSSHM_ROLLBACK_UNIT="lsshm-rollback"
LSSHM_ROLLBACK_DELAY="${LSSHM_ROLLBACK_DELAY:-120}"

# True when a controlling TTY is available (ignores LSSHM_ASSUME_YES).
lsshm_can_prompt_tty() {
    [ -t 0 ] && [ -t 1 ] && return 0
    lsshm_have_tty && return 0
    return 1
}

# Prompt that always reads the TTY; never auto-answered by -y.
# Used for the post-change rollback confirmation.
lsshm_prompt_tty() {
    local prompt="$1" default="${2:-}" answer="" msg=""
    if [ -n "$default" ]; then
        msg="${prompt} [${default}]: "
    else
        msg="${prompt}: "
    fi
    if ! lsshm_read_line answer "$msg"; then
        printf '%s' "$default"
        return 0
    fi
    printf '%s' "${answer:-$default}"
}

# Build a self-contained restore script that reverts to a backup archive.
lsshm_rollback_build_script() {
    local archive="$1" confirm_flag="$2" delay="$3"
    # persist: must not be deleted by the EXIT cleanup trap.
    local script; script="$(lsshm_mktemp persist)"
    cat >"$script" <<EOF
#!/bin/sh
# LSSHM automatic rollback helper
sleep "$delay"
if [ -f "$confirm_flag" ]; then
    rm -f "$confirm_flag"
    exit 0
fi
tar -xzf "$archive" -C / 2>/dev/null
if command -v systemctl >/dev/null 2>&1; then
    systemctl reload "$LSSHM_SSH_SERVICE" 2>/dev/null || systemctl restart "$LSSHM_SSH_SERVICE" 2>/dev/null
elif command -v rc-service >/dev/null 2>&1; then
    rc-service "$LSSHM_SSH_SERVICE" restart 2>/dev/null
else
    service "$LSSHM_SSH_SERVICE" restart 2>/dev/null
fi
EOF
    chmod +x "$script"
    printf '%s' "$script"
}

lsshm_rollback_schedule() {
    # lsshm_rollback_schedule SCRIPT DELAY -> echoes cancel token
    local script="$1" delay="$2"
    if [ "$LSSHM_HAS_SYSTEMD" = "1" ] && lsshm_have systemd-run; then
        lsshm_run_privileged systemd-run --unit="$LSSHM_ROLLBACK_UNIT" \
            --description="LSSHM automatic SSH rollback" \
            /bin/sh "$script" >/dev/null 2>&1 && { printf 'systemd'; return 0; }
    fi
    # Fallback: detached nohup process. Cancellation relies on the confirm flag.
    lsshm_run_privileged sh -c "nohup /bin/sh '$script' >/dev/null 2>&1 &"
    printf 'nohup'
}

lsshm_rollback_cancel() {
    local method="$1" confirm_flag="$2"
    # The confirm flag stops both methods when the helper wakes up.
    lsshm_run_privileged touch "$confirm_flag" 2>/dev/null || true
    if [ "$method" = "systemd" ] && lsshm_have systemctl; then
        lsshm_run_privileged systemctl stop "$LSSHM_ROLLBACK_UNIT" 2>/dev/null || true
        lsshm_run_privileged systemctl reset-failed "$LSSHM_ROLLBACK_UNIT" 2>/dev/null || true
    fi
}

# Main entry used by server_config.sh for dangerous directives.
lsshm_apply_dangerous_change() {
    local key="$1" value="$2" description="$3"

    # Dangerous changes require a TTY so the operator can confirm from a second session.
    # -y may auto-confirm the initial consent, but never skips the rollback safety net.
    if ! lsshm_can_prompt_tty; then
        lsshm_error 'Sensitive change not possible without an interactive terminal: %s' "$description"
        lsshm_info 'A TTY is required to confirm the new SSH session works.'
        return 1
    fi

    lsshm_warn 'Sensitive change: %s' "$description"
    if ! lsshm_confirm "$(lsshm_t 'Continue with an automatic safety rollback?')" no; then
        lsshm_info 'Cancelled.'
        return 1
    fi

    # 1. Backup.
    local archive; archive="$(lsshm_backup_server_config)" || return 1

    # 2. Apply the change (validates internally).
    if ! lsshm_managed_set "$key" "$value"; then
        lsshm_error 'Change application cancelled.'
        return 1
    fi

    # 3. Always schedule automatic restore (never skip under -y).
    local confirm_flag="$LSSHM_STATE_DIR/rollback.confirm"
    lsshm_run_privileged rm -f "$confirm_flag" 2>/dev/null || true
    local script; script="$(lsshm_rollback_build_script "$archive" "$confirm_flag" "$LSSHM_ROLLBACK_DELAY")"
    local method; method="$(lsshm_rollback_schedule "$script" "$LSSHM_ROLLBACK_DELAY")"

    # 4. Reload SSH.
    lsshm_server_reload || true

    # 5. Verify the port listens.
    if lsshm_server_port_listening; then
        lsshm_ok 'The SSH port is listening.'
    else
        lsshm_warn 'Unable to confirm the SSH port is listening.'
    fi

    # 6. Ask for confirmation from a second session (never auto-kept via -y).
    printf '\n'
    lsshm_out 'The new configuration is active.'; printf '\n'
    lsshm_out 'An automatic rollback will occur in %s seconds.' "$LSSHM_ROLLBACK_DELAY"; printf '\n'
    lsshm_out 'Open a second SSH connection before confirming.'; printf '\n'
    lsshm_out '  1. The new connection works'
    lsshm_out '  2. Restore immediately'
    local choice; choice="$(lsshm_prompt_tty "$(lsshm_t 'Choice')" '2')"
    case "$choice" in
        1)
            lsshm_rollback_cancel "$method" "$confirm_flag"
            lsshm_ok 'Automatic rollback cancelled. Change kept.'
            ;;
        *)
            lsshm_warn 'Restoring immediately...'
            lsshm_run_privileged tar -xzf "$archive" -C / 2>/dev/null || true
            lsshm_rollback_cancel "$method" "$confirm_flag"
            lsshm_server_reload || true
            lsshm_ok 'Previous configuration restored.'
            ;;
    esac
}

# ===== src/users.sh ====================================================
# shellcheck shell=bash
# =============================================================================
# users.sh - local user helpers
# =============================================================================

# List human/login users (UID >= 1000) plus root.
lsshm_users_list() {
    if lsshm_have getent; then
        getent passwd | awk -F: '($3==0)||($3>=1000 && $3<65534){print $1":"$3":"$6}'
    else
        awk -F: '($3==0)||($3>=1000 && $3<65534){print $1":"$3":"$6}' /etc/passwd
    fi
}

lsshm_users_print() {
    lsshm_info 'Local users:'
    local name uid home
    while IFS=: read -r name uid home; do
        printf '  %-16s uid=%-6s %s\n' "$name" "$uid" "$home"
    done <<EOF
$(lsshm_users_list)
EOF
}

lsshm_user_exists() {
    if lsshm_have getent; then
        getent passwd "$1" >/dev/null 2>&1
    else
        grep -q "^$1:" /etc/passwd 2>/dev/null
    fi
}

# Count authorized keys for a user. Quiet: returns 0 when unreadable without
# attempting privilege elevation (used in the status panel).
lsshm_user_key_count() {
    local user="$1" home ak count
    home="$(lsshm_user_home "$user")"
    ak="$home/.ssh/authorized_keys"
    if [ -r "$ak" ]; then
        count="$(grep -Ecv '^[[:space:]]*($|#)' "$ak" 2>/dev/null)"
        printf '%s' "${count:-0}"
    else
        printf '0'
    fi
}

# ===== src/authorized_keys.sh ==========================================
# shellcheck shell=bash
# =============================================================================
# authorized_keys.sh - incoming access: keys allowed to reach THIS machine
# =============================================================================
# This manages ~/.ssh/authorized_keys for a given user. These are the public
# keys that are ALLOWED TO CONNECT to this machine.

lsshm_access_file() {
    local user="${1:-$LSSHM_CALLING_USER}"
    printf '%s/.ssh/authorized_keys' "$(lsshm_user_home "$user")"
}

# Read the authorized_keys file (with privileges if needed).
lsshm_access_read() {
    local file="$1"
    if [ -r "$file" ]; then
        cat "$file"
    elif lsshm_can_elevate; then
        lsshm_run_privileged cat "$file" 2>/dev/null
    fi
}

# Compute the SHA256 fingerprint and type of a single key line.
lsshm_access_fingerprint_line() {
    local line="$1" tmp out
    tmp="$(lsshm_mktemp)"
    printf '%s\n' "$line" >"$tmp"
    out="$(ssh-keygen -lf "$tmp" 2>/dev/null)" || { printf ''; return 1; }
    printf '%s' "$out"
}

# Classify a line from authorized_keys for shared indexing.
# Sets: _ak_kind (active|disabled|skip), _ak_keyline (raw key line to fingerprint).
lsshm_access_classify_line() {
    local line="$1"
    _ak_kind="skip"
    _ak_keyline=""
    case "$line" in
        '# LSSHM-DISABLED '*)
            _ak_kind="disabled"
            _ak_keyline="${line#\# LSSHM-DISABLED }"
            ;;
        ''|'#'*)
            _ak_kind="skip"
            ;;
        *)
            _ak_kind="active"
            _ak_keyline="$line"
            ;;
    esac
}

# List authorized keys for a user with details.
# Indexing includes both active and LSSHM-DISABLED entries (same as remove/disable).
lsshm_access_list() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local file; file="$(lsshm_access_file "$user")"
    lsshm_out 'User : %s' "$user"
    lsshm_out 'File : %s' "$file"
    printf '\n'

    local content; content="$(lsshm_access_read "$file")"
    if [ -z "$content" ]; then
        lsshm_info 'No authorized key.'
        return 0
    fi

    local i=0 line fp bits type comment info
    while IFS= read -r line; do
        lsshm_access_classify_line "$line"
        [ "$_ak_kind" = "skip" ] && continue
        i=$((i+1))
        info="$(lsshm_access_fingerprint_line "$_ak_keyline")"
        bits="$(printf '%s' "$info" | awk '{print $1}')"
        fp="$(printf '%s' "$info" | awk '{print $2}')"
        type="$(printf '%s' "$info" | awk '{print $NF}' | tr -d '()')"
        # Comment = fields after key type + key body (options may precede the type).
        comment="$(printf '%s' "$_ak_keyline" | awk '
            {
              for (i=1;i<=NF;i++) {
                if ($i ~ /^(ssh-ed25519|ssh-rsa|ssh-dss|ecdsa-sha2-nistp[0-9]+|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)$/) {
                  if (i+2<=NF) { for (j=i+2;j<=NF;j++) printf "%s%s", $j, (j<NF?" ":""); }
                  exit
                }
              }
            }')"
        local nocomment; nocomment="$(lsshm_t 'no comment')"
        if [ "$_ak_kind" = "disabled" ]; then
            printf '%d. [%s] %s\n' "$i" "$(lsshm_t 'DISABLED')" "${comment:-$nocomment}"
        else
            printf '%d. %s\n' "$i" "${comment:-$nocomment}"
        fi
        lsshm_out '   Type        : %s (%s bits)' "${type:-?}" "${bits:-?}"
        lsshm_out '   Fingerprint : %s' "${fp:-$(lsshm_t 'unknown')}"
        case "$_ak_keyline" in
            *from=*)       lsshm_out '   Restriction : %s' "$(printf '%s' "$_ak_keyline" | grep -o 'from="[^"]*"')" ;;
        esac
        case "$_ak_keyline" in
            *command=*)    lsshm_out '   Command     : %s' "$(printf '%s' "$_ak_keyline" | grep -o 'command="[^"]*"')" ;;
        esac
        case "$_ak_keyline" in
            *no-port-forwarding*) lsshm_out '   Forwarding  : forbidden' ;;
        esac
    done <<EOF
$content
EOF
}

# Write new content to the authorized_keys file with correct ownership/perms.
lsshm_access_write() {
    local user="$1" file="$2" tmp="$3"
    local home; home="$(lsshm_user_home "$user")"
    local ssh_dir="$home/.ssh"
    local uid gid
    uid="$(id -u "$user" 2>/dev/null || echo 0)"
    gid="$(id -g "$user" 2>/dev/null || echo 0)"

    # As root, always set ownership: writable dirs would otherwise leave
    # root:root files that StrictModes rejects for the target user.
    if [ "${LSSHM_IS_ROOT:-0}" = "1" ]; then
        mkdir -p "$ssh_dir"
        install -m 0600 -o "$uid" -g "$gid" "$tmp" "$file"
        chmod 700 "$ssh_dir"
        chown "$uid:$gid" "$ssh_dir"
    elif [ -w "$ssh_dir" ] || { [ ! -e "$ssh_dir" ] && [ -w "$home" ]; }; then
        mkdir -p "$ssh_dir"
        install -m 0600 "$tmp" "$file"
        chmod 700 "$ssh_dir"
    else
        lsshm_run_privileged mkdir -p "$ssh_dir"
        lsshm_run_privileged install -m 0600 -o "$uid" -g "$gid" "$tmp" "$file"
        lsshm_run_privileged chmod 700 "$ssh_dir"
        lsshm_run_privileged chown "$uid:$gid" "$ssh_dir"
    fi
}

# Add a public key (pasted or from a .pub file).
lsshm_access_add() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local keyline="${2:-}"
    if [ -z "$keyline" ]; then
        if lsshm_is_interactive; then
            lsshm_out 'Paste the public key (one line), then Enter:'
            read -r keyline </dev/tty || keyline=""
        fi
    fi
    # Support importing from a file path.
    if [ -f "$keyline" ]; then
        keyline="$(cat "$keyline")"
    fi
    [ -n "$keyline" ] || { lsshm_error 'No key provided.'; return 1; }

    # Validate that it parses as a key.
    if ! lsshm_access_fingerprint_line "$keyline" >/dev/null; then
        lsshm_error 'The provided key is not a valid public key.'
        return 1
    fi

    local file; file="$(lsshm_access_file "$user")"
    lsshm_backup_authorized_keys "$user" >/dev/null 2>&1 || true
    local tmp; tmp="$(lsshm_mktemp)"
    lsshm_access_read "$file" >"$tmp" 2>/dev/null || true

    # Duplicate detection by fingerprint (active and LSSHM-DISABLED entries).
    local newfp; newfp="$(lsshm_access_fingerprint_line "$keyline" | awk '{print $2}')"
    local existing efp
    while IFS= read -r existing || [ -n "$existing" ]; do
        lsshm_access_classify_line "$existing"
        [ "$_ak_kind" = "skip" ] && continue
        efp="$(lsshm_access_fingerprint_line "$_ak_keyline" | awk '{print $2}')"
        if [ -n "$efp" ] && [ "$efp" = "$newfp" ]; then
            if [ "$_ak_kind" = "disabled" ]; then
                lsshm_warn 'This key already exists (disabled, fingerprint %s).' "$efp"
                lsshm_info 'Re-enable it via the Disable / re-enable a key entry.'
            else
                lsshm_warn 'This key is already authorized (fingerprint %s).' "$efp"
            fi
            return 0
        fi
    done <"$tmp"

    printf '%s\n' "$keyline" >>"$tmp"
    lsshm_access_write "$user" "$file" "$tmp"
    lsshm_ok 'Key added for %s.' "$user"
}

# Remove a key by fingerprint or by 1-based index (same numbering as list).
lsshm_access_remove() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local target="${2:-}"
    local file; file="$(lsshm_access_file "$user")"
    local content; content="$(lsshm_access_read "$file")"
    [ -n "$content" ] || { lsshm_info 'No key to remove.'; return 0; }

    if [ -z "$target" ]; then
        lsshm_access_list "$user"
        target="$(lsshm_prompt "$(lsshm_t 'SHA256 fingerprint or number to remove')" '')"
    fi
    [ -n "$target" ] || { lsshm_info 'Cancelled.'; return 0; }

    lsshm_backup_authorized_keys "$user" >/dev/null 2>&1 || true
    local tmp; tmp="$(lsshm_mktemp)"
    local i=0 removed=0 line fp
    while IFS= read -r line; do
        lsshm_access_classify_line "$line"
        if [ "$_ak_kind" = "skip" ]; then
            printf '%s\n' "$line" >>"$tmp"
            continue
        fi
        i=$((i+1))
        fp="$(lsshm_access_fingerprint_line "$_ak_keyline" | awk '{print $2}')"
        if [ "$target" = "$i" ] || { [ -n "$fp" ] && [ "$target" = "$fp" ]; }; then
            removed=1
            continue
        fi
        printf '%s\n' "$line" >>"$tmp"
    done <<EOF
$content
EOF
    if [ "$removed" = "0" ]; then
        lsshm_warn 'No matching key found.'
        return 1
    fi
    lsshm_access_write "$user" "$file" "$tmp"
    lsshm_ok 'Key removed for %s.' "$user"
}

# Repair ownership and permissions of the user's .ssh directory.
lsshm_access_repair() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local home; home="$(lsshm_user_home "$user")"
    local ssh_dir="$home/.ssh"
    local uid gid
    uid="$(id -u "$user" 2>/dev/null || echo 0)"
    gid="$(id -g "$user" 2>/dev/null || echo 0)"

    [ -d "$ssh_dir" ] || { lsshm_warn '%s does not exist.' "$ssh_dir"; return 0; }

    local runner=""
    [ -w "$ssh_dir" ] || runner="lsshm_run_privileged"

    $runner chown -R "$uid:$gid" "$ssh_dir"
    $runner chmod 700 "$ssh_dir"
    [ -e "$ssh_dir/authorized_keys" ] && $runner chmod 600 "$ssh_dir/authorized_keys"
    local f
    for f in "$ssh_dir"/id_* "$ssh_dir"/*.pub; do
        [ -e "$f" ] || continue
        case "$f" in
            *.pub) $runner chmod 644 "$f" ;;
            *)     $runner chmod 600 "$f" ;;
        esac
    done
    lsshm_ok 'Permissions repaired for %s:' "$user"
    lsshm_info '  .ssh 700, authorized_keys 600, private keys 600, public keys 644'
}

# Temporarily disable or re-enable a key by fingerprint or index (same numbering as list).
lsshm_access_disable() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local target="${2:-}"
    local file; file="$(lsshm_access_file "$user")"
    local content; content="$(lsshm_access_read "$file")"
    [ -n "$content" ] || { lsshm_info 'No key to disable.'; return 0; }

    if [ -z "$target" ]; then
        lsshm_access_list "$user"
        target="$(lsshm_prompt "$(lsshm_t 'SHA256 fingerprint or number to disable/re-enable')" '')"
    fi
    [ -n "$target" ] || { lsshm_info 'Cancelled.'; return 0; }

    lsshm_backup_authorized_keys "$user" >/dev/null 2>&1 || true
    local tmp; tmp="$(lsshm_mktemp)"
    local i=0 changed=0 line fp
    while IFS= read -r line; do
        lsshm_access_classify_line "$line"
        if [ "$_ak_kind" = "skip" ]; then
            printf '%s\n' "$line" >>"$tmp"
            continue
        fi
        i=$((i+1))
        fp="$(lsshm_access_fingerprint_line "$_ak_keyline" | awk '{print $2}')"
        if [ "$target" = "$i" ] || { [ -n "$fp" ] && [ "$target" = "$fp" ]; }; then
            if [ "$_ak_kind" = "disabled" ]; then
                printf '%s\n' "$_ak_keyline" >>"$tmp"
            else
                printf '# LSSHM-DISABLED %s\n' "$line" >>"$tmp"
            fi
            changed=1
        else
            printf '%s\n' "$line" >>"$tmp"
        fi
    done <<EOF
$content
EOF
    if [ "$changed" = "0" ]; then
        lsshm_warn 'No matching key found.'
        return 1
    fi
    lsshm_access_write "$user" "$file" "$tmp"
    lsshm_ok 'Key state updated for %s.' "$user"
}

# Detect duplicate keys across the file.
lsshm_access_duplicates() {
    local user="${1:-$LSSHM_CALLING_USER}"
    local file; file="$(lsshm_access_file "$user")"
    local content; content="$(lsshm_access_read "$file")"
    [ -n "$content" ] || { lsshm_info 'No key.'; return 0; }
    local line fp
    printf '%s\n' "$content" | while IFS= read -r line; do
        case "$line" in ''|'#'*) continue ;; esac
        lsshm_access_fingerprint_line "$line" | awk '{print $2}'
    done | sort | uniq -d | while IFS= read -r fp; do
        [ -n "$fp" ] && lsshm_warn 'Duplicate detected: %s' "$fp"
    done
    lsshm_ok 'Duplicate analysis complete.'
}

# ===== src/local_keys.sh ===============================================
# shellcheck shell=bash
# =============================================================================
# local_keys.sh - keys used by THIS machine to connect ELSEWHERE
# =============================================================================
# These are private/public key pairs in ~/.ssh/id_* used for outgoing SSH
# connections. LSSHM must never transmit or display a private key without an
# explicit warning.

lsshm_keys_dir() {
    lsshm_target_ssh_dir
}

# Fill LSSHM_KEY_PATHS with private-key paths (one per .pub found).
# Must be called in the current shell (not via $(...)): arrays do not survive
# command substitution. Sets LSSHM_KEY_COUNT and returns 0.
lsshm_keys_collect() {
    LSSHM_KEY_PATHS=()
    LSSHM_KEY_COUNT=0
    local dir; dir="$(lsshm_keys_dir)"
    [ -d "$dir" ] || return 0
    local pub priv
    # nullglob-safe: skip the literal "*.pub" when the directory is empty.
    for pub in "$dir"/*.pub; do
        [ -e "$pub" ] || continue
        priv="${pub%.pub}"
        LSSHM_KEY_PATHS+=("$priv")
    done
    LSSHM_KEY_COUNT="${#LSSHM_KEY_PATHS[@]}"
}

# Print a numbered list of key pairs (same numbering as pick).
lsshm_keys_print_numbered() {
    local dir; dir="$(lsshm_keys_dir)"
    lsshm_out 'Directory: %s' "$dir"
    printf '\n'
    lsshm_keys_collect
    if [ "${LSSHM_KEY_COUNT:-0}" = "0" ]; then
        lsshm_info 'No key pair detected.'
        return 1
    fi
    local i=0 priv pub info privlabel
    for priv in "${LSSHM_KEY_PATHS[@]}"; do
        i=$((i+1))
        pub="$priv.pub"
        info="$(ssh-keygen -lf "$pub" 2>/dev/null)"
        if [ -f "$priv" ]; then
            privlabel="$priv ($(lsshm_t 'present'))"
        else
            privlabel="$(lsshm_t 'absent')"
        fi
        printf '%d. %s\n' "$i" "$(basename "$priv")"
        lsshm_out '   Public key  : %s' "$pub"
        lsshm_out '   Private key : %s' "$privlabel"
        lsshm_out '   Fingerprint : %s' "${info:-$(lsshm_t 'unknown')}"
    done
    return 0
}

# Detect existing key pairs (files with a matching .pub).
lsshm_keys_list() {
    lsshm_keys_print_numbered || true
}

# Interactive picker: list keys, ask for a number (or accept an existing path).
# Usage: path="$(lsshm_keys_pick 'Prompt' [require_private=0|1])"
# Echoes the private-key path (without .pub), or empty on cancel.
lsshm_keys_pick() {
    local prompt="${1:-Choose a key}"
    local require_priv="${2:-0}"
    local given="${3:-}"

    # Non-interactive / explicit path argument.
    if [ -n "$given" ]; then
        local path="$given"
        case "$path" in *.pub) path="${path%.pub}" ;; esac
        if [ "$require_priv" = "1" ] && [ ! -f "$path" ]; then
            lsshm_error 'Private key not found: %s' "$path" >&2
            return 1
        fi
        if [ ! -f "$path.pub" ] && [ ! -f "$path" ]; then
            lsshm_error 'Key not found: %s' "$given" >&2
            return 1
        fi
        printf '%s' "$path"
        return 0
    fi

    # List on stderr so only the selected path is captured on stdout.
    if ! lsshm_keys_print_numbered >&2; then
        return 1
    fi
    printf '\n' >&2
    local choice; choice="$(lsshm_prompt "$(lsshm_tf '%s (number)' "$(lsshm_t "$prompt")")" '')"
    if [ -z "$choice" ]; then
        lsshm_info 'Cancelled.' >&2
        return 1
    fi

    # Allow typing a path as fallback.
    if [ -f "$choice" ] || [ -f "$choice.pub" ]; then
        case "$choice" in *.pub) choice="${choice%.pub}" ;; esac
        printf '%s' "$choice"
        return 0
    fi

    case "$choice" in
        ''|*[!0-9]*)
            lsshm_error 'Invalid choice: %s' "$choice" >&2
            return 1
            ;;
    esac
    if [ "$choice" -lt 1 ] || [ "$choice" -gt "${#LSSHM_KEY_PATHS[@]}" ]; then
        lsshm_error 'Number out of range (1-%s).' "${#LSSHM_KEY_PATHS[@]}" >&2
        return 1
    fi

    local path="${LSSHM_KEY_PATHS[$((choice-1))]}"
    if [ "$require_priv" = "1" ] && [ ! -f "$path" ]; then
        lsshm_error 'Private key missing for %s.' "$(basename "$path")" >&2
        return 1
    fi
    printf '%s' "$path"
    return 0
}

# Generate a new key pair. Default type ED25519.
lsshm_keys_generate() {
    local dir; dir="$(lsshm_keys_dir)"
    lsshm_ensure_user_ssh_dir "$LSSHM_CALLING_USER"

    local type; type="$(lsshm_prompt "$(lsshm_t 'Key type (ed25519/rsa)')" 'ed25519')"
    case "$type" in
        ed25519|ED25519) type="ed25519" ;;
        rsa|RSA)         type="rsa" ;;
        *)               lsshm_warn 'Unknown type, using ed25519.'; type="ed25519" ;;
    esac

    local default_name="id_$type"
    local name; name="$(lsshm_prompt "$(lsshm_t 'File name')" "$default_name")"
    local path="$dir/$name"

    if [ -e "$path" ]; then
        lsshm_warn 'The file %s already exists.' "$path"
        lsshm_confirm "$(lsshm_t 'Overwrite?')" no || { lsshm_info 'Cancelled.'; return 1; }
    fi

    local comment; comment="$(lsshm_prompt "$(lsshm_t 'Comment')" "$LSSHM_CALLING_USER@$(hostname 2>/dev/null || echo host)")"

    local args=(-t "$type" -f "$path" -C "$comment")
    [ "$type" = "rsa" ] && args+=(-b 4096)

    lsshm_info "ssh-keygen ${args[*]}"
    lsshm_info 'A passphrase is strongly recommended.'
    if ssh-keygen "${args[@]}"; then
        chmod 600 "$path" 2>/dev/null || true
        chmod 644 "$path.pub" 2>/dev/null || true
        lsshm_chown_user "$LSSHM_CALLING_USER" "$path" "$path.pub"
        lsshm_ok 'Key generated: %s (user %s)' "$path" "$LSSHM_CALLING_USER"
        lsshm_info 'Public key:'
        cat "$path.pub"
    else
        lsshm_error 'Generation failed.'
        return 1
    fi
}

lsshm_keys_inspect() {
    local path
    path="$(lsshm_keys_pick 'Key to inspect' 0 "${1:-}")" || return 1
    local pub="$path.pub"
    [ -f "$pub" ] || pub="$path"
    if [ ! -f "$pub" ]; then
        lsshm_error 'File not found: %s' "$pub"
        return 1
    fi
    lsshm_info 'Fingerprint:'
    ssh-keygen -lf "$pub"
    lsshm_info 'Random art:'
    ssh-keygen -lvf "$pub" 2>/dev/null | tail -n +1 || true
}

lsshm_keys_export() {
    local path
    path="$(lsshm_keys_pick 'Key to export' 0 "${1:-}")" || return 1
    local pub="$path.pub"
    if [ ! -f "$pub" ]; then
        lsshm_error 'Public key not found: %s' "$pub"
        return 1
    fi
    lsshm_info 'Public key (%s):' "$pub"
    cat "$pub"
}

lsshm_keys_passphrase() {
    local path
    path="$(lsshm_keys_pick 'Key whose passphrase to change' 1 "${1:-}")" || return 1
    lsshm_info 'Changing the passphrase of %s' "$path"
    ssh-keygen -p -f "$path"
}

lsshm_keys_delete() {
    local path
    path="$(lsshm_keys_pick 'Key to delete' 0 "${1:-}")" || return 1
    local priv="$path" pub="$path.pub"

    if [ ! -e "$priv" ] && [ ! -e "$pub" ]; then
        lsshm_error 'No key file found for: %s' "$path"
        return 1
    fi
    lsshm_warn 'Deleting the key pair:'
    [ -e "$priv" ] && printf '  %s\n' "$priv"
    [ -e "$pub" ]  && printf '  %s\n' "$pub"
    lsshm_confirm "$(lsshm_t 'A backup will be created. Confirm deletion?')" no || { lsshm_info 'Cancelled.'; return 0; }

    [ -e "$priv" ] && lsshm_backup_file "$priv" "privkey" >/dev/null 2>&1 || true
    [ -e "$pub" ]  && lsshm_backup_file "$pub" "pubkey" >/dev/null 2>&1 || true
    rm -f "$priv" "$pub"
    lsshm_ok 'Key pair deleted (backup kept).'
}

# ===== src/ssh_agent.sh ================================================
# shellcheck shell=bash
# =============================================================================
# ssh_agent.sh - manage keys loaded into ssh-agent
# =============================================================================

lsshm_agent_available() {
    if [ -z "${SSH_AUTH_SOCK:-}" ]; then
        lsshm_warn 'No ssh-agent detected (SSH_AUTH_SOCK not set).'
        lsshm_info 'Start an agent, e.g.: eval $(ssh-agent -s)'
        return 1
    fi
    return 0
}

lsshm_agent_list() {
    lsshm_agent_available || return 1
    local tmp; tmp="$(lsshm_mktemp)"
    if ssh-add -l >"$tmp" 2>&1; then
        lsshm_info 'Keys loaded in ssh-agent:'
        cat "$tmp"
    else
        lsshm_info "$(cat "$tmp")"
    fi
}

lsshm_agent_add() {
    local path="${1:-}"
    lsshm_agent_available || return 1
    path="$(lsshm_keys_pick 'Key to add to ssh-agent' 1 "$path")" || return 1
    ssh-add "$path" && lsshm_ok 'Key added to ssh-agent.'
}

lsshm_agent_remove() {
    local path="${1:-}"
    lsshm_agent_available || return 1
    if [ -z "$path" ]; then
        if lsshm_confirm "$(lsshm_t 'Remove all keys from the agent?')" no; then
            ssh-add -D && lsshm_ok 'All keys removed.'
            return 0
        fi
    fi
    path="$(lsshm_keys_pick 'Key to remove from ssh-agent' 1 "$path")" || return 1
    ssh-add -d "$path" && lsshm_ok 'Key removed from ssh-agent.'
}

# ===== src/hosts.sh ====================================================
# shellcheck shell=bash
# =============================================================================
# hosts.sh - remote machines managed through ~/.ssh/config (OPTIONAL feature)
# =============================================================================
# These are outgoing connection targets. LSSHM remains fully usable with no
# host configured.

lsshm_hosts_file() {
    printf '%s/config' "$(lsshm_target_ssh_dir)"
}

lsshm_hosts_list() {
    local file; file="$(lsshm_hosts_file)"
    if [ ! -f "$file" ]; then
        lsshm_info 'No ~/.ssh/config file.'
        return 0
    fi
    lsshm_info 'Registered remote hosts (%s):' "$file"
    local count=0 name hostname
    while IFS= read -r name; do
        [ -n "$name" ] || continue
        case "$name" in *'*'*|*'?'*) continue ;; esac
        count=$((count+1))
        hostname="$(lsshm_hosts_get_field "$name" HostName)"
        printf '  %-20s %s\n' "$name" "${hostname:-}"
    done <<EOF
$(awk 'tolower($1)=="host"{for(i=2;i<=NF;i++)print $i}' "$file")
EOF
    [ "$count" = "0" ] && lsshm_info '  (none)'
}

lsshm_hosts_count() {
    local file; file="$(lsshm_hosts_file)"
    [ -f "$file" ] || { printf '0'; return; }
    awk 'tolower($1)=="host"{for(i=2;i<=NF;i++){if($i!~/[*?]/)c++}}END{print c+0}' "$file"
}

# Get a field value from a Host block in the config file.
lsshm_hosts_get_field() {
    local name="$1" field="$2" file
    file="$(lsshm_hosts_file)"
    [ -f "$file" ] || return 1
    awk -v want="$name" -v f="$(printf '%s' "$field" | tr '[:upper:]' '[:lower:]')" '
        tolower($1)=="host" { inblk=0; for(i=2;i<=NF;i++) if($i==want) inblk=1; next }
        inblk && tolower($1)==f { $1=""; sub(/^ /,""); print; exit }
    ' "$file"
}

lsshm_hosts_exists() {
    local name="$1" file
    file="$(lsshm_hosts_file)"
    [ -f "$file" ] || return 1
    awk -v want="$name" 'tolower($1)=="host"{for(i=2;i<=NF;i++) if($i==want){found=1}} END{exit(found?0:1)}' "$file"
}

lsshm_hosts_add() {
    local file; file="$(lsshm_hosts_file)"
    lsshm_ensure_user_ssh_dir "$LSSHM_CALLING_USER"

    local name hostname user port identity proxyjump
    name="$(lsshm_prompt "$(lsshm_t 'Host alias name')" 'proxmox1')"
    [ -n "$name" ] || { lsshm_error 'Name required.'; return 1; }
    if lsshm_hosts_exists "$name"; then
        lsshm_error "A host named '%s' already exists." "$name"
        return 1
    fi
    hostname="$(lsshm_prompt "$(lsshm_t 'Address (HostName)')" '192.168.100.240')"
    user="$(lsshm_prompt "$(lsshm_t 'User')" 'root')"
    port="$(lsshm_prompt "$(lsshm_t 'Port')" '22')"
    identity="$(lsshm_prompt "$(lsshm_t 'Key file (IdentityFile)')" "$(lsshm_keys_dir)/id_ed25519")"
    proxyjump="$(lsshm_prompt "$(lsshm_t 'ProxyJump (empty = none)')" '')"

    {
        printf '\nHost %s\n' "$name"
        printf '    HostName %s\n' "$hostname"
        printf '    User %s\n' "$user"
        printf '    Port %s\n' "$port"
        printf '    IdentityFile %s\n' "$identity"
        printf '    IdentitiesOnly yes\n'
        [ -n "$proxyjump" ] && printf '    ProxyJump %s\n' "$proxyjump"
    } >>"$file"
    chmod 600 "$file" 2>/dev/null || true
    lsshm_chown_user "$LSSHM_CALLING_USER" "$file"
    lsshm_ok "Host '%s' added to %s" "$name" "$file"
}

lsshm_hosts_delete() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name to delete')" '')"
    [ -n "$name" ] || { lsshm_info 'Cancelled.'; return 0; }
    local file; file="$(lsshm_hosts_file)"
    [ -f "$file" ] || { lsshm_error 'No config file.'; return 1; }
    lsshm_hosts_exists "$name" || { lsshm_error 'Host not found: %s' "$name"; return 1; }

    lsshm_backup_file "$file" "ssh-config" >/dev/null 2>&1 || true
    local tmp; tmp="$(lsshm_mktemp)"
    awk -v want="$name" '
        tolower($1)=="host" {
            skip=0; for(i=2;i<=NF;i++) if($i==want) skip=1;
            if(skip){inblk=1; next} else {inblk=0}
        }
        !inblk { print }
    ' "$file" >"$tmp"
    install -m 0600 "$tmp" "$file"
    lsshm_chown_user "$LSSHM_CALLING_USER" "$file"
    lsshm_ok "Host '%s' deleted." "$name"
}

lsshm_hosts_edit() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name to edit')" '')"
    lsshm_hosts_exists "$name" || { lsshm_error 'Host not found: %s' "$name"; return 1; }
    lsshm_info "Current configuration of '%s':" "$name"
    lsshm_hosts_show "$name"
    lsshm_warn 'Editing replaces the whole block.'
    lsshm_confirm "$(lsshm_t 'Continue?')" no || return 0
    local file snap
    file="$(lsshm_hosts_file)"
    snap="$(lsshm_mktemp)"
    cp -a "$file" "$snap" 2>/dev/null || { lsshm_error 'Unable to back up %s.' "$file"; return 1; }
    lsshm_hosts_delete "$name"
    if ! lsshm_hosts_add; then
        install -m 0600 "$snap" "$file"
        lsshm_chown_user "$LSSHM_CALLING_USER" "$file"
        lsshm_warn "Edit cancelled: host '%s' has been restored." "$name"
        return 1
    fi
}

lsshm_hosts_show() {
    local name="$1"
    printf '  HostName    : %s\n' "$(lsshm_hosts_get_field "$name" HostName)"
    printf '  User        : %s\n' "$(lsshm_hosts_get_field "$name" User)"
    printf '  Port        : %s\n' "$(lsshm_hosts_get_field "$name" Port)"
    printf '  IdentityFile: %s\n' "$(lsshm_hosts_get_field "$name" IdentityFile)"
    printf '  ProxyJump   : %s\n' "$(lsshm_hosts_get_field "$name" ProxyJump)"
}

lsshm_hosts_effective() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name')" '')"
    lsshm_have ssh || { lsshm_error 'ssh not found.'; return 1; }
    lsshm_info 'Effective configuration (ssh -G %s):' "$name"
    ssh -G "$name" 2>/dev/null | grep -Ei '^(hostname|user|port|identityfile|proxyjump) '
}

lsshm_hosts_test() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name to test')" '')"
    local host port
    host="$(lsshm_hosts_get_field "$name" HostName)"; host="${host:-$name}"
    port="$(lsshm_hosts_get_field "$name" Port)"; port="${port:-22}"

    lsshm_info 'Resolving %s...' "$host"
    if lsshm_have getent && getent hosts "$host" >/dev/null 2>&1; then
        lsshm_ok 'DNS resolution succeeded.'
    else
        lsshm_warn 'DNS resolution uncertain.'
    fi

    lsshm_info 'Testing port %s...' "$port"
    if lsshm_have nc && nc -z -w 3 "$host" "$port" 2>/dev/null; then
        lsshm_ok 'Port %s open.' "$port"
    elif (exec 3<>"/dev/tcp/$host/$port") 2>/dev/null; then
        lsshm_ok 'Port %s open.' "$port"
        exec 3>&- 2>/dev/null || true
    else
        lsshm_warn 'Port %s unreachable.' "$port"
    fi

    lsshm_info 'SSH authentication test (BatchMode)...'
    local ssh_err ssh_rc=0
    ssh_err="$(ssh -o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=yes "$name" true 2>&1)" || ssh_rc=$?
    if [ "$ssh_rc" -eq 0 ]; then
        lsshm_ok 'Authentication succeeded.'
        return 0
    fi

    if printf '%s' "$ssh_err" | grep -Eqi 'REMOTE HOST IDENTIFICATION HAS CHANGED|Host key verification failed|Offending .+ key in'; then
        lsshm_warn 'Remote host identification has changed (known_hosts conflict).'
        lsshm_warn 'This can happen after a reinstall, or indicate a MITM risk.'
        if lsshm_confirm "$(lsshm_tf 'Remove the old host key for %s from known_hosts?' "$host")" yes; then
            lsshm_known_hosts_remove "$host" || true
            [ "$host" != "$name" ] && lsshm_known_hosts_remove "$name" || true
            if [ "$port" != "22" ]; then
                lsshm_known_hosts_remove "[${host}]:${port}" || true
            fi
            if lsshm_confirm "$(lsshm_t 'Fetch and accept the new host key now?')" yes; then
                if lsshm_have ssh-keyscan; then
                    local file; file="$(lsshm_known_hosts_file)"
                    mkdir -p "$(dirname "$file")"
                    touch "$file"
                    lsshm_backup_file "$file" "known-hosts" >/dev/null 2>&1 || true
                    if ssh-keyscan -p "$port" "$host" 2>/dev/null >>"$file"; then
                        lsshm_chown_user "$LSSHM_CALLING_USER" "$file"
                        lsshm_ok 'New host key(s) for %s added to known_hosts.' "$host"
                        lsshm_known_hosts_scan "$host" || true
                    else
                        lsshm_error 'Unable to fetch host keys from %s.' "$host"
                    fi
                else
                    lsshm_error 'ssh-keyscan not found.'
                fi
            fi
            lsshm_info 'Re-run the host test after updating known_hosts.'
        fi
        return 1
    fi

    lsshm_warn 'Automatic authentication failed (missing key or password required).'
}

lsshm_hosts_connect() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name')" '')"
    [ -n "$name" ] || return 1
    lsshm_info 'Connecting to %s...' "$name"
    ssh "$name"
}

lsshm_hosts_copy_key() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name')" '')"
    lsshm_have ssh-copy-id || { lsshm_error 'ssh-copy-id not found.'; return 1; }
    local identity; identity="$(lsshm_hosts_get_field "$name" IdentityFile)"
    identity="$(lsshm_expand_user_path "${identity:-$(lsshm_keys_dir)/id_ed25519}")"
    local pub="$identity.pub"
    [ -f "$pub" ] || { lsshm_error 'Public key not found: %s' "$pub"; return 1; }
    lsshm_info 'Copying %s to %s...' "$pub" "$name"
    ssh-copy-id -i "$pub" "$name"
}

lsshm_hosts_revoke_key() {
    local name="$1"
    [ -n "$name" ] || name="$(lsshm_prompt "$(lsshm_t 'Host name')" '')"
    [ -n "$name" ] || { lsshm_info 'Cancelled.'; return 0; }
    local identity; identity="$(lsshm_hosts_get_field "$name" IdentityFile)"
    identity="$(lsshm_expand_user_path "${identity:-$(lsshm_keys_dir)/id_ed25519}")"
    local pub="$identity.pub"
    [ -f "$pub" ] || { lsshm_error 'Public key not found: %s' "$pub"; return 1; }
    local keytext; keytext="$(awk '{print $2}' "$pub")"
    [ -n "$keytext" ] || { lsshm_error 'Empty public key body.'; return 1; }
    # OpenSSH key bodies are base64; reject anything else before remote use.
    case "$keytext" in
        *[!A-Za-z0-9+/=]*)
            lsshm_error 'Invalid key body (unexpected characters).'
            return 1
            ;;
    esac
    lsshm_warn 'Removing the key on %s (requires authorized access).' "$name"
    lsshm_confirm "$(lsshm_t 'Continue?')" no || return 0
    # Pass the key body as argv ($1): SSH does not forward local env vars.
    # base64-only keytext is safe to embed via printf %q.
    if ssh "$name" "bash -s -- $(printf '%q' "$keytext")" <<'REMOTE'
set -euo pipefail
KEYBLOB="$1"
ak="${HOME}/.ssh/authorized_keys"
[ -f "$ak" ] || { echo "authorized_keys not found" >&2; exit 1; }
tmp="$(mktemp "${TMPDIR:-/tmp}/lsshm-ak.XXXXXX")"
awk -v k="$KEYBLOB" '
{
  keep=1
  for (i=1; i<=NF; i++) if ($i == k) keep=0
  if (keep) print
}' "$ak" >"$tmp"
mv "$tmp" "$ak"
chmod 600 "$ak"
REMOTE
    then
        lsshm_ok 'Key removed on %s.' "$name"
    else
        lsshm_error 'Removal failed.'
        return 1
    fi
}

# ===== src/known_hosts.sh ==============================================
# shellcheck shell=bash
# =============================================================================
# known_hosts.sh - manage ~/.ssh/known_hosts fingerprints
# =============================================================================

lsshm_known_hosts_file() {
    printf '%s/known_hosts' "$(lsshm_target_ssh_dir)"
}

lsshm_known_hosts_list() {
    local file; file="$(lsshm_known_hosts_file)"
    if [ ! -f "$file" ]; then
        lsshm_info 'No known_hosts file.'
        return 0
    fi
    lsshm_info 'Known fingerprints (%s):' "$file"
    ssh-keygen -lf "$file" 2>/dev/null || awk '{print $1}' "$file"
}

lsshm_known_hosts_show() {
    local host="$1"
    [ -n "$host" ] || host="$(lsshm_prompt "$(lsshm_t 'Server name or address')" '')"
    [ -n "$host" ] || return 1
    lsshm_info 'Host fingerprint for %s:' "$host"
    ssh-keygen -F "$host" 2>/dev/null || lsshm_warn 'No entry for %s.' "$host"
}

lsshm_known_hosts_remove() {
    local host="$1"
    [ -n "$host" ] || host="$(lsshm_prompt "$(lsshm_t 'Host to remove from known_hosts')" '')"
    [ -n "$host" ] || { lsshm_info 'Cancelled.'; return 0; }
    local file; file="$(lsshm_known_hosts_file)"
    [ -f "$file" ] || { lsshm_error 'No known_hosts file.'; return 1; }
    lsshm_backup_file "$file" "known-hosts" >/dev/null 2>&1 || true
    if ssh-keygen -R "$host" -f "$file" >/dev/null 2>&1; then
        lsshm_chown_user "$LSSHM_CALLING_USER" "$file"
        [ -f "${file}.old" ] && lsshm_chown_user "$LSSHM_CALLING_USER" "${file}.old"
        lsshm_ok 'Fingerprint of %s removed.' "$host"
    else
        lsshm_error 'Removal failed for %s.' "$host"
        return 1
    fi
}

lsshm_known_hosts_scan() {
    local host="$1"
    [ -n "$host" ] || host="$(lsshm_prompt "$(lsshm_t 'Host to scan')" '')"
    [ -n "$host" ] || return 1
    lsshm_have ssh-keyscan || { lsshm_error 'ssh-keyscan not found.'; return 1; }
    lsshm_info 'Fingerprint announced by %s:' "$host"
    ssh-keyscan "$host" 2>/dev/null | ssh-keygen -lf - 2>/dev/null
}

# ===== src/logs.sh =====================================================
# shellcheck shell=bash
# =============================================================================
# logs.sh - sessions, logins, and SSH service logs
# =============================================================================

lsshm_logs_sessions() {
    lsshm_info 'Active SSH sessions:'
    if lsshm_have who; then
        who 2>/dev/null | grep -Ei 'pts|ssh' || who 2>/dev/null || lsshm_info '  (none)'
    else
        lsshm_warn "'who' unavailable."
    fi
}

lsshm_logs_recent_logins() {
    lsshm_info 'Recent logins:'
    if lsshm_have last; then
        lsshm_run_privileged last -n 10 2>/dev/null | head -n 10 || true
    else
        lsshm_warn "'last' unavailable."
    fi
}

lsshm_logs_failed() {
    lsshm_info 'Recent failed login attempts:'
    if lsshm_have lastb; then
        lsshm_run_privileged lastb -n 10 2>/dev/null | head -n 10 || lsshm_info '  (none or not accessible)'
    elif [ -f /var/log/auth.log ]; then
        lsshm_run_privileged grep -i 'failed password' /var/log/auth.log 2>/dev/null | tail -n 10 || lsshm_info '  (none)'
    else
        lsshm_warn 'No source of failed attempts available.'
    fi
}

lsshm_logs_service() {
    lsshm_info 'SSH service logs:'
    lsshm_server_logs 40
}

lsshm_logs_menu() {
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_logs_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'Connections and logs'
            printf '\n'
            lsshm_out '  1. Active sessions'
            lsshm_out '  2. Recent logins'
            lsshm_out '  3. Failed attempts'
            lsshm_out '  4. SSH service logs'
            lsshm_out '  5. Back'
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '5' || true)"
        fi
        case "$choice" in
            1) lsshm_ui_run "$(lsshm_t 'Active sessions')" lsshm_logs_sessions ;;
            2) lsshm_ui_run "$(lsshm_t 'Recent logins')" lsshm_logs_recent_logins ;;
            3) lsshm_ui_run "$(lsshm_t 'Failed attempts')" lsshm_logs_failed ;;
            4) lsshm_ui_run "$(lsshm_t 'SSH service logs')" lsshm_logs_service ;;
            5|q|Q) break ;;
            *) lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# ===== src/audit.sh ====================================================
# shellcheck shell=bash
# =============================================================================
# audit.sh - local SSH security audit and diagnostics
# =============================================================================

LSSHM_AUDIT_PASS=0
LSSHM_AUDIT_WARN=0
LSSHM_AUDIT_FAIL=0

lsshm_audit_pass() { LSSHM_AUDIT_PASS=$((LSSHM_AUDIT_PASS+1)); printf '  [%sOK%s]   %s\n' "${LSSHM_C_GREEN:-}" "${LSSHM_C_RESET:-}" "$*"; }
lsshm_audit_warn() { LSSHM_AUDIT_WARN=$((LSSHM_AUDIT_WARN+1)); printf '  [%s%s%s] %s\n' "${LSSHM_C_YELLOW:-}" "$(lsshm_t 'WARN')" "${LSSHM_C_RESET:-}" "$*"; }
lsshm_audit_fail() { LSSHM_AUDIT_FAIL=$((LSSHM_AUDIT_FAIL+1)); printf '  [%s%s%s] %s\n' "${LSSHM_C_RED:-}" "$(lsshm_t 'FAIL')" "${LSSHM_C_RESET:-}" "$*"; }

lsshm_audit() {
    LSSHM_AUDIT_PASS=0; LSSHM_AUDIT_WARN=0; LSSHM_AUDIT_FAIL=0
    lsshm_header
    lsshm_out 'Local SSH security audit'
    printf '\n'

    printf '%s%s%s\n' "${LSSHM_C_BOLD:-}" "$(lsshm_t 'SSH server')" "${LSSHM_C_RESET:-}"
    if lsshm_server_is_installed; then
        lsshm_audit_pass "$(lsshm_t 'OpenSSH Server installed.')"
    else
        lsshm_audit_warn "$(lsshm_t 'OpenSSH Server not installed.')"
    fi

    local root pass maxauth
    root="$(lsshm_server_config_effective_value permitrootlogin)"
    case "$root" in
        no) lsshm_audit_pass "$(lsshm_t 'PermitRootLogin = no (root forbidden).')" ;;
        prohibit-password|without-password) lsshm_audit_pass "$(lsshm_t 'PermitRootLogin = key only.')" ;;
        yes) lsshm_audit_fail "$(lsshm_t 'PermitRootLogin = yes (root with password allowed).')" ;;
        *) lsshm_audit_warn "$(lsshm_tf 'PermitRootLogin = %s.' "${root:-$(lsshm_t 'not set')}")" ;;
    esac

    pass="$(lsshm_server_config_effective_value passwordauthentication)"
    case "$pass" in
        no) lsshm_audit_pass "$(lsshm_t 'Password authentication disabled.')" ;;
        yes) lsshm_audit_warn "$(lsshm_t 'Password authentication enabled.')" ;;
        *) lsshm_audit_warn "$(lsshm_tf 'PasswordAuthentication = %s.' "${pass:-$(lsshm_t 'not set')}")" ;;
    esac

    maxauth="$(lsshm_server_config_effective_value maxauthtries)"
    if [ -n "$maxauth" ] && [ "$maxauth" -le 4 ] 2>/dev/null; then
        lsshm_audit_pass "$(lsshm_tf 'MaxAuthTries = %s.' "$maxauth")"
    else
        lsshm_audit_warn "$(lsshm_tf 'MaxAuthTries = %s (recommended <= 4).' "${maxauth:-$(lsshm_t 'default')}")"
    fi

    if lsshm_server_is_installed && lsshm_server_config_test >/dev/null 2>&1; then
        lsshm_audit_pass "$(lsshm_t 'sshd -t: configuration valid.')"
    elif lsshm_server_is_installed; then
        lsshm_audit_fail "$(lsshm_t 'sshd -t: configuration invalid.')"
    fi

    printf '\n%s%s%s\n' "${LSSHM_C_BOLD:-}" "$(lsshm_tf 'Local permissions (%s)' "$LSSHM_CALLING_USER")" "${LSSHM_C_RESET:-}"
    local ssh_dir; ssh_dir="$(lsshm_target_ssh_dir)"
    if [ -d "$ssh_dir" ]; then
        local perm; perm="$(stat -c '%a' "$ssh_dir" 2>/dev/null || stat -f '%Lp' "$ssh_dir" 2>/dev/null)"
        if [ "$perm" = "700" ]; then
            lsshm_audit_pass "$(lsshm_t 'The .ssh directory has 700 permissions.')"
        else
            lsshm_audit_warn "$(lsshm_tf 'The .ssh directory has %s permissions (expected 700).' "${perm:-$(lsshm_t 'unknown')}")"
        fi
        local ak="$ssh_dir/authorized_keys"
        if [ -f "$ak" ]; then
            perm="$(stat -c '%a' "$ak" 2>/dev/null || stat -f '%Lp' "$ak" 2>/dev/null)"
            [ "$perm" = "600" ] && lsshm_audit_pass "$(lsshm_t 'authorized_keys 600.')" \
                || lsshm_audit_warn "$(lsshm_tf 'authorized_keys %s (expected 600).' "${perm:-$(lsshm_t 'unknown')}")"
        fi
        local priv
        for priv in "$ssh_dir"/id_*; do
            [ -f "$priv" ] || continue
            case "$priv" in *.pub) continue ;; esac
            perm="$(stat -c '%a' "$priv" 2>/dev/null || stat -f '%Lp' "$priv" 2>/dev/null)"
            [ "$perm" = "600" ] && lsshm_audit_pass "$(lsshm_tf '%s 600.' "$(basename "$priv")")" \
                || lsshm_audit_fail "$(lsshm_tf '%s %s (private key must be 600).' "$(basename "$priv")" "${perm:-$(lsshm_t 'unknown')}")"
        done
    else
        lsshm_audit_warn "$(lsshm_tf 'No .ssh directory for %s.' "$LSSHM_CALLING_USER")"
    fi

    printf '\n%s%s%s\n' "${LSSHM_C_BOLD:-}" "$(lsshm_t 'Listening port')" "${LSSHM_C_RESET:-}"
    if lsshm_server_port_listening; then
        lsshm_audit_pass "$(lsshm_t 'The configured SSH port is listening.')"
    else
        lsshm_audit_warn "$(lsshm_t 'Unable to confirm the SSH port is listening.')"
    fi

    printf '\n%s%s%s : %s\n' \
        "${LSSHM_C_BOLD:-}" "$(lsshm_t 'Summary')" "${LSSHM_C_RESET:-}" \
        "$(lsshm_tf '%d OK, %d warnings, %d failures' "$LSSHM_AUDIT_PASS" "$LSSHM_AUDIT_WARN" "$LSSHM_AUDIT_FAIL")"

    [ "$LSSHM_AUDIT_FAIL" -eq 0 ]
}

# Doctor: environment and configuration diagnostics.
lsshm_doctor() {
    lsshm_header
    lsshm_out 'LSSHM diagnostics (doctor)'
    printf '\n'
    lsshm_platform_summary
    printf '\n'
    lsshm_info 'SSH tools:'
    local t
    for t in ssh sshd ssh-keygen ssh-add ssh-copy-id ssh-keyscan; do
        if lsshm_have "$t"; then printf '  [OK]  %s\n' "$t"; else printf '  [--]  %s (%s)\n' "$t" "$(lsshm_t 'absent')"; fi
    done
    printf '\n'
    lsshm_info 'LSSHM paths:'
    printf '  config : %s\n' "$LSSHM_CONFIG_DIR"
    printf '  data   : %s\n' "$LSSHM_DATA_DIR"
    printf '  state  : %s\n' "$LSSHM_STATE_DIR"
    printf '  cache  : %s\n' "$LSSHM_CACHE_DIR"
    printf '\n'
    lsshm_info 'PATH:'
    case ":$PATH:" in
        *":$LSSHM_BIN_DIR:"*) printf '  [OK]  %s\n' "$(lsshm_tf '%s is in PATH' "$LSSHM_BIN_DIR")" ;;
        *) printf '  [--]  %s\n' "$(lsshm_tf '%s is not in PATH' "$LSSHM_BIN_DIR")" ;;
    esac
}

# ===== src/updater.sh ==================================================
# shellcheck shell=bash
# =============================================================================
# updater.sh - configuration file and safe self-update
# =============================================================================

# --- configuration file (INI-style key=value) --------------------------------

lsshm_config_default() {
    cat <<EOF
# LSSHM configuration
update_check=daily
update_channel=stable
EOF
}

lsshm_config_load() {
    LSSHM_CFG_UPDATE_CHECK="daily"
    LSSHM_CFG_UPDATE_CHANNEL="stable"
    LSSHM_CFG_LANG=""
    [ -r "$LSSHM_CONFIG_FILE" ] || return 0
    local line key val
    while IFS= read -r line; do
        case "$line" in ''|'#'*) continue ;; esac
        key="${line%%=*}"; val="${line#*=}"
        key="$(printf '%s' "$key" | tr -d '[:space:]')"
        val="$(printf '%s' "$val" | tr -d '[:space:]')"
        case "$key" in
            update_check)   LSSHM_CFG_UPDATE_CHECK="$val" ;;
            update_channel) LSSHM_CFG_UPDATE_CHANNEL="$val" ;;
            language)       LSSHM_CFG_LANG="$val" ;;
        esac
    done <"$LSSHM_CONFIG_FILE"
}

lsshm_config_write_default() {
    lsshm_ensure_dirs
    [ -f "$LSSHM_CONFIG_FILE" ] && return 0
    lsshm_config_default >"$LSSHM_CONFIG_FILE"
}

lsshm_config_set() {
    local key="$1" value="$2"
    lsshm_ensure_dirs
    [ -f "$LSSHM_CONFIG_FILE" ] || lsshm_config_default >"$LSSHM_CONFIG_FILE"
    local tmp; tmp="$(lsshm_mktemp)"
    if grep -q "^${key}=" "$LSSHM_CONFIG_FILE" 2>/dev/null; then
        sed "s|^${key}=.*|${key}=${value}|" "$LSSHM_CONFIG_FILE" >"$tmp"
    else
        cat "$LSSHM_CONFIG_FILE" >"$tmp"
        printf '%s=%s\n' "$key" "$value" >>"$tmp"
    fi
    install -m 0644 "$tmp" "$LSSHM_CONFIG_FILE"
}

# --- download helpers --------------------------------------------------------

lsshm_download() {
    # lsshm_download URL OUTFILE
    local url="$1" out="$2"
    if lsshm_have curl; then
        curl -fsSL "$url" -o "$out"
    elif lsshm_have wget; then
        wget -qO "$out" "$url"
    else
        lsshm_error 'Neither curl nor wget available for download.'
        return 1
    fi
}

lsshm_remote_version() {
    local tmp; tmp="$(lsshm_mktemp)"
    if lsshm_download "$LSSHM_REPO_RAW/VERSION" "$tmp" 2>/dev/null; then
        tr -d '[:space:]' <"$tmp"
    fi
}

lsshm_version_gt() {
    # returns 0 if $1 > $2 (semantic-ish numeric compare)
    [ "$1" = "$2" ] && return 1
    local greater
    greater="$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)"
    [ "$greater" = "$1" ]
}

# --- update check ------------------------------------------------------------

lsshm_update_stamp() { printf '%s/last_update_check' "$LSSHM_CACHE_DIR"; }

lsshm_update_should_check() {
    lsshm_config_load
    case "$LSSHM_CFG_UPDATE_CHECK" in
        never) return 1 ;;
        always) return 0 ;;
        daily|*)
            local stamp; stamp="$(lsshm_update_stamp)"
            [ -f "$stamp" ] || return 0
            local last now
            last="$(cat "$stamp" 2>/dev/null || echo 0)"
            now="$(date +%s)"
            [ $((now - last)) -ge 86400 ]
            ;;
    esac
}

lsshm_update_touch_stamp() {
    lsshm_ensure_dirs
    date +%s >"$(lsshm_update_stamp)" 2>/dev/null || true
}

# Light check performed at startup.
lsshm_update_check() {
    lsshm_update_should_check || return 0
    lsshm_update_touch_stamp
    local remote; remote="$(lsshm_remote_version)"
    [ -n "$remote" ] || return 0
    if lsshm_version_gt "$remote" "$LSSHM_VERSION"; then
        printf '\n'
        lsshm_out 'Installed version: %s' "$LSSHM_VERSION"
        lsshm_out 'Available version: %s' "$remote"
        printf '\n'
        lsshm_out 'An update is available.'
        if lsshm_confirm "$(lsshm_t 'Install now?')" no; then
            lsshm_update_run
        fi
    fi
}

# --- safe update -------------------------------------------------------------

lsshm_update_run() {
    lsshm_ensure_dirs
    local target="$LSSHM_INSTALL_TARGET"
    if [ ! -f "$target" ]; then
        lsshm_warn 'LSSHM does not seem to be installed in %s.' "$target"
        lsshm_info 'Use: curl -fsSL %s/lsshm.sh | bash -s -- install' "$LSSHM_REPO_RAW"
        return 1
    fi

    local remote; remote="$(lsshm_remote_version)"
    lsshm_info 'Installed version: %s' "$LSSHM_VERSION"
    lsshm_info 'Remote version : %s' "${remote:-$(lsshm_t 'unknown')}"

    # 1. Download to a temporary file.
    local tmp; tmp="$(lsshm_mktemp)"
    lsshm_info 'Downloading the new version...'
    if ! lsshm_download "$LSSHM_REPO_RAW/lsshm.sh" "$tmp"; then
        lsshm_error 'Download failed.'
        return 1
    fi

    # 2. Validate syntax with bash -n.
    if ! bash -n "$tmp"; then
        lsshm_error 'The downloaded script has syntax errors. Aborting.'
        return 1
    fi

    # 3. Verify SHA-256 against the published SHA256SUMS.
    if ! lsshm_update_verify_checksum "$tmp"; then
        lsshm_error 'SHA-256 verification failed. Aborting.'
        return 1
    fi

    # 4. Sanity check: the new file must identify itself as LSSHM.
    if ! grep -q "LSSHM" "$tmp"; then
        lsshm_error 'The downloaded file does not look like LSSHM. Aborting.'
        return 1
    fi

    # 5/6. Keep previous version, then replace atomically.
    cp -a "$target" "$target.prev" 2>/dev/null || true
    chmod +x "$tmp"
    if install -m 0755 "$tmp" "$target"; then
        lsshm_ok 'Update installed. Previous version kept: %s' "$target.prev"
        lsshm_info "Use 'lsshm update rollback' to revert."
    else
        lsshm_error 'File replacement failed.'
        return 1
    fi
}

# Fail-closed: any missing tool, missing file, or mismatch aborts the caller.
lsshm_update_verify_checksum() {
    local file="$1"
    if [ ! -f "$file" ]; then
        lsshm_error 'File to verify not found.'
        return 1
    fi
    local sums; sums="$(lsshm_mktemp)"
    if ! lsshm_download "$LSSHM_REPO_RAW/SHA256SUMS" "$sums" 2>/dev/null; then
        lsshm_error 'SHA256SUMS unavailable: cannot verify (aborting).'
        return 1
    fi
    local expected actual
    # Accept both text ("hash  lsshm.sh") and binary ("hash *lsshm.sh") formats.
    expected="$(awk '
        {
            f = $2
            sub(/^\*/, "", f)
            if (f == "lsshm.sh") { print $1; exit }
        }
    ' "$sums")"
    if [ -z "$expected" ]; then
        lsshm_error 'lsshm.sh checksum missing from SHA256SUMS (aborting).'
        return 1
    fi
    if lsshm_have sha256sum; then
        actual="$(sha256sum "$file" | awk '{print $1}')"
    elif lsshm_have shasum; then
        actual="$(shasum -a 256 "$file" | awk '{print $1}')"
    else
        lsshm_error 'No SHA-256 tool (sha256sum/shasum): cannot verify (aborting).'
        return 1
    fi
    if [ "$expected" != "$actual" ]; then
        lsshm_error 'Incorrect SHA-256 checksum.'
        lsshm_error '  expected: %s' "$expected"
        lsshm_error '  actual:   %s' "$actual"
        return 1
    fi
    lsshm_ok 'SHA-256 checksum verified.'
    return 0
}

lsshm_update_rollback() {
    local target="$LSSHM_INSTALL_TARGET"
    if [ ! -f "$target.prev" ]; then
        lsshm_error 'No previous version available (%s).' "$target.prev"
        return 1
    fi
    lsshm_confirm "$(lsshm_t 'Restore the previous version of LSSHM?')" no || { lsshm_info 'Cancelled.'; return 0; }
    if install -m 0755 "$target.prev" "$target"; then
        lsshm_ok 'Previous version restored.'
    else
        lsshm_error 'Restore failed.'
        return 1
    fi
}

# ===== src/cli.sh ======================================================
# shellcheck shell=bash
# =============================================================================
# cli.sh - dependency-free CLI menus
# =============================================================================

# The status panel shown at the top of the main menu.
# Must not prompt for sudo: uses cached/non-interactive sshd -T or file parse.
lsshm_status_panel() {
    local active port root pass rootkeys userkeys hosts dump
    if lsshm_server_is_installed && lsshm_server_is_active; then active="$(lsshm_t 'active')"; else active="$(lsshm_t 'inactive')"; fi

    # One dump (or none) for all status fields — never three sudo prompts.
    dump="$(lsshm_server_config_dump)" || dump=""
    if [ -n "$dump" ]; then
        port="$(printf '%s\n' "$dump" | awk 'tolower($1)=="port"{sub($1 FS,""); print; exit}')"
        root="$(printf '%s\n' "$dump" | awk 'tolower($1)=="permitrootlogin"{sub($1 FS,""); print; exit}')"
        pass="$(printf '%s\n' "$dump" | awk 'tolower($1)=="passwordauthentication"{sub($1 FS,""); print; exit}')"
    else
        port="$(lsshm_config_parse_value port)"
        root="$(lsshm_config_parse_value permitrootlogin)"
        pass="$(lsshm_config_parse_value passwordauthentication)"
    fi
    port="${port:-22}"
    root="$(lsshm_rootlogin_label "$root")"
    pass="$(lsshm_yesno_label "$pass")"

    rootkeys="$(lsshm_user_key_count root)"
    userkeys="0"
    local kd; kd="$(lsshm_keys_dir)"
    if [ -d "$kd" ]; then
        userkeys="$(find "$kd" -maxdepth 1 -type f -name 'id_*' ! -name '*.pub' 2>/dev/null | wc -l | tr -d ' ')"
    fi
    hosts="$(lsshm_hosts_count)"

    lsshm_out 'Managed user: %s' "$LSSHM_CALLING_USER"
    lsshm_out 'SSH server status: %s' "$active"
    lsshm_out 'Port: %s' "$port"
    lsshm_out 'Root access: %s' "$root"
    lsshm_out 'Password authentication: %s' "$pass"
    lsshm_out 'Authorized keys for root: %s' "$rootkeys"
    lsshm_out 'Private keys of %s: %s' "$LSSHM_CALLING_USER" "$userkeys"
    lsshm_out 'Registered remote hosts: %s' "$hosts"
}

lsshm_cli_main() {
    lsshm_require_interactive
    while true; do
        clear 2>/dev/null || true
        lsshm_header
        lsshm_menu_try lsshm_status_panel
        printf '\n'
        lsshm_out '1. Manage the local SSH server'
        lsshm_out '2. Manage access to this machine'
        lsshm_out '3. Manage my SSH keys'
        lsshm_out '4. Manage remote hosts'
        lsshm_out '5. View connections and logs'
        lsshm_out '6. Run a security audit'
        lsshm_out '7. Back up or restore'
        lsshm_out '8. LSSHM settings'
        lsshm_out '9. Quit'
        local choice=""
        choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '9' || true)"
        case "$choice" in
            1) lsshm_menu_try lsshm_cli_server_menu ;;
            2) lsshm_menu_try lsshm_cli_access_menu ;;
            3) lsshm_menu_try lsshm_cli_keys_menu ;;
            4) lsshm_menu_try lsshm_cli_hosts_menu ;;
            5) lsshm_menu_try lsshm_logs_menu ;;
            6) lsshm_menu_action lsshm_audit ;;
            7) lsshm_menu_try lsshm_backup_menu ;;
            8) lsshm_menu_try lsshm_settings_menu ;;
            9|q|Q) break ;;
            *) lsshm_warn 'Invalid choice.' ; lsshm_pause ;;
        esac
    done
}

# --- server menu -------------------------------------------------------------

lsshm_cli_server_menu() {
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_server_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'Local SSH server'
            printf '\n'
            lsshm_menu_try lsshm_server_status
            printf '\n'
            printf ' 1. %s\n' "$(lsshm_t 'Install OpenSSH Server')"
            printf ' 2. %s\n' "$(lsshm_t 'Start the service')"
            printf ' 3. %s\n' "$(lsshm_t 'Stop the service')"
            printf ' 4. %s\n' "$(lsshm_t 'Restart the service')"
            printf ' 5. %s\n' "$(lsshm_t 'Reload the service')"
            printf ' 6. %s\n' "$(lsshm_t 'Enable at boot')"
            printf ' 7. %s\n' "$(lsshm_t 'Disable at boot')"
            printf ' 8. %s\n' "$(lsshm_t 'Change the port')"
            printf ' 9. %s\n' "$(lsshm_t 'Address family (AddressFamily)')"
            printf '10. %s\n' "$(lsshm_t 'Listen addresses (ListenAddress)')"
            printf '11. %s\n' "$(lsshm_t 'Manage root access')"
            printf '12. %s\n' "$(lsshm_t 'Password authentication')"
            printf '13. %s\n' "$(lsshm_t 'Key authentication')"
            printf '14. %s\n' "$(lsshm_t 'Allowed users (AllowUsers)')"
            printf '15. %s\n' "$(lsshm_t 'Allowed groups (AllowGroups)')"
            printf '16. %s\n' "$(lsshm_t 'Test the configuration (sshd -t)')"
            printf '17. %s\n' "$(lsshm_t 'Show the effective configuration (sshd -T)')"
            printf '18. %s\n' "$(lsshm_t 'View the logs')"
            printf '19. %s\n' "$(lsshm_t 'Back')"
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '19' || true)"
        fi
        case "$choice" in
            1)  lsshm_ui_run "$(lsshm_t 'OpenSSH Server installation')" lsshm_server_install ;;
            2)  lsshm_ui_run "$(lsshm_t 'Starting SSH')" lsshm_server_start ;;
            3)  lsshm_ui_run "$(lsshm_t 'Stopping SSH')" lsshm_server_stop ;;
            4)  lsshm_ui_run "$(lsshm_t 'Restarting SSH')" lsshm_server_restart ;;
            5)  lsshm_ui_run "$(lsshm_t 'Reloading SSH')" lsshm_server_reload ;;
            6)  lsshm_ui_run "$(lsshm_t 'Enabling at boot')" lsshm_server_enable ;;
            7)  lsshm_ui_run "$(lsshm_t 'Disabling at boot')" lsshm_server_disable ;;
            8)  lsshm_menu_action lsshm_set_port ;;
            9)  lsshm_menu_action lsshm_set_address_family ;;
            10) lsshm_menu_action lsshm_set_listen_address ;;
            11) lsshm_menu_action lsshm_set_root_login ;;
            12) lsshm_menu_action lsshm_set_password_auth ;;
            13) lsshm_menu_action lsshm_set_pubkey_auth ;;
            14) lsshm_menu_action lsshm_set_allow_users ;;
            15) lsshm_menu_action lsshm_set_allow_groups ;;
            16) lsshm_ui_run "$(lsshm_t 'sshd -t test')" lsshm_server_config_test ;;
            17)
                if lsshm_uses_dialog_ui; then
                    lsshm_menu_try lsshm_ui_show "$(lsshm_t 'Effective configuration')" lsshm_server_config_show
                else
                    lsshm_server_config_show | ${PAGER:-less} 2>/dev/null || lsshm_menu_try lsshm_server_config_show
                    lsshm_pause
                fi
                ;;
            18) lsshm_ui_run "$(lsshm_t 'SSH logs')" lsshm_server_logs ;;
            19|q|Q) break ;;
            *)  lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# --- access menu (incoming) --------------------------------------------------

lsshm_cli_access_menu() {
    while true; do
        local user="$LSSHM_CALLING_USER"
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_access_menu "$user")" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'Access to this machine (keys allowed to connect HERE)'
            lsshm_out 'Target user: %s' "$user"
            printf '\n'
            printf '1. %s\n' "$(lsshm_t 'List users')"
            printf '2. %s\n' "$(lsshm_t 'List authorized keys')"
            printf '3. %s\n' "$(lsshm_t 'Add a key (paste or import a .pub)')"
            printf '4. %s\n' "$(lsshm_t 'Remove a key')"
            printf '5. %s\n' "$(lsshm_t 'Disable / re-enable a key')"
            printf '6. %s\n' "$(lsshm_t 'Repair ~/.ssh permissions')"
            printf '7. %s\n' "$(lsshm_t 'Detect duplicates')"
            printf '8. %s\n' "$(lsshm_t 'Change target user')"
            printf '9. %s\n' "$(lsshm_t 'Back')"
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '9' || true)"
        fi
        case "$choice" in
            1) lsshm_ui_run "$(lsshm_t 'Local users')" lsshm_users_print ;;
            2) lsshm_ui_run "$(lsshm_t 'Authorized keys')" lsshm_access_list "$user" ;;
            3) lsshm_menu_action lsshm_access_add "$user" ;;
            4) lsshm_menu_action lsshm_access_remove "$user" ;;
            5) lsshm_menu_action lsshm_access_disable "$user" ;;
            6) lsshm_ui_run "$(lsshm_t 'Permission repair')" lsshm_access_repair "$user" ;;
            7) lsshm_ui_run "$(lsshm_t 'Duplicates')" lsshm_access_duplicates "$user" ;;
            8) lsshm_menu_action lsshm_pick_target_user "$user" ;;
            9|q|Q) break ;;
            *) lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# --- local keys menu (outgoing) ----------------------------------------------

lsshm_cli_keys_menu() {
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_keys_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'SSH keys of %s (to connect ELSEWHERE)' "$LSSHM_CALLING_USER"
            lsshm_out 'Directory: %s' "$(lsshm_keys_dir)"
            printf '\n'
            printf '1. %s\n'  "$(lsshm_t 'List key pairs')"
            printf '2. %s\n'  "$(lsshm_t 'Generate a new key (ED25519 by default)')"
            printf '3. %s\n'  "$(lsshm_t 'Inspect a key')"
            printf '4. %s\n'  "$(lsshm_t 'Show / export a public key')"
            printf '5. %s\n'  "$(lsshm_t 'Change the passphrase')"
            printf '6. %s\n'  "$(lsshm_t 'Delete a key pair')"
            printf '7. %s\n'  "$(lsshm_t 'ssh-agent: list')"
            printf '8. %s\n'  "$(lsshm_t 'ssh-agent: add a key')"
            printf '9. %s\n'  "$(lsshm_t 'ssh-agent: remove a key')"
            printf '10. %s\n' "$(lsshm_t 'Change target user')"
            printf '11. %s\n' "$(lsshm_t 'Back')"
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '11' || true)"
        fi
        case "$choice" in
            1)  lsshm_ui_run "$(lsshm_t 'Key pairs')" lsshm_keys_list ;;
            2)  lsshm_menu_action lsshm_keys_generate ;;
            3)  lsshm_menu_action lsshm_keys_inspect "" ;;
            4)  lsshm_ui_run "$(lsshm_t 'Public key')" lsshm_keys_export "" ;;
            5)  lsshm_menu_action lsshm_keys_passphrase "" ;;
            6)  lsshm_menu_action lsshm_keys_delete "" ;;
            7)  lsshm_ui_run "ssh-agent" lsshm_agent_list ;;
            8)  lsshm_menu_action lsshm_agent_add "" ;;
            9)  lsshm_menu_action lsshm_agent_remove "" ;;
            10) lsshm_menu_action lsshm_pick_target_user "$LSSHM_CALLING_USER" ;;
            11|q|Q) break ;;
            *)  lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# --- remote hosts menu -------------------------------------------------------

lsshm_cli_hosts_menu() {
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_hosts_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'Remote hosts (~/.ssh/config) - optional'
            lsshm_out 'User: %s' "$LSSHM_CALLING_USER"
            printf '\n'
            printf ' 1. %s\n' "$(lsshm_t 'List hosts')"
            printf ' 2. %s\n' "$(lsshm_t 'Add a host')"
            printf ' 3. %s\n' "$(lsshm_t 'Edit a host')"
            printf ' 4. %s\n' "$(lsshm_t 'Delete a host')"
            printf ' 5. %s\n' "$(lsshm_t 'Test a host (resolution, port, auth)')"
            printf ' 6. %s\n' "$(lsshm_t 'Effective configuration (ssh -G)')"
            printf ' 7. %s\n' "$(lsshm_t 'Connect to a host')"
            printf ' 8. %s\n' "$(lsshm_t 'Copy a key (ssh-copy-id)')"
            printf ' 9. %s\n' "$(lsshm_t 'Revoke a remote key')"
            printf '10. %s\n' "$(lsshm_t 'known_hosts: list')"
            printf '11. %s\n' "$(lsshm_t 'known_hosts: remove a fingerprint')"
            printf '12. %s\n' "$(lsshm_t 'Back')"
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '12' || true)"
        fi
        case "$choice" in
            1)  lsshm_ui_run "$(lsshm_t 'Remote hosts')" lsshm_hosts_list ;;
            2)  lsshm_menu_action lsshm_hosts_add ;;
            3)  lsshm_menu_action lsshm_hosts_edit "" ;;
            4)  lsshm_menu_action lsshm_hosts_delete "" ;;
            5)  lsshm_ui_run "$(lsshm_t 'Host test')" lsshm_hosts_test "" ;;
            6)  lsshm_ui_run "$(lsshm_t 'Effective configuration')" lsshm_hosts_effective "" ;;
            7)  lsshm_menu_try lsshm_hosts_connect "" ;;
            8)  lsshm_menu_action lsshm_hosts_copy_key "" ;;
            9)  lsshm_menu_action lsshm_hosts_revoke_key "" ;;
            10) lsshm_ui_run "known_hosts" lsshm_known_hosts_list ;;
            11) lsshm_menu_action lsshm_known_hosts_remove "" ;;
            12|q|Q) break ;;
            *)  lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# --- settings ----------------------------------------------------------------

lsshm_settings_menu() {
    lsshm_config_load
    while true; do
        local choice="" pick_ret=0
        if lsshm_uses_dialog_ui; then
            choice="$(lsshm_dialog_settings_menu)" || pick_ret=$?
            [ "$pick_ret" -ne 0 ] && break
        else
            clear 2>/dev/null || true
            lsshm_header
            lsshm_out 'LSSHM settings'
            printf '\n'
            lsshm_out 'Managed user        : %s' "$LSSHM_CALLING_USER"
            lsshm_out 'Update check        : %s' "$LSSHM_CFG_UPDATE_CHECK"
            lsshm_out 'Update channel      : %s' "$LSSHM_CFG_UPDATE_CHANNEL"
            lsshm_out 'Language            : %s' "$(lsshm_lang_native_name "$LSSHM_LANG")"
            lsshm_out 'Configuration file  : %s' "$LSSHM_CONFIG_FILE"
            printf '\n'
            lsshm_out '1. Update check: always'
            lsshm_out '2. Update check: once a day'
            lsshm_out '3. Update check: never'
            lsshm_out '4. Check for updates now'
            lsshm_out '5. Show diagnostics (doctor)'
            lsshm_out '6. Change the language'
            lsshm_out '7. Change managed user'
            lsshm_out '8. Back'
            choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '8' || true)"
        fi
        case "$choice" in
            1) lsshm_menu_try lsshm_config_set update_check always; lsshm_menu_try lsshm_config_load ;;
            2) lsshm_menu_try lsshm_config_set update_check daily; lsshm_menu_try lsshm_config_load ;;
            3) lsshm_menu_try lsshm_config_set update_check never; lsshm_menu_try lsshm_config_load ;;
            4) LSSHM_CFG_UPDATE_CHECK=always lsshm_menu_action lsshm_update_run ;;
            5) lsshm_ui_run "$(lsshm_t 'LSSHM diagnostics')" lsshm_doctor ;;
            6) lsshm_menu_action lsshm_i18n_choose; lsshm_menu_try lsshm_config_load ;;
            7) lsshm_menu_action lsshm_pick_target_user "$LSSHM_CALLING_USER" ;;
            8|q|Q) break ;;
            *) lsshm_warn 'Invalid choice.'; lsshm_uses_dialog_ui || lsshm_pause ;;
        esac
    done
}

# ===== src/dialog.sh ===================================================
# shellcheck shell=bash
# =============================================================================
# dialog.sh - optional terminal user interface using `dialog`
# =============================================================================

lsshm_dialog_available() { lsshm_have dialog; }

# dialog --menu wrapper. Prints the selected tag or returns non-zero on cancel.
lsshm_ui_menu() {
    local title="$1" body="$2"
    shift 2
    lsshm_tty_restore
    local result ret
    result="$(dialog --clear --backtitle "$LSSHM_LONG_NAME v$LSSHM_VERSION" \
        --title "$title" --menu "$body" 22 74 14 "$@" \
        3>&1 1>&2 2>&3)"
    ret=$?
    case "$ret" in
        0)
            [ -n "$result" ] || return 1
            printf '%s' "$result"
            return 0
            ;;
        *) return 1 ;;
    esac
}

# Run a command and show stdout/stderr inside dialog.
lsshm_ui_show() {
    local title="$1"; shift
    local tmp; tmp="$(lsshm_mktemp)"
    (
        export LSSHM_NO_COLOR=1
        export LSSHM_C_RESET="" LSSHM_C_BOLD="" LSSHM_C_DIM=""
        export LSSHM_C_RED="" LSSHM_C_GREEN="" LSSHM_C_YELLOW=""
        "$@"
    ) >"$tmp" 2>&1 || true
    lsshm_strip_ansi_file "$tmp"
    lsshm_tty_restore
    if [ ! -s "$tmp" ]; then
        dialog --backtitle "$LSSHM_LONG_NAME v$LSSHM_VERSION" \
            --title "$title" --msgbox "$(lsshm_t '(no output)')" 8 50
        return 0
    fi
    dialog --clear --backtitle "$LSSHM_LONG_NAME v$LSSHM_VERSION" \
        --title "$title" --programbox "$(lsshm_t 'Result')" 22 74 0 <"$tmp" \
        2>/dev/null || {
            local text; text="$(head -c 4000 "$tmp")"
            dialog --backtitle "$LSSHM_LONG_NAME v$LSSHM_VERSION" \
                --title "$title" --msgbox "$text" 22 74
        }
}

lsshm_ui_run() {
    local title="$1"; shift
    # Always return success: a cancelled/failed action must not exit the menu (set -e).
    if lsshm_uses_dialog_ui; then
        lsshm_ui_show "$title" "$@" || true
    else
        "$@" || true
        lsshm_pause
    fi
    return 0
}

# Offer to install dialog when missing.
lsshm_dialog_offer_install() {
    lsshm_out 'The terminal GUI requires the dialog package.'
    printf '\n'
    lsshm_out '1. Install dialog'
    lsshm_out '2. Continue with the CLI interface'
    lsshm_out '3. Cancel'
    printf '\n'
    local choice; choice="$(lsshm_prompt "$(lsshm_t 'Choice')" '2')"
    case "$choice" in
        1)
            lsshm_dialog_install
            if lsshm_dialog_available; then
                return 0
            fi
            lsshm_warn 'dialog could not be installed. Falling back to the CLI interface.'
            return 1
            ;;
        2) return 1 ;;
        *) exit 0 ;;
    esac
}

lsshm_dialog_install() {
    lsshm_require_root
    case "$LSSHM_PKG_MGR" in
        apt)    lsshm_run_privileged apt-get update && lsshm_run_privileged apt-get install -y dialog ;;
        apk)    lsshm_run_privileged apk add dialog ;;
        dnf)    lsshm_run_privileged dnf install -y dialog ;;
        yum)    lsshm_run_privileged yum install -y dialog ;;
        pacman) lsshm_run_privileged pacman -Sy --noconfirm dialog ;;
        zypper) lsshm_run_privileged zypper install -y dialog ;;
        *)      lsshm_error 'Unsupported package manager: %s' "$LSSHM_PKG_MGR" ;;
    esac
}

# Entry point for `lsshm ui`. Falls back to CLI when dialog is unavailable.
lsshm_dialog_main() {
    lsshm_require_interactive
    if ! lsshm_dialog_available; then
        if ! lsshm_dialog_offer_install; then
            lsshm_cli_main
            return
        fi
    fi
    LSSHM_UI_MODE=1
    export LSSHM_UI_MODE
    lsshm_init_colors
    # Preserve temp-file cleanup from main; do not replace it entirely.
    trap 'LSSHM_UI_MODE=0; lsshm_init_colors; lsshm_tty_restore; lsshm_cleanup' EXIT INT TERM
    lsshm_dialog_menu_loop
    LSSHM_UI_MODE=0
    lsshm_init_colors
    lsshm_tty_restore
    trap lsshm_cleanup EXIT INT TERM
}

lsshm_dialog_status_text() {
    lsshm_status_panel
}

lsshm_dialog_menu_loop() {
    while true; do
        local choice ret=0
        choice="$(lsshm_ui_menu "$(lsshm_t 'Main menu')" "$(lsshm_dialog_status_text)" \
            1 "$(lsshm_t 'Manage the local SSH server')" \
            2 "$(lsshm_t 'Manage access to this machine')" \
            3 "$(lsshm_t 'Manage my SSH keys')" \
            4 "$(lsshm_t 'Manage remote hosts')" \
            5 "$(lsshm_t 'View connections and logs')" \
            6 "$(lsshm_t 'Run a security audit')" \
            7 "$(lsshm_t 'Back up or restore')" \
            8 "$(lsshm_t 'LSSHM settings')" \
            9 "$(lsshm_t 'Quit')")" || ret=$?

        [ "$ret" -ne 0 ] && break
        case "$choice" in
            1) lsshm_menu_try lsshm_cli_server_menu ;;
            2) lsshm_menu_try lsshm_cli_access_menu ;;
            3) lsshm_menu_try lsshm_cli_keys_menu ;;
            4) lsshm_menu_try lsshm_cli_hosts_menu ;;
            5) lsshm_menu_try lsshm_logs_menu ;;
            6) lsshm_ui_run "$(lsshm_t 'Security audit')" lsshm_audit ;;
            7) lsshm_menu_try lsshm_backup_menu ;;
            8) lsshm_menu_try lsshm_settings_menu ;;
            9) break ;;
        esac
    done
    lsshm_tty_restore
}

# --- dialog sub-menus (used when LSSHM_UI_MODE=1) ---------------------------

lsshm_dialog_server_menu() {
    local body
    body="$(lsshm_server_status 2>/dev/null)"
    lsshm_ui_menu "$(lsshm_t 'Local SSH server')" "$body" \
        1 "$(lsshm_t 'Install OpenSSH Server')" \
        2 "$(lsshm_t 'Start the service')" \
        3 "$(lsshm_t 'Stop the service')" \
        4 "$(lsshm_t 'Restart the service')" \
        5 "$(lsshm_t 'Reload the service')" \
        6 "$(lsshm_t 'Enable at boot')" \
        7 "$(lsshm_t 'Disable at boot')" \
        8 "$(lsshm_t 'Change the port')" \
        9 "$(lsshm_t 'Address family (AddressFamily)')" \
        10 "$(lsshm_t 'Listen addresses (ListenAddress)')" \
        11 "$(lsshm_t 'Manage root access')" \
        12 "$(lsshm_t 'Password authentication')" \
        13 "$(lsshm_t 'Key authentication')" \
        14 "$(lsshm_t 'Allowed users (AllowUsers)')" \
        15 "$(lsshm_t 'Allowed groups (AllowGroups)')" \
        16 "$(lsshm_t 'Test the configuration (sshd -t)')" \
        17 "$(lsshm_t 'Show the effective configuration (sshd -T)')" \
        18 "$(lsshm_t 'View the logs')" \
        19 "$(lsshm_t 'Back')"
}

lsshm_dialog_access_menu() {
    local user="$1" body
    body="$(lsshm_t 'Access to this machine (keys allowed to connect HERE)')
$(lsshm_tf 'Target user: %s' "$user")"
    lsshm_ui_menu "$(lsshm_t 'Manage access to this machine')" "$body" \
        1 "$(lsshm_t 'List users')" \
        2 "$(lsshm_t 'List authorized keys')" \
        3 "$(lsshm_t 'Add a key (paste or import a .pub)')" \
        4 "$(lsshm_t 'Remove a key')" \
        5 "$(lsshm_t 'Disable / re-enable a key')" \
        6 "$(lsshm_t 'Repair ~/.ssh permissions')" \
        7 "$(lsshm_t 'Detect duplicates')" \
        8 "$(lsshm_t 'Change target user')" \
        9 "$(lsshm_t 'Back')"
}

lsshm_dialog_keys_menu() {
    lsshm_ui_menu "$(lsshm_t 'Manage my SSH keys')" "$(lsshm_tf 'SSH keys of %s (to connect ELSEWHERE)' "$LSSHM_CALLING_USER")" \
        1 "$(lsshm_t 'List key pairs')" \
        2 "$(lsshm_t 'Generate a new key (ED25519 by default)')" \
        3 "$(lsshm_t 'Inspect a key')" \
        4 "$(lsshm_t 'Show / export a public key')" \
        5 "$(lsshm_t 'Change the passphrase')" \
        6 "$(lsshm_t 'Delete a key pair')" \
        7 "$(lsshm_t 'ssh-agent: list')" \
        8 "$(lsshm_t 'ssh-agent: add a key')" \
        9 "$(lsshm_t 'ssh-agent: remove a key')" \
        10 "$(lsshm_t 'Change target user')" \
        11 "$(lsshm_t 'Back')"
}

lsshm_dialog_hosts_menu() {
    lsshm_ui_menu "$(lsshm_t 'Remote hosts')" "$(lsshm_t 'Remote hosts (~/.ssh/config) - optional')" \
        1 "$(lsshm_t 'List hosts')" \
        2 "$(lsshm_t 'Add a host')" \
        3 "$(lsshm_t 'Edit a host')" \
        4 "$(lsshm_t 'Delete a host')" \
        5 "$(lsshm_t 'Test a host (resolution, port, auth)')" \
        6 "$(lsshm_t 'Effective configuration (ssh -G)')" \
        7 "$(lsshm_t 'Connect to a host')" \
        8 "$(lsshm_t 'Copy a key (ssh-copy-id)')" \
        9 "$(lsshm_t 'Revoke a remote key')" \
        10 "$(lsshm_t 'known_hosts: list')" \
        11 "$(lsshm_t 'known_hosts: remove a fingerprint')" \
        12 "$(lsshm_t 'Back')"
}

lsshm_dialog_settings_menu() {
    lsshm_config_load
    local body
    body="$(lsshm_tf 'Managed user        : %s' "$LSSHM_CALLING_USER")
$(lsshm_tf 'Update check        : %s' "$LSSHM_CFG_UPDATE_CHECK")
$(lsshm_tf 'Update channel      : %s' "$LSSHM_CFG_UPDATE_CHANNEL")
$(lsshm_tf 'Language            : %s' "$(lsshm_lang_native_name "$LSSHM_LANG")")
$(lsshm_tf 'Configuration file  : %s' "$LSSHM_CONFIG_FILE")"
    lsshm_ui_menu "$(lsshm_t 'LSSHM settings')" "$body" \
        1 "$(lsshm_t 'Update check: always')" \
        2 "$(lsshm_t 'Update check: once a day')" \
        3 "$(lsshm_t 'Update check: never')" \
        4 "$(lsshm_t 'Check for updates now')" \
        5 "$(lsshm_t 'Show diagnostics (doctor)')" \
        6 "$(lsshm_t 'Change the language')" \
        7 "$(lsshm_t 'Change managed user')" \
        8 "$(lsshm_t 'Back')"
}

lsshm_dialog_logs_menu() {
    lsshm_ui_menu "$(lsshm_t 'Connections and logs')" "$(lsshm_t 'Consult SSH activity')" \
        1 "$(lsshm_t 'Active sessions')" \
        2 "$(lsshm_t 'Recent logins')" \
        3 "$(lsshm_t 'Failed attempts')" \
        4 "$(lsshm_t 'SSH service logs')" \
        5 "$(lsshm_t 'Back')"
}

lsshm_dialog_backup_menu() {
    lsshm_ui_menu "$(lsshm_t 'Backup and restore')" "$(lsshm_t 'Back up or restore the SSH configuration')" \
        1 "$(lsshm_t 'Back up the SSH server configuration')" \
        2 "$(lsshm_t 'Back up authorized keys (authorized_keys)')" \
        3 "$(lsshm_t 'List backups')" \
        4 "$(lsshm_t 'Restore a server configuration')" \
        5 "$(lsshm_t 'Back')"
}

# ===== src/main.sh =====================================================
# shellcheck shell=bash
# =============================================================================
# main.sh - entry point, argument parsing, command dispatch, install/uninstall
# =============================================================================

# Path to the running script (may be empty when piped from curl | bash).
lsshm_self_path() {
    local self="${BASH_SOURCE[0]:-$0}"
    if [ -f "$self" ]; then
        ( cd "$(dirname "$self")" 2>/dev/null && printf '%s/%s' "$(pwd)" "$(basename "$self")" )
    fi
}

lsshm_bootstrap() {
    lsshm_init_paths
    lsshm_init_colors
    lsshm_init_privileges
    lsshm_detect_platform
    lsshm_ensure_dirs
    lsshm_config_write_default
    lsshm_config_load
    lsshm_i18n_init
    trap lsshm_cleanup EXIT INT TERM
}

# ---------------------------------------------------------------------------
# Usage
# ---------------------------------------------------------------------------
lsshm_usage() {
    printf '%s v%s\n\n' "$LSSHM_LONG_NAME" "$LSSHM_VERSION"
    lsshm_out 'Usage:'
    printf '  lsshm                     %s\n' "$(lsshm_t 'Open the CLI menu')"
    printf '  lsshm ui | --ui           %s\n' "$(lsshm_t 'Open the dialog interface')"
    printf '  lsshm status              %s\n' "$(lsshm_t 'Show local SSH status')"
    printf '  lsshm doctor              %s\n' "$(lsshm_t 'Environment diagnostics')"
    printf '  lsshm audit               %s\n' "$(lsshm_t 'Security audit')"
    printf '  lsshm update [rollback]   %s\n' "$(lsshm_t 'Update LSSHM (or roll back)')"
    printf '  lsshm install             %s\n' "$(lsshm_t 'Install LSSHM into ~/.local')"
    printf '  lsshm uninstall           %s\n' "$(lsshm_t 'Uninstall LSSHM')"
    printf '  lsshm version             %s\n' "$(lsshm_t 'Show the version')"
    printf '  lsshm help                %s\n' "$(lsshm_t 'Show this help')"
    printf '\n'
    lsshm_out 'Global options:'
    printf '  --user NAME               %s\n' "$(lsshm_t "Manage NAME's SSH files (access, keys, hosts)")"
    printf '  --lang CODE               %s\n' "$(lsshm_tf 'Interface language (%s)' "$LSSHM_LANGS")"
    printf '  --ui                      %s\n' "$(lsshm_t 'Force the dialog interface')"
    printf '  -y, --yes                 %s\n' "$(lsshm_t 'Answer yes automatically (non-interactive)')"
    printf '  --no-color                %s\n' "$(lsshm_t 'Disable color')"
    printf '  -V, --version             %s\n' "$(lsshm_t 'Show the version')"
    printf '  -h, --help                %s\n' "$(lsshm_t 'Show this help')"
    printf '\n'
    lsshm_out 'Local SSH server:'
    printf '  lsshm server status|install|start|stop|restart|reload|enable|disable\n'
    printf '  lsshm server config|test|logs\n'
    printf '\n'
    lsshm_out 'Incoming access (keys allowed HERE):'
    printf '  lsshm access list [--user U]\n'
    printf '  lsshm access add [--user U]\n'
    printf '  lsshm access remove [--user U]\n'
    printf '  lsshm access disable [--user U]\n'
    printf '  lsshm access repair [--user U]\n'
    printf '\n'
    lsshm_out 'Local keys (to connect ELSEWHERE):'
    printf '  lsshm key list|generate\n'
    printf '  lsshm key inspect PATH\n'
    printf '  lsshm key export PATH\n'
    printf '  lsshm key delete PATH\n'
    printf '  lsshm key agent list|add PATH|remove PATH\n'
    printf '\n'
    lsshm_out 'Remote hosts:'
    printf '  lsshm host list|add\n'
    printf '  lsshm host edit|delete|test|connect|copy-key|revoke-key NAME\n'
}

# ---------------------------------------------------------------------------
# Installation / uninstallation
# ---------------------------------------------------------------------------
lsshm_path_in_file() {
    local file="$1"
    [ -f "$file" ] && grep -q '.local/bin' "$file" 2>/dev/null
}

lsshm_path_export_line() {
    printf '# Added by LSSHM\nexport PATH="$HOME/.local/bin:$PATH"\n'
}

lsshm_path_is_set() {
    case ":$PATH:" in
        *":$LSSHM_BIN_DIR:"*) return 0 ;;
    esac
    return 1
}

lsshm_path_activate_session() {
    if lsshm_path_is_set; then
        return 0
    fi
    export PATH="$LSSHM_BIN_DIR:$PATH"
    lsshm_ok 'PATH activated for this session.'
}

# Persist ~/.local/bin in the user profile and activate it in the current shell.
# No interactive confirm: called automatically after a successful install.
lsshm_ensure_path() {
    local profile="$LSSHM_HOME/.profile"
    local bashrc="$LSSHM_HOME/.bashrc"
    local wrote=0

    if ! lsshm_path_in_file "$profile"; then
        lsshm_path_export_line >>"$profile"
        wrote=1
        lsshm_ok 'PATH configured in %s for future logins.' "$profile"
    fi

    # Root interactive shell (Debian, Proxmox): ~/.bashrc is often read each session.
    if [ -f "$bashrc" ] && ! lsshm_path_in_file "$bashrc"; then
        lsshm_path_export_line >>"$bashrc"
        wrote=1
        lsshm_ok 'Also added to %s (interactive shell).' "$bashrc"
    fi

    if [ "$wrote" = "0" ] && lsshm_path_in_file "$profile"; then
        lsshm_ok 'PATH already configured in %s.' "$profile"
    fi

    lsshm_path_activate_session
}

# Legacy interactive helper (kept for callers that still ask). Prefer lsshm_ensure_path.
lsshm_check_path() {
    lsshm_path_is_set && return 0
    lsshm_ensure_path
}

lsshm_install() {
    lsshm_header

    # Ask which language to use (preselecting the detected system language) and
    # store the choice so it persists for future runs.
    if lsshm_is_interactive; then
        lsshm_i18n_choose
    fi

    lsshm_info 'Installing LSSHM into the user directory...'
    lsshm_ensure_dirs
    mkdir -p "$LSSHM_DATA_DIR" "$LSSHM_BIN_DIR"

    local self; self="$(lsshm_self_path)"
    if [ -n "$self" ] && [ -f "$self" ]; then
        install -m 0755 "$self" "$LSSHM_INSTALL_TARGET"
    else
        lsshm_info 'Downloading lsshm.sh from the repository...'
        local tmp; tmp="$(lsshm_mktemp)"
        lsshm_download "$LSSHM_REPO_RAW/lsshm.sh" "$tmp" || lsshm_die 'Download failed.'
        bash -n "$tmp" || lsshm_die 'The downloaded script is invalid.'
        lsshm_update_verify_checksum "$tmp" || lsshm_die 'SHA-256 verification failed: installation aborted.'
        install -m 0755 "$tmp" "$LSSHM_INSTALL_TARGET"
    fi

    ln -sf "$LSSHM_INSTALL_TARGET" "$LSSHM_BIN_LINK"
    lsshm_ok 'Installed:'
    printf '  %s\n' "$LSSHM_INSTALL_TARGET"
    printf '  %s -> %s\n' "$LSSHM_BIN_LINK" "$LSSHM_INSTALL_TARGET"

    lsshm_config_write_default
    lsshm_ensure_path
    lsshm_ok 'Installation complete.'
    lsshm_ok 'Run: lsshm'
    lsshm_note 'PATH was updated for future sessions; open a new terminal if the command is not found.'
}

lsshm_uninstall() {
    lsshm_header
    lsshm_warn 'Uninstalling LSSHM.'
    lsshm_confirm "$(lsshm_t 'Continue?')" no || { lsshm_info 'Cancelled.'; return 0; }

    rm -f "$LSSHM_BIN_LINK"
    rm -f "$LSSHM_INSTALL_TARGET" "$LSSHM_INSTALL_TARGET.prev"
    rmdir "$LSSHM_DATA_DIR" 2>/dev/null || true
    lsshm_ok 'Binary and link removed.'

    if lsshm_confirm "$(lsshm_tf 'Also remove configuration and state (%s, %s)?' "$LSSHM_CONFIG_DIR" "$LSSHM_STATE_DIR")" no; then
        rm -rf "$LSSHM_CONFIG_DIR" "$LSSHM_STATE_DIR" "$LSSHM_CACHE_DIR"
        lsshm_ok 'Configuration and state removed.'
    else
        lsshm_info 'Configuration kept: %s' "$LSSHM_CONFIG_DIR"
    fi
    lsshm_info 'Note: LSSHM does not modify your SSH configuration on uninstall.'
    lsshm_info 'Remember to remove the PATH line from ~/.profile if necessary.'
}

# ---------------------------------------------------------------------------
# Sub-command dispatchers
# ---------------------------------------------------------------------------
lsshm_cmd_server() {
    local sub="${1:-status}"; shift || true
    case "$sub" in
        status)  lsshm_server_status ;;
        install) lsshm_server_install ;;
        start)   lsshm_server_start ;;
        stop)    lsshm_server_stop ;;
        restart) lsshm_server_restart ;;
        reload)  lsshm_server_reload ;;
        enable)  lsshm_server_enable ;;
        disable) lsshm_server_disable ;;
        config)  lsshm_server_config_show ;;
        test)    lsshm_server_config_test && lsshm_ok 'Configuration valid.' ;;
        logs)    lsshm_server_logs "${1:-40}" ;;
        *) lsshm_error 'Unknown server subcommand: %s' "$sub"; return 1 ;;
    esac
}

lsshm_cmd_access() {
    local sub="${1:-list}"; shift || true
    local user="$LSSHM_CALLING_USER" rest=()
    while [ $# -gt 0 ]; do
        case "$1" in
            --user) user="${2:-}"; shift 2 || shift ;;
            --user=*) user="${1#*=}"; shift ;;
            *) rest+=("$1"); shift ;;
        esac
    done
    set -- "${rest[@]}"
    case "$sub" in
        list)    lsshm_access_list "$user" ;;
        add)     lsshm_access_add "$user" "${1:-}" ;;
        remove)  lsshm_access_remove "$user" "${1:-}" ;;
        disable) lsshm_access_disable "$user" "${1:-}" ;;
        repair)  lsshm_access_repair "$user" ;;
        *) lsshm_error 'Unknown access subcommand: %s' "$sub"; return 1 ;;
    esac
}

lsshm_cmd_key() {
    local sub="${1:-list}"; shift || true
    case "$sub" in
        list)     lsshm_keys_list ;;
        generate) lsshm_keys_generate ;;
        inspect)  lsshm_keys_inspect "${1:-}" ;;
        export)   lsshm_keys_export "${1:-}" ;;
        delete)   lsshm_keys_delete "${1:-}" ;;
        agent)
            local asub="${1:-list}"; shift || true
            case "$asub" in
                list)   lsshm_agent_list ;;
                add)    lsshm_agent_add "${1:-}" ;;
                remove) lsshm_agent_remove "${1:-}" ;;
                *) lsshm_error 'Unknown agent subcommand: %s' "$asub"; return 1 ;;
            esac
            ;;
        *) lsshm_error 'Unknown key subcommand: %s' "$sub"; return 1 ;;
    esac
}

lsshm_cmd_host() {
    local sub="${1:-list}"; shift || true
    case "$sub" in
        list)      lsshm_hosts_list ;;
        add)       lsshm_hosts_add ;;
        edit)      lsshm_hosts_edit "${1:-}" ;;
        delete)    lsshm_hosts_delete "${1:-}" ;;
        test)      lsshm_hosts_test "${1:-}" ;;
        connect)   lsshm_hosts_connect "${1:-}" ;;
        copy-key)  lsshm_hosts_copy_key "${1:-}" ;;
        revoke-key) lsshm_hosts_revoke_key "${1:-}" ;;
        *) lsshm_error 'Unknown host subcommand: %s' "$sub"; return 1 ;;
    esac
}

# ---------------------------------------------------------------------------
# Main
# ---------------------------------------------------------------------------
lsshm_main() {
    # Parse global options; collect the remaining positional arguments.
    local args=() force_ui=0
    while [ $# -gt 0 ]; do
        case "$1" in
            --user) LSSHM_TARGET_USER="${2:-}"; shift 2 || shift ;;
            --user=*) LSSHM_TARGET_USER="${1#*=}"; shift ;;
            --lang|--language) LSSHM_LANG_OVERRIDE="${2:-}"; shift 2 || shift ;;
            --lang=*|--language=*) LSSHM_LANG_OVERRIDE="${1#*=}"; shift ;;
            --ui) force_ui=1; shift ;;
            -y|--yes) LSSHM_ASSUME_YES=1; shift ;;
            --no-color) LSSHM_NO_COLOR=1; shift ;;
            -V|--version) args+=("version"); shift ;;
            -h|--help) args+=("help"); shift ;;
            --) shift; while [ $# -gt 0 ]; do args+=("$1"); shift; done ;;
            *) args+=("$1"); shift ;;
        esac
    done

    lsshm_bootstrap
    # Re-init colors in case --no-color was set after init.
    lsshm_init_colors

    local cmd="${args[0]:-menu}"
    if [ "$force_ui" = "1" ]; then
        cmd="ui"
    fi

    # Target-user prompt is only for personal SSH file management — never for
    # install/uninstall/update/help/version (or server-only ops).
    case "$cmd" in
        install|uninstall|update|version|help|--help|-h|server) ;;
        *) lsshm_resolve_target_user ;;
    esac

    # First interactive run without a stored language: offer to choose one
    # (preselecting the detected system language) and remember it.
    # Skip when --lang already forced a language for this invocation.
    case "$cmd" in
        menu|ui)
            if ! lsshm_i18n_configured \
                && [ -z "${LSSHM_LANG_OVERRIDE:-}" ] \
                && lsshm_is_interactive; then
                lsshm_i18n_choose
            fi
            ;;
    esac

    case "$cmd" in
        menu)
            lsshm_update_check || true
            lsshm_cli_main
            ;;
        ui) lsshm_dialog_main ;;
        status) lsshm_status_panel ;;
        doctor) lsshm_doctor ;;
        audit) lsshm_audit ;;
        update)
            case "${args[1]:-}" in
                rollback) lsshm_update_rollback ;;
                *) lsshm_update_run ;;
            esac
            ;;
        install) lsshm_install ;;
        uninstall) lsshm_uninstall ;;
        server) lsshm_cmd_server "${args[@]:1}" ;;
        access) lsshm_cmd_access "${args[@]:1}" ;;
        key)    lsshm_cmd_key "${args[@]:1}" ;;
        host)   lsshm_cmd_host "${args[@]:1}" ;;
        version) printf '%s v%s\n' "$LSSHM_NAME" "$LSSHM_VERSION" ;;
        help|--help|-h) lsshm_usage ;;
        *)
            lsshm_error 'Unknown command: %s' "$cmd"
            lsshm_usage
            return 1
            ;;
    esac
}

# ===== entry point ===========================================================
lsshm_main "$@"