menu.func

#!/usr/bin/env bash
# Copyright (c) 2021-2026 community-scripts ORG
# License: MIT | https://raw.githubusercontent.com/community-scripts/core/main/LICENSE

# ==============================================================================
# BUILD-UI/MENU.FUNC - MENUS, DIAGNOSTICS AND ENTRY POINTS
# ==============================================================================
# Part of the build UI. Load ui/build-ui.func -- it sources every part --
# rather than this file directly; the split is for maintenance only and no
# function name or behaviour changed with it.
# ==============================================================================

[[ -n "${_BUILD_UI_MENU_LOADED:-}" ]] && return 0
_BUILD_UI_MENU_LOADED=1

# ==============================================================================
# SECTION 7: USER INTERFACE & DIAGNOSTICS
# ==============================================================================

# ------------------------------------------------------------------------------
# diagnostics_check()
#
# - Ensures diagnostics config file exists at /usr/local/community-scripts/diagnostics
# - Asks user whether to send anonymous diagnostic data
# - Saves DIAGNOSTICS=yes/no in the config file
# - Creates file if missing with default DIAGNOSTICS=yes
# - Reads current diagnostics setting from file
# - Sets global DIAGNOSTICS variable for API telemetry opt-in/out
# ------------------------------------------------------------------------------
diagnostics_check() {
  local _cs_dir _diag_file
  _cs_dir="$(declare -f community_scripts_dir >/dev/null 2>&1 && community_scripts_dir || echo /usr/local/community-scripts)"
  _diag_file="${_cs_dir}/diagnostics"
  if ! [ -d "$_cs_dir" ]; then
    mkdir -p "$_cs_dir"
  fi

  if ! [ -f "$_diag_file" ]; then
    if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "DIAGNOSTICS" --yesno "Send Diagnostics of LXC Installation?\n\n(This only transmits data without user data, just RAM, CPU, LXC name, ...)" 10 58); then
      cat <<EOF >"$_diag_file"
DIAGNOSTICS=yes

#This file is used to store the diagnostics settings for the Community-Scripts API.
#https://git.community-scripts.org/community-scripts/ProxmoxVED/discussions/1836
#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
#You can review the data at https://community-scripts.github.io/ProxmoxVED/data
#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in ${_diag_file}, or use the menue.
#This will disable the diagnostics feature.
#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in ${_diag_file}, or use the menue.
#This will enable the diagnostics feature.
#The following information will be sent:
#"disk_size"
#"core_count"
#"ram_size"
#"os_type"
#"os_version"
#"nsapp"
#"method"
#"pve_version"
#"status"
#If you have any concerns, please review the source code at core/core/build.func
EOF
      DIAGNOSTICS="yes"
    else
      cat <<EOF >"$_diag_file"
DIAGNOSTICS=no

#This file is used to store the diagnostics settings for the Community-Scripts API.
#https://git.community-scripts.org/community-scripts/ProxmoxVED/discussions/1836
#Your diagnostics will be sent to the Community-Scripts API for troubleshooting/statistical purposes.
#You can review the data at https://community-scripts.github.io/ProxmoxVED/data
#If you do not wish to send diagnostics, please set the variable 'DIAGNOSTICS' to "no" in ${_diag_file}, or use the menue.
#This will disable the diagnostics feature.
#To send diagnostics, set the variable 'DIAGNOSTICS' to "yes" in ${_diag_file}, or use the menue.
#This will enable the diagnostics feature.
#The following information will be sent:
#"disk_size"
#"core_count"
#"ram_size"
#"os_type"
#"os_version"
#"nsapp"
#"method"
#"pve_version"
#"status"
#If you have any concerns, please review the source code at core/core/build.func
EOF
      DIAGNOSTICS="no"
    fi
  else
    DIAGNOSTICS=$(awk -F '=' '/^DIAGNOSTICS/ {print $2}' "$_diag_file")

  fi
}

diagnostics_menu() {
  local _diag_file
  _diag_file="$(declare -f community_scripts_dir >/dev/null 2>&1 && community_scripts_dir || echo /usr/local/community-scripts)/diagnostics"
  if [ "${DIAGNOSTICS:-no}" = "yes" ]; then
    if whiptail --backtitle "Proxmox VE Helper Scripts" \
      --title "DIAGNOSTIC SETTINGS" \
      --yesno "Send Diagnostics?\n\nCurrent: ${DIAGNOSTICS}" 10 58 \
      --yes-button "No" --no-button "Back"; then
      DIAGNOSTICS="no"
      sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=no/' "$_diag_file"
      whiptail --msgbox "Diagnostics set to ${DIAGNOSTICS}." 8 58
    fi
  else
    if whiptail --backtitle "Proxmox VE Helper Scripts" \
      --title "DIAGNOSTIC SETTINGS" \
      --yesno "Send Diagnostics?\n\nCurrent: ${DIAGNOSTICS}" 10 58 \
      --yes-button "Yes" --no-button "Back"; then
      DIAGNOSTICS="yes"
      sed -i 's/^DIAGNOSTICS=.*/DIAGNOSTICS=yes/' "$_diag_file"
      whiptail --msgbox "Diagnostics set to ${DIAGNOSTICS}." 8 58
    fi
  fi
}

# ------------------------------------------------------------------------------
# echo_default()
#
# - Prints summary of default values (ID, OS, type, disk, RAM, CPU, etc.)
# - Uses icons and formatting for readability
# - Convert CT_TYPE to description
# ------------------------------------------------------------------------------
echo_default() {
  CT_TYPE_DESC="Unprivileged"
  if [ "$CT_TYPE" -eq 0 ]; then
    CT_TYPE_DESC="Privileged"
  fi
  echo -e "${INFO}${BOLD}${DGN}PVE Version ${PVEVERSION} (Kernel: ${KERNEL_VERSION})${CL}"
  echo -e "${CONTAINERID}${BOLD}${DGN}Container ID: ${BGN}${CT_ID}${CL}"
  echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}$var_os ($var_version)${CL}"
  echo -e "${CONTAINERTYPE}${BOLD}${DGN}Container Type: ${BGN}$CT_TYPE_DESC${CL}"
  echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE} GB${CL}"
  echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
  echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE} MiB${CL}"
  if [[ "$(dpkg --print-architecture)" == "arm64" ]]; then
    echo -e "${INFO}${BOLD}${DGN}Architecture: ${BGN}arm64${CL}"
  fi
  if [[ -n "${var_gpu:-}" && "${var_gpu}" == "yes" ]]; then
    echo -e "${GPU}${BOLD}${DGN}GPU Passthrough: ${BGN}Enabled${CL}"
  fi
  if [ "$VERBOSE" == "yes" ]; then
    echo -e "${SEARCH}${BOLD}${DGN}Verbose Mode: ${BGN}Enabled${CL}"
  fi
  echo -e "${CREATING}${BOLD}${BL}Creating a ${APP} LXC using the above default settings${CL}"
  echo -e "  "

  # Log settings to file
  log_section "CONTAINER SETTINGS - ${APP}"
  log_msg "Application: ${APP}"
  log_msg "PVE Version: ${PVEVERSION} (Kernel: ${KERNEL_VERSION})"
  log_msg "Container ID: ${CT_ID}"
  log_msg "Operating System: $var_os ($var_version)"
  log_msg "Container Type: $CT_TYPE_DESC"
  log_msg "Disk Size: ${DISK_SIZE} GB"
  log_msg "CPU Cores: ${CORE_COUNT}"
  log_msg "RAM Size: ${RAM_SIZE} MiB"
  [[ -n "${var_gpu:-}" && "${var_gpu}" == "yes" ]] && log_msg "GPU Passthrough: Enabled"
  [[ "$VERBOSE" == "yes" ]] && log_msg "Verbose Mode: Enabled"
  log_msg "Session ID: ${SESSION_ID}"
}

# ------------------------------------------------------------------------------
# install_script()
#
# - Main entrypoint for installation mode
# - Runs safety checks (pve_check, root_check, diagnostics_check, run_preflight)
# - Builds interactive menu (Default, Verbose, Advanced, My Defaults, App Defaults, Diagnostics, Storage, Exit)
# - Applies chosen settings and triggers container build
# ------------------------------------------------------------------------------
install_script() {
  # pvesh spawns a Perl client and waits on pvedaemon — the slowest thing here
  # by far, and it needs nothing the checks below produce. Start it now and
  # collect it when it is actually needed, so it runs while they do.
  local _nextid_file="" _nextid_pid=""
  if ! declare -f get_next_container_identifier &>/dev/null && command -v pvesh &>/dev/null; then
    _nextid_file="$(mktemp 2>/dev/null)" || _nextid_file=""
    if [[ -n "$_nextid_file" ]]; then
      pvesh get /cluster/nextid >"$_nextid_file" 2>/dev/null &
      _nextid_pid=$!
    fi
  fi

  pve_check
  shell_check
  root_check
  ensure_whiptail
  arch_check
  arm64_notice
  ssh_check
  maxkeys_check
  diagnostics_check

  if systemctl is-active -q ping-instances.service; then
    systemctl -q stop ping-instances.service
  fi

  if declare -f get_next_container_identifier &>/dev/null; then
    NEXTID="$(get_next_container_identifier)"
  elif [[ -n "$_nextid_pid" ]]; then
    wait "$_nextid_pid" 2>/dev/null || true
    NEXTID="$(tr -d '[:space:]' <"$_nextid_file" 2>/dev/null)"
    rm -f "$_nextid_file"
    # A backgrounded call that came back empty is not a reason to continue with
    # an empty CTID; ask again in the foreground so the error is the real one.
    [[ -z "$NEXTID" ]] && NEXTID=$(pvesh get /cluster/nextid)
  else
    NEXTID=$(pvesh get /cluster/nextid)
  fi

  # Get timezone using timedatectl (Debian 13+ compatible)
  # Fallback to /etc/timezone for older systems
  if command -v timedatectl >/dev/null 2>&1; then
    timezone=$(timedatectl show --value --property=Timezone 2>/dev/null || echo "UTC")
  elif [ -f /etc/timezone ]; then
    timezone=$(cat /etc/timezone)
  else
    timezone="UTC"
  fi
  [[ "${timezone:-}" == Etc/* ]] && timezone="host" # pct doesn't accept Etc/* zones

  # dev_mode set without naming flags means "ask": the picker comes before the
  # install menu rather than being buried in Settings, and the palette turns
  # red as soon as something is selected.
  if [[ "${_DEV_MODE_ASK:-0}" == "1" ]] && declare -f dev_mode_menu >/dev/null 2>&1; then
    dev_mode_menu
    color
  fi

  # Show APP Header + run preflight checks
  header_info
  run_preflight

  # --- Support CLI argument as direct preset (default, advanced, …) ---
  CHOICE="${mode:-${1:-}}"

  # If no CLI argument → show whiptail menu
  # Build menu dynamically based on available options
  local appdefaults_option=""
  local settings_option=""
  local menu_items=(
    "1" "Default Install"
    "2" "Advanced Install"
    "3" "User Defaults"
  )

  if [ -f "$(get_app_defaults_path)" ]; then
    appdefaults_option="4"
    menu_items+=("4" "App Defaults for ${APP}")
    settings_option="5"
    menu_items+=("5" "Settings")
  else
    settings_option="4"
    menu_items+=("4" "Settings")
  fi

  APPDEFAULTS_OPTION="$appdefaults_option"
  SETTINGS_OPTION="$settings_option"

  # Main menu loop - allows returning from Settings
  while true; do
    if [ -z "$CHOICE" ]; then
      TMP_CHOICE=$(whiptail \
        --backtitle "Proxmox VE Helper Scripts" \
        --title "Community-Scripts Options" \
        --ok-button "Select" --cancel-button "Exit Script" \
        --notags \
        --menu "\nChoose an option:\n Use TAB or Arrow keys to navigate, ENTER to select.\n" \
        20 60 9 \
        "${menu_items[@]}" \
        --default-item "1" \
        3>&1 1>&2 2>&3) || exit_script
      CHOICE="$TMP_CHOICE"
    fi

    # --- Main case ---
    local defaults_target=""
    local run_maybe_offer="no"
    case "$CHOICE" in
    1 | default | DEFAULT)
      header_info
      echo -e "${DEFAULT}${BOLD}${BL}Using Default Settings on node $PVEHOST_NAME${CL}"
      VERBOSE="no"
      METHOD="default"
      base_settings "$VERBOSE"
      echo_default
      defaults_target="$(ensure_global_default_vars_file)"
      break
      ;;
    2 | advanced | ADVANCED)
      header_info
      echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Install on node $PVEHOST_NAME${CL}"
      METHOD="advanced"
      base_settings
      advanced_settings
      defaults_target="$(ensure_global_default_vars_file)"
      run_maybe_offer="yes"
      break
      ;;
    3 | mydefaults | MYDEFAULTS | userdefaults | USERDEFAULTS)
      default_var_settings || {
        msg_error "Failed to apply default.vars"
        exit 1
      }
      defaults_target="$(declare -f community_scripts_dir >/dev/null 2>&1 && community_scripts_dir || echo /usr/local/community-scripts)/default.vars"
      break
      ;;
    "$APPDEFAULTS_OPTION" | appdefaults | APPDEFAULTS)
      if [ -f "$(get_app_defaults_path)" ]; then
        header_info
        echo -e "${DEFAULT}${BOLD}${BL}Using App Defaults for ${APP} on node $PVEHOST_NAME${CL}"
        METHOD="appdefaults"
        load_vars_file "$(get_app_defaults_path)" "yes" # Force override script defaults
        base_settings
        echo_default
        defaults_target="$(get_app_defaults_path)"
        break
      else
        msg_error "No App Defaults available for ${APP}"
        exit 1
      fi
      ;;
    "$SETTINGS_OPTION" | settings | SETTINGS)
      settings_menu
      # After settings menu, show main menu again
      header_info
      CHOICE=""
      ;;
    "$GENERATED_OPTION" | generated | GENERATED)
      header_info
      echo -e "${DEFAULT}${BOLD}${BL}Using Generated Settings on node $PVEHOST_NAME${CL}"
      VERBOSE="no"
      METHOD="generated"
      base_settings "$VERBOSE"
      echo_default
      break
      ;;
    *)
      echo -e "${CROSS}${RD}Invalid option: $CHOICE${CL}"
      exit 1
      ;;
    esac
  done

  if [[ -n "$defaults_target" ]]; then
    ensure_storage_selection_for_vars_file "$defaults_target"
  fi

  if [[ "$run_maybe_offer" == "yes" ]]; then
    maybe_offer_save_app_defaults
  fi
}

edit_default_storage() {
  local vf
  vf="$(declare -f community_scripts_dir >/dev/null 2>&1 && community_scripts_dir || echo /usr/local/community-scripts)/default.vars"

  # Ensure file exists
  if [[ ! -f "$vf" ]]; then
    mkdir -p "$(dirname "$vf")" 2>/dev/null || true
    touch "$vf" 2>/dev/null || true
  fi

  # Let ensure_storage_selection_for_vars_file handle everything
  ensure_storage_selection_for_vars_file "$vf"
}

settings_menu() {
  while true; do
    local settings_items=(
      "1" "Manage API-Diagnostic Setting"
      "2" "Edit Default.vars"
      "3" "Configure dev mode"
    )
    if [ -f "$(get_app_defaults_path)" ]; then
      settings_items+=("4" "Edit App.vars for ${APP}")
      settings_items+=("5" "Back to Main Menu")
    else
      settings_items+=("4" "Back to Main Menu")
    fi

    local choice
    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" \
      --title "Community-Scripts SETTINGS Menu" \
      --ok-button "Select" --cancel-button "Exit Script" \
      --menu "\n\nChoose a settings option:\n\nUse Arrow keys to navigate, ENTER to select, TAB for buttons." 20 60 9 \
      "${settings_items[@]}" \
      3>&1 1>&2 2>&3) || exit_script

    case "$choice" in
    1) diagnostics_menu ;;
    2) nano "$(declare -f community_scripts_dir >/dev/null 2>&1 && community_scripts_dir || echo /usr/local/community-scripts)/default.vars" ;;
    3) dev_mode_menu ;;
    4)
      if [ -f "$(get_app_defaults_path)" ]; then
        nano "$(get_app_defaults_path)"
      else
        # Back was selected (no app.vars available)
        return
      fi
      ;;
    5)
      # Back to main menu
      return
      ;;
    esac
  done
}

# ------------------------------------------------------------------------------
# check_container_resources()
#
# - Compares host RAM/CPU with required values
# - Warns if under-provisioned and asks user to continue or abort
# ------------------------------------------------------------------------------
check_container_resources() {
  current_ram=$(free -m | awk 'NR==2{print $2}')
  current_cpu=$(nproc)

  if [[ "$current_ram" -lt "$var_ram" ]] || [[ "$current_cpu" -lt "$var_cpu" ]]; then
    echo -e "\n${INFO}${HOLD} ${GN}Required: ${var_cpu} CPU, ${var_ram}MB RAM ${CL}| ${RD}Current: ${current_cpu} CPU, ${current_ram}MB RAM${CL}"
    echo -e "${YWB}Please ensure that the ${APP} LXC is configured with at least ${var_cpu} vCPU and ${var_ram} MB RAM for the build process.${CL}\n"
    echo -ne "${INFO}${HOLD} May cause data loss! ${INFO} Continue update with under-provisioned LXC? <yes/No>  "
    read -r prompt </dev/tty
    if [[ ! ${prompt,,} =~ ^(yes)$ ]]; then
      echo -e "${CROSS}${HOLD} ${YWB}Exiting based on user input.${CL}"
      exit 1
    fi
  else
    echo -e ""
  fi
}

# ------------------------------------------------------------------------------
# check_container_storage()
#
# - Checks root (/) partition usage
# - Warns if usage >80% and asks user confirmation before proceeding
# ------------------------------------------------------------------------------
check_container_storage() {
  usage=$(df / -P | awk 'NR==2 {print $5}' | tr -d '%')

  if [ -z "$usage" ] || [ "$usage" -lt 0 ]; then
    echo -e "${CROSS}${HOLD}${RD}Error: Failed to check disk usage.${CL}"
    exit 1
  fi

  if [ "$usage" -gt 80 ]; then
    echo -e "${INFO}${HOLD}${YWB}Warning: Storage is dangerously low (${usage}%).${CL}"
    printf "Continue anyway? <y/N>  "
    read -r prompt </dev/tty

    case "$prompt" in
    [yY][eE][sS] | [yY]) ;;
    *)
      echo -e "${CROSS}${HOLD}${YWB}Exiting based on user input.${CL}"
      exit 1
      ;;
    esac
  fi
}

# ------------------------------------------------------------------------------
# ssh_extract_keys_from_file()
#
# - Extracts valid SSH public keys from given file
# - Supports RSA, Ed25519, ECDSA and filters out comments/invalid lines
# ------------------------------------------------------------------------------
ssh_extract_keys_from_file() {
  local f="$1"
  [[ -r "$f" ]] || return 0
  tr -d '\r' <"$f" | awk '
    /^[[:space:]]*#/ {next}
    /^[[:space:]]*$/ {next}
    # bare format: type base64 [comment]
    /^(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))[[:space:]]+/ {print; next}
    # with options: find from first key-type onward
    {
      match($0, /(ssh-(rsa|ed25519)|ecdsa-sha2-nistp256|sk-(ssh-ed25519|ecdsa-sha2-nistp256))[[:space:]]+/)
      if (RSTART>0) { print substr($0, RSTART) }
    }
  '
}

# ------------------------------------------------------------------------------
# ssh_build_choices_from_files()
#
# - Builds interactive whiptail checklist of available SSH keys
# - Generates fingerprint, type and comment for each key
# ------------------------------------------------------------------------------
ssh_build_choices_from_files() {
  local -a files=("$@")
  CHOICES=()
  COUNT=0
  MAPFILE="$(mktemp)"
  local id key typ fp cmt base ln=0

  for f in "${files[@]}"; do
    [[ -f "$f" && -r "$f" ]] || continue
    base="$(basename -- "$f")"
    case "$base" in
    known_hosts | known_hosts.* | config) continue ;;
    id_*) [[ "$f" != *.pub ]] && continue ;;
    esac

    # map every key in file
    while IFS= read -r key; do
      [[ -n "$key" ]] || continue

      typ=""
      fp=""
      cmt=""
      # Only the pure key part (without options) is already included in ‘key’.
      read -r _typ _b64 _cmt <<<"$key"
      typ="${_typ:-key}"
      cmt="${_cmt:-}"
      # Fingerprint via ssh-keygen (if available)
      if command -v ssh-keygen >/dev/null 2>&1; then
        fp="$(printf '%s\n' "$key" | ssh-keygen -lf - 2>/dev/null | awk '{print $2}')"
      fi
      # Label shorten
      [[ ${#cmt} -gt 40 ]] && cmt="${cmt:0:37}..."

      ln=$((ln + 1))
      COUNT=$((COUNT + 1))
      id="K${COUNT}"
      echo "${id}|${key}" >>"$MAPFILE"
      CHOICES+=("$id" "[$typ] ${fp:+$fp }${cmt:+$cmt }— ${base}" "OFF")
    done < <(ssh_extract_keys_from_file "$f")
  done
}

# ------------------------------------------------------------------------------
# ssh_discover_default_files()
#
# - Scans standard paths for SSH keys
# - Includes ~/.ssh/*.pub, /etc/ssh/authorized_keys, etc.
# ------------------------------------------------------------------------------
ssh_discover_default_files() {
  local -a cand=()
  shopt -s nullglob
  cand+=(/root/.ssh/authorized_keys /root/.ssh/authorized_keys2)
  cand+=(/root/.ssh/*.pub)
  cand+=(/etc/ssh/authorized_keys /etc/ssh/authorized_keys.d/*)
  shopt -u nullglob
  printf '%s\0' "${cand[@]}"
}

configure_ssh_settings() {
  local step_info="${1:-}"
  local backtitle="Proxmox VE Helper Scripts"
  [[ -n "$step_info" ]] && backtitle="Proxmox VE Helper Scripts [${step_info}]"

  SSH_KEYS_FILE="$(mktemp)"
  : >"$SSH_KEYS_FILE"

  IFS=$'\0' read -r -d '' -a _def_files < <(ssh_discover_default_files && printf '\0')
  ssh_build_choices_from_files "${_def_files[@]}"
  local default_key_count="$COUNT"

  local ssh_key_mode
  if [[ "$default_key_count" -gt 0 ]]; then
    ssh_key_mode=$(whiptail --backtitle "$backtitle" --title "SSH KEY SOURCE" --menu \
      "Provision SSH keys for root:" 14 72 4 \
      "found" "Select from detected keys (${default_key_count})" \
      "manual" "Paste a single public key" \
      "folder" "Scan another folder (path or glob)" \
      "none" "No keys" 3>&1 1>&2 2>&3) || exit_script
  else
    ssh_key_mode=$(whiptail --backtitle "$backtitle" --title "SSH KEY SOURCE" --menu \
      "No host keys detected; choose manual/none:" 12 72 2 \
      "manual" "Paste a single public key" \
      "none" "No keys" 3>&1 1>&2 2>&3) || exit_script
  fi

  case "$ssh_key_mode" in
  found)
    local selection
    selection=$(whiptail --backtitle "$backtitle" --title "SELECT HOST KEYS" \
      --checklist "Select one or more keys to import:" 20 140 10 "${CHOICES[@]}" 3>&1 1>&2 2>&3) || exit_script
    for tag in $selection; do
      tag="${tag%\"}"
      tag="${tag#\"}"
      local line
      line=$(grep -E "^${tag}\|" "$MAPFILE" | head -n1 | cut -d'|' -f2-)
      [[ -n "$line" ]] && printf '%s\n' "$line" >>"$SSH_KEYS_FILE"
    done
    ;;
  manual)
    SSH_AUTHORIZED_KEY="$(whiptail --backtitle "$backtitle" \
      --inputbox "Paste one SSH public key line (ssh-ed25519/ssh-rsa/...)" 10 72 --title "SSH Public Key" 3>&1 1>&2 2>&3)"
    [[ -n "$SSH_AUTHORIZED_KEY" ]] && printf '%s\n' "$SSH_AUTHORIZED_KEY" >>"$SSH_KEYS_FILE"
    ;;
  folder)
    local glob_path
    glob_path=$(whiptail --backtitle "$backtitle" \
      --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
    if [[ -n "$glob_path" ]]; then
      shopt -s nullglob
      read -r -a _scan_files <<<"$glob_path"
      shopt -u nullglob
      if [[ "${#_scan_files[@]}" -gt 0 ]]; then
        ssh_build_choices_from_files "${_scan_files[@]}"
        if [[ "$COUNT" -gt 0 ]]; then
          local folder_selection
          folder_selection=$(whiptail --backtitle "$backtitle" --title "SELECT FOLDER KEYS" \
            --checklist "Select key(s) to import:" 20 78 10 "${CHOICES[@]}" 3>&1 1>&2 2>&3) || exit_script
          for tag in $folder_selection; do
            tag="${tag%\"}"
            tag="${tag#\"}"
            local line
            line=$(grep -E "^${tag}\|" "$MAPFILE" | head -n1 | cut -d'|' -f2-)
            [[ -n "$line" ]] && printf '%s\n' "$line" >>"$SSH_KEYS_FILE"
          done
        else
          whiptail --backtitle "$backtitle" --msgbox "No keys found in: $glob_path" 8 60
        fi
      else
        whiptail --backtitle "$backtitle" --msgbox "Path/glob returned no files." 8 60
      fi
    fi
    ;;
  none)
    :
    ;;
  esac

  if [[ -s "$SSH_KEYS_FILE" ]]; then
    sort -u -o "$SSH_KEYS_FILE" "$SSH_KEYS_FILE"
    printf '\n' >>"$SSH_KEYS_FILE"
  fi

  # Always show SSH access dialog - user should be able to enable SSH even without keys
  if (whiptail --backtitle "$backtitle" --defaultno --title "SSH ACCESS" --yesno "Enable root SSH access?" 10 58); then
    SSH="yes"
  else
    SSH="no"
  fi
}

# ------------------------------------------------------------------------------
# msg_menu()
#
# - Displays a numbered menu for update_script() functions
# - In silent mode (PHS_SILENT=1): auto-selects the default option
# - In interactive mode: shows menu via read with 10s timeout + default fallback
# - Usage: CHOICE=$(msg_menu "Title" "tag1" "Description 1" "tag2" "Desc 2" ...)
# - The first item is always the default
# - Returns the selected tag to stdout
# - If no valid selection or timeout, returns the default (first) tag
# ------------------------------------------------------------------------------
msg_menu() {
  local title="$1"
  shift

  # Parse items into parallel arrays: tags[] and descriptions[]
  local -a tags=()
  local -a descs=()
  while [[ $# -ge 2 ]]; do
    tags+=("$1")
    descs+=("$2")
    shift 2
  done

  local default_tag="${tags[0]}"
  local count=${#tags[@]}

  # Silent mode: return default immediately
  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
    echo "$default_tag"
    return 0
  fi

  # Display menu to /dev/tty so it doesn't get captured by command substitution
  {
    echo ""
    msg_custom "📋" "${BL}" "${title}"
    echo ""
    for i in "${!tags[@]}"; do
      local marker="  "
      [[ $i -eq 0 ]] && marker="* "
      printf "${TAB3}${marker}%s) %s\n" "${tags[$i]}" "${descs[$i]}"
    done
    echo ""
  } >/dev/tty

  local selection=""
  read -r -t 10 -p "${TAB3}Select [default=${default_tag}, timeout 10s]: " selection </dev/tty >/dev/tty || true

  # Validate selection
  if [[ -n "$selection" ]]; then
    for tag in "${tags[@]}"; do
      if [[ "$selection" == "$tag" ]]; then
        echo "$selection"
        return 0
      fi
    done
    msg_warn "Invalid selection '${selection}' - using default: ${default_tag}"
  fi

  echo "$default_tag"
  return 0
}

run_addon_updates() {
  shopt -s nullglob
  local addons=(/usr/local/bin/update_*)
  local a name ans
  shopt -u nullglob

  ((${#addons[@]} == 0)) && return 0

  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
    msg_info "Detected ${#addons[@]} addon update script(s) - skipping (PHS_SILENT)"
    return 0
  fi

  echo
  echo -e "${INFO}${YW} Detected installed addon update script(s):${CL}"
  for a in "${addons[@]}"; do
    echo -e "${TAB}- ${a##*/update_}"
  done
  echo

  for a in "${addons[@]}"; do
    name="${a##*/update_}"
    printf 'Do you also want to update addon "%s"? (y/N) [60s]: ' "$name"
    ans=""
    if read -r -t 60 ans </dev/tty; then :; else echo; fi
    case "${ans,,}" in
    y | yes)
      bash "$a" || msg_warn "Addon update for $name failed (rc=$?)"
      ;;
    *)
      msg_info "Skipped addon: $name"
      ;;
    esac
  done
}

runtime_script_status_guard() {
  local mode="${1:-}"
  local script_slug="${SCRIPT_SLUG:-${NSAPP:-}}"
  script_slug="$(echo "$script_slug" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
  [[ -z "$script_slug" ]] && return 0

  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message,pinned_version,pin_reason"
  local response
  if ! response=$(curl -fsSL --connect-timeout 2 --max-time 3 "$api_url" 2>/dev/null); then
    msg_warn "Script status check is unavailable. Continuing without status verification."
    return 0
  fi

  local is_deleted is_disabled deleted_message disable_message pinned_version pin_reason info_url
  if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
    return 0
  fi

  # PocketBase returns a flat, fixed-field JSON blob; sed is enough here (no jq needed).
  is_deleted=$(printf '%s' "$response" | sed -n 's/.*"is_deleted"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
  is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
  deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  pinned_version=$(printf '%s' "$response" | sed -n 's/.*"pinned_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  pin_reason=$(printf '%s' "$response" | sed -n 's/.*"pin_reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  is_deleted=${is_deleted:-false}
  is_disabled=${is_disabled:-false}
  info_url="https://community-scripts.org/scripts/${script_slug}"

  if [[ "$is_deleted" == "true" ]]; then
    msg_error "This script is no longer available in community-scripts."
    [[ -n "$deleted_message" ]] && msg_error "$deleted_message"
    [[ -z "$deleted_message" ]] && msg_error "This script was removed and cannot be installed or updated."
    msg_warn "More info: ${info_url}"
    return 1
  fi

  if [[ "$is_disabled" == "true" ]]; then
    case "${var_ignore_disable:-}" in
    1 | yes | true | on)
      msg_warn "This script is currently disabled in community-scripts."
      [[ -n "$disable_message" ]] && msg_warn "$disable_message"
      msg_warn "Bypassing disable status via var_ignore_disable — continuing at your own risk."
      msg_warn "More info: ${info_url}"
      return 0
      ;;
    esac

    msg_error "This script is currently disabled in community-scripts."
    [[ -n "$disable_message" ]] && msg_error "$disable_message"
    [[ -z "$disable_message" ]] && msg_error "Updates and installs are temporarily disabled for this script."
    msg_warn "More info: ${info_url}"
    return 1
  fi

  if [[ "$mode" == "update" && -n "$pinned_version" && -n "${NSAPP:-}" ]]; then
    local current_file="$HOME/.${NSAPP}"
    if [[ -f "$current_file" ]]; then
      local installed pinned_clean installed_clean
      installed="$(<"$current_file")"
      pinned_clean="$pinned_version"
      installed_clean="$installed"
      [[ "$pinned_clean" =~ ^v[0-9] ]] && pinned_clean="${pinned_clean:1}"
      [[ "$installed_clean" =~ ^v[0-9] ]] && installed_clean="${installed_clean:1}"
      if [[ "$installed_clean" == "$pinned_clean" ]]; then
        if [[ -n "$pin_reason" ]]; then
          msg_info "You are already on the pinned version (${pinned_version}). ${pin_reason}"
        else
          msg_info "You are already on the pinned version (${pinned_version}). No newer update is offered intentionally — please do not open an issue unless you see an actual error."
        fi
        msg_info "More info: ${info_url}"
      fi
    fi
  fi

  return 0
}
check_container_os_guard() {
  local rec_os="${var_os:-}" rec_ver="${var_version:-}"
  rec_os="${rec_os,,}"
  [[ -z "$rec_os" || -z "$rec_ver" ]] && return 0
  [[ -r /etc/os-release ]] || return 0

  local cur_os cur_ver
  cur_os="$(. /etc/os-release 2>/dev/null; echo "${ID:-}")"
  cur_ver="$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID:-}")"
  cur_os="${cur_os,,}"
  [[ -z "$cur_os" || -z "$cur_ver" ]] && return 0

  # Exact version or prefix on a dot boundary (e.g. alpine 3.22 matches 3.22.1)
  if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" == "$rec_ver" || "$cur_ver" == "$rec_ver".* ]]; then
    return 0
  fi

  local downgraded_target=0
  if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" != "$rec_ver" ]]; then
    if [[ "$(printf '%s\n%s\n' "$cur_ver" "$rec_ver" | sort -V | tail -n1)" == "$cur_ver" ]]; then
      downgraded_target=1
    fi
  fi

  case "${var_ignore_os_mismatch:-}" in
  1 | yes | true | on)
    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing via var_ignore_os_mismatch (may break, no support)."
    return 0
    ;;
  esac

  local ignore_file="/usr/local/community-scripts/ignore-os-mismatch"
  if [[ -f "$ignore_file" && "$(cat "$ignore_file" 2>/dev/null)" == "${rec_os} ${rec_ver}" ]]; then
    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing (previously ignored via ${ignore_file}, may break, no support)."
    return 0
  fi

  local mismatch_detail remediation
  if [[ "$downgraded_target" -eq 1 ]]; then
    mismatch_detail="Your container runs ${cur_os} ${cur_ver}, which is newer than what this script now targets (${rec_os} ${rec_ver}).\n\nThe target was likely lowered on purpose, e.g. because ${APP:-the app} had problems on newer OS versions - check the GitHub issues for ${APP:-this app} for details.\n\nContinuing on ${cur_ver} often still works, but isn't guaranteed. If you are unsure, ask in our Discord (https://discord.gg/3AnUqsXnmK) before continuing."
    remediation="This script now targets the older ${rec_os} ${rec_ver}. Check the GitHub issues for ${APP:-this app}, or ask in Discord (https://discord.gg/3AnUqsXnmK) if you are unsure"
  else
    mismatch_detail="This container runs ${cur_os} ${cur_ver}, but this script now targets ${rec_os} ${rec_ver}.\n\nUpdating on the older base OS may fail or leave ${APP:-the application} broken (e.g. required runtime versions are not available).\n\nRecommended: upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again."
    remediation="Upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again"
  fi

  if [[ "${PHS_SILENT:-0}" != "1" ]] && command -v whiptail &>/dev/null && [ -t 0 ] && [[ "$TERM" != "dumb" ]]; then
    local choice
    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "OS VERSION MISMATCH" --menu \
      "${mismatch_detail}\n\nIf you continue anyway, it may break — no support is provided in that case.\n\nContinue anyway?" \
      20 70 3 \
      "1" "No  (cancel update)" \
      "2" "Yes (continue this time)" \
      "3" "Yes (continue and don't ask again)" \
      --nocancel --default-item "1" 3>&1 1>&2 2>&3)
    case "$choice" in
    2)
      msg_warn "Continuing update on ${cur_os} ${cur_ver} despite recommended ${rec_os} ${rec_ver} — may break, no support."
      return 0
      ;;
    3)
      mkdir -p "${ignore_file%/*}"
      echo "${rec_os} ${rec_ver}" >"$ignore_file"
      msg_warn "Continuing update on ${cur_os} ${cur_ver}; OS check for ${rec_os} ${rec_ver} disabled via ${ignore_file} — may break, no support."
      return 0
      ;;
    esac
    msg_error "Update cancelled: container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver}."
    return 1
  fi

  msg_error "Container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver} — skipping update."
  msg_error "${remediation} — or bypass this check (may break, no support) with: echo \"${rec_os} ${rec_ver}\" > ${ignore_file}"
  return 1
}
start() {
  # Through the resolver, not a bare curl: this way a local checkout and the
  # prefetched copy are used. Hardcoding the URL here meant tools.func and its
  # five parts were six network requests between the header and the menu,
  # every run, whatever else had already been fetched.
  _cs_source_func "lib/tools.func"
  if command -v pveversion >/dev/null 2>&1; then
    runtime_script_status_guard install || return 0
    install_script || return 0
    return 0
  elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
    VERBOSE="no"
    set_std_mode
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
    cleanup_lxc
  elif ! command -v whiptail &>/dev/null || ! [ -t 0 ] || [[ "$TERM" == "dumb" ]]; then
    msg_info "No interactive terminal detected – defaulting to silent update mode"
    VERBOSE="no"
    set_std_mode
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
    cleanup_lxc
  else
    CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "${APP} LXC Update/Setting" --menu \
      "Support/Update functions for ${APP} LXC. Choose an option:" \
      12 60 3 \
      "1" "YES (Silent Mode)" \
      "2" "YES (Verbose Mode)" \
      "3" "NO (Cancel Update)" --nocancel --default-item "1" 3>&1 1>&2 2>&3)

    case "$CHOICE" in
    1)
      VERBOSE="no"
      set_std_mode
      ;;
    2)
      VERBOSE="yes"
      set_std_mode
      ;;
    3)
      clear
      exit_script
      exit
      ;;
    esac
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
    cleanup_lxc
  fi
}