githelper.sh

#!/usr/bin/env bash
# =============================================
# Interactive Git + GitHub Helper for Termux
# =============================================

# ── Colors ────────────────────────────────────────────────────────────────────
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
MAGENTA='\033[0;35m'
BOLD='\033[1m'
RESET='\033[0m'

# ── Script location ────────────────────────────────────────────────────────
# Used to co-locate some state files with the repo this script lives in,
# instead of always dumping them in $HOME.
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"

# ── Config file (saved GitHub accounts) ───────────────────────────────────────
CONFIG_FILE="$SCRIPT_DIR/.githelper_accounts"
LAST_MSG_FILE="$SCRIPT_DIR/.githelper_lastmsg"
AI_CONFIG_FILE="$SCRIPT_DIR/.githelper_ai_engine"
# Per-account SSH signing key mapping, one line per account:
#   username:keypath:email
# keypath points at the PRIVATE key file (its .pub sibling is used for
# allowed_signers / display). Used to auto-apply the right signing identity
# whenever quick_switch_account / gh_switch_to_saved switches accounts, so
# two Termux accounts never accidentally sign commits with the wrong key.
SSH_KEY_CONFIG_FILE="$HOME/.githelper_ssh_keys"
ALLOWED_SIGNERS_FILE="$HOME/.ssh/allowed_signers"
DRY_RUN=false

# ── AI engine list (order = priority if none configured) ─────────────────────
# Status: gemini, openrouter = live. anthropic, openai, megallm = placeholders
# (env var read + curl wiring present, but left for future endpoint/model tuning).
AI_ENGINES=(gemini openrouter anthropic openai megallm)

# Gemini-specific model cascade (tried in this order within the gemini engine).
# On any recoverable failure for one model -- quota exhaustion (HTTP 429 /
# RESOURCE_EXHAUSTED), a deprecated/missing model, a server overload, a
# safety-blocked empty response, etc. -- automatically falls through to the
# next model. Only a rejected/invalid key (401/403) skips straight to the
# next configured key instead of the next model.
GEMINI_MODELS=(gemini-3.5-flash gemini-3.1-flash-lite gemini-2.5-flash gemini-2.5-flash-lite)

ai_env_var() {
    case "$1" in
        gemini)     echo "GEMINI_API_KEY" ;;
        openrouter) echo "OPENROUTER_API_KEY" ;;
        anthropic)  echo "ANTHROPIC_API_KEY" ;;
        openai)     echo "OPENAI_API_KEY" ;;
        megallm)    echo "MEGALLM_API_KEY" ;;
    esac
}

# Multiple keys per engine are supported by setting the env var to a
# comma-separated list, e.g. GEMINI_API_KEY="key1,key2,key3".
# This returns that engine's keys as a bash array (via global AI_KEYS).
ai_keys_for() {
    local engine="$1" var raw
    var=$(ai_env_var "$engine")
    raw="${!var}"
    AI_KEYS=()
    [ -z "$raw" ] && return 0
    local IFS=','
    read -ra AI_KEYS <<< "$raw"
    # trim whitespace around each key
    local i
    for i in "${!AI_KEYS[@]}"; do
        AI_KEYS[$i]=$(echo "${AI_KEYS[$i]}" | xargs)
    done
}

ai_engine_live() {
    # Engines with an actual API call implemented below
    case "$1" in
        gemini|openrouter) return 0 ;;
        *) return 1 ;;
    esac
}

ai_load_config() {
    AI_ACTIVE=""
    AI_FALLBACKS=()
    if [ -f "$AI_CONFIG_FILE" ]; then
        AI_ACTIVE=$(sed -n '1p' "$AI_CONFIG_FILE")
        local fb_line
        fb_line=$(sed -n '2p' "$AI_CONFIG_FILE")
        [ -n "$fb_line" ] && IFS=',' read -ra AI_FALLBACKS <<< "$fb_line"
    fi
    [ -z "$AI_ACTIVE" ] && AI_ACTIVE="gemini"
}

ai_check_deps() {
    local missing=()
    command -v curl &>/dev/null || missing+=(curl)
    command -v jq &>/dev/null   || missing+=(jq)
    if [ ${#missing[@]} -gt 0 ]; then
        echo -e "${RED}✗ Missing: ${missing[*]}. Install with: pkg install ${missing[*]}${RESET}" >&2
        return 1
    fi
}

ai_save_config() {
    {
        echo "$AI_ACTIVE"
        local IFS=','
        echo "${AI_FALLBACKS[*]}"
    } > "$AI_CONFIG_FILE"
}

# ── m) AI Engine Selector ──────────────────────────────────────────────────────
ai_engine_config() {
    ai_load_config
    echo -e "${CYAN}${BOLD}AI Engine Selector${RESET}\n"
    echo -e "${BLUE}Active:    $AI_ACTIVE${RESET}"
    echo -e "${BLUE}Fallback:  ${AI_FALLBACKS[*]:-none}${RESET}\n"

    for i in "${!AI_ENGINES[@]}"; do
        local e="${AI_ENGINES[$i]}" status key_state
        ai_keys_for "$e"
        if [ ${#AI_KEYS[@]} -eq 1 ]; then
            key_state="${GREEN}1 key${RESET}"
        elif [ ${#AI_KEYS[@]} -gt 1 ]; then
            key_state="${GREEN}${#AI_KEYS[@]} keys${RESET}"
        else
            key_state="${YELLOW}no key${RESET}"
        fi
        if ai_engine_live "$e"; then status="${GREEN}live${RESET}"; else status="${MAGENTA}placeholder${RESET}"; fi
        printf "  %d) %-12s [%s, %s]\n" "$((i+1))" "$e" "$status" "$key_state"
    done

    echo ""
    echo "  s) Set active engine"
    echo "  f) Set fallback order (comma list of numbers, e.g. 2,1)"
    echo "  t) Test active engine"
    echo "  q) Back"
    read -rp "Choice: " ac

    case $ac in
        s|S)
            read -rp "Active engine number: " n
            if [[ $n =~ ^[0-9]+$ ]] && [ "$n" -ge 1 ] && [ "$n" -le "${#AI_ENGINES[@]}" ]; then
                AI_ACTIVE="${AI_ENGINES[$((n-1))]}"
                ai_save_config
                echo -e "${GREEN}✓ Active engine set to $AI_ACTIVE${RESET}"
            fi
            ;;
        f|F)
            read -rp "Fallback order (numbers, comma-separated): " fb
            AI_FALLBACKS=()
            IFS=',' read -ra picks <<< "$fb"
            for n in "${picks[@]}"; do
                n=$(echo "$n" | xargs)
                if [[ $n =~ ^[0-9]+$ ]] && [ "$n" -ge 1 ] && [ "$n" -le "${#AI_ENGINES[@]}" ]; then
                    AI_FALLBACKS+=("${AI_ENGINES[$((n-1))]}")
                fi
            done
            ai_save_config
            echo -e "${GREEN}✓ Fallback order: ${AI_FALLBACKS[*]:-none}${RESET}"
            ;;
        t|T)
            local out
            out=$(ai_call "Reply with exactly: OK")
            if [ -n "$out" ]; then
                echo -e "${GREEN}✓ $AI_ACTIVE responded:${RESET} $out"
            else
                echo -e "${RED}✗ No response from $AI_ACTIVE (and any fallbacks).${RESET}"
            fi
            ;;
    esac
}

# ── Generic AI call with active engine + fallback chain ───────────────────────
# Usage: ai_call "prompt text"   → prints response to stdout, empty on total failure
ai_call() {
    local prompt="$1"
    ai_check_deps || return 1
    ai_load_config
    local chain=("$AI_ACTIVE" "${AI_FALLBACKS[@]}")
    local tried=()
    local total_engines=${#chain[@]}
    local engine_num=0

    for engine in "${chain[@]}"; do
        [ -z "$engine" ] && continue
        engine_num=$((engine_num+1))
        # skip duplicates
        [[ " ${tried[*]} " == *" $engine "* ]] && continue
        tried+=("$engine")

        if ! ai_engine_live "$engine"; then
            echo -e "${YELLOW}↷ Skipping $engine (placeholder, not implemented yet)${RESET}" >&2
            continue
        fi

        ai_keys_for "$engine"
        if [ ${#AI_KEYS[@]} -eq 0 ]; then
            local var
            var=$(ai_env_var "$engine")
            echo -e "${YELLOW}↷ Skipping $engine (no $var set)${RESET}" >&2
            continue
        fi

        progress_step "Engine: $engine" "$engine_num" "$total_engines"

        local key_idx result key_used
        for key_idx in "${!AI_KEYS[@]}"; do
            local key="${AI_KEYS[$key_idx]}"
            [ -z "$key" ] && continue
            key_used=$((key_idx+1))

            if [ "${#AI_KEYS[@]}" -gt 1 ]; then
                echo -e "  ${CYAN}key ${key_used}/${#AI_KEYS[@]}${RESET}" >&2
            fi

            case "$engine" in
                gemini)     result=$(ai_call_gemini "$key" "$prompt") ;;
                openrouter) result=$(ai_call_openrouter "$key" "$prompt") ;;
            esac

            if [ -n "$result" ]; then
                echo "$result"
                return 0
            else
                echo -e "${YELLOW}✗ $engine key $key_used failed, trying next...${RESET}" >&2
            fi
        done
    done

    echo -e "${RED}✗ All configured engines failed or unavailable.${RESET}" >&2
    return 1
}

ai_call_gemini() {
    local key="$1" prompt="$2"
    local payload
    payload=$(jq -n --arg p "$prompt" '{contents:[{parts:[{text:$p}]}]}')
    [ -z "$payload" ] && return 1

    # Try models in order. Quota exhaustion (429 / RESOURCE_EXHAUSTED) falls
    # through to the next model, and so does everything else *except* a
    # genuine auth/key failure -- a 404 for a deprecated model name, a 503
    # overload, or a safety-blocked empty response are model-specific or
    # transient and worth retrying on the next model. Only a bad/invalid key
    # is truly pointless to retry across models, so that's the one case that
    # jumps straight to the next key.
    local model model_num=0 total_models=${#GEMINI_MODELS[@]}
    for model in "${GEMINI_MODELS[@]}"; do
        model_num=$((model_num+1))

        if $DRY_RUN; then
            echo -e "    ${MAGENTA}[dry-run] would call $model${RESET}" >&2
            echo "[dry-run OK: $model]"
            return 0
        fi

        local response http_code body
        response=$(run_spinner "Gemini ${model} (${model_num}/${total_models})" \
            curl -s --max-time 30 -w $'\n%{http_code}' -X POST \
            "https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=$key" \
            -H "Content-Type: application/json" \
            -d "$payload")

        http_code=$(echo "$response" | tail -1)
        body=$(echo "$response" | sed '$d')

        if [ "$http_code" == "200" ]; then
            local text
            text=$(echo "$body" | jq -r '.candidates[0].content.parts[0].text // empty' 2>/dev/null)
            if [ -n "$text" ]; then
                echo "$text"
                return 0
            fi
            echo -e "    ${YELLOW}↷ $model: 200 but no text (likely safety-blocked), trying next Gemini model...${RESET}" >&2
            continue
        fi

        if [ "$http_code" == "429" ] || echo "$body" | grep -qi "RESOURCE_EXHAUSTED"; then
            echo -e "    ${YELLOW}↷ $model: quota exhausted, trying next Gemini model...${RESET}" >&2
            continue
        fi

        if [ "$http_code" == "401" ] || [ "$http_code" == "403" ] || \
           echo "$body" | grep -qiE "API_KEY_INVALID|UNAUTHENTICATED|PERMISSION_DENIED"; then
            echo -e "    ${RED}✗ $model: key rejected (HTTP $http_code) — skipping remaining models for this key.${RESET}" >&2
            return 1
        fi

        # Anything else (404 deprecated model, 500/503 overloaded, network
        # hiccup, etc.) is model-specific or transient -- try the next model
        # before giving up on this key entirely.
        echo -e "    ${YELLOW}↷ $model: request failed (HTTP $http_code), trying next Gemini model...${RESET}" >&2
    done

    return 1
}

ai_call_openrouter() {
    local key="$1" prompt="$2"
    local payload
    payload=$(jq -n --arg p "$prompt" '{model:"openrouter/auto",messages:[{role:"user",content:$p}]}' 2>/dev/null)
    [ -z "$payload" ] && return 1

    if $DRY_RUN; then
        echo -e "    ${MAGENTA}[dry-run] would call openrouter${RESET}" >&2
        echo "[dry-run OK: openrouter]"
        return 0
    fi

    local response
    response=$(run_spinner "OpenRouter" \
        curl -s --max-time 30 -X POST "https://openrouter.ai/api/v1/chat/completions" \
        -H "Authorization: Bearer $key" \
        -H "Content-Type: application/json" \
        -d "$payload")

    echo "$response" | jq -r '.choices[0].message.content // empty' 2>/dev/null
}

# ── Placeholder engines (future implementation) ───────────────────────────────
# Anthropic, OpenAI, and Megallm calls go here once wired up. They're already
# selectable in the menu and will be skipped automatically by ai_call() until
# ai_engine_live() is updated to return 0 for them and a matching
# ai_call_<engine>() function is added above.
ai_call_anthropic() { :; }
ai_call_openai()    { :; }
ai_call_megallm()   { :; }

# ── Parse flags & direct-launch args ─────────────────────────────────────────
# Usage:
#   gh1                        → interactive menu (normal mode)
#   gh1 --dry-run              → interactive menu, no commands execute
#   gh1 <file>                 → jump straight to file history for that file
#   gh1 --gitignore            → jump straight to .gitignore editor
#   gh1 --workspace            → jump straight to workspace switcher
DIRECT_MODE=""
DIRECT_FILE=""

for arg in "$@"; do
    case "$arg" in
        --dry-run)    DRY_RUN=true ;;
        --gitignore)  DIRECT_MODE="gitignore" ;;
        --workspace)  DIRECT_MODE="workspace" ;;
        --help)       DIRECT_MODE="help" ;;
        --*)          echo -e "${RED}Unknown flag: $arg${RESET}"; exit 1 ;;
        *)
            # Treat any non-flag argument as a file path for file history
            DIRECT_FILE="$arg"
            DIRECT_MODE="filehistory"
            ;;
    esac
done

# ── Run or simulate a command ─────────────────────────────────────────────────
run() {
    if $DRY_RUN; then
        echo -e "${MAGENTA}[dry-run] $*${RESET}"
    else
        "$@"
    fi
}

# ── Progress: spinner + step counter ──────────────────────────────────────────
# Two pieces that combine for multi-phase operations:
#   progress_step "label" cur total   → prints "[cur/total] label" once, no spin
#   run_spinner "label" cmd args...   → runs cmd in background, spins until done,
#                                        then prints a final ✓/✗ line in its place
#
# Usage in a phase loop:
#   progress_step "Pushing to origin" 1 1
#   run_spinner "git push" git push
#
# run_spinner captures the command's stdout+stderr to a temp file and replays it
# after the spinner line is cleared, so output isn't lost or interleaved.

PROGRESS_ACTIVE=false  # set true while a spinner owns the terminal line

progress_step() {
    local label="$1" cur="$2" total="$3"
    echo -e "${CYAN}[${cur}/${total}]${RESET} ${label}" >&2
}

run_spinner() {
    local label="$1"; shift
    local frames='⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏'
    local tmp_out
    tmp_out=$(mktemp)

    if $DRY_RUN; then
        echo -e "${MAGENTA}[dry-run] $*${RESET}"
        rm -f "$tmp_out"
        return 0
    fi

    "$@" > "$tmp_out" 2>&1 &
    local pid=$!
    PROGRESS_ACTIVE=true

    local i=0
    local start_ts=$SECONDS
    # Hide cursor while spinning, always restore it on exit (even on Ctrl-C)
    tput civis >&2 2>/dev/null
    trap 'tput cnorm >&2 2>/dev/null' RETURN
    while kill -0 "$pid" 2>/dev/null; do
        local frame="${frames:i++%${#frames}:1}"
        local elapsed=$((SECONDS - start_ts))
        printf "\r${MAGENTA}%s${RESET} %s ${YELLOW}(%ds)${RESET}\033[K" "$frame" "$label" "$elapsed" >&2
        sleep 0.1
    done

    wait "$pid"
    local status=$?
    tput cnorm >&2 2>/dev/null
    PROGRESS_ACTIVE=false

    printf "\r\033[K" >&2
    if [ $status -eq 0 ]; then
        echo -e "${GREEN}✓${RESET} ${label}" >&2
    else
        echo -e "${RED}✗${RESET} ${label} ${RED}(exit $status)${RESET}" >&2
    fi

    # Replay captured output below the status line
    if [ -s "$tmp_out" ]; then
        cat "$tmp_out"
    fi
    rm -f "$tmp_out"
    return $status
}

# ── Helpers ───────────────────────────────────────────────────────────────────
require_repo() {
    if ! git rev-parse --git-dir &>/dev/null; then
        echo -e "${RED}✗ Not inside a git repository.${RESET}"
        return 1
    fi
}

require_gh() {
    if ! command -v gh &>/dev/null; then
        echo -e "${RED}✗ 'gh' CLI is not installed. Install it with: pkg install gh${RESET}"
        return 1
    fi
    if ! gh auth status &>/dev/null; then
        echo -e "${RED}✗ Not logged in to GitHub. Run: gh auth login${RESET}"
        return 1
    fi
}

require_copilot() {
    require_gh || return 1
    if ! gh copilot --help &>/dev/null; then
        echo -e "${RED}✗ 'gh copilot' extension not installed.${RESET}"
        read -rp "Install it now with 'gh extension install github/gh-copilot'? (y/n) [y]: " inst
        inst="${inst:-y}"
        if [[ $inst == y || $inst == Y ]]; then
            run gh extension install github/gh-copilot || { echo -e "${RED}✗ Install failed.${RESET}"; return 1; }
        else
            return 1
        fi
    fi
}

# ── Numbered branch picker ─────────────────────────────────────────────────────
pick_branch() {
    local prompt="${1:-Branch}"
    local branches=()
    while IFS= read -r b; do
        branches+=("$(echo "$b" | sed 's/^\*[[:space:]]*//' | xargs)")
    done < <(git branch -a 2>/dev/null | grep -v HEAD)

    if [ ${#branches[@]} -eq 0 ]; then
        echo -e "${YELLOW}No branches found.${RESET}" >&2
        return 1
    fi

    echo -e "${CYAN}Available branches:${RESET}" >&2
    for i in "${!branches[@]}"; do
        printf "  %2d) %s\n" "$((i+1))" "${branches[$i]}" >&2
    done
    echo "" >&2
    read -rp "$prompt (number or name): " sel

    # If numeric pick
    if [[ $sel =~ ^[0-9]+$ ]] && [ "$sel" -ge 1 ] && [ "$sel" -le "${#branches[@]}" ]; then
        echo "${branches[$((sel-1))]}"
    else
        echo "$sel"
    fi
}

# ── Stage preview before commit ───────────────────────────────────────────────
stage_and_confirm() {
    echo -e "${CYAN}Changed files:${RESET}"
    git status -s
    echo ""
    read -rp "Stage all changes? (y/n) [y]: " sa
    sa="${sa:-y}"
    if [[ $sa == y || $sa == Y ]]; then
        run git add -A
        return 0
    else
        echo -e "${YELLOW}Aborted — nothing staged.${RESET}"
        return 1
    fi
}

# ── Secret redaction before sending any diff to an AI engine ──────────────────
# Two passes:
#  1. Hard patterns (AWS keys, GH tokens, private key blocks, key=/secret=/
#     password= assignments, JWTs, generic API key formats) → auto-redacted,
#     no prompt, since these are unambiguous.
#  2. Lines that merely *look* like they could hold a secret (long random-ish
#     token assigned to a var) → shown to the user, who decides per line.
# This only touches the text sent to the AI; the real diff used for git
# commit / gh pr diff is never modified.

redact_diff() {
    local diff="$1"
    local redacted=""
    local line
    local q="\"'"   # quote chars, used as a bracket-class fragment below
    local in_key_block=0

    # NOTE: matching below uses bash's native `[[ =~ ]]` instead of piping
    # through `echo | grep` for every pattern on every line. The old version
    # forked 2 external processes per pattern per line (6+ patterns x every
    # line in the diff), which is what made this step slow — process
    # spawning is expensive, especially under Termux/Android. Native bash
    # regex has no fork/exec cost. The sed substitutions below still fork,
    # but only on lines that actually matched, which is rare.
    local pat_end_key='^[+-]?[[:space:]]*-----END (RSA|EC|OPENSSH|PGP|DSA)? ?PRIVATE KEY-----'
    local pat_begin_key='^[+-]?[[:space:]]*-----BEGIN (RSA|EC|OPENSSH|PGP|DSA)? ?PRIVATE KEY-----'
    local pat_aws='AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}'
    local pat_gh='gh[pousr]_[A-Za-z0-9]{20,}'
    local pat_sk='sk-(ant-|proj-)?[A-Za-z0-9_-]{20,}'
    local pat_kv="(api[_-]?key|secret|password|passwd|token|access[_-]?key)[$q]?[[:space:]]*[:=][[:space:]]*[$q]?[A-Za-z0-9_/+=-]{12,}"
    local pat_jwt='eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'
    local pat_ambiguous="^[+-].{0,40}[:=][[:space:]]*[$q]?[A-Za-z0-9_/+-]{24,}[$q]?"

    while IFS= read -r line <&3; do
        local hard_hit=0

        if [ "$in_key_block" -eq 1 ]; then
            [[ $line =~ $pat_end_key ]] && in_key_block=0
            redacted+="[REDACTED_PRIVATE_KEY_BLOCK]"$'\n'
            continue
        fi

        # --- Hard, unambiguous patterns -> always redact, no prompt ---
        if [[ $line =~ $pat_aws ]]; then
            line=$(echo "$line" | sed -E 's/(AKIA|ASIA)[0-9A-Z]{16}/[REDACTED_AWS_KEY]/g')
            hard_hit=1
        fi
        if [[ $line =~ $pat_gh ]]; then
            line=$(echo "$line" | sed -E 's/gh[pousr]_[A-Za-z0-9]{20,}/[REDACTED_GH_TOKEN]/g')
            hard_hit=1
        fi
        if [[ $line =~ $pat_sk ]]; then
            line=$(echo "$line" | sed -E 's/sk-(ant-|proj-)?[A-Za-z0-9_-]{20,}/[REDACTED_API_KEY]/g')
            hard_hit=1
        fi
        if [[ $line =~ $pat_begin_key ]]; then
            line="[REDACTED_PRIVATE_KEY_BLOCK]"
            hard_hit=1
            in_key_block=1
        fi
        local kv_hit=0
        shopt -s nocasematch
        [[ $line =~ $pat_kv ]] && kv_hit=1
        shopt -u nocasematch
        if [ "$kv_hit" -eq 1 ]; then
            line=$(echo "$line" | sed -E "s/([:=][[:space:]]*[$q]?)[A-Za-z0-9_/+=-]{12,}([$q]?)/\1[REDACTED]\2/")
            hard_hit=1
        fi
        if [[ $line =~ $pat_jwt ]]; then
            line=$(echo "$line" | sed -E 's/eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/[REDACTED_JWT]/g')
            hard_hit=1
        fi

        # --- Ambiguous pass: long random-looking token, not already handled ---
        if [ "$hard_hit" -eq 0 ] && [[ $line =~ $pat_ambiguous ]]; then
            echo "" >&2
            echo -e "${YELLOW}⚠ Possible secret in diff:${RESET}" >&2
            echo -e "${CYAN}$line${RESET}" >&2
            read -rp "Send this line to AI as-is? (y = send, n = redact) [n]: " sendit < /dev/tty >&2 2>/dev/null || \
                read -rp "Send this line to AI as-is? (y = send, n = redact) [n]: " sendit >&2
            sendit="${sendit:-n}"
            if [[ $sendit != y && $sendit != Y ]]; then
                line=$(echo "$line" | sed -E "s/([:=][[:space:]]*[$q]?)[A-Za-z0-9_/+-]{24,}([$q]?)/\1[REDACTED]\2/")
            fi
        fi

        redacted+="$line"$'\n'
    done 3<<< "$diff"

    echo "$redacted"
}


suggest_commit_msg() {
    local diff
    diff=$(git diff --cached --stat; echo; git diff --cached | head -c 6000)
    if [ -z "$diff" ]; then
        echo -e "${YELLOW}Nothing staged to summarize.${RESET}" >&2
        return 1
    fi

    diff=$(redact_diff "$diff")

    ai_load_config
    echo "  1) gh copilot" >&2
    echo "  2) AI rotator (active: $AI_ACTIVE)" >&2
    read -rp "Use which engine? [2]: " eng >&2
    eng="${eng:-2}"

    if [[ $eng == 1 ]]; then
        require_copilot || return 1
        echo -e "${MAGENTA}Asking Copilot for a commit message...${RESET}" >&2
        local copilot_out copilot_status
        copilot_out=$(gh copilot suggest -t shell --non-interactive \
            "Write a single concise conventional-commit style git commit message (one line, no quotes, no explanation) for this staged diff:
$diff" 2>&1)
        copilot_status=$?
        if [ $copilot_status -ne 0 ] || [ -z "$copilot_out" ]; then
            echo -e "${YELLOW}↷ gh copilot failed (exit $copilot_status):${RESET} ${copilot_out:-no output}" >&2
            return 1
        fi
        echo "$copilot_out" | grep -vE '^(gh|Suggestion|Welcome|$)' | sed -n '1{/^[[:space:]]*$/d};p' | head -1
    else
        ai_call "Write a single concise conventional-commit style git commit message (one line, no quotes, no explanation, no markdown) for this staged diff:
$diff" | head -1
    fi
}

# ── Commit with last-message memory ───────────────────────────────────────────
commit_with_msg() {
    local last_msg=""
    [ -f "$LAST_MSG_FILE" ] && last_msg=$(cat "$LAST_MSG_FILE")

    if [ -n "$last_msg" ]; then
        echo -e "${BLUE}Last message: ${last_msg}${RESET}"
        read -rp "Commit message (Enter to reuse last, '?' for AI suggestion): " msg
    else
        read -rp "Commit message ('?' for AI suggestion): " msg
    fi

    if [[ $msg == "?" ]]; then
        local ai_msg
        ai_msg=$(suggest_commit_msg)
        if [ -n "$ai_msg" ]; then
            echo -e "${GREEN}Suggested: ${ai_msg}${RESET}"
            read -rp "Use this message? (y/n) [y]: " useit
            useit="${useit:-y}"
            if [[ $useit == y || $useit == Y ]]; then
                msg="$ai_msg"
            else
                read -rp "Commit message: " msg
            fi
        else
            echo -e "${YELLOW}Could not get a suggestion.${RESET}"
            read -rp "Commit message: " msg
        fi
    fi

    [ -z "$msg" ] && [ -n "$last_msg" ] && msg="$last_msg"

    if [ -z "$msg" ]; then
        echo -e "${YELLOW}Aborted — empty message.${RESET}"
        return 1
    fi

    echo "$msg" > "$LAST_MSG_FILE"
    run git commit -m "$msg" && echo -e "${GREEN}✓ Committed: $msg${RESET}"
}

# ── Force-push menu shown after a hard reset ─────────────────────────────────
# Call this after any hard reset so the user can optionally rewrite the remote.
force_push_after_reset() {
    # Only makes sense inside a repo with a remote
    if ! git rev-parse --git-dir &>/dev/null; then return; fi
    local remote_url
    remote_url=$(git remote get-url origin 2>/dev/null)
    [ -z "$remote_url" ] && return

    local branch
    branch=$(git branch --show-current)

    # Show how local compares to origin
    local ahead behind
    ahead=$(git rev-list --count "origin/${branch}..HEAD" 2>/dev/null || echo "?")
    behind=$(git rev-list --count "HEAD..origin/${branch}" 2>/dev/null || echo "?")

    echo ""
    echo -e "${CYAN}${BOLD}── Remote status ──${RESET}"
    if [[ $ahead == "0" && $behind == "0" ]]; then
        echo -e "${GREEN}Local branch is in sync with origin/${branch}.${RESET}"
        return
    fi
    [ "$ahead"  != "0" ] && echo -e "${YELLOW}Local is ${ahead} commit(s) ahead of origin/${branch}.${RESET}"
    [ "$behind" != "0" ] && echo -e "${YELLOW}Local is ${behind} commit(s) behind origin/${branch}.${RESET}"

    echo ""
    echo -e "${YELLOW}Force-push this reset to origin?${RESET}"
    echo -e "${RED}This will rewrite the remote branch history.${RESET}"
    echo -e "Only do this if you intend to replace the remote history.\n"
    echo "  1) No (default)"
    echo "  2) Force push (safe):   git push --force-with-lease origin ${branch}"
    echo "  3) Force push anyway:   git push --force origin ${branch}"
    echo ""
    read -rp "Choice [1]: " fpc
    fpc="${fpc:-1}"
    case $fpc in
        2)
            run_spinner "Force push (--force-with-lease) origin/${branch}" \
                git push --force-with-lease origin "$branch"
            ;;
        3)
            echo -e "${RED}${BOLD}WARNING: This rewrites remote history permanently.${RESET}"
            read -rp "Type YES to confirm: " fpconfirm
            if [[ $fpconfirm == "YES" ]]; then
                run_spinner "Force push (--force) origin/${branch}" \
                    git push --force origin "$branch"
            else
                echo -e "${YELLOW}Force push cancelled.${RESET}"
            fi
            ;;
        *)
            echo -e "${YELLOW}Skipped — remote not changed.${RESET}"
            ;;
    esac
}

# ── Detect the repo's default branch (main/master/etc) ────────────────────────
# Local-only, no network calls: prefers the remote HEAD symref set at clone
# time, falls back to checking common names against already-fetched
# remote-tracking refs. Repo-agnostic by construction — never hardcodes
# "main".
detect_default_branch() {
    local ref
    ref=$(git symbolic-ref -q refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')
    if [ -n "$ref" ]; then
        echo "$ref"
        return 0
    fi
    local candidate
    for candidate in main master develop; do
        if git rev-parse --verify -q "origin/$candidate" &>/dev/null; then
            echo "$candidate"
            return 0
        fi
    done
    return 1
}

# ── Re-sign commits (fix missing/failed "Verified" badges) ────────────────────
# Repo/account-agnostic: reads whatever signing key is *currently active*
# in git config (set via apply_account_signing / the Account Manager, or
# manually) — never assumes a specific key path, repo, or account. Detects
# unsigned/bad-signature commits using git's own %G? status per commit
# rather than any hardcoded SHA list, so it works on any branch in any repo.
#
# Scoping: by default this only ever looks at commits unique to the CURRENT
# branch since it diverged from the repo's default branch (via merge-base) --
# not an arbitrary slice of shared history. That's almost always what "resign
# my commits" actually means, and it keeps a crude scroll-and-copy-a-hash
# step out of the common case.
resign_commits() {
    echo -e "${CYAN}${BOLD}Re-sign commits (fix missing/failed signatures)${RESET}\n"

    local signingkey signing_on
    signingkey=$(git config user.signingkey 2>/dev/null)
    signing_on=$(git config commit.gpgsign 2>/dev/null)
    if [ -z "$signingkey" ] || [[ "$signing_on" != "true" ]]; then
        echo -e "${RED}✗ No active SSH signing key configured for this repo/account.${RESET}"
        echo -e "${YELLOW}  Set one up first: 'G) GitHub Accounts → k) Set/generate SSH signing key'.${RESET}"
        return 1
    fi
    echo -e "${BLUE}Signing key in use: $signingkey${RESET}\n"

    # Cross-check against whichever account gh is CURRENTLY authenticated
    # as. Local user.signingkey/user.name only get refreshed when you switch
    # accounts through this script (quick_switch_account / gh_switch_to_saved)
    # -- if the gh session moved on since (another switch elsewhere, a raw
    # `gh auth switch`), this repo's local config would still point at the
    # old account's key. That would sign commits under the wrong identity.
    local git_identity gh_active
    git_identity=$(git config user.name 2>/dev/null)
    gh_active=$(gh api user --jq '.login' 2>/dev/null)
    if [ -n "$gh_active" ] && [ -n "$git_identity" ] && [ "$gh_active" != "$git_identity" ]; then
        echo -e "${RED}✗ Mismatch: this repo is configured to sign as '$git_identity',${RESET}"
        echo -e "${RED}  but gh is currently authenticated as '$gh_active'.${RESET}"
        echo -e "${YELLOW}  Re-sync first: 'S) Switch GH Account' → pick '$gh_active', then retry.${RESET}"
        read -rp "Continue signing as '$git_identity' anyway? (y/n) [n]: " force_mismatch
        [[ $force_mismatch != y && $force_mismatch != Y ]] && { echo -e "${YELLOW}Cancelled.${RESET}"; return 1; }
    fi

    local branch
    branch=$(git branch --show-current)
    if [ -z "$branch" ]; then
        echo -e "${RED}✗ Not on a branch (detached HEAD?) — aborting.${RESET}"
        return 1
    fi

    local default_branch
    default_branch=$(detect_default_branch)

    if [ -n "$default_branch" ] && [ "$branch" == "$default_branch" ]; then
        echo -e "${RED}${BOLD}⚠ You're on '$branch', which looks like this repo's default branch.${RESET}"
        echo -e "${RED}  Rewriting shared trunk history is rarely what you want and can break${RESET}"
        echo -e "${RED}  other clones/collaborators of this branch.${RESET}\n"
        read -rp "Type YES to fall back to manual mode anyway: " trunk_confirm
        [ "$trunk_confirm" != "YES" ] && { echo -e "${YELLOW}Cancelled.${RESET}"; return 1; }
        _resign_manual_fallback "$branch"
        return $?
    fi

    local base=""
    if [ -n "$default_branch" ]; then
        base=$(git merge-base HEAD "origin/$default_branch" 2>/dev/null || git merge-base HEAD "$default_branch" 2>/dev/null)
    fi

    if [ -z "$base" ]; then
        echo -e "${YELLOW}↷ Couldn't auto-detect where '$branch' diverged from the default branch.${RESET}"
        _resign_manual_fallback "$branch"
        return $?
    fi

    # %G? per commit: G=good, U=good/unknown validity, B=bad, X/Y/R=expired
    # or revoked, E=can't check, N=no signature at all.
    local hashes=() lines=() i=0
    while IFS= read -r line; do
        i=$((i+1))
        lines+=("$line")
        hashes+=("$(echo "$line" | awk '{print $1}')")
    done < <(git log --pretty=format:"%h [%G?] %s" "${base}..HEAD")

    if [ ${#lines[@]} -eq 0 ]; then
        echo -e "${GREEN}✓ '$branch' has no commits beyond '$default_branch' — nothing to resign.${RESET}"
        return 0
    fi

    echo -e "${CYAN}Commits on '$branch' since it diverged from '$default_branch':${RESET}"
    local n
    for n in "${!lines[@]}"; do
        printf "  %d) %s\n" "$((n+1))" "${lines[$n]}"
    done
    echo ""

    echo -e "${YELLOW}Press Enter to re-sign ALL ${#lines[@]} of the above.${RESET}"
    echo -e "${YELLOW}Or enter a number to re-sign only commits NEWER than that one.${RESET}"
    read -rp "Choice [Enter = all]: " pick

    if [ -n "$pick" ]; then
        if ! [[ $pick =~ ^[0-9]+$ ]] || [ "$pick" -lt 1 ] || [ "$pick" -gt "${#lines[@]}" ]; then
            echo -e "${RED}✗ Invalid selection.${RESET}"
            return 1
        fi
        base="${hashes[$((pick-1))]}"
    fi

    echo ""
    echo -e "${CYAN}This rewrites the selected commit(s) on '$branch',${RESET}"
    echo -e "${CYAN}re-signing each with the key above. Commit hashes will change.${RESET}"
    git log --oneline "${base}..HEAD"
    echo ""
    read -rp "Proceed? (y/n) [n]: " confirm
    if [[ $confirm != y && $confirm != Y ]]; then
        echo -e "${YELLOW}Cancelled.${RESET}"
        return 0
    fi

    run git rebase --exec "git commit --amend --no-edit -S" "$base"
    local status=$?
    if [ $status -ne 0 ]; then
        echo -e "${RED}✗ Rebase stopped — likely a conflict.${RESET}"
        echo -e "${YELLOW}  Resolve it, then run: git rebase --continue${RESET}"
        echo -e "${YELLOW}  Or use 'x) Conflict Resolver' from the main menu.${RESET}"
        return 1
    fi

    echo -e "${GREEN}✓ Rebase complete. New signature status:${RESET}"
    git log --pretty=format:"  %C(yellow)%h%C(reset)  [%G?]  %s" "${base}..HEAD"
    echo ""
    echo -e "${YELLOW}Note: any GitHub review comments anchored to the old commit SHAs${RESET}"
    echo -e "${YELLOW}may show as 'outdated' after you push — that's expected.${RESET}\n"

    force_push_after_reset
}

# Escape hatch for when default-branch divergence can't be auto-detected
# (no origin remote-tracking ref, or genuinely on/near the default branch):
# falls back to the original scroll-and-type-a-hash flow, scoped to the
# last 20 commits so it's still usable without network access.
_resign_manual_fallback() {
    local branch="$1"
    echo -e "${CYAN}Recent commits on '$branch' (status → subject):${RESET}"
    git log --pretty=format:"  %C(yellow)%h%C(reset)  [%G?]  %s" -20
    echo -e "\n"
    echo -e "${YELLOW}Find the newest commit that is NOT marked [N] going down from the top —${RESET}"
    echo -e "${YELLOW}everything above it (and including any [N] ones) will be re-signed.${RESET}\n"

    local base
    read -rp "Base commit hash to rebase FROM (last known-good commit, exclusive): " base
    if [ -z "$base" ] || ! git cat-file -e "${base}^{commit}" 2>/dev/null; then
        echo -e "${RED}✗ Not a valid commit.${RESET}"
        return 1
    fi

    echo ""
    echo -e "${CYAN}This rewrites every commit from ${base} to HEAD on '$branch',${RESET}"
    echo -e "${CYAN}re-signing each with the currently configured key. Commit hashes will change.${RESET}"
    git log --oneline "${base}..HEAD"
    echo ""
    read -rp "Proceed? (y/n) [n]: " confirm
    if [[ $confirm != y && $confirm != Y ]]; then
        echo -e "${YELLOW}Cancelled.${RESET}"
        return 0
    fi

    run git rebase --exec "git commit --amend --no-edit -S" "$base"
    local status=$?
    if [ $status -ne 0 ]; then
        echo -e "${RED}✗ Rebase stopped — likely a conflict.${RESET}"
        echo -e "${YELLOW}  Resolve it, then run: git rebase --continue${RESET}"
        echo -e "${YELLOW}  Or use 'x) Conflict Resolver' from the main menu.${RESET}"
        return 1
    fi

    echo -e "${GREEN}✓ Rebase complete. New signature status:${RESET}"
    git log --pretty=format:"  %C(yellow)%h%C(reset)  [%G?]  %s" "${base}..HEAD"
    echo ""
    force_push_after_reset
}


# ── Push with upstream auto-set ───────────────────────────────────────────────
smart_push() {
    local branch
    branch=$(git branch --show-current)

    progress_step "Checking upstream" 1 2
    local push_out push_status
    if $DRY_RUN; then
        echo -e "${MAGENTA}[dry-run] git push${RESET}"
        return 0
    fi

    push_out=$(git push 2>&1)
    push_status=$?

    if [ $push_status -ne 0 ] && echo "$push_out" | grep -q "no upstream"; then
        echo -e "${YELLOW}No upstream set. Push and set upstream for '$branch'? (y/n)${RESET}"
        read -rp "> " ans
        if [[ $ans == y || $ans == Y ]]; then
            progress_step "Pushing & setting upstream" 2 2
            run_spinner "Push (set-upstream origin $branch)" git push --set-upstream origin "$branch"
        fi
    elif [ $push_status -ne 0 ]; then
        echo -e "${RED}✗ Push failed:${RESET}"
        echo "$push_out"

        if echo "$push_out" | grep -qi "not found"; then
            local remote_url remote_owner gh_active
            remote_url=$(git remote get-url origin 2>/dev/null)
            remote_owner=$(echo "$remote_url" | sed -E 's#.*[:/]([^/]+)/[^/.]+(\.git)?/?$#\1#')
            gh_active=$(gh api user --jq '.login' 2>/dev/null)

            echo ""
            echo -e "${YELLOW}↷ 'Repository not found' usually means:${RESET}"
            echo -e "${YELLOW}  1. The repo name/owner is wrong, or it was renamed/deleted.${RESET}"
            echo -e "${YELLOW}  2. It's private and the currently authenticated account can't see it${RESET}"
            echo -e "${YELLOW}     (GitHub returns this same error for both cases).${RESET}"

            if [ -n "$gh_active" ] && [ -n "$remote_owner" ] && [ "$gh_active" != "$remote_owner" ]; then
                echo ""
                echo -e "${RED}  ✗ Likely cause: gh is authenticated as '$gh_active', but the remote${RESET}"
                echo -e "${RED}    points at owner '$remote_owner' (${remote_url}).${RESET}"
                echo -e "${YELLOW}    Use 's' from the main menu to switch to '$remote_owner', or check${RESET}"
                echo -e "${YELLOW}    '9) Manage Remotes' if the URL itself is wrong.${RESET}"
            fi
        fi
        return 1
    else
        progress_step "Pushed" 2 2
        echo -e "${GREEN}✓ Pushed${RESET}"
        [ -n "$push_out" ] && echo "$push_out"
    fi
}


# ── r) AI-Assisted PR Review ──────────────────────────────────────────────────
ai_pr_review() {
    require_gh || return 1

    echo -e "${CYAN}${BOLD}AI-Assisted PR Review${RESET}\n"
    echo -e "${BLUE}Open PRs:${RESET}"
    gh pr list 2>/dev/null
    echo ""
    read -rp "PR number to review: " prnum
    [ -z "$prnum" ] && { echo -e "${YELLOW}Aborted.${RESET}"; return; }

    echo -e "${MAGENTA}Fetching diff for PR #$prnum...${RESET}"
    local diff
    diff=$(gh pr diff "$prnum" 2>/dev/null)
    if [ -z "$diff" ]; then
        echo -e "${RED}✗ Could not fetch diff. Check the PR number.${RESET}"
        return 1
    fi

    local safe_diff
    safe_diff=$(redact_diff "$diff")

    ai_load_config
    echo ""
    echo "  1) gh copilot"
    echo "  2) AI rotator (active: $AI_ACTIVE)"
    read -rp "Use which engine? [2]: " eng
    eng="${eng:-2}"

    echo -e "${MAGENTA}Asking for review...${RESET}\n"
    if [[ $eng == 1 ]]; then
        require_copilot || return 1
        gh copilot explain \
            "Review this pull request diff. Call out bugs, edge cases, security issues, and style problems. Be concise and use bullet points:
$(echo "$safe_diff" | head -c 8000)" 2>/dev/null | grep -vE '^(gh|Welcome)'
    else
        ai_call "Review this pull request diff. Call out bugs, edge cases, security issues, and style problems. Be concise and use bullet points:
$(echo "$safe_diff" | head -c 8000)"
    fi

    echo ""
    echo "  c) Add review comment on GitHub   v) View full diff   q) Back"
    read -rp "Choice: " rc
    case $rc in
        c|C)
            read -rp "Comment body (Enter to open editor): " body
            if [ -z "$body" ]; then
                run gh pr review "$prnum" --comment
            else
                run gh pr review "$prnum" --comment -b "$body"
            fi
            echo -e "${GREEN}✓ Comment posted${RESET}"
            ;;
        v|V)
            echo "$diff" | less
            ;;
    esac
}

# ── ? Help Screen ─────────────────────────────────────────────────────────────
show_help() {
    clear
    echo -e "${CYAN}${BOLD}=== Git Helper — Key Reference ===${RESET}\n"

    echo -e "${BOLD}── Local ───────────────────────────────────────────────${RESET}"
    echo -e "  ${CYAN}1${RESET}  Status & Info          — git status + branch list"
    echo -e "  ${CYAN}2${RESET}  Pull (rebase)          — fetch + rebase onto upstream"
    echo -e "  ${CYAN}3${RESET}  Add & Commit           — stage preview → commit"
    echo -e "  ${CYAN}4${RESET}  Create Branch          — new branch from current HEAD"
    echo -e "  ${CYAN}5${RESET}  Merge Branch           — merge a branch into current"
    echo -e "  ${CYAN}6${RESET}  Stash / Pop            — stash, pop, list, drop"
    echo -e "  ${CYAN}7${RESET}  View Log               — graph log last 20 commits"
    echo -e "  ${CYAN}sb${RESET} Switch Branch          — numbered picker, stash guard"
    echo -e "  ${CYAN}rb${RESET} Rebase Branch          — rebase current onto picked branch"
    echo -e "  ${CYAN}c${RESET}  Add + Commit + Push    — one-step with push summary"
    echo -e "  ${CYAN}0${RESET}  Advanced               — diff, reset, cherry-pick, blame"

    echo -e "\n${BOLD}── GitHub ──────────────────────────────────────────────${RESET}"
    echo -e "  ${CYAN}cl${RESET} Clone Repo             — by URL or pick from your GitHub"
    echo -e "  ${CYAN}f${RESET}  Fetch Updates          — fetch all remotes + prune"
    echo -e "  ${CYAN}p${RESET}  Push Changes           — push with auto upstream set"
    echo -e "  ${CYAN}pr${RESET} Create Pull Request    — gh pr create --fill"
    echo -e "  ${CYAN}G${RESET}  GitHub Accounts        — login, switch, list/create repos"
    echo -e "  ${CYAN}o${RESET}  Open in Browser        — gh browse"
    echo -e "  ${CYAN}r${RESET}  AI PR Review           — gh copilot reviews a PR's diff"
    echo -e "  ${CYAN}n${RESET}  Init New Repo Here     — git init + optional GitHub push"
    echo -e "  ${CYAN}8${RESET}  Issues / PRs           — list via gh"
    echo -e "  ${CYAN}9${RESET}  Manage Remotes         — add, remove, change URL"

    echo -e "\n${BOLD}── Restore ─────────────────────────────────────────────${RESET}"
    echo -e "  ${CYAN}z${RESET}  Restore to Commit      — checkout / soft / hard / new branch"

    echo -e "\n${BOLD}── Utilities ───────────────────────────────────────────${RESET}"
    echo -e "  ${CYAN}fh${RESET} File History           — per-file log, view & restore"
    echo -e "  ${CYAN}v${RESET}  Quick Diff Summary     — files changed + stat, open full diff"
    echo -e "  ${CYAN}l${RESET}  Branch Cleanup         — delete merged branches in bulk"
    echo -e "  ${CYAN}x${RESET}  Conflict Resolver      — list conflicts, open each, mark resolved"
    echo -e "  ${CYAN}j${RESET}  Jump to Repo Root      — cd to top of repo instantly"
    echo -e "  ${CYAN}w${RESET}  Workspace Switcher     — saved repo list with branch/status"
    echo -e "  ${CYAN}.${RESET}  .gitignore Editor      — add/remove/preset patterns"

    echo -e "\n${BOLD}── Setup ────────────────────────────────────────────────${RESET}"
    echo -e "  ${CYAN}i${RESET}  Git Config             — name, email, credential helper"
    echo -e "  ${CYAN}m${RESET}  AI Engine              — pick active AI + fallback (Gemini/OpenRouter/...)"
    echo -e "  ${CYAN}?${RESET}  Help                   — this screen"
    echo -e "  ${CYAN}q${RESET}  Exit"

    echo -e "\n${BOLD}── CLI flags (call from shell) ─────────────────────────${RESET}"
    echo -e "  ${CYAN}gh1 <file>${RESET}          Jump to file history"
    echo -e "  ${CYAN}gh1 --gitignore${RESET}     Jump to .gitignore editor"
    echo -e "  ${CYAN}gh1 --workspace${RESET}     Jump to workspace switcher"
    echo -e "  ${CYAN}gh1 --dry-run${RESET}       Simulate all commands"

    echo ""
    read -rp "Press Enter to go back..."
}

# ── v) Quick Diff Summary ─────────────────────────────────────────────────────
quick_diff_summary() {
    echo -e "${CYAN}${BOLD}Diff Summary${RESET}\n"

    # Staged
    local staged
    staged=$(git diff --cached --stat 2>/dev/null)
    if [ -n "$staged" ]; then
        echo -e "${GREEN}Staged changes:${RESET}"
        echo "$staged"
    else
        echo -e "${YELLOW}Nothing staged.${RESET}"
    fi

    echo ""

    # Unstaged
    local unstaged
    unstaged=$(git diff --stat 2>/dev/null)
    if [ -n "$unstaged" ]; then
        echo -e "${YELLOW}Unstaged changes:${RESET}"
        echo "$unstaged"
    else
        echo -e "${BLUE}No unstaged changes.${RESET}"
    fi

    # Unpushed commits
    local branch ahead
    branch=$(git branch --show-current)
    ahead=$(git rev-list --count "origin/$branch..HEAD" 2>/dev/null)
    if [ -n "$ahead" ] && [ "$ahead" -gt 0 ]; then
        echo ""
        echo -e "${MAGENTA}↑ $ahead unpushed commit(s) on '$branch':${RESET}"
        git log --oneline "origin/$branch..HEAD" 2>/dev/null
    fi

    echo ""
    echo "  f) Full diff   s) Full staged diff   q) Back"
    read -rp "Choice: " dc
    case $dc in
        f) git diff --color=always | less -R ;;
        s) git diff --cached --color=always | less -R ;;
    esac
}

# ── l) Branch Cleanup ─────────────────────────────────────────────────────────
branch_cleanup() {
    local default_branch
    default_branch=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')
    [ -z "$default_branch" ] && default_branch="main"

    echo -e "${CYAN}${BOLD}Branch Cleanup${RESET}"
    echo -e "${BLUE}Default branch: $default_branch${RESET}\n"

    # Find merged local branches (excluding current and default)
    local merged=()
    while IFS= read -r b; do
        local clean
        clean=$(echo "$b" | sed 's/^\*[[:space:]]*//' | xargs)
        [[ "$clean" == "$default_branch" ]] && continue
        [[ "$clean" == "main" ]] && continue
        [[ "$clean" == "master" ]] && continue
        merged+=("$clean")
    done < <(git branch --merged "$default_branch" 2>/dev/null)

    if [ ${#merged[@]} -eq 0 ]; then
        echo -e "${GREEN}✓ No merged branches to clean up.${RESET}"
        return
    fi

    echo -e "${YELLOW}These branches are already merged into '$default_branch':${RESET}\n"
    for i in "${!merged[@]}"; do
        printf "  ${CYAN}%2d)${RESET} %s\n" "$((i+1))" "${merged[$i]}"
    done

    echo ""
    echo "  a) Delete ALL of them"
    echo "  n) Pick numbers to delete (e.g. 1 3 4)"
    echo "  q) Cancel"
    echo ""
    read -rp "Choice: " bc

    case $bc in
        a|A)
            read -rp "Delete all ${#merged[@]} merged branches? Type YES: " confirm
            if [[ $confirm == "YES" ]]; then
                for b in "${merged[@]}"; do
                    run git branch -d "$b" && echo -e "  ${GREEN}✓ Deleted $b${RESET}"
                done
                # Offer to prune remote tracking refs too
                read -rp "Also prune remote tracking refs? (y/n) [y]: " pr
                pr="${pr:-y}"
                [[ $pr == y || $pr == Y ]] && run git remote prune origin && \
                    echo -e "${GREEN}✓ Remote refs pruned${RESET}"
            else
                echo -e "${YELLOW}Cancelled.${RESET}"
            fi
            ;;
        n|N)
            read -rp "Numbers to delete (space-separated): " picks
            for num in $picks; do
                if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#merged[@]}" ]; then
                    local b="${merged[$((num-1))]}"
                    run git branch -d "$b" && echo -e "  ${GREEN}✓ Deleted $b${RESET}"
                fi
            done
            ;;
        q|Q) echo -e "${YELLOW}Cancelled.${RESET}" ;;
        *)   echo -e "${YELLOW}Invalid.${RESET}" ;;
    esac
}

# ── x) Conflict Resolver ──────────────────────────────────────────────────────
conflict_resolver() {
    echo -e "${CYAN}${BOLD}Conflict Resolver${RESET}\n"

    # Find all conflicted files
    local conflicted=()
    while IFS= read -r f; do
        [ -n "$f" ] && conflicted+=("$f")
    done < <(git diff --name-only --diff-filter=U 2>/dev/null)

    if [ ${#conflicted[@]} -eq 0 ]; then
        echo -e "${GREEN}✓ No conflicts detected.${RESET}"
        return
    fi

    echo -e "${RED}${#conflicted[@]} conflicted file(s):${RESET}\n"
    for i in "${!conflicted[@]}"; do
        # Count conflict markers as severity hint
        local markers
        markers=$(grep -c "^<<<<<<< " "${conflicted[$i]}" 2>/dev/null || echo "?")
        printf "  ${CYAN}%2d)${RESET} %s  ${YELLOW}(%s conflict region(s))${RESET}\n" \
            "$((i+1))" "${conflicted[$i]}" "$markers"
    done

    echo ""
    echo "  o) Open each file one by one in \$EDITOR"
    echo "  m) Open a specific file by number"
    echo "  r) Mark all as resolved (git add) and continue rebase/merge"
    echo "  a) Abort the current merge/rebase"
    echo "  q) Back"
    echo ""
    read -rp "Choice: " xc

    local editor="${EDITOR:-nano}"

    case $xc in
        o|O)
            for i in "${!conflicted[@]}"; do
                echo -e "\n${CYAN}Opening ($((i+1))/${#conflicted[@]}): ${conflicted[$i]}${RESET}"
                $editor "${conflicted[$i]}"
                read -rp "Mark '${conflicted[$i]}' as resolved? (y/n) [y]: " ok
                ok="${ok:-y}"
                if [[ $ok == y || $ok == Y ]]; then
                    run git add "${conflicted[$i]}" && \
                        echo -e "${GREEN}✓ Marked resolved${RESET}"
                fi
            done
            # Check if all resolved
            local remaining
            remaining=$(git diff --name-only --diff-filter=U 2>/dev/null | wc -l)
            if [ "$remaining" -eq 0 ]; then
                echo -e "\n${GREEN}✓ All conflicts resolved.${RESET}"
                echo "  1) Continue rebase   2) Continue merge   3) Nothing (I'll do it manually)"
                read -rp "Choice: " cont
                case $cont in
                    1) run git rebase --continue ;;
                    2) run git merge --continue ;;
                esac
            else
                echo -e "${YELLOW}$remaining file(s) still conflicted.${RESET}"
            fi
            ;;
        m|M)
            read -rp "File number: " num
            if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#conflicted[@]}" ]; then
                local f="${conflicted[$((num-1))]}"
                $editor "$f"
                read -rp "Mark '$f' as resolved? (y/n) [y]: " ok
                ok="${ok:-y}"
                [[ $ok == y || $ok == Y ]] && run git add "$f" && \
                    echo -e "${GREEN}✓ Marked resolved${RESET}"
            fi
            ;;
        r|R)
            for f in "${conflicted[@]}"; do
                run git add "$f" && echo -e "  ${GREEN}✓ $f${RESET}"
            done
            echo ""
            echo "  1) Continue rebase   2) Continue merge   3) Nothing"
            read -rp "Choice: " cont
            case $cont in
                1) run git rebase --continue ;;
                2) run git merge --continue ;;
            esac
            ;;
        a|A)
            echo -e "${YELLOW}Abort current operation?${RESET}"
            echo "  1) Abort rebase   2) Abort merge   3) Cancel"
            read -rp "Choice: " abort_choice
            case $abort_choice in
                1) run git rebase --abort && echo -e "${GREEN}✓ Rebase aborted${RESET}" ;;
                2) run git merge --abort  && echo -e "${GREEN}✓ Merge aborted${RESET}" ;;
            esac
            ;;
        q|Q) return ;;
        *)   echo -e "${YELLOW}Invalid.${RESET}" ;;
    esac
}

# ── j) Jump to Repo Root ──────────────────────────────────────────────────────
jump_to_root() {
    local root
    root=$(git rev-parse --show-toplevel 2>/dev/null)
    if [ -z "$root" ]; then
        echo -e "${RED}✗ Not inside a git repository.${RESET}"
        return
    fi
    if [ "$root" = "$(pwd)" ]; then
        echo -e "${BLUE}Already at repo root: $root${RESET}"
    else
        cd "$root" || return
        echo -e "${GREEN}✓ Jumped to repo root: $root${RESET}"
    fi
}


# ── Restore to a specific commit ──────────────────────────────────────────────
restore_commit() {
    echo -e "${CYAN}Recent commits:${RESET}\n"
    # Show log with index numbers
    local hashes=() messages=()
    while IFS='|' read -r h m; do
        hashes+=("$h")
        messages+=("$m")
    done < <(git log --oneline --no-walk=unsorted --format="%h|%s" -20 2>/dev/null || \
             git log --oneline --format="%h|%s" -20 2>/dev/null)

    # Print numbered list
    for i in "${!hashes[@]}"; do
        printf "  ${CYAN}%2d)${RESET} ${YELLOW}%s${RESET}  %s\n" \
            "$((i+1))" "${hashes[$i]}" "${messages[$i]}"
    done
    echo ""
    read -rp "Pick commit (number or paste hash): " sel

    local target_hash=""
    if [[ $sel =~ ^[0-9]+$ ]] && [ "$sel" -ge 1 ] && [ "$sel" -le "${#hashes[@]}" ]; then
        target_hash="${hashes[$((sel-1))]}"
    elif [ -n "$sel" ]; then
        target_hash="$sel"
    else
        echo -e "${YELLOW}Aborted.${RESET}"
        return
    fi

    # Confirm what we're about to do
    echo ""
    echo -e "${CYAN}Target commit:${RESET}"
    git show --no-patch --format="  Hash:    %H%n  Author:  %an%n  Date:    %ad%n  Message: %s" \
        --date=format:'%Y-%m-%d %H:%M' "$target_hash" 2>/dev/null
    echo ""

    echo -e "${GREEN}How do you want to restore?${RESET}"
    echo -e "  1) ${BOLD}Safe checkout${RESET}   — view/explore that commit (detached HEAD, files change, easy to get back)"
    echo -e "  2) ${BOLD}Soft rewind${RESET}     — move branch back to this commit, keep all file changes staged"
    echo -e "  3) ${BOLD}Hard reset${RESET}      — ${RED}DANGER${RESET}: reset branch AND files exactly to this commit, discard everything after"
    echo -e "  4) ${BOLD}New branch here${RESET} — create a new branch from this commit (safest for experimentation)"
    echo ""
    read -rp "Choice: " mode

    case $mode in
        1)
            run git checkout "$target_hash" && \
            echo -e "${GREEN}✓ Now viewing commit $target_hash (detached HEAD).${RESET}" && \
            echo -e "${BLUE}  Run 'sb) Switch Branch' and pick a branch to return to normal.${RESET}"
            ;;
        2)
            run git reset --soft "$target_hash" && \
            echo -e "${GREEN}✓ Branch rewound to $target_hash — your changes are staged and ready.${RESET}"
            ;;
        3)
            echo -e "${RED}${BOLD}WARNING: All commits after $target_hash will be lost from this branch!${RESET}"
            echo -e "${YELLOW}Files will be reset to exactly how they were at that commit.${RESET}"
            echo ""
            read -rp "Stash current changes first instead? (y/n) [y]: " dostash
            dostash="${dostash:-y}"
            if [[ $dostash == y || $dostash == Y ]]; then
                run git stash && echo -e "${GREEN}✓ Stashed safely first.${RESET}"
            fi
            read -rp "Type YES to confirm hard reset to $target_hash: " confirm
            if [[ $confirm == "YES" ]]; then
                run git reset --hard "$target_hash" && \
                echo -e "${GREEN}✓ Hard reset to $target_hash done.${RESET}"
                force_push_after_reset
            else
                echo -e "${YELLOW}Cancelled.${RESET}"
            fi
            ;;
        4)
            read -rp "New branch name: " newbranch
            if [ -n "$newbranch" ]; then
                run git checkout -b "$newbranch" "$target_hash" && \
                echo -e "${GREEN}✓ Created branch '$newbranch' at commit $target_hash.${RESET}"
            else
                echo -e "${YELLOW}Aborted — empty branch name.${RESET}"
            fi
            ;;
        *)
            echo -e "${YELLOW}Cancelled.${RESET}"
            ;;
    esac
}


# ── fh) File History ──────────────────────────────────────────────────────────
file_history() {
    local target_file="${1:-}"
    if [ -z "$target_file" ]; then
        read -rp "File path: " target_file
    fi
    if [ -z "$target_file" ]; then
        echo -e "${YELLOW}Aborted — no file given.${RESET}"; return
    fi
    if ! git ls-files --error-unmatch "$target_file" &>/dev/null && [ ! -e "$target_file" ]; then
        echo -e "${RED}✗ '$target_file' not found in working tree or git history.${RESET}"; return
    fi

    echo -e "${CYAN}${BOLD}File history: $target_file${RESET}\n"
    local hashes=() messages=() dates=()
    while IFS='|' read -r h d m; do
        hashes+=("$h"); dates+=("$d"); messages+=("$m")
    done < <(git log --follow --format="%h|%ad|%s" --date=format:'%Y-%m-%d %H:%M' -- "$target_file" 2>/dev/null)

    if [ ${#hashes[@]} -eq 0 ]; then
        echo -e "${YELLOW}No commits found for '$target_file'.${RESET}"; return
    fi

    for i in "${!hashes[@]}"; do
        printf "  ${CYAN}%2d)${RESET} ${YELLOW}%s${RESET}  ${BLUE}%s${RESET}  %s\n" \
            "$((i+1))" "${hashes[$i]}" "${dates[$i]}" "${messages[$i]}"
    done

    echo ""
    echo "  v) View file at a commit    r) Restore file to a commit version    q) Back"
    echo ""
    read -rp "Choice: " fhc

    case $fhc in
        v|V)
            read -rp "Commit number: " num
            if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#hashes[@]}" ]; then
                git show "${hashes[$((num-1))]}:$target_file" 2>/dev/null | less
            fi
            ;;
        r|R)
            echo -e "${YELLOW}This restores ONLY '$target_file' — rest of repo untouched.${RESET}"
            read -rp "Commit number to restore from: " num
            if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#hashes[@]}" ]; then
                local chosen_hash="${hashes[$((num-1))]}"
                echo -e "${CYAN}Restore '$target_file' → $chosen_hash (${messages[$((num-1))]})${RESET}"
                read -rp "Confirm? (y/n) [y]: " ok; ok="${ok:-y}"
                if [[ $ok == y || $ok == Y ]]; then
                    run git checkout "$chosen_hash" -- "$target_file" && \
                    echo -e "${GREEN}✓ Restored. File is staged — commit when ready.${RESET}"
                else
                    echo -e "${YELLOW}Cancelled.${RESET}"
                fi
            fi
            ;;
        q|Q) return ;;
        *) echo -e "${YELLOW}No action.${RESET}" ;;
    esac
}

# ── .gitignore Editor ─────────────────────────────────────────────────────────
gitignore_editor() {
    local gifile
    local repo_root
    repo_root=$(git rev-parse --show-toplevel 2>/dev/null)
    gifile="${repo_root:-.}/.gitignore"

    echo -e "${CYAN}${BOLD}.gitignore Editor — $gifile${RESET}\n"
    if [ -f "$gifile" ]; then
        echo -e "${CYAN}Current contents:${RESET}"
        nl -ba "$gifile"
    else
        echo -e "${YELLOW}No .gitignore found — will create one.${RESET}"
    fi

    echo ""
    echo "  1) Add a pattern          2) Add from presets"
    echo "  3) Remove a line          4) Open in \$EDITOR"
    echo "  5) Show ignored files     q) Back"
    echo ""
    read -rp "Choice: " gic

    case $gic in
        1)
            read -rp "Pattern (e.g. *.log  build/  .env): " pat
            if [ -n "$pat" ]; then
                echo "$pat" >> "$gifile"
                echo -e "${GREEN}✓ Added '$pat'${RESET}"
            fi
            ;;
        2)
            echo "Presets (space-separated numbers):"
            echo "  1) Node    2) Python   3) Android  4) Java"
            echo "  5) macOS   6) JetBrains  7) VSCode  8) C/C++   9) Go"
            read -rp "Choice(s): " presets
            for p in $presets; do
                case $p in
                    1) printf "\n# Node\nnode_modules/\ndist/\n.env\n*.log\n" >> "$gifile" ;;
                    2) printf "\n# Python\n__pycache__/\n*.pyc\n.env\nvenv/\n.venv/\n*.egg-info/\n" >> "$gifile" ;;
                    3) printf "\n# Android\n.gradle/\n*.apk\n*.aab\nlocal.properties\n.idea/\nbuild/\n" >> "$gifile" ;;
                    4) printf "\n# Java\n*.class\n*.jar\ntarget/\n.idea/\n" >> "$gifile" ;;
                    5) printf "\n# macOS\n.DS_Store\n.AppleDouble\n._*\n" >> "$gifile" ;;
                    6) printf "\n# JetBrains\n.idea/\n*.iml\n" >> "$gifile" ;;
                    7) printf "\n# VSCode\n.vscode/\n.history/\n" >> "$gifile" ;;
                    8) printf "\n# C/C++\n*.o\n*.a\n*.so\nbuild/\n" >> "$gifile" ;;
                    9) printf "\n# Go\n*.exe\n*.test\nvendor/\n" >> "$gifile" ;;
                esac
            done
            echo -e "${GREEN}✓ Preset(s) added${RESET}"
            ;;
        3)
            [ ! -f "$gifile" ] && echo -e "${YELLOW}No .gitignore to edit.${RESET}" && return
            nl -ba "$gifile"
            read -rp "Line number to remove: " lnum
            [[ $lnum =~ ^[0-9]+$ ]] && run sed -i "${lnum}d" "$gifile" && echo -e "${GREEN}✓ Line $lnum removed${RESET}"
            ;;
        4)
            local editor="${EDITOR:-nano}"
            touch "$gifile"; $editor "$gifile"
            ;;
        5)
            echo -e "${CYAN}Ignored files:${RESET}"
            git ls-files --others --ignored --exclude-standard | head -40
            ;;
        q|Q) return ;;
        *) echo -e "${YELLOW}No action.${RESET}" ;;
    esac
}

# ── w) Workspace Switcher ─────────────────────────────────────────────────────
WORKSPACES_FILE="$HOME/.githelper_workspaces"

workspace_switcher() {
    while true; do
        clear_screen
        echo -e "${CYAN}${BOLD}── Workspace Switcher ──${RESET}\n"

        local workspaces=()
        if [ -f "$WORKSPACES_FILE" ] && [ -s "$WORKSPACES_FILE" ]; then
            while IFS= read -r line; do
                [ -z "$line" ] && continue
                workspaces+=("$line")
            done < "$WORKSPACES_FILE"
        fi

        if [ ${#workspaces[@]} -gt 0 ]; then
            echo -e "${CYAN}Saved workspaces:${RESET}"
            for i in "${!workspaces[@]}"; do
                local ws="${workspaces[$i]}"
                local extra=""
                if [ -d "$ws/.git" ]; then
                    local b; b=$(git -C "$ws" branch --show-current 2>/dev/null)
                    [ -n "$b" ] && extra=" ${BLUE}[$b]${RESET}"
                    if ! git -C "$ws" diff --quiet 2>/dev/null || \
                       ! git -C "$ws" diff --cached --quiet 2>/dev/null; then
                        extra+=" ${YELLOW}⚠${RESET}"
                    fi
                fi
                printf "  ${CYAN}%2d)${RESET} %s%b\n" "$((i+1))" "$ws" "$extra"
            done
        else
            echo -e "${YELLOW}  No saved workspaces yet.${RESET}"
        fi

        echo ""
        echo "  a) Add current dir     A) Add custom path"
        echo "  r) Remove              s) Scan folder for repos"
        echo "  q) Back to main menu"
        echo ""
        echo -e "${BLUE}Pick a number to switch into that workspace.${RESET}\n"
        read -rp "Choice: " wc

        case $wc in
            a)
                local cwd; cwd="$(pwd)"
                touch "$WORKSPACES_FILE"
                if grep -qxF "$cwd" "$WORKSPACES_FILE"; then
                    echo -e "${YELLOW}Already saved.${RESET}"
                else
                    echo "$cwd" >> "$WORKSPACES_FILE"
                    echo -e "${GREEN}✓ Added: $cwd${RESET}"
                fi
                ;;
            A)
                read -rp "Full path: " wpath
                if [ -d "$wpath" ]; then
                    touch "$WORKSPACES_FILE"
                    grep -qxF "$wpath" "$WORKSPACES_FILE" && \
                        echo -e "${YELLOW}Already saved.${RESET}" || \
                        { echo "$wpath" >> "$WORKSPACES_FILE"; echo -e "${GREEN}✓ Added${RESET}"; }
                else
                    echo -e "${RED}✗ Directory not found.${RESET}"
                fi
                ;;
            r)
                [ ${#workspaces[@]} -eq 0 ] && echo -e "${YELLOW}Nothing to remove.${RESET}" && \
                    read -rp "Press Enter..." && continue
                read -rp "Number to remove: " num
                if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#workspaces[@]}" ]; then
                    local to_rm="${workspaces[$((num-1))]}"
                    grep -vxF "$to_rm" "$WORKSPACES_FILE" > "${WORKSPACES_FILE}.tmp" && \
                        mv "${WORKSPACES_FILE}.tmp" "$WORKSPACES_FILE"
                    echo -e "${GREEN}✓ Removed '$to_rm'${RESET}"
                fi
                ;;
            s)
                read -rp "Parent folder to scan [$HOME]: " scandir
                scandir="${scandir:-$HOME}"
                echo -e "${CYAN}Scanning $scandir ...${RESET}"
                local found=0; touch "$WORKSPACES_FILE"
                while IFS= read -r gitdir; do
                    local rd; rd="$(dirname "$gitdir")"
                    if ! grep -qxF "$rd" "$WORKSPACES_FILE"; then
                        echo "$rd" >> "$WORKSPACES_FILE"
                        echo -e "  ${GREEN}+${RESET} $rd"
                        ((found++))
                    fi
                done < <(find "$scandir" -maxdepth 4 -name ".git" -type d 2>/dev/null)
                echo -e "${GREEN}✓ Added $found new workspace(s)${RESET}"
                ;;
            q|Q) return ;;
            *)
                if [[ $wc =~ ^[0-9]+$ ]] && [ "$wc" -ge 1 ] && [ "$wc" -le "${#workspaces[@]}" ]; then
                    local dest="${workspaces[$((wc-1))]}"
                    if [ -d "$dest" ]; then
                        cd "$dest" || return
                        echo -e "${GREEN}✓ Switched to: $dest${RESET}"
                        sleep 0.5
                    else
                        echo -e "${RED}✗ Directory gone: $dest${RESET}"
                        read -rp "Remove from list? (y/n) [y]: " rmd; rmd="${rmd:-y}"
                        if [[ $rmd == y || $rmd == Y ]]; then
                            grep -vxF "$dest" "$WORKSPACES_FILE" > "${WORKSPACES_FILE}.tmp" && \
                                mv "${WORKSPACES_FILE}.tmp" "$WORKSPACES_FILE"
                        fi
                    fi
                else
                    echo -e "${RED}Invalid.${RESET}"
                fi
                ;;
        esac

        echo ""; read -rp "Press Enter to continue..."
    done
}

# ── Header ────────────────────────────────────────────────────────────────────
clear_screen() {
    clear
    echo -e "${CYAN}${BOLD}=== Git + GitHub Helper ===${RESET}"
    $DRY_RUN && echo -e "${MAGENTA}${BOLD}  ⚠ DRY-RUN MODE — no commands will execute${RESET}"
    echo -e "${BLUE}Dir:    $(pwd)${RESET}"

    local branch dirty=""
    branch=$(git branch --show-current 2>/dev/null)
    local in_repo=false
    if [ -n "$branch" ]; then
        in_repo=true
        local branch_color="${GREEN}"
        if ! git diff --quiet 2>/dev/null || ! git diff --cached --quiet 2>/dev/null; then
            dirty=" ${YELLOW}⚠ uncommitted changes${RESET}"
            branch_color="${YELLOW}"
        fi
        # Check for conflicts
        if git diff --name-only --diff-filter=U 2>/dev/null | grep -q .; then
            branch_color="${RED}"
            dirty=" ${RED}✗ conflicts detected${RESET}"
        fi
        echo -e "${BLUE}Branch: ${branch_color}${branch}${RESET}${dirty}"

        local remote_url
        remote_url=$(git remote get-url origin 2>/dev/null)
        if [ -n "$remote_url" ]; then
            # Normalize to owner/repo for both git@ and https:// remotes
            local repo_slug
            repo_slug=$(echo "$remote_url" | sed -E 's#(git@|https://)github.com[:/]##; s#\.git$##')
            echo -e "${BLUE}Repo:   ${repo_slug}${RESET}"
        fi
    else
        echo -e "${BLUE}Branch: ${RED}(not a git repo)${RESET}"
    fi

    # Account + signing status — reads local git config only (no network
    # calls), so this stays instant even though clear_screen runs on every
    # menu redraw. This is deliberately what governs actual commit
    # behavior (not gh's OAuth session), since that's the thing that broke
    # before: the two can silently drift apart.
    local cfg_scope=""
    $in_repo && cfg_scope="--local"
    local acct_name acct_email gpgsign signkey
    acct_name=$(git config $cfg_scope user.name 2>/dev/null || git config user.name 2>/dev/null)
    acct_email=$(git config $cfg_scope user.email 2>/dev/null || git config user.email 2>/dev/null)
    gpgsign=$(git config $cfg_scope commit.gpgsign 2>/dev/null || git config commit.gpgsign 2>/dev/null)
    signkey=$(git config $cfg_scope user.signingkey 2>/dev/null || git config user.signingkey 2>/dev/null)

    if [ -n "$acct_name" ] || [ -n "$acct_email" ]; then
        echo -e "${BLUE}Account: ${acct_name:-?} <${acct_email:-?}>${RESET}"
    fi

    if [ "$gpgsign" = "true" ]; then
        if [ -n "$signkey" ] && [ -f "$signkey" ]; then
            echo -e "${GREEN}Signing: ON  (${signkey})${RESET}"
        elif [ -n "$signkey" ]; then
            echo -e "${RED}Signing: ON  but key missing: ${signkey} ⚠ commits will fail${RESET}"
        else
            echo -e "${RED}Signing: ON  but no user.signingkey set ⚠ commits will fail${RESET}"
        fi
    else
        echo -e "${YELLOW}Signing: off${RESET}"
    fi

    echo -e "${BLUE}────────────────────────────────────────────────${RESET}"
}


# ── Direct-launch dispatch ────────────────────────────────────────────────────
# Runs immediately when called with a file/flag argument, then exits.
if [ -n "$DIRECT_MODE" ]; then
    # Minimal color setup already done above
    case "$DIRECT_MODE" in
        filehistory)
            if ! git rev-parse --git-dir &>/dev/null; then
                echo -e "${RED}✗ Not inside a git repository.${RESET}"
                exit 1
            fi
            file_history "$DIRECT_FILE"
            ;;
        gitignore)
            gitignore_editor
            ;;
        workspace)
            workspace_switcher
            ;;
        help)
            show_help
            ;;
    esac
    exit 0
fi

# ── Per-account SSH signing key ───────────────────────────────────────────────
# Looks up a saved "username:keypath:email" mapping. Prints nothing and
# returns 1 if no mapping exists for this account yet.
lookup_ssh_key_for_account() {
    local user="$1"
    [ -f "$SSH_KEY_CONFIG_FILE" ] || return 1
    grep "^${user}:" "$SSH_KEY_CONFIG_FILE" | tail -1
}

# Applies (or updates) a "username:keypath:email" mapping in the config file,
# replacing any existing line for that username.
save_ssh_key_for_account() {
    local user="$1" keypath="$2" email="$3"
    touch "$SSH_KEY_CONFIG_FILE"
    grep -v "^${user}:" "$SSH_KEY_CONFIG_FILE" > "${SSH_KEY_CONFIG_FILE}.tmp" 2>/dev/null
    mv "${SSH_KEY_CONFIG_FILE}.tmp" "$SSH_KEY_CONFIG_FILE"
    echo "${user}:${keypath}:${email}" >> "$SSH_KEY_CONFIG_FILE"
}

# Applies signing config (gpg.format=ssh, user.signingkey, commit.gpgsign,
# user.email/name) for the given account's mapped key, and registers the
# public key in allowed_signers so local `git log --show-signature` can
# resolve the principal too (not just GitHub's server-side check).
# Scopes to the current repo (--local) when inside one, since that's what
# keeps two accounts on one Termux install from clobbering each other's
# global git identity. Falls back to --global with a warning otherwise.
apply_account_signing() {
    local user="$1" entry keypath email
    entry=$(lookup_ssh_key_for_account "$user")

    local scope="--local" scope_label="this repo only"
    if ! git rev-parse --git-dir &>/dev/null; then
        scope="--global"
        scope_label="global — not inside a repo right now"
        echo -e "${YELLOW}⚠ Not inside a repo, so signing config is being applied globally instead.${RESET}"
        echo -e "${YELLOW}  Re-run this (or just switch accounts again) once you're inside the repo you're about to commit in.${RESET}"
    fi

    if [ -z "$entry" ]; then
        # No key mapped for this account. Signing is strictly OPT-IN per
        # account -- explicitly turn it OFF here rather than leaving
        # whatever commit.gpgsign/user.signingkey happened to be set
        # already (stale global config, a previous account's leftover
        # local override, etc). This is what stops switching to an
        # unconfigured account from silently inheriting a forced,
        # possibly-broken signing setup.
        run git config $scope commit.gpgsign false

        # Identity must still follow the switch even with no signing key
        # mapped -- otherwise user.name/user.email are left pointing at
        # whatever account was active before, and commits get authored
        # as the wrong person while signing is (correctly) off.
        local noKeyEmail
        noKeyEmail=$(gh api user --jq '.email // empty' 2>/dev/null)
        noKeyEmail="${noKeyEmail:-${user}@users.noreply.github.com}"
        run git config $scope user.name "$user"
        run git config $scope user.email "$noKeyEmail"

        echo -e "${YELLOW}↷ No SSH signing key on file for $user — signing turned OFF for $scope_label.${RESET}"
        echo -e "${YELLOW}  Identity set to $user <$noKeyEmail> for $scope_label.${RESET}"
        echo -e "${YELLOW}  Use 'k) Set/generate SSH signing key' in the Account Manager if you want $user to sign commits.${RESET}"
        return 1
    fi
    IFS=':' read -r _ keypath email <<< "$entry"

    if [ ! -f "$keypath" ]; then
        echo -e "${RED}✗ Signing key for $user not found at $keypath (was it moved/deleted?)${RESET}"
        echo -e "${YELLOW}↷ Turning signing OFF for $scope_label until this is fixed.${RESET}"
        run git config $scope commit.gpgsign false
        return 1
    fi
    if [ ! -f "${keypath}.pub" ]; then
        echo -e "${RED}✗ No public key at ${keypath}.pub — can't configure signing for $user.${RESET}"
        run git config $scope commit.gpgsign false
        return 1
    fi

    run git config $scope gpg.format ssh
    # Git's ssh-signing format wants the PUBLIC key path here -- it shells
    # out to `ssh-keygen -Y sign` against this file and expects your
    # ssh-agent to hold the matching private key. Pointing this at the
    # private key file instead is the more common mistake and can fail
    # depending on git/ssh-keygen version.
    run git config $scope user.signingkey "${keypath}.pub"
    run git config $scope commit.gpgsign true
    [ -n "$email" ] && run git config $scope user.email "$email"
    run git config $scope user.name "$user"

    mkdir -p "$(dirname "$ALLOWED_SIGNERS_FILE")"
    touch "$ALLOWED_SIGNERS_FILE"
    local pubkey
    pubkey=$(cat "${keypath}.pub")
    if [ -n "$pubkey" ] && [ -n "$email" ]; then
        grep -qF "$pubkey" "$ALLOWED_SIGNERS_FILE" 2>/dev/null || echo "$email $pubkey" >> "$ALLOWED_SIGNERS_FILE"
        run git config $scope gpg.ssh.allowedSignersFile "$ALLOWED_SIGNERS_FILE"
    fi

    # Make sure the private key is actually loaded in the agent -- signing
    # will fail with a confusing error otherwise, same shape as this bug.
    if command -v ssh-add &>/dev/null; then
        if ! ssh-add -l 2>/dev/null | grep -qF "$(ssh-keygen -lf "${keypath}.pub" 2>/dev/null | awk '{print $2}')"; then
            echo -e "${YELLOW}⚠ This key isn't loaded in ssh-agent. Run: ssh-add $keypath${RESET}"
        fi
    fi

    echo -e "${GREEN}✓ Signing identity set for $user ($scope_label): $keypath${RESET}"
}

# Interactive: point an existing key at an account, or generate a fresh
# ed25519 keypair for it. Either way, saves the mapping and reminds the
# user to register the .pub key on GitHub as a *Signing Key* (GitHub tracks
# Authentication and Signing keys separately — the same key can be added
# as both, but each needs to be added explicitly).
set_ssh_key_for_account() {
    local user="$1"
    echo -e "${CYAN}${BOLD}SSH signing key for: $user${RESET}\n"

    local existing
    existing=$(lookup_ssh_key_for_account "$user")
    if [ -n "$existing" ]; then
        echo -e "${BLUE}Currently mapped: $(echo "$existing" | cut -d: -f2) (email: $(echo "$existing" | cut -d: -f3))${RESET}\n"
    fi

    echo "1) Use an existing key file"
    echo "2) Generate a new ed25519 keypair for this account"
    read -rp "Choice [2]: " kc
    kc="${kc:-2}"

    local keypath email
    if [[ $kc == 1 ]]; then
        read -rp "Path to private key [~/.ssh/id_ed25519_${user}]: " keypath
        keypath="${keypath:-$HOME/.ssh/id_ed25519_${user}}"
        keypath="${keypath/#\~/$HOME}"
        if [ ! -f "$keypath" ]; then
            echo -e "${RED}✗ No file at $keypath${RESET}"
            return 1
        fi
    else
        keypath="$HOME/.ssh/id_ed25519_${user}"
        if [ -f "$keypath" ]; then
            echo -e "${YELLOW}⚠ $keypath already exists.${RESET}"
            read -rp "Overwrite with a new keypair? (y/n) [n]: " ow
            [[ $ow != y && $ow != Y ]] && { echo -e "${YELLOW}Keeping existing key.${RESET}"; }
        fi
        if [ ! -f "$keypath" ] || [[ $ow == y || $ow == Y ]]; then
            read -rp "Email/comment for this key [${user}@users.noreply.github.com]: " keycomment
            keycomment="${keycomment:-${user}@users.noreply.github.com}"
            run ssh-keygen -t ed25519 -C "$keycomment" -f "$keypath"
        fi
    fi

    read -rp "Email to associate with commits [${email:-$(gh api user --jq '.email // empty' 2>/dev/null)}]: " email_in
    email="${email_in:-$email}"
    if [ -z "$email" ]; then
        read -rp "Email is required for allowed_signers — enter it: " email
    fi

    save_ssh_key_for_account "$user" "$keypath" "$email"
    echo -e "${GREEN}✓ Saved: $user → $keypath ($email)${RESET}\n"

    if [ -f "${keypath}.pub" ]; then
        echo -e "${CYAN}Public key (copy this to GitHub):${RESET}"
        cat "${keypath}.pub"
        echo ""
        echo -e "${YELLOW}→ GitHub → Settings → SSH and GPG keys → New SSH key${RESET}"
        echo -e "${YELLOW}  Set 'Key type' to 'Signing Key' (add as 'Authentication Key' too if you also push over SSH).${RESET}"
        echo -e "${YELLOW}  This must be done on the ${BOLD}${user}${RESET}${YELLOW} account specifically.${RESET}"
    fi

    read -rp "Apply this signing config now, for the current repo? (y/n) [y]: " applynow
    applynow="${applynow:-y}"
    [[ $applynow == y || $applynow == Y ]] && apply_account_signing "$user"
}

# ── GitHub Account Manager ────────────────────────────────────────────────────
# Switches to a saved gh account by name: re-wires git's credential helper
# to gh, applies that account's SSH signing key (if one is on file), and
# re-saves the username to CONFIG_FILE if not already there.
gh_switch_to_saved() {
    local user="$1"
    echo -e "${CYAN}Switching to $user — you may be prompted for a token.${RESET}"

    local switch_err
    switch_err=$(gh auth switch --user "$user" 2>&1)
    if [ $? -ne 0 ]; then
        echo -e "${YELLOW}↷ 'gh auth switch' couldn't switch to '$user': ${switch_err}${RESET}"
        echo -e "${YELLOW}  Usually means '$user' isn't already a logged-in gh profile on this device.${RESET}"
        read -rp "Log in as $user now instead? (y/n) [y]: " dologin
        dologin="${dologin:-y}"
        [[ $dologin == y || $dologin == Y ]] && gh auth login
    fi

    # Re-wire git to defer to `gh` for credentials, so pushes/pulls
    # actually follow whichever account is active in gh.
    gh auth setup-git 2>/dev/null

    local new_user
    new_user=$(gh api user --jq '.login' 2>/dev/null)
    if [ -n "$new_user" ]; then
        if [ "$new_user" != "$user" ]; then
            echo -e "${RED}✗ gh's active account is now '$new_user', not '$user' as requested.${RESET}"
            echo -e "${YELLOW}  Pushes/pulls will authenticate as '$new_user' until this is resolved --${RESET}"
            echo -e "${YELLOW}  even if the header below shows '$user' (that only reflects local git${RESET}"
            echo -e "${YELLOW}  identity, not which gh session is actually active).${RESET}"
        fi

        touch "$CONFIG_FILE"
        if ! grep -qx "$new_user" "$CONFIG_FILE"; then
            echo "$new_user" >> "$CONFIG_FILE"
            echo -e "${GREEN}✓ Saved account: $new_user${RESET}"
        else
            echo -e "${GREEN}✓ Now using: $new_user${RESET}"
        fi

        # Auto-apply this account's signing key, if one has been configured.
        # This is what prevents the "signed with the wrong account's key"
        # mixup — every switch re-points user.signingkey/user.email at the
        # right identity instead of leaving whatever was set last.
        apply_account_signing "$new_user"
    else
        echo -e "${RED}✗ Couldn't confirm gh's active account after switching.${RESET}"
        echo -e "${YELLOW}  Run 'gh auth status' to check manually before pushing.${RESET}"
    fi
}

# Top-level quick switcher: lists saved accounts and switches immediately,
# no need to drill into the Account Manager submenu.
quick_switch_account() {
    require_gh || return 1

    local accounts=()
    if [ -f "$CONFIG_FILE" ] && [ -s "$CONFIG_FILE" ]; then
        echo -e "${CYAN}${BOLD}Switch GitHub account:${RESET}\n"
        while IFS= read -r line; do
            [ -z "$line" ] && continue
            accounts+=("$line")
            echo "  $((${#accounts[@]}))) $line"
        done < "$CONFIG_FILE"
    fi

    if [ ${#accounts[@]} -eq 0 ]; then
        echo -e "${YELLOW}No saved accounts yet. Use 'G) GitHub Accounts' to log in first.${RESET}"
        return 1
    fi

    echo ""
    read -rp "Switch to number (or Enter to cancel): " num
    [ -z "$num" ] && { echo -e "${YELLOW}Cancelled.${RESET}"; return 0; }

    if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#accounts[@]}" ]; then
        gh_switch_to_saved "${accounts[$((num-1))]}"
    else
        echo -e "${YELLOW}Invalid choice.${RESET}"
    fi
}

manage_accounts() {
    require_gh || return 1

    while true; do
        clear_screen
        echo -e "${CYAN}${BOLD}── GitHub Account Manager ──${RESET}\n"

        # Show saved accounts
        local accounts=()
        if [ -f "$CONFIG_FILE" ] && [ -s "$CONFIG_FILE" ]; then
            echo -e "${CYAN}Saved accounts:${RESET}"
            while IFS= read -r line; do
                [ -z "$line" ] && continue
                accounts+=("$line")
                echo "  $((${#accounts[@]}))) $line"
            done < "$CONFIG_FILE"
        else
            echo -e "${YELLOW}  No saved accounts yet.${RESET}"
        fi

        echo ""
        echo -e "${GREEN}Options:${RESET}"
        echo "  s) Switch to a saved account"
        echo "  a) Add a new account (login)"
        echo "  r) Remove a saved account"
        echo "  i) Identity check (gh login vs. git identity + signing key)"
        echo "  k) Set/generate SSH signing key for an account"
        echo "  o) Turn OFF signing for the current repo right now"
        echo "  l) List your GitHub repos"
        echo "  n) Create a new GitHub repo"
        echo "  c) Clone one of your GitHub repos"
        echo "  b) Bulk-update old repos' remote URLs (username changed)"
        echo "  q) Back to main menu"
        echo ""
        read -rp "Choice: " ac
        echo ""

        case "$ac" in

            s|S)
                if [ ${#accounts[@]} -eq 0 ]; then
                    echo -e "${YELLOW}No saved accounts yet — add one first ('a').${RESET}"
                else
                    read -rp "Enter account number: " num
                    if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#accounts[@]}" ]; then
                        gh_switch_to_saved "${accounts[$((num-1))]}"
                    else
                        echo -e "${YELLOW}Invalid choice.${RESET}"
                    fi
                fi
                ;;

            a|A)
                echo -e "${CYAN}Current gh status:${RESET}"
                gh auth status 2>&1 | head -5
                echo ""
                echo "1) Login with browser (OAuth)"
                echo "2) Login with token"
                read -rp "Choice: " lc

                case $lc in
                    1)
                        gh auth login --web
                        gh auth setup-git 2>/dev/null
                        new_user=$(gh api user --jq '.login' 2>/dev/null)
                        if [ -n "$new_user" ]; then
                            touch "$CONFIG_FILE"
                            grep -qx "$new_user" "$CONFIG_FILE" || echo "$new_user" >> "$CONFIG_FILE"
                            echo -e "${GREEN}✓ Saved account: $new_user${RESET}"
                        fi
                        ;;
                    2)
                        gh auth login --with-token
                        gh auth setup-git 2>/dev/null
                        new_user=$(gh api user --jq '.login' 2>/dev/null)
                        if [ -n "$new_user" ]; then
                            touch "$CONFIG_FILE"
                            grep -qx "$new_user" "$CONFIG_FILE" || echo "$new_user" >> "$CONFIG_FILE"
                            echo -e "${GREEN}✓ Saved account: $new_user${RESET}"
                        fi
                        ;;
                esac
                ;;

            r|R)
                if [ ${#accounts[@]} -eq 0 ]; then
                    echo -e "${YELLOW}No accounts to remove.${RESET}"
                else
                    read -rp "Enter number to remove: " num
                    if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#accounts[@]}" ]; then
                        local to_remove="${accounts[$((num-1))]}"
                        sed -i "/^${to_remove}$/d" "$CONFIG_FILE"
                        echo -e "${GREEN}✓ Removed '$to_remove'${RESET}"
                    fi
                fi
                ;;

            i|I)
                echo -e "${CYAN}Current GitHub login:${RESET}"
                gh auth status 2>&1
                echo ""

                # Cross-check: does the account gh thinks is active actually
                # match what git will use to author/sign the next commit?
                # This is the exact drift that caused the earlier mixup --
                # gh switching accounts and git's local config staying put.
                local gh_active git_scope="--local" git_name git_email mapped_key
                gh_active=$(gh api user --jq '.login' 2>/dev/null)
                if ! git rev-parse --git-dir &>/dev/null; then
                    git_scope="--global"
                fi
                git_name=$(git config $git_scope user.name 2>/dev/null || git config user.name 2>/dev/null)
                git_email=$(git config $git_scope user.email 2>/dev/null || git config user.email 2>/dev/null)

                echo -e "${CYAN}${BOLD}Cross-check (gh session vs. git identity):${RESET}"
                if [ -z "$gh_active" ]; then
                    echo -e "${YELLOW}  Couldn't determine gh's active account (are you logged in?)${RESET}"
                elif [ -z "$git_name" ]; then
                    echo -e "${YELLOW}  gh active: $gh_active — but no git user.name is set here yet.${RESET}"
                elif [ "$gh_active" = "$git_name" ]; then
                    echo -e "${GREEN}  ✓ gh active ($gh_active) matches git's configured identity ($git_name).${RESET}"
                else
                    echo -e "${RED}  ✗ MISMATCH: gh is logged in as '$gh_active', but git here is configured as '$git_name' <${git_email:-?}>.${RESET}"
                    echo -e "${YELLOW}    Commits will be authored/signed as '$git_name', not '$gh_active'.${RESET}"
                    echo -e "${YELLOW}    Use 's' from the main menu, or 's' here, to switch to the matching account.${RESET}"
                fi

                if [ -n "$git_name" ]; then
                    mapped_key=$(lookup_ssh_key_for_account "$git_name")
                    if [ -n "$mapped_key" ]; then
                        local mk_path
                        mk_path=$(echo "$mapped_key" | cut -d: -f2)
                        if [ -f "$mk_path" ]; then
                            echo -e "${GREEN}  ✓ Signing key for $git_name found: $mk_path${RESET}"
                        else
                            echo -e "${RED}  ✗ Signing key mapped for $git_name is missing on disk: $mk_path${RESET}"
                        fi
                    else
                        echo -e "${YELLOW}  ↷ No signing key mapped for $git_name yet (commits will be unsigned).${RESET}"
                    fi
                fi
                ;;

            l|L)
                echo -e "${CYAN}Your GitHub repositories:${RESET}\n"
                gh repo list --limit 30 --json name,visibility,updatedAt \
                    --template '{{range .}}  {{.name}} ({{.visibility}}) — updated {{timeago .updatedAt}}{{"\n"}}{{end}}' 2>/dev/null \
                    || gh repo list --limit 30
                ;;

            n|N)
                echo -e "${CYAN}Create a new GitHub repository${RESET}\n"
                read -rp "Repo name: " rname
                [ -z "$rname" ] && echo -e "${YELLOW}Aborted.${RESET}" && continue

                read -rp "Description (optional): " rdesc
                echo "Visibility:  1) Public   2) Private"
                read -rp "Choice [1]: " rvis
                local vis_flag="--public"
                [[ $rvis == 2 ]] && vis_flag="--private"

                read -rp "Init with README? (y/n) [y]: " rreadme
                rreadme="${rreadme:-y}"
                local readme_flag=""
                [[ $rreadme == y || $rreadme == Y ]] && readme_flag="--add-readme"

                echo ""
                run gh repo create "$rname" $vis_flag $readme_flag \
                    ${rdesc:+--description "$rdesc"} && \
                    echo -e "${GREEN}✓ Repo '$rname' created on GitHub${RESET}"

                # Offer to clone it locally
                read -rp "Clone it locally now? (y/n) [y]: " doclone
                doclone="${doclone:-y}"
                if [[ $doclone == y || $doclone == Y ]]; then
                    local ghuser
                    ghuser=$(gh api user --jq '.login' 2>/dev/null)
                    run_spinner "Cloning ${rname}" git clone "https://github.com/${ghuser}/${rname}.git"
                fi
                ;;

            c|C)
                echo -e "${CYAN}Your repos:${RESET}\n"
                local repo_names=()
                while IFS= read -r r; do
                    repo_names+=("$r")
                    echo "  $((${#repo_names[@]}))) $r"
                done < <(gh repo list --limit 50 --json nameWithOwner --jq '.[].nameWithOwner' 2>/dev/null)

                if [ ${#repo_names[@]} -eq 0 ]; then
                    echo -e "${YELLOW}No repos found.${RESET}"
                else
                    echo ""
                    read -rp "Pick number to clone: " num
                    if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#repo_names[@]}" ]; then
                        local chosen="${repo_names[$((num-1))]}"
                        run gh repo clone "$chosen" && echo -e "${GREEN}✓ Cloned $chosen${RESET}"
                    fi
                fi
                ;;

            o|O)
                local xscope="--local" xlabel="this repo"
                if ! git rev-parse --git-dir &>/dev/null; then
                    xscope="--global"
                    xlabel="global"
                fi
                run git config $xscope commit.gpgsign false
                echo -e "${GREEN}✓ Signing turned OFF ($xlabel). Commits will go through unsigned until you re-enable it.${RESET}"
                ;;

            b|B)
                bulk_update_remote_username
                ;;

            k|K)
                if [ ${#accounts[@]} -eq 0 ]; then
                    echo -e "${YELLOW}No saved accounts yet — add one first.${RESET}"
                else
                    read -rp "Enter account number: " num
                    if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#accounts[@]}" ]; then
                        set_ssh_key_for_account "${accounts[$((num-1))]}"
                    else
                        echo -e "${YELLOW}Invalid choice.${RESET}"
                    fi
                fi
                ;;

            q|Q) return ;;
            *) echo -e "${RED}Invalid.${RESET}" ;;
        esac

        echo ""
        read -rp "Press Enter to continue..."
    done
}

# ── Bulk-update remote URLs after a GitHub username change ───────────────────
# Handles the "we renamed dumbCodesOnly -> allocsys, then created a NEW
# dumbCodesOnly account" situation: old repos' remote URLs still literally
# say .../dumbCodesOnly/..., which now resolves to the *new* account instead
# of the renamed one. Scans a folder tree for repos, finds every remote
# matching the old username, and rewrites it -- across as many repos as are
# found, not just the one you happen to be sitting in.
bulk_update_remote_username() {
    echo -e "${CYAN}${BOLD}Bulk-update remote username${RESET}\n"
    echo -e "${BLUE}For when a GitHub username was reassigned (renamed away, then reused${RESET}"
    echo -e "${BLUE}by a new account) and old local repos still point at the old owner.${RESET}\n"

    read -rp "Old GitHub username (as it appears in existing remote URLs): " old_user
    [ -z "$old_user" ] && { echo -e "${YELLOW}Aborted.${RESET}"; return; }
    read -rp "New GitHub username to point those remotes at: " new_user
    [ -z "$new_user" ] && { echo -e "${YELLOW}Aborted.${RESET}"; return; }
    if [ "$old_user" = "$new_user" ]; then
        echo -e "${YELLOW}Old and new are the same — nothing to do.${RESET}"
        return
    fi

    read -rp "Parent folder to scan [$HOME]: " scandir
    scandir="${scandir:-$HOME}"
    scandir="${scandir/#\~/$HOME}"

    echo -e "${CYAN}Scanning $scandir for remotes referencing github.com/$old_user/...${RESET}\n"

    local repo_dirs=() remote_names=() old_urls=()
    while IFS= read -r gitdir; do
        local rd; rd="$(dirname "$gitdir")"
        while IFS= read -r rn; do
            [ -z "$rn" ] && continue
            local url; url=$(git -C "$rd" remote get-url "$rn" 2>/dev/null)
            [ -z "$url" ] && continue
            case "$url" in
                *"github.com/${old_user}/"*|*"github.com:${old_user}/"*)
                    repo_dirs+=("$rd")
                    remote_names+=("$rn")
                    old_urls+=("$url")
                    ;;
            esac
        done < <(git -C "$rd" remote 2>/dev/null)
    done < <(find "$scandir" -maxdepth 5 -name ".git" -type d 2>/dev/null)

    if [ ${#repo_dirs[@]} -eq 0 ]; then
        echo -e "${YELLOW}No remotes found referencing '$old_user' under $scandir.${RESET}"
        echo -e "${YELLOW}(Try a broader parent folder, or check the username is exactly right.)${RESET}"
        return
    fi

    echo -e "${CYAN}Found ${#repo_dirs[@]} remote(s) to update:${RESET}\n"
    local i new_url
    for i in "${!repo_dirs[@]}"; do
        new_url=$(echo "${old_urls[$i]}" | sed -E "s#(github\.com[:/])${old_user}/#\1${new_user}/#")
        printf "  ${CYAN}%2d)${RESET} %s ${BLUE}[%s]${RESET}\n      %s\n      ${GREEN}→ %s${RESET}\n" \
            "$((i+1))" "${repo_dirs[$i]}" "${remote_names[$i]}" "${old_urls[$i]}" "$new_url"
    done

    echo ""
    read -rp "Apply all these updates? (y/n) [y]: " apply
    apply="${apply:-y}"
    if [[ $apply != y && $apply != Y ]]; then
        echo -e "${YELLOW}Cancelled — no changes made.${RESET}"
        return
    fi

    local updated=0
    for i in "${!repo_dirs[@]}"; do
        new_url=$(echo "${old_urls[$i]}" | sed -E "s#(github\.com[:/])${old_user}/#\1${new_user}/#")
        if run git -C "${repo_dirs[$i]}" remote set-url "${remote_names[$i]}" "$new_url"; then
            ((updated++))
        else
            echo -e "${RED}✗ Failed to update ${repo_dirs[$i]} [${remote_names[$i]}]${RESET}"
        fi
    done
    echo -e "${GREEN}✓ Updated $updated remote(s).${RESET}"

    if [ -n "$(lookup_ssh_key_for_account "$new_user")" ]; then
        echo ""
        read -rp "Also apply '$new_user's git identity/signing config in each updated repo? (y/n) [y]: " reapply
        reapply="${reapply:-y}"
        if [[ $reapply == y || $reapply == Y ]]; then
            local d seen=()
            for d in "${repo_dirs[@]}"; do
                [[ " ${seen[*]} " == *" $d "* ]] && continue
                seen+=("$d")
                echo -e "${CYAN}→ $d${RESET}"
                ( cd "$d" && apply_account_signing "$new_user" )
            done
        fi
    fi
}


init_repo() {
    if git rev-parse --git-dir &>/dev/null; then
        echo -e "${YELLOW}Already a git repo ($(git rev-parse --show-toplevel)).${RESET}"
        read -rp "Continue anyway? (y/n): " yn
        [[ $yn != y && $yn != Y ]] && return
    fi

    echo -e "${CYAN}Initialising repo in: $(pwd)${RESET}\n"

    read -rp "Default branch name [main]: " initbranch
    initbranch="${initbranch:-main}"

    run git init -b "$initbranch"

    # .gitignore
    echo "Common .gitignore templates:"
    echo "  1) None   2) Node   3) Python   4) Android   5) Custom"
    read -rp "Choice [1]: " gitignore_choice
    gitignore_choice="${gitignore_choice:-1}"
    case $gitignore_choice in
        2) printf "node_modules/\ndist/\n.env\n*.log\n" > .gitignore ;;
        3) printf "__pycache__/\n*.pyc\n.env\nvenv/\n*.egg-info/\n" > .gitignore ;;
        4) printf ".gradle/\n*.apk\n*.aab\nlocal.properties\n.idea/\nbuild/\n" > .gitignore ;;
        5) read -rp "Enter patterns (space-separated): " pats
           for p in $pats; do echo "$p" >> .gitignore; done ;;
    esac
    [ -f .gitignore ] && echo -e "${GREEN}✓ .gitignore created${RESET}"

    # Initial README
    read -rp "Create README.md? (y/n) [y]: " mkreadme
    mkreadme="${mkreadme:-y}"
    if [[ $mkreadme == y || $mkreadme == Y ]]; then
        local folder
        folder=$(basename "$(pwd)")
        read -rp "Project title [$folder]: " ptitle
        ptitle="${ptitle:-$folder}"
        printf "# %s\n" "$ptitle" > README.md
        echo -e "${GREEN}✓ README.md created${RESET}"
    fi

    # Initial commit
    read -rp "Make initial commit? (y/n) [y]: " docommit
    docommit="${docommit:-y}"
    if [[ $docommit == y || $docommit == Y ]]; then
        run git add -A
        run git commit -m "Initial commit" && echo -e "${GREEN}✓ Initial commit done${RESET}"
    fi

    # Push to GitHub?
    if command -v gh &>/dev/null && gh auth status &>/dev/null; then
        read -rp "Create & push to a new GitHub repo? (y/n) [y]: " dopush
        dopush="${dopush:-y}"
        if [[ $dopush == y || $dopush == Y ]]; then
            local folder
            folder=$(basename "$(pwd)")
            read -rp "GitHub repo name [$folder]: " ghname
            ghname="${ghname:-$folder}"
            read -rp "Description (optional): " ghdesc
            echo "Visibility:  1) Public   2) Private"
            read -rp "Choice [2]: " ghvis
            local vis="--private"
            [[ $ghvis == 1 ]] && vis="--public"

            run gh repo create "$ghname" $vis ${ghdesc:+--description "$ghdesc"} --source=. --push \
                && echo -e "${GREEN}✓ Pushed to GitHub as '$ghname'${RESET}"
        fi
    fi

    echo -e "${GREEN}✓ Repo ready!${RESET}"
}

# ── Main loop ─────────────────────────────────────────────────────────────────
while true; do
    clear_screen

    echo -e "${GREEN}${BOLD}Choose an action:${RESET}\n"

    cat << 'MENU'
  ── Local ──────────────────────────────────────
  1) Status & Info               4) Create Branch
  2) Pull (rebase)               5) Merge Branch
  3) Add & Commit                6) Stash / Pop
  c) Add + Commit + Push         7) View Log
  sb) Switch Branch              0) Advanced
  rb) Rebase Branch

  ── GitHub ─────────────────────────────────────
  cl) Clone Repo                 G) GitHub Accounts
  f)  Fetch Updates              8) Issues / PRs
  p)  Push Changes               pr) Create PR
  n)  Init New Repo Here         o)  Open in Browser
  9) Manage Remotes              r)  AI PR Review
  S) Switch GH Account

  ── Restore ────────────────────────────────────
  z) Restore to a Previous Commit

  ── Utilities ───────────────────────────────────
  fh) File History & Restore    w) Workspace Switcher
  v)  Quick Diff Summary        .) .gitignore Editor
  l)  Branch Cleanup            x) Conflict Resolver
  j)  Jump to Repo Root

  ── Setup ──────────────────────────────────────
  i) Git Config     m) AI Engine     ?) Help     q) Exit
MENU

    echo ""
    read -rp "Enter choice: " choice
    echo ""

    case "$choice" in

        1)
            require_repo || { read -rp "Press Enter..."; continue; }
            git status -s
            echo -e "\n${CYAN}Branches:${RESET}"
            git branch -a
            ;;

        2)
            require_repo || { read -rp "Press Enter..."; continue; }
            run git pull --rebase && echo -e "${GREEN}✓ Pulled${RESET}"
            ;;

        3)
            require_repo || { read -rp "Press Enter..."; continue; }
            stage_and_confirm || { read -rp "Press Enter..."; continue; }
            commit_with_msg
            ;;

        4)
            require_repo || { read -rp "Press Enter..."; continue; }
            read -rp "New branch name: " branch
            if [ -n "$branch" ]; then
                run git checkout -b "$branch" && echo -e "${GREEN}✓ Created & switched to '$branch'${RESET}"
            else
                echo -e "${YELLOW}Aborted — empty name.${RESET}"
            fi
            ;;

        5)
            require_repo || { read -rp "Press Enter..."; continue; }
            branch=$(pick_branch "Branch to merge")
            [ -n "$branch" ] && run git merge "$branch"
            ;;

        6)
            require_repo || { read -rp "Press Enter..."; continue; }
            echo "1) Stash   2) Pop stash   3) List stashes   4) Drop stash"
            read -rp "Choice: " sc
            case $sc in
                1) run git stash push -m "$(date '+%Y-%m-%d %H:%M')" && echo -e "${GREEN}✓ Stashed${RESET}" ;;
                2) run git stash pop && echo -e "${GREEN}✓ Stash popped${RESET}" ;;
                3) git stash list ;;
                4)
                    git stash list
                    read -rp "Stash index to drop (e.g. 0): " si
                    run git stash drop "stash@{$si}" && echo -e "${GREEN}✓ Dropped${RESET}"
                    ;;
            esac
            ;;

        7)
            require_repo || { read -rp "Press Enter..."; continue; }
            git log --oneline --graph --decorate -20
            ;;

        8)
            require_gh || { read -rp "Press Enter..."; continue; }
            echo "1) Issues   2) PRs"
            read -rp "Choice: " ch
            if [[ $ch == 1 ]]; then
                gh issue list
            else
                gh pr list
            fi
            ;;

        9)
            require_repo || { read -rp "Press Enter..."; continue; }
            echo -e "${CYAN}Remotes:${RESET}"; git remote -v
            echo "1) Add   2) Remove   3) Change URL"
            read -rp "Action: " ract
            case $ract in
                1)
                    add_ghuser=""
                    if command -v gh &>/dev/null && gh auth status &>/dev/null; then
                        add_ghuser=$(gh api user --jq '.login' 2>/dev/null)
                    fi

                    read -rp "Name [origin]: " rn
                    rn="${rn:-origin}"

                    rin=""; ru=""
                    if [ -n "$add_ghuser" ]; then
                        read -rp "Repo name (as ${add_ghuser}) or full URL: " rin
                    else
                        echo -e "${YELLOW}↷ No active gh account detected — enter the full URL.${RESET}"
                        read -rp "URL: " rin
                    fi

                    if [[ "$rin" =~ ^(https?://|git@|ssh://) ]]; then
                        ru="$rin"
                    elif [ -n "$add_ghuser" ] && [ -n "$rin" ]; then
                        ru="https://github.com/${add_ghuser}/${rin}.git"
                        echo -e "${CYAN}→ ${ru}${RESET}"
                    else
                        ru="$rin"
                    fi

                    run git remote add "$rn" "$ru" && echo -e "${GREEN}✓ Added${RESET}"
                    ;;
                2)
                    read -rp "Name to remove: " rn
                    run git remote remove "$rn" && echo -e "${GREEN}✓ Removed${RESET}"
                    ;;
                3)
                    read -rp "Remote name [origin]: " rn; read -rp "New URL: " ru
                    run git remote set-url "${rn:-origin}" "$ru" && echo -e "${GREEN}✓ URL updated${RESET}"
                    ;;
            esac
            ;;

        0)
            require_repo || { read -rp "Press Enter..."; continue; }
            echo -e "${YELLOW}Advanced:${RESET}"
            echo "  d)  Diff (staged+unstaged)"
            echo "  rs) Reset soft (undo last commit, keep changes staged)"
            echo "  rh) Reset hard (DANGER: discard all changes)"
            echo "  cp) Cherry-pick"
            echo "  bl) Blame a file"
            echo "  rc) Re-sign commits (fix missing/failed Verified badge)"
            read -rp "Choice: " adv
            case $adv in
                d|diff)
                    echo "1) Unstaged   2) Staged   3) Both"
                    read -rp "Choice [3]: " dc; dc="${dc:-3}"
                    case $dc in
                        1) git diff --color=always | less -R ;;
                        2) git diff --cached --color=always | less -R ;;
                        *) { git diff --color=always; git diff --cached --color=always; } | less -R ;;
                    esac
                    ;;
                rs)
                    run git reset --soft HEAD~1 && echo -e "${GREEN}✓ Soft reset — changes kept staged${RESET}"
                    ;;
                rh)
                    echo -e "${RED}${BOLD}WARNING: This permanently discards ALL uncommitted changes!${RESET}"
                    echo -e "${YELLOW}Current status:${RESET}"
                    git status -s
                    echo ""
                    read -rp "Stash current changes first? (y/n) [y]: " dostash
                    dostash="${dostash:-y}"
                    if [[ $dostash == y || $dostash == Y ]]; then
                        run git stash && echo -e "${GREEN}✓ Stashed safely. Use '6 → Pop' to recover.${RESET}"
                    fi
                    read -rp "Type YES to confirm hard reset: " confirm
                    if [[ $confirm == "YES" ]]; then
                        run git reset --hard HEAD~1 && echo -e "${GREEN}✓ Hard reset complete.${RESET}"
                        force_push_after_reset
                    else
                        echo -e "${YELLOW}Cancelled.${RESET}"
                    fi
                    ;;
                cp|cherry-pick)
                    git log --oneline -10
                    read -rp "Commit hash to cherry-pick: " hash
                    [ -n "$hash" ] && run git cherry-pick "$hash"
                    ;;
                bl|blame)
                    read -rp "File path: " bfile
                    [ -n "$bfile" ] && git blame "$bfile" | less
                    ;;
                rc|sign)
                    resign_commits
                    ;;
                *)
                    echo -e "${YELLOW}Invalid.${RESET}"
                    ;;
            esac
            ;;

        cl)
            echo "1) Enter URL manually"
            echo "2) Pick from your GitHub repos"
            read -rp "Choice [1]: " clonemode
            clonemode="${clonemode:-1}"
            if [[ $clonemode == 2 ]]; then
                require_gh || { read -rp "Press Enter..."; continue; }
                local_repos=()
                while IFS= read -r r; do
                    local_repos+=("$r")
                    echo "  $((${#local_repos[@]}))) $r"
                done < <(gh repo list --limit 50 --json nameWithOwner --jq '.[].nameWithOwner' 2>/dev/null)
                echo ""
                read -rp "Pick number: " num
                if [[ $num =~ ^[0-9]+$ ]] && [ "$num" -ge 1 ] && [ "$num" -le "${#local_repos[@]}" ]; then
                    run_spinner "Cloning ${local_repos[$((num-1))]}" gh repo clone "${local_repos[$((num-1))]}"
                fi
            else
                read -rp "Repository URL: " url
                [ -n "$url" ] && run_spinner "Cloning $url" git clone "$url"
            fi
            ;;

        f|F)
            require_repo || { read -rp "Press Enter..."; continue; }
            run_spinner "Fetching all remotes" git fetch --all --prune
            ;;

        p|P)
            require_repo || { read -rp "Press Enter..."; continue; }
            smart_push
            ;;

        sb|SB)
            require_repo || { read -rp "Press Enter..."; continue; }
            # Check for dirty state
            if ! git diff --quiet 2>/dev/null || ! git diff --cached --quiet 2>/dev/null; then
                echo -e "${YELLOW}⚠ You have uncommitted changes.${RESET}"
                echo "1) Stash them first   2) Switch anyway   3) Cancel"
                read -rp "Choice [1]: " dirtychoice
                dirtychoice="${dirtychoice:-1}"
                case $dirtychoice in
                    1) run git stash && echo -e "${GREEN}✓ Stashed${RESET}" ;;
                    2) ;;
                    *) echo -e "${YELLOW}Cancelled.${RESET}"; read -rp "Press Enter..."; continue ;;
                esac
            fi
            branch=$(pick_branch "Switch to")
            [ -n "$branch" ] && run git checkout "$branch"
            ;;

        rb|RB)
            require_repo || { read -rp "Press Enter..."; continue; }
            branch=$(pick_branch "Rebase onto")
            [ -n "$branch" ] && run git rebase "$branch"
            ;;

        pr)
            require_gh || { read -rp "Press Enter..."; continue; }
            run gh pr create --fill
            ;;

        G)
            manage_accounts
            ;;

        s|S)
            quick_switch_account
            ;;

        o|O)
            require_gh || { read -rp "Press Enter..."; continue; }
            gh browse
            ;;

        r|R)
            ai_pr_review
            ;;

        m|M)
            ai_engine_config
            ;;

        i|I)
            # Show current config
            cur_name=""; cur_email=""
            cur_name=$(git config --global user.name 2>/dev/null)
            cur_email=$(git config --global user.email 2>/dev/null)
            [ -n "$cur_name" ]  && echo -e "${BLUE}Current name:  $cur_name${RESET}"
            [ -n "$cur_email" ] && echo -e "${BLUE}Current email: $cur_email${RESET}"
            echo ""
            read -rp "Name [$cur_name]: " name
            read -rp "Email [$cur_email]: " email
            name="${name:-$cur_name}"
            email="${email:-$cur_email}"
            if [ -n "$name" ] && [ -n "$email" ]; then
                run git config --global user.name "$name"
                run git config --global user.email "$email"
                # Only set a fallback credential helper if none is configured yet.
                # (Avoids clobbering gh's per-account helper set via `gh auth setup-git`,
                # which is how the Account Manager's account switching actually works.)
                if ! git config --global credential.helper >/dev/null 2>&1; then
                    run git config --global credential.helper store
                fi
                run git config --global init.defaultBranch main
                echo -e "${GREEN}✓ Config saved${RESET}"
            else
                echo -e "${YELLOW}Aborted — name and email required.${RESET}"
            fi
            ;;

        c|C)
            require_repo || { read -rp "Press Enter..."; continue; }
            stage_and_confirm || { read -rp "Press Enter..."; continue; }
            commit_with_msg || { read -rp "Press Enter..."; continue; }
            # Push summary confirmation
            echo ""
            echo -e "${CYAN}${BOLD}── Push Summary ──${RESET}"
            echo -e "${BLUE}Branch:  $(git branch --show-current)${RESET}"
            echo -e "${BLUE}Remote:  $(git remote get-url origin 2>/dev/null || echo 'no remote')${RESET}"
            echo -e "${BLUE}Commits to push:${RESET}"
            git log --oneline "origin/$(git branch --show-current)..HEAD" 2>/dev/null ||                 git log --oneline -3
            echo ""
            read -rp "Push now? (y/n) [y]: " dopush
            dopush="${dopush:-y}"
            if [[ $dopush == y || $dopush == Y ]]; then
                smart_push
            else
                echo -e "${YELLOW}Push skipped. Changes are committed locally.${RESET}"
            fi
            ;;

        n|N)
            init_repo
            ;;

        fh|FH)
            require_repo || { read -rp "Press Enter..."; continue; }
            file_history
            ;;

        w|W)
            workspace_switcher
            ;;

        ".")
            gitignore_editor
            ;;

        v|V)
            require_repo || { read -rp "Press Enter..."; continue; }
            quick_diff_summary
            ;;

        l|L)
            require_repo || { read -rp "Press Enter..."; continue; }
            branch_cleanup
            ;;

        x|X)
            require_repo || { read -rp "Press Enter..."; continue; }
            conflict_resolver
            ;;

        j|J)
            require_repo || { read -rp "Press Enter..."; continue; }
            jump_to_root
            ;;

        "?")
            show_help
            ;;

        z|Z)
            require_repo || { read -rp "Press Enter..."; continue; }
            restore_commit
            ;;

        q|Q)
            echo -e "${GREEN}Goodbye! 👋${RESET}"
            exit 0
            ;;

        *)
            echo -e "${RED}Invalid choice — try again.${RESET}"
            ;;
    esac

    echo ""
    read -rp "Press Enter to continue..."
done