torware.sh

#!/bin/bash
#
# ╔═════════════════════════════════════════════════════════ ╗
# ║      🧅 TORWARE v1.1                                     ║
# ║                                                          ║
# ║  One-click setup for Tor Bridge/Relay nodes              ║
# ║                                                          ║
# ║  • Installs Docker (if needed)                           ║
# ║  • Runs Tor Bridge/Relay in Docker with live stats       ║
# ║  • Snowflake WebRTC proxy support                        ║
# ║  • Auto-start on boot via systemd/OpenRC/SysVinit        ║
# ║  • Easy management via CLI or interactive menu           ║
# ║                                                          ║
# ║  Tor Project: https://www.torproject.org/                ║
# ╚═════════════════════════════════════════════════════════ ╝
#
# Usage:
# curl -sL https://raw.githubusercontent.com/SamNet-dev/torware/main/torware.sh | sudo bash
#
# Tor relay types:
#   Bridge (obfs4) - Hidden entry point, helps censored users (DEFAULT)
#   Middle Relay   - Routes traffic within Tor network
#   Exit Relay     - Final hop, higher risk (advanced users only)
#

set -eo pipefail

# Ensure consistent numeric formatting across locales
export LC_NUMERIC=C

# Require bash 4.2+ (for associative arrays and declare -g)
if [ -z "$BASH_VERSION" ]; then
    echo "Error: This script requires bash. Please run with: bash $0"
    exit 1
fi
if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ] || { [ "${BASH_VERSINFO[0]:-0}" -eq 4 ] && [ "${BASH_VERSINFO[1]:-0}" -lt 2 ]; }; then
    echo "Error: This script requires bash 4.2+ (found $BASH_VERSION). Please upgrade bash."
    exit 1
fi

# Global temp file tracking for cleanup
_TMP_FILES=()
_cleanup_tmp() {
    for f in "${_TMP_FILES[@]}"; do
        rm -rf "$f" 2>/dev/null || true
    done
    # Clean caches and CPU state for THIS process
    rm -f "${TMPDIR:-/tmp}"/torware_cpu_state_$$ 2>/dev/null || true
    rm -f "${TMPDIR:-/tmp}"/.tg_curl.* 2>/dev/null || true
    rm -f "${TMPDIR:-/tmp}"/.tor_fp_cache_* 2>/dev/null || true
    rm -f "${TMPDIR:-/tmp}"/.tor_cookie_cache_* 2>/dev/null || true
}
trap '_cleanup_tmp' EXIT

VERSION="1.1"
# Docker image tags — pinned to specific versions for reproducibility. Use :latest for auto-updates.
BRIDGE_IMAGE="thetorproject/obfs4-bridge:0.24"
RELAY_IMAGE="osminogin/tor-simple:0.4.8.10"
SNOWFLAKE_IMAGE="thetorproject/snowflake-proxy:latest"
INSTALL_DIR="${INSTALL_DIR:-/opt/torware}"

# Validate INSTALL_DIR is absolute
case "$INSTALL_DIR" in
    /*) ;; # OK
    *) echo "Error: INSTALL_DIR must be an absolute path"; exit 1 ;;
esac

BACKUP_DIR="$INSTALL_DIR/backups"
STATS_DIR="$INSTALL_DIR/relay_stats"
CONTAINERS_DIR="$INSTALL_DIR/containers"
FORCE_REINSTALL=false

# Defaults
RELAY_TYPE="bridge"
NICKNAME=""
CONTACT_INFO=""
BANDWIDTH=5           # Mbps
CONTAINER_COUNT=1
ORPORT_BASE=9001
CONTROLPORT_BASE=9051
PT_PORT_BASE=9100
DATA_CAP_GB=0

# Snowflake proxy settings
SNOWFLAKE_ENABLED="false"
SNOWFLAKE_COUNT=1
SNOWFLAKE_CONTAINER="snowflake-proxy"
SNOWFLAKE_VOLUME="snowflake-data"
SNOWFLAKE_METRICS_PORT=9999
SNOWFLAKE_CPUS="1.5"
SNOWFLAKE_MEMORY="512m"
SNOWFLAKE_CPUS_1=""
SNOWFLAKE_MEMORY_1=""
SNOWFLAKE_CPUS_2=""
SNOWFLAKE_MEMORY_2=""

# Unbounded (Lantern) proxy settings
UNBOUNDED_ENABLED="false"
UNBOUNDED_CONTAINER="unbounded-proxy"
UNBOUNDED_VOLUME="unbounded-data"
UNBOUNDED_IMAGE="torware/unbounded-widget:latest"
UNBOUNDED_CPUS="0.5"
UNBOUNDED_MEMORY="256m"
UNBOUNDED_FREDDIE="https://freddie.iantem.io"
UNBOUNDED_EGRESS="wss://unbounded.iantem.io"
UNBOUNDED_TAG=""

# MTProxy (Telegram) settings
MTPROXY_ENABLED="false"
MTPROXY_CONTAINER="mtproxy"
MTPROXY_IMAGE="nineseconds/mtg:2.1.7"
MTPROXY_PORT=8443
MTPROXY_METRICS_PORT=3129
MTPROXY_DOMAIN="cloudflare.com"
MTPROXY_SECRET=""
MTPROXY_CPUS="0.5"
MTPROXY_MEMORY="128m"
MTPROXY_CONCURRENCY=8192
MTPROXY_BLOCKLIST_COUNTRIES=""

#═══════════════════════════════════════════════════════════════════════
# Centralized Configuration
#═══════════════════════════════════════════════════════════════════════
declare -gA CONFIG=(
    # Relay Configuration
    [relay_type]="bridge"
    [relay_nickname]=""
    [relay_contact]=""
    [relay_bandwidth]=5
    [relay_container_count]=1
    [relay_orport_base]=9001
    [relay_controlport_base]=9051
    [relay_ptport_base]=9100
    [relay_data_cap_gb]=0
    [relay_exit_policy]="reduced"

    # Snowflake Proxy
    [snowflake_enabled]="false"
    [snowflake_count]=1
    [snowflake_cpus]="1.5"
    [snowflake_memory]="512m"

    # Unbounded Proxy
    [unbounded_enabled]="false"
    [unbounded_cpus]="0.5"
    [unbounded_memory]="256m"

    # MTProxy (Telegram)
    [mtproxy_enabled]="false"
    [mtproxy_port]=8443
    [mtproxy_domain]="cloudflare.com"
    [mtproxy_secret]=""
    [mtproxy_concurrency]=8192

    # Telegram Integration
    [telegram_enabled]="false"
    [telegram_bot_token]=""
    [telegram_chat_id]=""
    [telegram_interval]=6
)

config_get() {
    local key="$1"
    echo "${CONFIG[$key]:-}"
}

config_set() {
    local key="$1"
    local val="$2"
    CONFIG[$key]="$val"
}

config_sync_from_globals() {
    CONFIG[relay_type]="${RELAY_TYPE:-bridge}"
    CONFIG[relay_nickname]="${NICKNAME:-}"
    CONFIG[relay_contact]="${CONTACT_INFO:-}"
    CONFIG[relay_bandwidth]="${BANDWIDTH:-5}"
    CONFIG[relay_container_count]="${CONTAINER_COUNT:-1}"
    CONFIG[relay_orport_base]="${ORPORT_BASE:-9001}"
    CONFIG[relay_controlport_base]="${CONTROLPORT_BASE:-9051}"
    CONFIG[relay_ptport_base]="${PT_PORT_BASE:-9100}"
    CONFIG[relay_data_cap_gb]="${DATA_CAP_GB:-0}"
    CONFIG[snowflake_enabled]="${SNOWFLAKE_ENABLED:-false}"
    CONFIG[snowflake_count]="${SNOWFLAKE_COUNT:-1}"
    CONFIG[unbounded_enabled]="${UNBOUNDED_ENABLED:-false}"
    CONFIG[mtproxy_enabled]="${MTPROXY_ENABLED:-false}"
    CONFIG[mtproxy_port]="${MTPROXY_PORT:-8443}"
    CONFIG[mtproxy_domain]="${MTPROXY_DOMAIN:-cloudflare.com}"
    CONFIG[telegram_enabled]="${TELEGRAM_ENABLED:-false}"
    CONFIG[telegram_bot_token]="${TELEGRAM_BOT_TOKEN:-}"
    CONFIG[telegram_chat_id]="${TELEGRAM_CHAT_ID:-}"
}

config_sync_to_globals() {
    RELAY_TYPE="${CONFIG[relay_type]}"
    NICKNAME="${CONFIG[relay_nickname]}"
    CONTACT_INFO="${CONFIG[relay_contact]}"
    BANDWIDTH="${CONFIG[relay_bandwidth]}"
    CONTAINER_COUNT="${CONFIG[relay_container_count]}"
    ORPORT_BASE="${CONFIG[relay_orport_base]}"
    CONTROLPORT_BASE="${CONFIG[relay_controlport_base]}"
    PT_PORT_BASE="${CONFIG[relay_ptport_base]}"
    DATA_CAP_GB="${CONFIG[relay_data_cap_gb]}"
    SNOWFLAKE_ENABLED="${CONFIG[snowflake_enabled]}"
    SNOWFLAKE_COUNT="${CONFIG[snowflake_count]}"
    UNBOUNDED_ENABLED="${CONFIG[unbounded_enabled]}"
    MTPROXY_ENABLED="${CONFIG[mtproxy_enabled]}"
    MTPROXY_PORT="${CONFIG[mtproxy_port]}"
    MTPROXY_DOMAIN="${CONFIG[mtproxy_domain]}"
    TELEGRAM_ENABLED="${CONFIG[telegram_enabled]}"
    TELEGRAM_BOT_TOKEN="${CONFIG[telegram_bot_token]}"
    TELEGRAM_CHAT_ID="${CONFIG[telegram_chat_id]}"
}

# Colors — disable when stdout is not a terminal
if [ -t 1 ]; then
    RED='\033[0;31m'
    GREEN='\033[0;32m'
    YELLOW='\033[1;33m'
    BLUE='\033[0;34m'
    CYAN='\033[0;36m'
    MAGENTA='\033[0;35m'
    BOLD='\033[1m'
    DIM='\033[2m'
    NC='\033[0m'
else
    RED='' GREEN='' YELLOW='' BLUE='' CYAN='' MAGENTA='' BOLD='' DIM='' NC=''
fi

#═══════════════════════════════════════════════════════════════════════
# Utility Functions
#═══════════════════════════════════════════════════════════════════════

# Structured logging support
LOG_FORMAT="${LOG_FORMAT:-text}"  # text or json
LOG_FILE="${LOG_FILE:-}"          # Optional file output

log_json() {
    local level="$1" msg="$2"
    local ts
    ts=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
    # Escape special JSON characters in message
    msg="${msg//\\/\\\\}"
    msg="${msg//\"/\\\"}"
    msg="${msg//$'\n'/\\n}"
    msg="${msg//$'\r'/\\r}"
    msg="${msg//$'\t'/\\t}"
    local json="{\"timestamp\":\"$ts\",\"level\":\"$level\",\"message\":\"$msg\"}"

    if [ -n "$LOG_FILE" ]; then
        echo "$json" >> "$LOG_FILE"
    fi

    if [ "$LOG_FORMAT" = "json" ]; then
        echo "$json"
        return 0
    fi
    return 1
}

print_header() {
    local W=57
    local bar="═════════════════════════════════════════════════════════"
    echo -e "${CYAN}"
    echo "╔${bar}╗"
    # 🧅 emoji = 2 display cols but 1 char; "  🧅 " = 5 display cols, printf sees 4 → use W-5+1=53
    printf "║  🧅 %-52s║\n" "TORWARE v${VERSION}"
    echo "╠${bar}╣"
    # — is 1 display col, 1 char; normal printf works. Content: 2+53+2=57
    printf "║  %-57s║\n" "Tor Bridge/Relay nodes — easy setup & management"
    echo "╚${bar}╝"
    echo -e "${NC}"
}

log_info() {
    log_json "INFO" "$1" || echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    log_json "SUCCESS" "$1" || echo -e "${GREEN}[✓]${NC} $1"
}

log_warn() {
    log_json "WARN" "$1" || echo -e "${YELLOW}[!]${NC} $1" >&2
}

log_error() {
    log_json "ERROR" "$1" || echo -e "${RED}[✗]${NC} $1" >&2
}

check_root() {
    if [ "$EUID" -ne 0 ]; then
        log_error "This script must be run as root (use sudo)"
        exit 1
    fi
}

validate_port() {
    local port="$1"
    [[ "$port" =~ ^[0-9]+$ ]] && [ "$port" -ge 1 ] && [ "$port" -le 65535 ]
}

format_bytes() {
    local bytes=$1
    [[ "$bytes" =~ ^[0-9]+$ ]] || bytes=0
    if [ -z "$bytes" ] || [ "$bytes" = "0" ]; then
        echo "0 B"
        return
    fi
    if [ "$bytes" -lt 1024 ] 2>/dev/null; then
        echo "${bytes} B"
    elif [ "$bytes" -lt 1048576 ] 2>/dev/null; then
        echo "$(awk -v b="$bytes" 'BEGIN {printf "%.1f", b/1024}') KB"
    elif [ "$bytes" -lt 1073741824 ] 2>/dev/null; then
        echo "$(awk -v b="$bytes" 'BEGIN {printf "%.2f", b/1048576}') MB"
    else
        echo "$(awk -v b="$bytes" 'BEGIN {printf "%.2f", b/1073741824}') GB"
    fi
}

format_number() {
    local num=$1
    if [ -z "$num" ] || [ "$num" = "0" ]; then
        echo "0"
        return
    fi
    if [ "$num" -ge 1000000 ] 2>/dev/null; then
        echo "$(awk -v n="$num" 'BEGIN {printf "%.1f", n/1000000}')M"
    elif [ "$num" -ge 1000 ] 2>/dev/null; then
        echo "$(awk -v n="$num" 'BEGIN {printf "%.1f", n/1000}')K"
    else
        echo "$num"
    fi
}

format_duration() {
    local secs=$1
    [[ "$secs" =~ ^-?[0-9]+$ ]] || secs=0
    if [ "$secs" -lt 1 ]; then
        echo "0s"
        return
    fi
    local days=$((secs / 86400))
    local hours=$(( (secs % 86400) / 3600 ))
    local mins=$(( (secs % 3600) / 60 ))
    local remaining=$((secs % 60))
    if [ "$days" -gt 0 ]; then
        echo "${days}d ${hours}h ${mins}m"
    elif [ "$hours" -gt 0 ]; then
        echo "${hours}h ${mins}m"
    elif [ "$mins" -gt 0 ]; then
        echo "${mins}m"
    else
        echo "${remaining}s"
    fi
}

escape_md() {
    local text="$1"
    text="${text//\\/\\\\}"
    text="${text//\*/\\*}"
    text="${text//_/\\_}"
    text="${text//\`/\\\`}"
    text="${text//\[/\\[}"
    text="${text//\]/\\]}"
    echo "$text"
}

# Convert 2-letter country code to human-readable name
country_code_to_name() {
    local cc="$1"
    case "$cc" in
        # Americas (18)
        us) echo "United States" ;; ca) echo "Canada" ;; mx) echo "Mexico" ;;
        br) echo "Brazil" ;; ar) echo "Argentina" ;; co) echo "Colombia" ;;
        cl) echo "Chile" ;; pe) echo "Peru" ;; ve) echo "Venezuela" ;;
        ec) echo "Ecuador" ;; bo) echo "Bolivia" ;; py) echo "Paraguay" ;;
        uy) echo "Uruguay" ;; cu) echo "Cuba" ;; cr) echo "Costa Rica" ;;
        pa) echo "Panama" ;; do) echo "Dominican Rep." ;; gt) echo "Guatemala" ;;
        # Europe West (16)
        gb|uk) echo "United Kingdom" ;; de) echo "Germany" ;; fr) echo "France" ;;
        nl) echo "Netherlands" ;; be) echo "Belgium" ;; at) echo "Austria" ;;
        ch) echo "Switzerland" ;; ie) echo "Ireland" ;; lu) echo "Luxembourg" ;;
        es) echo "Spain" ;; pt) echo "Portugal" ;; it) echo "Italy" ;;
        gr) echo "Greece" ;; mt) echo "Malta" ;; cy) echo "Cyprus" ;;
        is) echo "Iceland" ;;
        # Europe North (7)
        se) echo "Sweden" ;; no) echo "Norway" ;; fi) echo "Finland" ;;
        dk) echo "Denmark" ;; ee) echo "Estonia" ;; lv) echo "Latvia" ;;
        lt) echo "Lithuania" ;;
        # Europe East (16)
        pl) echo "Poland" ;; cz) echo "Czech Rep." ;; sk) echo "Slovakia" ;;
        hu) echo "Hungary" ;; ro) echo "Romania" ;; bg) echo "Bulgaria" ;;
        hr) echo "Croatia" ;; rs) echo "Serbia" ;; si) echo "Slovenia" ;;
        ba) echo "Bosnia" ;; mk) echo "N. Macedonia" ;; al) echo "Albania" ;;
        me) echo "Montenegro" ;; ua) echo "Ukraine" ;; md) echo "Moldova" ;;
        by) echo "Belarus" ;;
        # Russia & Central Asia (6)
        ru) echo "Russia" ;; kz) echo "Kazakhstan" ;; uz) echo "Uzbekistan" ;;
        tm) echo "Turkmenistan" ;; kg) echo "Kyrgyzstan" ;; tj) echo "Tajikistan" ;;
        # Middle East (10)
        tr) echo "Turkey" ;; il) echo "Israel" ;; sa) echo "Saudi Arabia" ;;
        ae) echo "UAE" ;; ir) echo "Iran" ;; iq) echo "Iraq" ;;
        sy) echo "Syria" ;; jo) echo "Jordan" ;; lb) echo "Lebanon" ;;
        qa) echo "Qatar" ;;
        # Africa (12)
        za) echo "South Africa" ;; ng) echo "Nigeria" ;; ke) echo "Kenya" ;;
        eg) echo "Egypt" ;; ma) echo "Morocco" ;; tn) echo "Tunisia" ;;
        gh) echo "Ghana" ;; et) echo "Ethiopia" ;; tz) echo "Tanzania" ;;
        ug) echo "Uganda" ;; dz) echo "Algeria" ;; ly) echo "Libya" ;;
        # Asia East (8)
        cn) echo "China" ;; jp) echo "Japan" ;; kr) echo "South Korea" ;;
        tw) echo "Taiwan" ;; hk) echo "Hong Kong" ;; mn) echo "Mongolia" ;;
        kp) echo "North Korea" ;; mo) echo "Macau" ;;
        # Asia South & Southeast (14)
        in) echo "India" ;; pk) echo "Pakistan" ;; bd) echo "Bangladesh" ;;
        np) echo "Nepal" ;; lk) echo "Sri Lanka" ;; mm) echo "Myanmar" ;;
        th) echo "Thailand" ;; vn) echo "Vietnam" ;; ph) echo "Philippines" ;;
        id) echo "Indonesia" ;; my) echo "Malaysia" ;; sg) echo "Singapore" ;;
        kh) echo "Cambodia" ;; la) echo "Laos" ;;
        # Oceania & Caucasus (6)
        au) echo "Australia" ;; nz) echo "New Zealand" ;; ge) echo "Georgia" ;;
        am) echo "Armenia" ;; az) echo "Azerbaijan" ;; bh) echo "Bahrain" ;;
        mu) echo "Mauritius" ;; zm) echo "Zambia" ;; sd) echo "Sudan" ;;
        zw) echo "Zimbabwe" ;; mz) echo "Mozambique" ;; cm) echo "Cameroon" ;;
        ci) echo "Ivory Coast" ;; sn) echo "Senegal" ;; cd) echo "DR Congo" ;;
        ao) echo "Angola" ;; om) echo "Oman" ;; kw) echo "Kuwait" ;;
        '??') echo "Unknown" ;;
        *) echo "$cc" | tr '[:lower:]' '[:upper:]' ;;
    esac
}

#═══════════════════════════════════════════════════════════════════════
# OS Detection & Package Management
#═══════════════════════════════════════════════════════════════════════

detect_os() {
    OS="unknown"
    OS_VERSION="unknown"
    OS_FAMILY="unknown"
    HAS_SYSTEMD=false
    PKG_MANAGER="unknown"

    if [ -f /etc/os-release ] && [ -r /etc/os-release ]; then
        # Read only the specific vars we need (avoid executing arbitrary content)
        OS=$(sed -n 's/^ID=//p' /etc/os-release | tr -d '"' | head -1)
        OS_VERSION=$(sed -n 's/^VERSION_ID=//p' /etc/os-release | tr -d '"' | head -1)
        OS="${OS:-unknown}"
        OS_VERSION="${OS_VERSION:-unknown}"
    elif [ -f /etc/redhat-release ]; then
        OS="rhel"
    elif [ -f /etc/debian_version ]; then
        OS="debian"
    elif [ -f /etc/alpine-release ]; then
        OS="alpine"
    elif [ -f /etc/arch-release ]; then
        OS="arch"
    elif [ -f /etc/SuSE-release ] || [ -f /etc/SUSE-brand ]; then
        OS="opensuse"
    else
        OS=$(uname -s | tr '[:upper:]' '[:lower:]')
    fi

    case "$OS" in
        ubuntu|debian|linuxmint|pop|elementary|zorin|kali|raspbian)
            OS_FAMILY="debian"
            PKG_MANAGER="apt"
            ;;
        rhel|centos|fedora|rocky|almalinux|oracle|amazon|amzn)
            OS_FAMILY="rhel"
            if command -v dnf &>/dev/null; then
                PKG_MANAGER="dnf"
            else
                PKG_MANAGER="yum"
            fi
            ;;
        arch|manjaro|endeavouros|garuda)
            OS_FAMILY="arch"
            PKG_MANAGER="pacman"
            ;;
        opensuse|opensuse-leap|opensuse-tumbleweed|sles)
            OS_FAMILY="suse"
            PKG_MANAGER="zypper"
            ;;
        alpine)
            OS_FAMILY="alpine"
            PKG_MANAGER="apk"
            ;;
        *)
            OS_FAMILY="unknown"
            PKG_MANAGER="unknown"
            ;;
    esac

    if command -v systemctl &>/dev/null && [ -d /run/systemd/system ]; then
        HAS_SYSTEMD=true
    fi

    log_info "Detected: $OS ($OS_FAMILY family), Package manager: $PKG_MANAGER"

    if command -v podman &>/dev/null && ! command -v docker &>/dev/null; then
        log_warn "Podman detected. This script is optimized for Docker."
        log_warn "If installation fails, consider installing 'docker-ce' manually."
    fi
}

install_package() {
    local package="$1"
    log_info "Installing $package..."

    case "$PKG_MANAGER" in
        apt)
            apt-get update -q || log_warn "apt-get update failed, attempting install anyway..."
            if apt-get install -y -q "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        dnf)
            if dnf install -y -q "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        yum)
            if yum install -y -q "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        pacman)
            if pacman -S --noconfirm --needed "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        zypper)
            if zypper install -y -n "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        apk)
            if apk add --no-cache "$package"; then
                log_success "$package installed successfully"
            else
                log_error "Failed to install $package"
                return 1
            fi
            ;;
        *)
            log_warn "Unknown package manager. Please install $package manually."
            return 1
            ;;
    esac
}

check_dependencies() {
    if [ "$OS_FAMILY" = "alpine" ]; then
        if ! command -v bash &>/dev/null; then
            log_info "Installing bash..."
            apk add --no-cache bash 2>/dev/null
        fi
    fi

    if ! command -v curl &>/dev/null; then
        install_package curl || log_warn "Could not install curl automatically"
    fi

    if ! command -v awk &>/dev/null; then
        case "$PKG_MANAGER" in
            apt) install_package gawk || log_warn "Could not install gawk" ;;
            apk) install_package gawk || log_warn "Could not install gawk" ;;
            *) install_package awk || log_warn "Could not install awk" ;;
        esac
    fi

    if ! command -v free &>/dev/null; then
        case "$PKG_MANAGER" in
            apt|dnf|yum) install_package procps || log_warn "Could not install procps" ;;
            pacman) install_package procps-ng || log_warn "Could not install procps" ;;
            zypper) install_package procps || log_warn "Could not install procps" ;;
            apk) install_package procps || log_warn "Could not install procps" ;;
        esac
    fi

    if ! command -v tput &>/dev/null; then
        case "$PKG_MANAGER" in
            apt) install_package ncurses-bin || log_warn "Could not install ncurses-bin" ;;
            apk) install_package ncurses || log_warn "Could not install ncurses" ;;
            *) install_package ncurses || log_warn "Could not install ncurses" ;;
        esac
    fi

    # netcat for ControlPort communication
    if ! command -v nc &>/dev/null && ! command -v ncat &>/dev/null; then
        case "$PKG_MANAGER" in
            apt) install_package netcat-openbsd || log_warn "Could not install netcat" ;;
            dnf|yum) install_package nmap-ncat || log_warn "Could not install ncat" ;;
            pacman) install_package openbsd-netcat || log_warn "Could not install netcat" ;;
            zypper) install_package netcat-openbsd || log_warn "Could not install netcat" ;;
            apk) install_package netcat-openbsd || log_warn "Could not install netcat" ;;
        esac
    fi

    # GeoIP (for country stats on middle/exit relays — bridges use Tor's built-in CLIENTS_SEEN)
    # Only needed if user runs non-bridge relay types
    if ! command -v geoiplookup &>/dev/null && ! command -v mmdblookup &>/dev/null; then
        log_info "GeoIP tools not found (optional — needed for middle/exit relay country stats)"
        log_info "Bridges use Tor's built-in country data and don't need GeoIP."
        case "$PKG_MANAGER" in
            apt)
                install_package geoip-bin 2>/dev/null || true
                install_package geoip-database 2>/dev/null || true
                ;;
            dnf|yum)
                install_package GeoIP 2>/dev/null || true
                ;;
            pacman) install_package geoip 2>/dev/null || true ;;
            zypper) install_package GeoIP 2>/dev/null || true ;;
            apk) install_package geoip 2>/dev/null || true ;;
            *) true ;;
        esac
    fi

    # qrencode is optional — only useful for bridge line QR codes
    if ! command -v qrencode &>/dev/null; then
        install_package qrencode 2>/dev/null || log_info "qrencode not installed (optional — for bridge line QR codes)"
    fi
}

#═══════════════════════════════════════════════════════════════════════
# System Resource Detection
#═══════════════════════════════════════════════════════════════════════

get_ram_mb() {
    local ram=""
    if command -v free &>/dev/null; then
        ram=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}')
    fi
    if [ -z "$ram" ] || [ "$ram" = "0" ]; then
        if [ -f /proc/meminfo ]; then
            local kb=$(awk '/^MemTotal:/{print $2}' /proc/meminfo 2>/dev/null)
            if [ -n "$kb" ]; then
                ram=$((kb / 1024))
            fi
        fi
    fi
    if [ -z "$ram" ] || [ "$ram" -lt 1 ] 2>/dev/null; then
        echo 1  # Fallback: 1MB (prevents division-by-zero in callers)
    else
        echo "$ram"
    fi
}

get_cpu_cores() {
    local cores=1
    if command -v nproc &>/dev/null; then
        cores=$(nproc)
    elif [ -f /proc/cpuinfo ]; then
        cores=$(grep -c ^processor /proc/cpuinfo)
    fi
    if [ -z "$cores" ] || [ "$cores" -lt 1 ] 2>/dev/null; then
        echo 1
    else
        echo "$cores"
    fi
}

get_public_ip() {
    # Try multiple services to get public IP
    local ip=""
    ip=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null) ||
    ip=$(curl -s --max-time 5 https://ifconfig.me 2>/dev/null) ||
    ip=$(curl -s --max-time 5 https://icanhazip.com 2>/dev/null) ||
    ip=""
    # Validate it looks like an IP (basic check)
    if [[ "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]] || [[ "$ip" =~ : ]]; then
        echo "$ip"
    else
        echo ""
    fi
}

get_net_speed() {
    local iface
    iface=$(ip route 2>/dev/null | awk '/default/{print $5; exit}')
    if [ -z "$iface" ]; then
        echo "0.00 0.00"
        return
    fi

    local rx1 tx1 rx2 tx2
    rx1=$(cat /sys/class/net/"$iface"/statistics/rx_bytes 2>/dev/null || echo 0)
    tx1=$(cat /sys/class/net/"$iface"/statistics/tx_bytes 2>/dev/null || echo 0)
    sleep 0.5
    rx2=$(cat /sys/class/net/"$iface"/statistics/rx_bytes 2>/dev/null || echo 0)
    tx2=$(cat /sys/class/net/"$iface"/statistics/tx_bytes 2>/dev/null || echo 0)

    local rx_speed tx_speed
    rx_speed=$(awk -v r1="$rx1" -v r2="$rx2" 'BEGIN {printf "%.2f", (r2 - r1) * 2 * 8 / 1000000}')
    tx_speed=$(awk -v t1="$tx1" -v t2="$tx2" 'BEGIN {printf "%.2f", (t2 - t1) * 2 * 8 / 1000000}')

    echo "$rx_speed $tx_speed"
}

#═══════════════════════════════════════════════════════════════════════
# Docker Installation
#═══════════════════════════════════════════════════════════════════════

install_docker() {
    if command -v docker &>/dev/null; then
        log_success "Docker is already installed"
        return 0
    fi

    log_info "Installing Docker..."

    if [ "$OS_FAMILY" = "rhel" ]; then
        log_info "Adding Docker repo for RHEL..."
        if command -v dnf &>/dev/null; then
            dnf install -y -q dnf-plugins-core 2>/dev/null || true
            dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo 2>/dev/null || true
        else
            yum install -y -q yum-utils 2>/dev/null || true
            yum-config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo 2>/dev/null || true
        fi
    fi

    if [ "$OS_FAMILY" = "alpine" ]; then
        if ! apk add --no-cache docker docker-cli-compose 2>/dev/null; then
            log_error "Failed to install Docker on Alpine"
            return 1
        fi
        rc-update add docker boot 2>/dev/null || true
        service docker start 2>/dev/null || rc-service docker start 2>/dev/null || true
    else
        # Download Docker install script first, then execute (safer than piping curl|sh)
        local docker_script
        docker_script=$(mktemp) || { log_error "Failed to create temp file"; return 1; }
        if ! curl -fsSL https://get.docker.com -o "$docker_script"; then
            rm -f "$docker_script"
            log_error "Failed to download Docker installation script."
            log_info "Try installing docker manually: https://docs.docker.com/engine/install/"
            return 1
        fi
        if ! sh "$docker_script"; then
            rm -f "$docker_script"
            log_error "Official Docker installation script failed."
            log_info "Try installing docker manually: https://docs.docker.com/engine/install/"
            return 1
        fi
        rm -f "$docker_script"

        if [ "$HAS_SYSTEMD" = "true" ]; then
            systemctl enable docker 2>/dev/null || true
            systemctl start docker 2>/dev/null || true
        else
            if command -v update-rc.d &>/dev/null; then
                update-rc.d docker defaults 2>/dev/null || true
            elif command -v chkconfig &>/dev/null; then
                chkconfig docker on 2>/dev/null || true
            elif command -v rc-update &>/dev/null; then
                rc-update add docker default 2>/dev/null || true
            fi
            service docker start 2>/dev/null || /etc/init.d/docker start 2>/dev/null || true
        fi
    fi

    sleep 3
    local retries=27
    while ! docker info &>/dev/null && [ $retries -gt 0 ]; do
        sleep 1
        retries=$((retries - 1))
    done

    if docker info &>/dev/null; then
        log_success "Docker installed successfully"
    else
        log_error "Docker installation may have failed. Please check manually."
        return 1
    fi
}

#═══════════════════════════════════════════════════════════════════════
# Container Naming & Configuration Helpers
#═══════════════════════════════════════════════════════════════════════

get_container_name() {
    local idx=$1
    if [ "$idx" -le 1 ] 2>/dev/null; then
        echo "torware"
    else
        echo "torware-${idx}"
    fi
}

get_volume_name() {
    local idx=$1
    echo "relay-data-${idx}"
}

get_snowflake_name() {
    local idx=$1
    if [ "$idx" -le 1 ] 2>/dev/null; then
        echo "snowflake-proxy"
    else
        echo "snowflake-proxy-${idx}"
    fi
}

get_snowflake_volume() {
    local idx=$1
    if [ "$idx" -le 1 ] 2>/dev/null; then
        echo "snowflake-data"
    else
        echo "snowflake-data-${idx}"
    fi
}

get_snowflake_metrics_port() {
    local idx=$1
    echo $((10000 - idx))
}

get_snowflake_cpus() {
    local idx=$1
    local var="SNOWFLAKE_CPUS_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo "${SNOWFLAKE_CPUS:-1.5}"
    fi
}

get_snowflake_memory() {
    local idx=$1
    local var="SNOWFLAKE_MEMORY_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo "${SNOWFLAKE_MEMORY:-512m}"
    fi
}

get_snowflake_default_cpus() {
    local cores=$(nproc 2>/dev/null || echo 1)
    if [ "$cores" -ge 2 ]; then
        echo "1.5"
    else
        echo "1.0"
    fi
}

get_snowflake_default_memory() {
    local total_mb=$(awk '/MemTotal/ {printf "%.0f", $2/1024}' /proc/meminfo 2>/dev/null || echo 0)
    if [ "$total_mb" -ge 3500 ]; then
        echo "1g"
    else
        echo "512m"
    fi
}

get_unbounded_default_cpus() {
    local cores=$(nproc 2>/dev/null || echo 1)
    if [ "$cores" -ge 2 ]; then
        echo "0.5"
    else
        echo "0.25"
    fi
}

get_unbounded_default_memory() {
    local total_mb=$(awk '/MemTotal/ {printf "%.0f", $2/1024}' /proc/meminfo 2>/dev/null || echo 0)
    if [ "$total_mb" -ge 1024 ]; then
        echo "256m"
    else
        echo "128m"
    fi
}

is_unbounded_running() {
    docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${UNBOUNDED_CONTAINER}$"
}

get_container_orport() {
    local idx=$1
    local var="ORPORT_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo $((ORPORT_BASE + idx - 1))
    fi
}

get_container_controlport() {
    local idx=$1
    echo $((CONTROLPORT_BASE + idx - 1))
}

get_container_ptport() {
    local idx=$1
    local var="PT_PORT_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo $((PT_PORT_BASE + idx - 1))
    fi
}

get_container_bandwidth() {
    local idx=$1
    local var="BANDWIDTH_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo "$BANDWIDTH"
    fi
}

get_container_cpus() {
    local idx=$1
    local var="CPUS_${idx}"
    echo "${!var}"
}

get_container_memory() {
    local idx=$1
    local var="MEMORY_${idx}"
    echo "${!var}"
}

get_container_relay_type() {
    local idx=$1
    local var="RELAY_TYPE_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then
        echo "$val"
    else
        echo "$RELAY_TYPE"
    fi
}

get_container_nickname() {
    local idx=$1
    if [ "$idx" -le 1 ] 2>/dev/null; then
        echo "$NICKNAME"
    else
        echo "${NICKNAME}${idx}"
    fi
}

#═══════════════════════════════════════════════════════════════════════
# Torrc Generation
#═══════════════════════════════════════════════════════════════════════

generate_torrc() {
    local idx=$1
    local orport=$(get_container_orport $idx)
    local controlport=$(get_container_controlport $idx)
    local ptport=$(get_container_ptport $idx)
    local bw=$(get_container_bandwidth $idx)
    local nick=$(get_container_nickname $idx)
    local torrc_dir="$CONTAINERS_DIR/relay-${idx}"

    mkdir -p "$torrc_dir"

    # Sanitize contact info for torrc (strip quotes that could break the directive)
    local safe_contact
    safe_contact=$(printf '%s' "$CONTACT_INFO" | tr -d '\042\134')

    # Convert bandwidth from Mbps to bytes/sec for torrc
    local bw_bytes=""
    local bw_burst=""
    if [ "$bw" != "-1" ] && [ -n "$bw" ]; then
        # BandwidthRate in bytes per second (Mbps * 125000 = bytes/sec)
        bw_bytes=$(awk -v b="$bw" 'BEGIN {printf "%.0f", b * 125000}')
        # Burst = 2x rate
        bw_burst=$(awk -v b="$bw" 'BEGIN {printf "%.0f", b * 250000}')
    fi

    local torrc_file="$torrc_dir/torrc"

    cat > "$torrc_file" << EOF
# Torware Configuration - Generated by torware.sh v${VERSION}
# Container: $(get_container_name $idx)
# Generated: $(date -u '+%Y-%m-%d %H:%M:%S UTC')

# Identity
Nickname ${nick}
ContactInfo "${safe_contact}"

# Network Ports
ORPort ${orport}
ControlPort 127.0.0.1:${controlport}

# Authentication
CookieAuthentication 1

# Data directory
DataDirectory /var/lib/tor
EOF

    # Relay-type specific configuration
    local rtype=$(get_container_relay_type $idx)
    case "$rtype" in
        bridge)
            cat >> "$torrc_file" << EOF

# Bridge Configuration (obfs4)
BridgeRelay 1
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:${ptport}
ExtORPort auto
PublishServerDescriptor bridge
EOF
            ;;
        middle)
            cat >> "$torrc_file" << EOF

# Middle Relay Configuration
ExitRelay 0
ExitPolicy reject *:*
ExitPolicy reject6 *:*
PublishServerDescriptor v3
EOF
            ;;
        exit)
            cat >> "$torrc_file" << EOF

# Exit Relay Configuration
$(generate_exit_policy)
PublishServerDescriptor v3
EOF
            ;;
    esac

    # Bandwidth limits
    if [ -n "$bw_bytes" ]; then
        cat >> "$torrc_file" << EOF

# Bandwidth Limits
BandwidthRate ${bw_bytes}
BandwidthBurst ${bw_burst}
RelayBandwidthRate ${bw_bytes}
RelayBandwidthBurst ${bw_burst}
EOF
    fi

    # Data cap / accounting
    if [ "${DATA_CAP_GB}" -gt 0 ] 2>/dev/null; then
        cat >> "$torrc_file" << EOF

# Traffic Accounting
AccountingMax ${DATA_CAP_GB} GB
AccountingStart month 1 00:00
EOF
    fi

    # Logging
    cat >> "$torrc_file" << EOF

# Logging
Log notice stdout
EOF

    chmod 644 "$torrc_file"
}

generate_exit_policy() {
    case "${EXIT_POLICY:-reduced}" in
        reduced)
            cat << 'EOF'
# Reduced Exit Policy (web traffic only)
ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject *:*
ExitPolicy reject6 *:*
EOF
            ;;
        default)
            cat << 'EOF'
# Default Exit Policy (common ports)
ExitPolicy accept *:20-23
ExitPolicy accept *:43
ExitPolicy accept *:53
ExitPolicy accept *:79-81
ExitPolicy accept *:88
ExitPolicy accept *:110
ExitPolicy accept *:143
ExitPolicy accept *:194
ExitPolicy accept *:220
ExitPolicy accept *:389
ExitPolicy accept *:443
ExitPolicy accept *:465
ExitPolicy accept *:531
ExitPolicy accept *:543-544
ExitPolicy accept *:554
ExitPolicy accept *:563
ExitPolicy accept *:587
ExitPolicy accept *:636
ExitPolicy accept *:706
ExitPolicy accept *:749
ExitPolicy accept *:873
ExitPolicy accept *:902-904
ExitPolicy accept *:981
ExitPolicy accept *:989-995
ExitPolicy accept *:1194
ExitPolicy accept *:1220
ExitPolicy accept *:1293
ExitPolicy accept *:1500
ExitPolicy accept *:1533
ExitPolicy accept *:1677
ExitPolicy accept *:1723
ExitPolicy accept *:1755
ExitPolicy accept *:1863
ExitPolicy accept *:2082-2083
ExitPolicy accept *:2086-2087
ExitPolicy accept *:2095-2096
ExitPolicy accept *:2102-2104
ExitPolicy accept *:3128
ExitPolicy accept *:3389
ExitPolicy accept *:3690
ExitPolicy accept *:4321
ExitPolicy accept *:4643
ExitPolicy accept *:5050
ExitPolicy accept *:5190
ExitPolicy accept *:5222-5223
ExitPolicy accept *:5228
ExitPolicy accept *:5900
ExitPolicy accept *:6660-6669
ExitPolicy accept *:6679
ExitPolicy accept *:6697
ExitPolicy accept *:8000
ExitPolicy accept *:8008
ExitPolicy accept *:8074
ExitPolicy accept *:8080
ExitPolicy accept *:8082
ExitPolicy accept *:8087-8088
ExitPolicy accept *:8232-8233
ExitPolicy accept *:8332-8333
ExitPolicy accept *:8443
ExitPolicy accept *:8888
ExitPolicy accept *:9418
ExitPolicy accept *:11371
ExitPolicy accept *:19294
ExitPolicy accept *:19638
ExitPolicy accept *:50002
ExitPolicy accept *:64738
ExitPolicy reject *:*
ExitPolicy reject6 *:*
EOF
            ;;
        full)
            cat << 'EOF'
# Full Exit Policy (all ports - HIGHEST RISK)
ExitPolicy accept *:*
ExitPolicy accept6 *:*
EOF
            ;;
    esac
}

#═══════════════════════════════════════════════════════════════════════
# ControlPort Communication
#═══════════════════════════════════════════════════════════════════════

# Get the netcat command available on this system
get_nc_cmd() {
    if command -v ncat &>/dev/null; then
        echo "ncat"
    elif command -v nc &>/dev/null; then
        echo "nc"
    else
        echo ""
    fi
}

# Read cookie from Docker volume and convert to hex (cached for 60s)
get_control_cookie() {
    local idx=$1
    local vol=$(get_volume_name $idx)
    local cache_file="${TMPDIR:-/tmp}/.tor_cookie_cache_${idx}"

    # Symlink protection - refuse to use if symlink
    if [ -L "$cache_file" ]; then
        rm -f "$cache_file" 2>/dev/null
    fi

    # Use cache if fresh and regular file (avoid spawning Docker container every call)
    if [ -f "$cache_file" ] && [ ! -L "$cache_file" ]; then
        local mtime
        mtime=$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null || echo 0)
        local age=$(( $(date +%s) - mtime ))
        if [ "$age" -lt 60 ] && [ "$age" -ge 0 ]; then
            cat "$cache_file"
            return
        fi
    fi

    local cookie
    cookie=$(docker run --rm -v "${vol}:/data:ro" alpine \
        sh -c 'od -A n -t x1 /data/control_auth_cookie 2>/dev/null | tr -d " \n"' 2>/dev/null)

    if [ -n "$cookie" ]; then
        # Write to temp file then atomically move to prevent TOCTOU race
        local tmp_cache
        tmp_cache=$(mktemp "${TMPDIR:-/tmp}/.tor_cookie_cache_${idx}.XXXXXX" 2>/dev/null) || return
        ( umask 077; echo "$cookie" > "$tmp_cache" ) && mv -f "$tmp_cache" "$cache_file" 2>/dev/null
    fi
    echo "$cookie"
}

# Query ControlPort with authentication
controlport_query() {
    local port=$1
    shift
    local nc_cmd=$(get_nc_cmd)

    if [ -z "$nc_cmd" ]; then
        return 1
    fi

    # Build the query: authenticate, run commands, quit
    local idx=$((port - CONTROLPORT_BASE + 1))
    local cookie=$(get_control_cookie $idx)

    if [ -z "$cookie" ]; then
        return 1
    fi

    {
        printf 'AUTHENTICATE %s\r\n' "$cookie"
        for cmd in "$@"; do
            printf "%s\r\n" "$cmd"
        done
        printf "QUIT\r\n"
    } | timeout 5 "$nc_cmd" 127.0.0.1 "$port" 2>/dev/null | tr -d '\r'
}

# Get traffic bytes (read, written) from a container
get_tor_traffic() {
    local idx=$1
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" "GETINFO traffic/read" "GETINFO traffic/written" 2>/dev/null)

    local read_bytes write_bytes
    read_bytes=$(echo "$result" | sed -n 's/.*traffic\/read=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")
    write_bytes=$(echo "$result" | sed -n 's/.*traffic\/written=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")

    echo "$read_bytes $write_bytes"
}

# Get circuit count from a container
get_tor_circuits() {
    local idx=$1
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" "GETINFO circuit-status" 2>/dev/null)

    # Count lines that start with a circuit ID (number)
    local count
    count=$(echo "$result" | grep -cE '^[0-9]+ (BUILT|EXTENDED|LAUNCHED)' 2>/dev/null || echo "0")
    count=${count//[^0-9]/}
    echo "${count:-0}"
}

# Get OR connection count
get_tor_connections() {
    local idx=$1
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" "GETINFO orconn-status" 2>/dev/null)

    local count
    count=$(echo "$result" | grep -c '\$' 2>/dev/null || echo "0")
    count=${count//[^0-9]/}
    echo "${count:-0}"
}

# Get accounting info (data cap usage)
get_tor_accounting() {
    local idx=$1
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" \
        "GETINFO accounting/enabled" \
        "GETINFO accounting/bytes" \
        "GETINFO accounting/bytes-left" \
        "GETINFO accounting/interval-end" 2>/dev/null)
    echo "$result"
}

# Get relay fingerprint (cached for 300s to avoid spawning Docker container every call)
get_tor_fingerprint() {
    local idx=$1
    local cache_file="${TMPDIR:-/tmp}/.tor_fp_cache_${idx}"

    # Symlink protection - refuse to use if symlink
    if [ -L "$cache_file" ]; then
        rm -f "$cache_file" 2>/dev/null
    fi

    if [ -f "$cache_file" ] && [ ! -L "$cache_file" ]; then
        local mtime
        mtime=$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null || echo 0)
        local age=$(( $(date +%s) - mtime ))
        if [ "$age" -lt 300 ] && [ "$age" -ge 0 ]; then
            cat "$cache_file"
            return
        fi
    fi
    local vol=$(get_volume_name $idx)
    local fp
    fp=$(docker run --rm -v "${vol}:/data:ro" alpine \
        cat /data/fingerprint 2>/dev/null | awk '{print $2}')
    if [ -n "$fp" ]; then
        # Write to temp file then atomically move to prevent TOCTOU race
        local tmp_cache
        tmp_cache=$(mktemp "${TMPDIR:-/tmp}/.tor_fp_cache_${idx}.XXXXXX" 2>/dev/null) || return
        ( umask 077; echo "$fp" > "$tmp_cache" ) && mv -f "$tmp_cache" "$cache_file" 2>/dev/null
    fi
    echo "$fp"
}

# Cached external IP (avoids repeated curl calls)
_CACHED_EXTERNAL_IP=""
_get_external_ip() {
    if [ -z "$_CACHED_EXTERNAL_IP" ]; then
        _CACHED_EXTERNAL_IP=$(curl -s --max-time 5 ifconfig.me 2>/dev/null || echo "")
    fi
    echo "$_CACHED_EXTERNAL_IP"
}

# Get bridge line (for obfs4 bridges)
get_bridge_line() {
    local idx=$1
    local cname=$(get_container_name $idx)
    local raw
    raw=$(docker exec "$cname" cat /var/lib/tor/pt_state/obfs4_bridgeline.txt 2>/dev/null | grep -vE '^#|^$' | head -1)
    if [ -n "$raw" ]; then
        # Replace placeholders with real IP, port, and fingerprint
        local ip
        ip=$(_get_external_ip)
        local ptport=$(get_container_ptport "$idx")
        local fp=$(get_tor_fingerprint "$idx")
        if [ -n "$ip" ]; then
            raw="${raw/<IP ADDRESS>/$ip}"
            raw="${raw/<PORT>/$ptport}"
            raw="${raw/<FINGERPRINT>/$fp}"
        fi
        echo "$raw"
    fi
}

# Get bridge client country stats (bridges only — uses Tor's built-in CLIENTS_SEEN)
# Returns lines like: ir=50 cn=120 us=30
get_tor_clients_seen() {
    local idx=$1
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" "GETINFO status/clients-seen" 2>/dev/null)
    # Extract the CountrySummary field: cc=num,cc=num,...
    local countries
    countries=$(echo "$result" | sed -n 's/.*CountrySummary=\([^ \r]*\).*/\1/p' | head -1 2>/dev/null)
    echo "$countries"
}

# Resolve IP to country via Tor ControlPort
tor_geo_lookup() {
    local ip=$1
    # Validate IP format (IPv4 only)
    if ! [[ "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
        echo "??"
        return
    fi
    local idx=${2:-1}
    local port=$(get_container_controlport $idx)
    local result
    result=$(controlport_query "$port" "GETINFO ip-to-country/$ip" 2>/dev/null)
    local sed_safe_ip=$(printf '%s' "$ip" | sed 's/[.]/\\./g; s/[/]/\\//g')
    echo "$result" | sed -n "s/.*ip-to-country\/${sed_safe_ip}=\([^\r]*\)/\1/p" | head -1 || echo "??"
}

#═══════════════════════════════════════════════════════════════════════
# Interactive Setup Wizard
#═══════════════════════════════════════════════════════════════════════

prompt_relay_settings() {
  while true; do
    local ram_mb=$(get_ram_mb)
    local cpu_cores=$(get_cpu_cores)

    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}                   TORWARE CONFIGURATION                     ${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo ""
    echo -e "  ${BOLD}Server Info:${NC}"
    echo -e "    CPU Cores: ${GREEN}${cpu_cores}${NC}"
    if [ "$ram_mb" -ge 1000 ]; then
        local ram_gb=$(awk -v m="$ram_mb" 'BEGIN {printf "%.1f", m/1024}')
        echo -e "    RAM: ${GREEN}${ram_gb} GB${NC}"
    else
        echo -e "    RAM: ${GREEN}${ram_mb} MB${NC}"
    fi
    echo ""

    # ── Suggested Setup Modes ──
    echo -e "  ${BOLD}Choose a Setup Mode:${NC}"
    echo ""
    echo -e "  ${DIM}Options 1-4: You can add Snowflake, Lantern, or Telegram proxy later from the menu.${NC}"
    echo ""
    echo -e "  ${GREEN}${BOLD}  1. Single Bridge${NC} (${BOLD}RECOMMENDED${NC})"
    echo -e "       1 obfs4 bridge container — ideal for most users"
    echo -e "       Helps censored users connect to Tor"
    echo -e "       Your IP stays PRIVATE (not publicly listed)"
    echo -e "       Zero legal risk, zero abuse complaints"
    echo ""
    echo -e "  ${GREEN}  2. Multi-Bridge${NC}"
    echo -e "       2-5 bridge containers on the same IP"
    echo -e "       Each bridge gets its own identity and ORPort"
    echo -e "       All bridges stay private — safe to run together"
    echo -e "       Best for servers with spare CPU/RAM"
    echo ""
    echo -e "  ${YELLOW}  3. Middle Relay${NC}"
    echo -e "       1 middle relay container — routes Tor traffic"
    echo -e "       Your IP WILL be publicly listed in the Tor consensus"
    echo -e "       No exit traffic, so lower risk than an exit relay"
    echo -e "       Helps increase Tor network capacity"
    echo ""
    echo -e "  ${DIM}  4. Custom${NC}"
    echo -e "       Choose relay type and container count manually"
    echo -e "       Includes exit relay option (advanced, legal risks)"
    echo ""
    echo -e "  ${CYAN}  5. Snowflake Only${NC}"
    echo -e "       No Tor relay — just run Snowflake WebRTC proxy"
    echo -e "       Helps censored users connect to Tor"
    echo -e "       Lightweight, no IP exposure, zero config"
    echo ""
    echo -e "  ${CYAN}  6. Unbounded Only (Lantern)${NC}"
    echo -e "       No Tor relay — just run Lantern Unbounded WebRTC proxy"
    echo -e "       Helps censored users connect via Lantern network"
    echo -e "       Lightweight, no IP exposure, zero config"
    echo ""
    echo -e "  ${CYAN}  7. Telegram Proxy Only (MTProxy)${NC}"
    echo -e "       No Tor relay — just run MTProxy for Telegram"
    echo -e "       Helps censored users access Telegram"
    echo -e "       FakeTLS disguises traffic as HTTPS, share link/QR"
    echo ""
    echo -e "  ${DIM}  0. Exit${NC}"
    echo ""

    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Choose setup mode [0-7] (default: 1)"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  mode: " input_mode < /dev/tty || true

    case "${input_mode:-1}" in
        1|"")
            RELAY_TYPE="bridge"
            CONTAINER_COUNT=1
            echo -e "  Selected: ${GREEN}Single Bridge (obfs4)${NC}"
            ;;
        2)
            RELAY_TYPE="bridge"
            # Recommend container count based on resources
            local rec_multi=2
            if [ "$cpu_cores" -ge 4 ] && [ "$ram_mb" -ge 4096 ]; then
                rec_multi=3
            fi
            echo ""
            echo -e "  How many bridge containers? (2-5, default: ${rec_multi})"
            echo -e "  ${DIM}System: ${cpu_cores} CPU core(s), ${ram_mb}MB RAM${NC}"
            read -p "  bridges: " input_multi < /dev/tty || true
            if [ -z "$input_multi" ]; then
                CONTAINER_COUNT=$rec_multi
            elif [[ "$input_multi" =~ ^[2-5]$ ]]; then
                CONTAINER_COUNT=$input_multi
            else
                log_warn "Invalid input. Using default: ${rec_multi}"
                CONTAINER_COUNT=$rec_multi
            fi
            echo -e "  Selected: ${GREEN}${CONTAINER_COUNT}x Bridge (obfs4)${NC}"
            ;;
        3)
            RELAY_TYPE="middle"
            CONTAINER_COUNT=1
            echo -e "  Selected: ${YELLOW}Middle Relay${NC}"
            echo ""
            echo -e "  ${DIM}Note: Your IP will be publicly listed in the Tor consensus.${NC}"
            echo -e "  ${DIM}This is normal for middle relays and poses low risk.${NC}"
            ;;
        4)
            local _custom_needs_count=true
            # ── Custom: Relay Type ──
            echo ""
            echo -e "  ${BOLD}Relay Type:${NC}"
            echo -e "    ${GREEN}1. Bridge (obfs4)${NC} — IP stays private, helps censored users"
            echo -e "    ${YELLOW}2. Middle Relay${NC}   — IP is public, routes Tor traffic"
            echo -e "    ${RED}3. Exit Relay${NC}     — ADVANCED: IP is public, receives abuse complaints"
            echo ""
            read -p "  relay type [1-3] (default: 1): " input_type < /dev/tty || true

            case "${input_type:-1}" in
                1|"")
                    RELAY_TYPE="bridge"
                    echo -e "  Selected: ${GREEN}Bridge (obfs4)${NC}"
                    ;;
                2)
                    RELAY_TYPE="middle"
                    echo -e "  Selected: ${YELLOW}Middle Relay${NC}"
                    ;;
                3)
                    echo ""
                    echo -e "${RED}╔═══════════════════════════════════════════════════════════════════╗${NC}"
                    echo -e "${RED}║  EXIT RELAY — LEGAL WARNING                                      ║${NC}"
                    echo -e "${RED}╠═══════════════════════════════════════════════════════════════════╣${NC}"
                    echo -e "${RED}║                                                                   ║${NC}"
                    echo -e "${RED}║  Running an exit relay means:                                     ║${NC}"
                    echo -e "${RED}║                                                                   ║${NC}"
                    echo -e "${RED}║  • Your IP will be publicly listed as a Tor exit                  ║${NC}"
                    echo -e "${RED}║  • Abuse complaints may be sent to your ISP                       ║${NC}"
                    echo -e "${RED}║  • Some services may block your IP                                ║${NC}"
                    echo -e "${RED}║  • You may receive DMCA notices or legal requests                 ║${NC}"
                    echo -e "${RED}║                                                                   ║${NC}"
                    echo -e "${RED}║  Learn more:                                                      ║${NC}"
                    echo -e "${RED}║  https://community.torproject.org/relay/community-resources/      ║${NC}"
                    echo -e "${RED}║                                                                   ║${NC}"
                    echo -e "${RED}╚═══════════════════════════════════════════════════════════════════╝${NC}"
                    echo ""
                    read -p "  Type 'I UNDERSTAND' to continue, or press Enter for Bridge: " confirm_exit < /dev/tty || true
                    if [ "$confirm_exit" = "I UNDERSTAND" ]; then
                        RELAY_TYPE="exit"
                        echo -e "  Selected: ${RED}Exit Relay${NC}"
                        echo ""
                        echo -e "  ${BOLD}Exit Policy:${NC}"
                        echo -e "    ${GREEN}a. Reduced${NC} (ports 80, 443 only) - ${BOLD}RECOMMENDED${NC}"
                        echo -e "    ${YELLOW}b. Default${NC} (common ports)"
                        echo -e "    ${RED}c. Full${NC} (all ports) - HIGHEST RISK"
                        echo ""
                        read -p "  Exit policy [a/b/c] (default: a): " ep_choice < /dev/tty || true
                        case "${ep_choice:-a}" in
                            b) EXIT_POLICY="default" ;;
                            c) EXIT_POLICY="full" ;;
                            *) EXIT_POLICY="reduced" ;;
                        esac
                    else
                        RELAY_TYPE="bridge"
                        echo -e "  Defaulting to: ${GREEN}Bridge (obfs4)${NC}"
                    fi
                    ;;
                *)
                    RELAY_TYPE="bridge"
                    echo -e "  Invalid input. Defaulting to: ${GREEN}Bridge (obfs4)${NC}"
                    ;;
            esac
            # Custom mode: skip to container count below (handled after this case)
            ;;
        5)
            # Snowflake-only mode: no Tor relay
            RELAY_TYPE="none"
            CONTAINER_COUNT=0
            SNOWFLAKE_ENABLED="true"
            echo -e "  Selected: ${CYAN}Snowflake Only${NC} (no Tor relay)"
            echo ""
            echo -e "  ${DIM}You can run up to 2 Snowflake instances. Each registers${NC}"
            echo -e "  ${DIM}independently with the broker for more client assignments.${NC}"
            read -p "  Number of Snowflake instances (1-2) [1]: " _sf_count < /dev/tty || true
            if [ "$_sf_count" = "2" ]; then
                SNOWFLAKE_COUNT=2
            else
                SNOWFLAKE_COUNT=1
            fi
            local _def_cpu=$(get_snowflake_default_cpus)
            local _def_mem=$(get_snowflake_default_memory)
            for _si in $(seq 1 $SNOWFLAKE_COUNT); do
                echo ""
                if [ "$SNOWFLAKE_COUNT" -gt 1 ]; then
                    echo -e "  ${BOLD}Instance #${_si}:${NC}"
                fi
                read -p "  CPU cores [${_def_cpu}]: " _sf_cpu < /dev/tty || true
                read -p "  RAM limit [${_def_mem}]: " _sf_mem < /dev/tty || true
                [ -z "$_sf_cpu" ] && _sf_cpu="$_def_cpu"
                [ -z "$_sf_mem" ] && _sf_mem="$_def_mem"
                [[ "$_sf_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _sf_cpu="$_def_cpu"
                [[ "$_sf_mem" =~ ^[0-9]+[mMgG]$ ]] || _sf_mem="$_def_mem"
                _sf_mem=$(echo "$_sf_mem" | tr '[:upper:]' '[:lower:]')
                eval "SNOWFLAKE_CPUS_${_si}=\"$_sf_cpu\""
                eval "SNOWFLAKE_MEMORY_${_si}=\"$_sf_mem\""
            done
            echo -e "  Snowflake: ${GREEN}${SNOWFLAKE_COUNT} instance(s)${NC}"
            ;;
        6)
            # Unbounded-only mode: no Tor relay
            RELAY_TYPE="none"
            CONTAINER_COUNT=0
            UNBOUNDED_ENABLED="true"
            echo -e "  Selected: ${CYAN}Unbounded Only${NC} (Lantern network, no Tor relay)"
            echo ""
            local _def_ub_cpu=$(get_unbounded_default_cpus)
            local _def_ub_mem=$(get_unbounded_default_memory)
            read -p "  CPU cores [${_def_ub_cpu}]: " _ub_cpu < /dev/tty || true
            read -p "  RAM limit [${_def_ub_mem}]: " _ub_mem < /dev/tty || true
            [ -z "$_ub_cpu" ] && _ub_cpu="$_def_ub_cpu"
            [ -z "$_ub_mem" ] && _ub_mem="$_def_ub_mem"
            [[ "$_ub_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _ub_cpu="$_def_ub_cpu"
            [[ "$_ub_mem" =~ ^[0-9]+[mMgG]$ ]] || _ub_mem="$_def_ub_mem"
            _ub_mem=$(echo "$_ub_mem" | tr '[:upper:]' '[:lower:]')
            UNBOUNDED_CPUS="$_ub_cpu"
            UNBOUNDED_MEMORY="$_ub_mem"
            echo -e "  Unbounded: ${GREEN}Enabled${NC} (CPU: ${_ub_cpu}, RAM: ${_ub_mem})"
            ;;
        7)
            # MTProxy-only mode: no Tor relay
            RELAY_TYPE="none"
            CONTAINER_COUNT=0
            MTPROXY_ENABLED="true"
            echo -e "  Selected: ${CYAN}Telegram Proxy Only${NC} (MTProxy, no Tor relay)"
            echo ""
            echo -e "  ${DIM}FakeTLS domain (any popular HTTPS site — you don't need to own it):${NC}"
            echo -e "  ${DIM}  Traffic will appear as normal HTTPS to this domain.${NC}"
            echo -e "  ${DIM}  1. cloudflare.com (recommended)${NC}"
            echo -e "  ${DIM}  2. google.com${NC}"
            echo -e "  ${DIM}  3. Custom (any HTTPS site, e.g. microsoft.com, amazon.com)${NC}"
            read -p "  Domain choice [1]: " _mtp_dom_choice < /dev/tty || true
            case "${_mtp_dom_choice:-1}" in
                2) MTPROXY_DOMAIN="google.com" ;;
                3)
                    read -p "  Enter domain (e.g. microsoft.com): " _mtp_custom_dom < /dev/tty || true
                    MTPROXY_DOMAIN="${_mtp_custom_dom:-cloudflare.com}"
                    ;;
                *) MTPROXY_DOMAIN="cloudflare.com" ;;
            esac
            echo ""
            read -p "  Port [8443]: " _mtp_port < /dev/tty || true
            MTPROXY_PORT="${_mtp_port:-8443}"
            [[ "$MTPROXY_PORT" =~ ^[0-9]+$ ]] || MTPROXY_PORT=8443
            echo ""
            local _def_mtp_cpu="0.5"
            local _def_mtp_mem="128m"
            read -p "  CPU cores [${_def_mtp_cpu}]: " _mtp_cpu < /dev/tty || true
            read -p "  RAM limit [${_def_mtp_mem}]: " _mtp_mem < /dev/tty || true
            [ -z "$_mtp_cpu" ] && _mtp_cpu="$_def_mtp_cpu"
            [ -z "$_mtp_mem" ] && _mtp_mem="$_def_mtp_mem"
            [[ "$_mtp_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _mtp_cpu="$_def_mtp_cpu"
            [[ "$_mtp_mem" =~ ^[0-9]+[mMgG]$ ]] || _mtp_mem="$_def_mtp_mem"
            _mtp_mem=$(echo "$_mtp_mem" | tr '[:upper:]' '[:lower:]')
            MTPROXY_CPUS="$_mtp_cpu"
            MTPROXY_MEMORY="$_mtp_mem"
            MTPROXY_SECRET=""  # Will be generated on first run
            echo -e "  MTProxy: ${GREEN}Enabled${NC} (Port: ${MTPROXY_PORT}, Domain: ${MTPROXY_DOMAIN})"
            echo ""
            echo -e "  ${DIM}Tip: You can configure connection limits and geo-blocking in the main menu.${NC}"
            ;;
        0)
            echo -e "  ${YELLOW}Exiting setup.${NC}"
            exit 0
            ;;
        *)
            RELAY_TYPE="bridge"
            CONTAINER_COUNT=1
            echo -e "  Invalid input. Defaulting to: ${GREEN}Single Bridge (obfs4)${NC}"
            ;;
    esac

    # Skip relay config for proxy-only modes (Snowflake-only or Unbounded-only)
    if [ "$RELAY_TYPE" = "none" ]; then
        # Jump to summary confirmation
        :
    else

    # ── Container Count (custom mode only — modes 1-3 already set CONTAINER_COUNT) ──
    if [ "${input_mode:-1}" = "4" ] && [ "${_custom_needs_count:-false}" = "true" ]; then
        CONTAINER_COUNT=""  # will be set below
        local rec_containers=1
        if [ "$cpu_cores" -ge 4 ] && [ "$ram_mb" -ge 4096 ]; then
            rec_containers=2
        fi

        echo ""
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        echo -e "  How many containers to run? (1-5)"
        echo -e "  Each gets a unique ORPort and identity"
        echo -e "  ${DIM}System: ${cpu_cores} CPU core(s), ${ram_mb}MB RAM${NC}"
        echo -e "  Press Enter for default: ${GREEN}${rec_containers}${NC}"
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        read -p "  containers: " input_containers < /dev/tty || true

        if [ -z "$input_containers" ]; then
            CONTAINER_COUNT=$rec_containers
        elif [[ "$input_containers" =~ ^[1-5]$ ]]; then
            CONTAINER_COUNT=$input_containers
        else
            log_warn "Invalid input. Using default: ${rec_containers}"
            CONTAINER_COUNT=$rec_containers
        fi
    fi

    # ── Per-Container Relay Type (custom mode, multiple containers) ──
    if [ "${input_mode:-1}" = "4" ] && [ "$CONTAINER_COUNT" -gt 1 ]; then
        echo ""
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        echo -e "  Use the same relay type (${GREEN}${RELAY_TYPE}${NC}) for all containers?"
        echo -e "  Selecting 'n' lets you assign different types per container"
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        read -p "  Same type for all? [Y/n] " same_type < /dev/tty || true

        if [[ "$same_type" =~ ^[Nn]$ ]]; then
            echo ""
            for ci in $(seq 1 $CONTAINER_COUNT); do
                echo -e "  ${BOLD}Container $ci:${NC} [1=Bridge, 2=Middle, 3=Exit] (default: 1)"
                read -p "    type: " ct_choice < /dev/tty || true
                case "${ct_choice:-1}" in
                    2)
                        printf -v "RELAY_TYPE_${ci}" '%s' "middle"
                        echo -e "    -> ${YELLOW}Middle Relay${NC}"
                        ;;
                    3)
                        printf -v "RELAY_TYPE_${ci}" '%s' "exit"
                        echo -e "    -> ${RED}Exit Relay${NC}"
                        ;;
                    *)
                        printf -v "RELAY_TYPE_${ci}" '%s' "bridge"
                        echo -e "    -> ${GREEN}Bridge${NC}"
                        ;;
                esac
            done

            # Check for mixed bridge + relay on same host (unsafe per Tor Project guidance)
            local _has_bridge=false _has_relay=false
            for ci in $(seq 1 $CONTAINER_COUNT); do
                local _crt=$(get_container_relay_type $ci)
                [ "$_crt" = "bridge" ] && _has_bridge=true || _has_relay=true
            done
            if [ "$_has_bridge" = "true" ] && [ "$_has_relay" = "true" ]; then
                echo ""
                echo -e "  ${RED}╔══════════════════════════════════════════════════════════╗${NC}"
                echo -e "  ${RED}║  WARNING: Bridge + Relay on same IP is NOT recommended   ║${NC}"
                echo -e "  ${RED}╠══════════════════════════════════════════════════════════╣${NC}"
                echo -e "  ${RED}║${NC}  Bridges are UNLISTED — their IPs are kept private.      ${RED}║${NC}"
                echo -e "  ${RED}║${NC}  Middle relays are PUBLICLY LISTED in the Tor consensus. ${RED}║${NC}"
                echo -e "  ${RED}║${NC}                                                          ${RED}║${NC}"
                echo -e "  ${RED}║${NC}  Running both on the same IP exposes your bridge's IP    ${RED}║${NC}"
                echo -e "  ${RED}║${NC}  through the public relay listing, defeating the purpose  ${RED}║${NC}"
                echo -e "  ${RED}║${NC}  of running a bridge.                                    ${RED}║${NC}"
                echo -e "  ${RED}║${NC}                                                          ${RED}║${NC}"
                echo -e "  ${RED}║${NC}  Safe combos: all bridges OR all middle relays.           ${RED}║${NC}"
                echo -e "  ${RED}╚══════════════════════════════════════════════════════════╝${NC}"
                echo ""
                read -p "  Continue anyway? [y/N] " _mix_confirm < /dev/tty || true
                if [[ ! "$_mix_confirm" =~ ^[Yy]$ ]]; then
                    echo -e "  Resetting all containers to ${GREEN}${RELAY_TYPE}${NC}"
                    for ci in $(seq 1 $CONTAINER_COUNT); do
                        printf -v "RELAY_TYPE_${ci}" '%s' "$RELAY_TYPE"
                    done
                fi
            fi
        fi
    fi

    echo ""

    # ── Nickname ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Enter a nickname for your relay (1-19 chars, alphanumeric)"
    echo -e "  Press Enter for default: ${GREEN}Torware${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  nickname: " input_nick < /dev/tty || true

    if [ -z "$input_nick" ]; then
        NICKNAME="Torware"
    elif [[ "$input_nick" =~ ^[A-Za-z0-9]{1,19}$ ]]; then
        NICKNAME="$input_nick"
    else
        log_warn "Invalid nickname (must be 1-19 alphanumeric chars). Using default."
        NICKNAME="Torware"
    fi

    echo ""

    # ── Contact Info ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Enter contact email (shown to Tor Project, not public)"
    echo -e "  Press Enter to skip"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  email: " input_email < /dev/tty || true
    CONTACT_INFO="${input_email:-nobody@example.com}"

    echo ""

    # ── Bandwidth ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Do you want to set ${BOLD}UNLIMITED${NC} bandwidth?"
    echo -e "  ${YELLOW}Note: For relays, Tor recommends at least 2 Mbps.${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  Set unlimited bandwidth? [y/N] " unlimited_bw < /dev/tty || true

    if [[ "$unlimited_bw" =~ ^[Yy]$ ]]; then
        BANDWIDTH="-1"
        echo -e "  Selected: ${GREEN}Unlimited${NC}"
    else
        echo ""
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        echo -e "  Enter bandwidth in Mbps (1-100)"
        echo -e "  Press Enter for default: ${GREEN}5${NC} Mbps"
        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
        read -p "  bandwidth: " input_bandwidth < /dev/tty || true

        if [ -z "$input_bandwidth" ]; then
            BANDWIDTH=5
        elif [[ "$input_bandwidth" =~ ^[0-9]+$ ]] && [ "$input_bandwidth" -ge 1 ] && [ "$input_bandwidth" -le 100 ]; then
            BANDWIDTH=$input_bandwidth
        elif [[ "$input_bandwidth" =~ ^[0-9]*\.[0-9]+$ ]]; then
            local float_ok=$(awk -v val="$input_bandwidth" 'BEGIN { print (val >= 1 && val <= 100) ? "yes" : "no" }')
            if [ "$float_ok" = "yes" ]; then
                BANDWIDTH=$input_bandwidth
            else
                log_warn "Invalid input. Using default: 5 Mbps"
                BANDWIDTH=5
            fi
        else
            log_warn "Invalid input. Using default: 5 Mbps"
            BANDWIDTH=5
        fi
    fi

    echo ""

    # ── Data Cap ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Set a monthly data cap? (in GB, 0 = unlimited)"
    echo -e "  Tor will automatically hibernate when cap is reached."
    echo -e "  Press Enter for default: ${GREEN}0${NC} (unlimited)"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  data cap (GB): " input_cap < /dev/tty || true

    if [ -z "$input_cap" ] || [ "$input_cap" = "0" ]; then
        DATA_CAP_GB=0
    elif [[ "$input_cap" =~ ^[0-9]+$ ]] && [ "$input_cap" -ge 1 ]; then
        DATA_CAP_GB=$input_cap
    else
        log_warn "Invalid input. Using unlimited."
        DATA_CAP_GB=0
    fi

    echo ""

    # ── Snowflake Proxy ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  ${BOLD}Snowflake Proxy${NC} (${GREEN}RECOMMENDED${NC})"
    echo -e "  Runs a lightweight WebRTC proxy alongside your relay."
    echo -e "  Helps censored users connect to Tor (looks like a video call)."
    echo -e "  Uses ~10-30MB RAM, negligible CPU. No extra config needed."
    echo -e "  ${DIM}Learn more: https://snowflake.torproject.org/${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  Enable Snowflake proxy? [Y/n] " input_sf < /dev/tty || true
    if [[ "$input_sf" =~ ^[Nn]$ ]]; then
        SNOWFLAKE_ENABLED="false"
        echo -e "  Snowflake: ${DIM}Disabled${NC}"
    else
        SNOWFLAKE_ENABLED="true"
        echo -e "  Snowflake: ${GREEN}Enabled${NC}"
        echo ""
        echo -e "  ${DIM}You can run up to 2 Snowflake instances. Each registers${NC}"
        echo -e "  ${DIM}independently with the broker for more client assignments.${NC}"
        read -p "  Number of Snowflake instances (1-2) [1]: " _sf_count < /dev/tty || true
        if [ "$_sf_count" = "2" ]; then
            SNOWFLAKE_COUNT=2
        else
            SNOWFLAKE_COUNT=1
        fi
        local _def_cpu=$(get_snowflake_default_cpus)
        local _def_mem=$(get_snowflake_default_memory)
        for _si in $(seq 1 $SNOWFLAKE_COUNT); do
            echo ""
            if [ "$SNOWFLAKE_COUNT" -gt 1 ]; then
                echo -e "  ${BOLD}Instance #${_si}:${NC}"
            fi
            read -p "  CPU cores [${_def_cpu}]: " _sf_cpu < /dev/tty || true
            read -p "  RAM limit [${_def_mem}]: " _sf_mem < /dev/tty || true
            [ -z "$_sf_cpu" ] && _sf_cpu="$_def_cpu"
            [ -z "$_sf_mem" ] && _sf_mem="$_def_mem"
            [[ "$_sf_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _sf_cpu="$_def_cpu"
            [[ "$_sf_mem" =~ ^[0-9]+[mMgG]$ ]] || _sf_mem="$_def_mem"
            _sf_mem=$(echo "$_sf_mem" | tr '[:upper:]' '[:lower:]')
            eval "SNOWFLAKE_CPUS_${_si}=\"$_sf_cpu\""
            eval "SNOWFLAKE_MEMORY_${_si}=\"$_sf_mem\""
        done
        echo -e "  Snowflake: ${GREEN}${SNOWFLAKE_COUNT} instance(s)${NC}"
    fi

    # ── Unbounded (Lantern) Proxy ──
    echo ""
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  ${BOLD}Unbounded Proxy (Lantern)${NC}"
    echo -e "  Runs a lightweight WebRTC proxy alongside your relay."
    echo -e "  Helps censored users connect via the Lantern network."
    echo -e "  Very lightweight (~10MB RAM). No port forwarding needed."
    echo -e "  ${DIM}Learn more: https://unbounded.lantern.io/${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  Enable Unbounded proxy? [y/N] " input_ub < /dev/tty || true
    if [[ "$input_ub" =~ ^[Yy]$ ]]; then
        UNBOUNDED_ENABLED="true"
        local _def_ub_cpu=$(get_unbounded_default_cpus)
        local _def_ub_mem=$(get_unbounded_default_memory)
        read -p "  CPU cores [${_def_ub_cpu}]: " _ub_cpu < /dev/tty || true
        read -p "  RAM limit [${_def_ub_mem}]: " _ub_mem < /dev/tty || true
        [ -z "$_ub_cpu" ] && _ub_cpu="$_def_ub_cpu"
        [ -z "$_ub_mem" ] && _ub_mem="$_def_ub_mem"
        [[ "$_ub_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _ub_cpu="$_def_ub_cpu"
        [[ "$_ub_mem" =~ ^[0-9]+[mMgG]$ ]] || _ub_mem="$_def_ub_mem"
        _ub_mem=$(echo "$_ub_mem" | tr '[:upper:]' '[:lower:]')
        UNBOUNDED_CPUS="$_ub_cpu"
        UNBOUNDED_MEMORY="$_ub_mem"
        echo -e "  Unbounded: ${GREEN}Enabled${NC} (CPU: ${_ub_cpu}, RAM: ${_ub_mem})"
    else
        UNBOUNDED_ENABLED="false"
        echo -e "  Unbounded: ${DIM}Disabled${NC}"
    fi

    # ── MTProxy (Telegram) Prompt ──
    echo ""
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  ${BOLD}📱 MTProxy (Telegram Proxy)${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  Run a proxy that helps censored users access Telegram."
    echo -e "  Uses FakeTLS to disguise traffic as normal HTTPS."
    echo -e "  Very lightweight (~50MB RAM). Share link/QR with users."
    echo -e "  ${DIM}Learn more: https://core.telegram.org/proxy${NC}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    read -p "  Enable MTProxy? [y/N] " input_mtp < /dev/tty || true
    if [[ "$input_mtp" =~ ^[Yy]$ ]]; then
        MTPROXY_ENABLED="true"
        echo ""
        echo -e "  ${DIM}FakeTLS domain (any popular HTTPS site — you don't need to own it):${NC}"
        echo -e "  ${DIM}  Traffic will appear as normal HTTPS to this domain.${NC}"
        echo -e "  ${DIM}  1. cloudflare.com (recommended)${NC}"
        echo -e "  ${DIM}  2. google.com${NC}"
        echo -e "  ${DIM}  3. Custom (any HTTPS site, e.g. microsoft.com, amazon.com)${NC}"
        read -p "  Domain choice [1]: " _mtp_dom_choice < /dev/tty || true
        case "${_mtp_dom_choice:-1}" in
            2) MTPROXY_DOMAIN="google.com" ;;
            3)
                read -p "  Enter domain (e.g. microsoft.com): " _mtp_custom_dom < /dev/tty || true
                MTPROXY_DOMAIN="${_mtp_custom_dom:-cloudflare.com}"
                ;;
            *) MTPROXY_DOMAIN="cloudflare.com" ;;
        esac
        echo ""
        echo -e "  ${DIM}MTProxy uses host networking. Choose an available port.${NC}"
        echo -e "  ${DIM}Common choices: 443, 8443, 8080, 9443${NC}"
        read -p "  Port [8443]: " _mtp_port < /dev/tty || true
        _mtp_port="${_mtp_port:-8443}"
        if [[ "$_mtp_port" =~ ^[0-9]+$ ]]; then
            if ss -tln 2>/dev/null | grep -q ":${_mtp_port} " || netstat -tln 2>/dev/null | grep -q ":${_mtp_port} "; then
                log_warn "Port ${_mtp_port} appears to be in use. You can change it later via settings."
            fi
            MTPROXY_PORT="$_mtp_port"
        else
            MTPROXY_PORT=8443
        fi
        echo ""
        local _def_mtp_cpu="0.5"
        local _def_mtp_mem="128m"
        read -p "  CPU cores [${_def_mtp_cpu}]: " _mtp_cpu < /dev/tty || true
        read -p "  RAM limit [${_def_mtp_mem}]: " _mtp_mem < /dev/tty || true
        [ -z "$_mtp_cpu" ] && _mtp_cpu="$_def_mtp_cpu"
        [ -z "$_mtp_mem" ] && _mtp_mem="$_def_mtp_mem"
        [[ "$_mtp_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _mtp_cpu="$_def_mtp_cpu"
        [[ "$_mtp_mem" =~ ^[0-9]+[mMgG]$ ]] || _mtp_mem="$_def_mtp_mem"
        _mtp_mem=$(echo "$_mtp_mem" | tr '[:upper:]' '[:lower:]')
        MTPROXY_CPUS="$_mtp_cpu"
        MTPROXY_MEMORY="$_mtp_mem"
        MTPROXY_SECRET=""  # Will be generated on first run
        echo -e "  MTProxy: ${GREEN}Enabled${NC} (Port: ${MTPROXY_PORT}, Domain: ${MTPROXY_DOMAIN})"
    else
        MTPROXY_ENABLED="false"
        echo -e "  MTProxy: ${DIM}Disabled${NC}"
    fi

    fi # end of relay-type != none block

    echo ""

    # ── Summary ──
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  ${BOLD}Your Settings:${NC}"
    # Show per-container types if mixed
    local has_mixed=false
    if [ "${CONTAINER_COUNT:-0}" -gt 1 ]; then
        for _ci in $(seq 1 $CONTAINER_COUNT); do
            local _rt=$(get_container_relay_type $_ci)
            [ "$_rt" != "$RELAY_TYPE" ] && has_mixed=true
        done
    fi
    if [ "$RELAY_TYPE" = "none" ]; then
        echo -e "    Mode:        ${CYAN}Proxy Only${NC}"
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            echo -e "    Snowflake:   ${GREEN}${SNOWFLAKE_COUNT} instance(s)${NC}"
            for _si in $(seq 1 ${SNOWFLAKE_COUNT}); do
                echo -e "      Instance #${_si}: CPU $(get_snowflake_cpus $_si), RAM $(get_snowflake_memory $_si)"
            done
        fi
        if [ "$UNBOUNDED_ENABLED" = "true" ]; then
            echo -e "    Unbounded:   ${GREEN}Enabled${NC} (CPU: ${UNBOUNDED_CPUS:-0.5}, RAM: ${UNBOUNDED_MEMORY:-256m})"
        fi
        if [ "$MTPROXY_ENABLED" = "true" ]; then
            echo -e "    MTProxy:     ${GREEN}Enabled${NC} (Port: ${MTPROXY_PORT}, Domain: ${MTPROXY_DOMAIN})"
        fi
    else
        if [ "$has_mixed" = "true" ]; then
            echo -e "    Relay Types:"
            for _ci in $(seq 1 $CONTAINER_COUNT); do
                echo -e "      Container $_ci: ${GREEN}$(get_container_relay_type $_ci)${NC}"
            done
        else
            echo -e "    Relay Type:  ${GREEN}${RELAY_TYPE}${NC}"
        fi
        echo -e "    Nickname:    ${GREEN}${NICKNAME}${NC}"
        echo -e "    Contact:     ${GREEN}${CONTACT_INFO}${NC}"
        if [ "$BANDWIDTH" = "-1" ]; then
            echo -e "    Bandwidth:   ${GREEN}Unlimited${NC}"
        else
            echo -e "    Bandwidth:   ${GREEN}${BANDWIDTH}${NC} Mbps"
        fi
        echo -e "    Containers:  ${GREEN}${CONTAINER_COUNT}${NC}"
        if [ "$DATA_CAP_GB" -gt 0 ] 2>/dev/null; then
            echo -e "    Data Cap:    ${GREEN}${DATA_CAP_GB} GB/month${NC}"
        else
            echo -e "    Data Cap:    ${GREEN}Unlimited${NC}"
        fi
        echo -e "    ORPorts:     ${GREEN}${ORPORT_BASE}-$((ORPORT_BASE + CONTAINER_COUNT - 1))${NC}"
        # Show obfs4 ports only for bridge containers
        local _has_bridge=false
        for _ci in $(seq 1 $CONTAINER_COUNT); do
            [ "$(get_container_relay_type $_ci)" = "bridge" ] && _has_bridge=true
        done
        if [ "$_has_bridge" = "true" ]; then
            local _bridge_ports=""
            for _ci in $(seq 1 $CONTAINER_COUNT); do
                if [ "$(get_container_relay_type $_ci)" = "bridge" ]; then
                    local _pp=$(get_container_ptport $_ci)
                    if [ -z "$_bridge_ports" ]; then _bridge_ports="$_pp"; else _bridge_ports="${_bridge_ports}, ${_pp}"; fi
                fi
            done
            echo -e "    obfs4 Ports: ${GREEN}${_bridge_ports}${NC}"
        fi
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            echo -e "    Snowflake:   ${GREEN}${SNOWFLAKE_COUNT} instance(s)${NC}"
        fi
        if [ "$UNBOUNDED_ENABLED" = "true" ]; then
            echo -e "    Unbounded:   ${GREEN}Enabled${NC} (CPU: ${UNBOUNDED_CPUS:-0.5}, RAM: ${UNBOUNDED_MEMORY:-256m})"
        fi
        if [ "$MTPROXY_ENABLED" = "true" ]; then
            echo -e "    MTProxy:     ${GREEN}Enabled${NC} (Port: ${MTPROXY_PORT}, Domain: ${MTPROXY_DOMAIN})"
        fi
    fi
    # Show auto-calculated resource limits (only for relay modes)
    if [ "${CONTAINER_COUNT:-0}" -gt 0 ]; then
        local _sys_cores=$(get_cpu_cores)
        local _sys_ram=$(get_ram_mb)
        local _per_cpu=$(awk -v c="$_sys_cores" -v n="$CONTAINER_COUNT" 'BEGIN {v=(c>1)?(c-1)/n:0.5; if(v<0.5)v=0.5; printf "%.1f",v}')
        local _per_ram=$(awk -v r="$_sys_ram" -v n="$CONTAINER_COUNT" 'BEGIN {v=(r-512)/n; if(v<256)v=256; if(v>2048)v=2048; printf "%.0f",v}')
        # Validate values (some awk implementations return "inf" on edge cases)
        [[ "$_per_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] || _per_cpu="0.5"
        [[ "$_per_ram" =~ ^[0-9]+$ ]] || _per_ram="256"
        echo -e "    Resources:   ${GREEN}${_per_cpu} CPU / ${_per_ram}MB RAM${NC} per relay container"
    fi
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo ""

    read -p "  Proceed with these settings? [Y/n] " confirm < /dev/tty || true
    if [[ "$confirm" =~ ^[Nn]$ ]]; then
        continue
    fi
    break
  done
}

#═══════════════════════════════════════════════════════════════════════
# Settings Management
#═══════════════════════════════════════════════════════════════════════

save_settings() {
    mkdir -p "$INSTALL_DIR"
    local _tmp
    _tmp=$(mktemp "$INSTALL_DIR/settings.conf.XXXXXX") || { log_error "Failed to create temp file"; return 1; }
    _TMP_FILES+=("$_tmp")

    # Capture current globals BEFORE load_settings overwrites them
    # Relay settings
    local _caller_relay_type="${RELAY_TYPE:-bridge}"
    local _caller_nickname="${NICKNAME:-}"
    local _caller_contact_info="${CONTACT_INFO:-}"
    local _caller_bandwidth="${BANDWIDTH:-5}"
    local _caller_container_count="${CONTAINER_COUNT:-1}"
    local _caller_orport_base="${ORPORT_BASE:-9001}"
    local _caller_controlport_base="${CONTROLPORT_BASE:-9051}"
    local _caller_pt_port_base="${PT_PORT_BASE:-9100}"
    local _caller_exit_policy="${EXIT_POLICY:-reduced}"
    local _caller_data_cap_gb="${DATA_CAP_GB:-0}"
    # Per-container relay types
    local _caller_relay_type_1="${RELAY_TYPE_1:-}"
    local _caller_relay_type_2="${RELAY_TYPE_2:-}"
    local _caller_relay_type_3="${RELAY_TYPE_3:-}"
    local _caller_relay_type_4="${RELAY_TYPE_4:-}"
    local _caller_relay_type_5="${RELAY_TYPE_5:-}"

    local _caller_snowflake_count="${SNOWFLAKE_COUNT:-1}"
    local _caller_snowflake_cpus_1="${SNOWFLAKE_CPUS_1:-}"
    local _caller_snowflake_memory_1="${SNOWFLAKE_MEMORY_1:-}"
    local _caller_snowflake_cpus_2="${SNOWFLAKE_CPUS_2:-}"
    local _caller_snowflake_memory_2="${SNOWFLAKE_MEMORY_2:-}"
    local _caller_snowflake_enabled="${SNOWFLAKE_ENABLED:-false}"
    local _caller_snowflake_cpus="${SNOWFLAKE_CPUS:-1.0}"
    local _caller_snowflake_memory="${SNOWFLAKE_MEMORY:-256m}"

    # Capture Unbounded globals
    local _caller_unbounded_enabled="${UNBOUNDED_ENABLED:-false}"
    local _caller_unbounded_cpus="${UNBOUNDED_CPUS:-0.5}"
    local _caller_unbounded_memory="${UNBOUNDED_MEMORY:-256m}"
    local _caller_unbounded_freddie="${UNBOUNDED_FREDDIE:-https://freddie.iantem.io}"
    local _caller_unbounded_egress="${UNBOUNDED_EGRESS:-wss://unbounded.iantem.io}"
    local _caller_unbounded_tag="${UNBOUNDED_TAG:-}"

    # Capture MTProxy globals
    local _caller_mtproxy_enabled="${MTPROXY_ENABLED:-false}"
    local _caller_mtproxy_port="${MTPROXY_PORT:-8443}"
    local _caller_mtproxy_metrics_port="${MTPROXY_METRICS_PORT:-3129}"
    local _caller_mtproxy_domain="${MTPROXY_DOMAIN:-cloudflare.com}"
    local _caller_mtproxy_secret="${MTPROXY_SECRET:-}"
    local _caller_mtproxy_cpus="${MTPROXY_CPUS:-0.5}"
    local _caller_mtproxy_memory="${MTPROXY_MEMORY:-128m}"
    local _caller_mtproxy_concurrency="${MTPROXY_CONCURRENCY:-8192}"
    local _caller_mtproxy_blocklist_countries="${MTPROXY_BLOCKLIST_COUNTRIES:-}"

    # Preserve existing Telegram settings on reinstall
    local _caller_tg_token="${TELEGRAM_BOT_TOKEN:-}"
    local _caller_tg_chat="${TELEGRAM_CHAT_ID:-}"
    local _caller_tg_interval="${TELEGRAM_INTERVAL:-6}"
    local _caller_tg_enabled="${TELEGRAM_ENABLED:-false}"
    local _caller_tg_alerts="${TELEGRAM_ALERTS_ENABLED:-true}"
    local _caller_tg_daily="${TELEGRAM_DAILY_SUMMARY:-true}"
    local _caller_tg_weekly="${TELEGRAM_WEEKLY_SUMMARY:-true}"
    local _caller_tg_label="${TELEGRAM_SERVER_LABEL:-}"
    local _caller_tg_start_hour="${TELEGRAM_START_HOUR:-0}"

    local _tg_token="" _tg_chat="" _tg_interval="6" _tg_enabled="false"
    local _tg_alerts="true" _tg_daily="true" _tg_weekly="true" _tg_label="" _tg_start_hour="0"
    if [ -f "$INSTALL_DIR/settings.conf" ]; then
        load_settings
        _tg_token="${TELEGRAM_BOT_TOKEN:-}"
        _tg_chat="${TELEGRAM_CHAT_ID:-}"
        _tg_interval="${TELEGRAM_INTERVAL:-6}"
        _tg_enabled="${TELEGRAM_ENABLED:-false}"
        _tg_alerts="${TELEGRAM_ALERTS_ENABLED:-true}"
        _tg_daily="${TELEGRAM_DAILY_SUMMARY:-true}"
        _tg_weekly="${TELEGRAM_WEEKLY_SUMMARY:-true}"
        _tg_label="${TELEGRAM_SERVER_LABEL:-}"
        _tg_start_hour="${TELEGRAM_START_HOUR:-0}"
    fi

    # Always use caller's current globals — they reflect the user's latest action
    _tg_token="$_caller_tg_token"
    _tg_chat="$_caller_tg_chat"
    _tg_enabled="$_caller_tg_enabled"
    _tg_interval="$_caller_tg_interval"
    _tg_alerts="$_caller_tg_alerts"
    _tg_daily="$_caller_tg_daily"
    _tg_weekly="$_caller_tg_weekly"
    _tg_label="$_caller_tg_label"
    _tg_start_hour="$_caller_tg_start_hour"

    # Restore relay globals after load_settings clobbered them
    RELAY_TYPE="$_caller_relay_type"
    NICKNAME="$_caller_nickname"
    CONTACT_INFO="$_caller_contact_info"
    BANDWIDTH="$_caller_bandwidth"
    CONTAINER_COUNT="$_caller_container_count"
    ORPORT_BASE="$_caller_orport_base"
    CONTROLPORT_BASE="$_caller_controlport_base"
    PT_PORT_BASE="$_caller_pt_port_base"
    EXIT_POLICY="$_caller_exit_policy"
    DATA_CAP_GB="$_caller_data_cap_gb"
    RELAY_TYPE_1="$_caller_relay_type_1"
    RELAY_TYPE_2="$_caller_relay_type_2"
    RELAY_TYPE_3="$_caller_relay_type_3"
    RELAY_TYPE_4="$_caller_relay_type_4"
    RELAY_TYPE_5="$_caller_relay_type_5"

    # Restore snowflake globals after load_settings clobbered them
    SNOWFLAKE_COUNT="$_caller_snowflake_count"
    SNOWFLAKE_ENABLED="$_caller_snowflake_enabled"
    SNOWFLAKE_CPUS="$_caller_snowflake_cpus"
    SNOWFLAKE_MEMORY="$_caller_snowflake_memory"
    SNOWFLAKE_CPUS_1="$_caller_snowflake_cpus_1"
    SNOWFLAKE_MEMORY_1="$_caller_snowflake_memory_1"
    SNOWFLAKE_CPUS_2="$_caller_snowflake_cpus_2"
    SNOWFLAKE_MEMORY_2="$_caller_snowflake_memory_2"

    # Restore unbounded globals after load_settings clobbered them
    UNBOUNDED_ENABLED="$_caller_unbounded_enabled"
    UNBOUNDED_CPUS="$_caller_unbounded_cpus"
    UNBOUNDED_MEMORY="$_caller_unbounded_memory"
    UNBOUNDED_FREDDIE="$_caller_unbounded_freddie"
    UNBOUNDED_EGRESS="$_caller_unbounded_egress"
    UNBOUNDED_TAG="$_caller_unbounded_tag"

    # Restore MTProxy globals after load_settings clobbered them
    MTPROXY_ENABLED="$_caller_mtproxy_enabled"
    MTPROXY_PORT="$_caller_mtproxy_port"
    MTPROXY_METRICS_PORT="$_caller_mtproxy_metrics_port"
    MTPROXY_DOMAIN="$_caller_mtproxy_domain"
    MTPROXY_SECRET="$_caller_mtproxy_secret"
    MTPROXY_CPUS="$_caller_mtproxy_cpus"
    MTPROXY_MEMORY="$_caller_mtproxy_memory"
    MTPROXY_CONCURRENCY="$_caller_mtproxy_concurrency"
    MTPROXY_BLOCKLIST_COUNTRIES="$_caller_mtproxy_blocklist_countries"

    # Restore ALL telegram globals after load_settings clobbered them
    TELEGRAM_BOT_TOKEN="$_tg_token"
    TELEGRAM_CHAT_ID="$_tg_chat"
    TELEGRAM_ENABLED="$_tg_enabled"
    TELEGRAM_INTERVAL="$_tg_interval"
    TELEGRAM_ALERTS_ENABLED="$_tg_alerts"
    TELEGRAM_DAILY_SUMMARY="$_tg_daily"
    TELEGRAM_WEEKLY_SUMMARY="$_tg_weekly"
    TELEGRAM_SERVER_LABEL="$_tg_label"
    TELEGRAM_START_HOUR="$_tg_start_hour"

    # Sanitize values — strip characters that could break shell sourcing
    local _safe_contact
    _safe_contact=$(printf '%s' "$CONTACT_INFO" | tr -d '\047\042\140\044\134')
    local _safe_nickname
    _safe_nickname=$(printf '%s' "$NICKNAME" | tr -cd 'A-Za-z0-9')
    local _safe_tg_label
    _safe_tg_label=$(printf '%s' "$_tg_label" | tr -d '\047\042\140\044\134')
    local _safe_tg_token
    _safe_tg_token=$(printf '%s' "$_tg_token" | tr -cd 'A-Za-z0-9:_-')
    local _safe_tg_chat
    _safe_tg_chat=$(printf '%s' "$_tg_chat" | tr -cd 'A-Za-z0-9_-')

    cat > "$_tmp" << EOF
# Torware Settings - v${VERSION}
# Generated: $(date -u '+%Y-%m-%d %H:%M:%S UTC')

# Relay Configuration
RELAY_TYPE='${RELAY_TYPE}'
NICKNAME='${_safe_nickname}'
CONTACT_INFO='${_safe_contact}'
BANDWIDTH='${BANDWIDTH}'
CONTAINER_COUNT='${CONTAINER_COUNT:-1}'
ORPORT_BASE='${ORPORT_BASE}'
CONTROLPORT_BASE='${CONTROLPORT_BASE}'
PT_PORT_BASE='${PT_PORT_BASE}'
EXIT_POLICY='${EXIT_POLICY:-reduced}'
DATA_CAP_GB='${DATA_CAP_GB:-0}'

# Snowflake Proxy
SNOWFLAKE_ENABLED='${SNOWFLAKE_ENABLED:-false}'
SNOWFLAKE_COUNT='${SNOWFLAKE_COUNT:-1}'
SNOWFLAKE_CPUS='${SNOWFLAKE_CPUS:-1.0}'
SNOWFLAKE_MEMORY='${SNOWFLAKE_MEMORY:-256m}'
SNOWFLAKE_CPUS_1='${SNOWFLAKE_CPUS_1}'
SNOWFLAKE_MEMORY_1='${SNOWFLAKE_MEMORY_1}'
SNOWFLAKE_CPUS_2='${SNOWFLAKE_CPUS_2}'
SNOWFLAKE_MEMORY_2='${SNOWFLAKE_MEMORY_2}'

# Unbounded (Lantern) Proxy
UNBOUNDED_ENABLED='${UNBOUNDED_ENABLED:-false}'
UNBOUNDED_CPUS='${UNBOUNDED_CPUS:-0.5}'
UNBOUNDED_MEMORY='${UNBOUNDED_MEMORY:-256m}'
UNBOUNDED_FREDDIE='${UNBOUNDED_FREDDIE:-https://freddie.iantem.io}'
UNBOUNDED_EGRESS='${UNBOUNDED_EGRESS:-wss://unbounded.iantem.io}'
UNBOUNDED_TAG='${UNBOUNDED_TAG}'

# MTProxy (Telegram Proxy)
MTPROXY_ENABLED='${MTPROXY_ENABLED:-false}'
MTPROXY_PORT='${MTPROXY_PORT:-8443}'
MTPROXY_METRICS_PORT='${MTPROXY_METRICS_PORT:-3129}'
MTPROXY_DOMAIN='${MTPROXY_DOMAIN:-cloudflare.com}'
MTPROXY_SECRET='${MTPROXY_SECRET}'
MTPROXY_CPUS='${MTPROXY_CPUS:-0.5}'
MTPROXY_MEMORY='${MTPROXY_MEMORY:-128m}'
MTPROXY_CONCURRENCY='${MTPROXY_CONCURRENCY:-8192}'
MTPROXY_BLOCKLIST_COUNTRIES='${MTPROXY_BLOCKLIST_COUNTRIES}'

# Telegram Integration
TELEGRAM_BOT_TOKEN='${_safe_tg_token}'
TELEGRAM_CHAT_ID='${_safe_tg_chat}'
TELEGRAM_INTERVAL='${_tg_interval}'
TELEGRAM_ENABLED='${_tg_enabled}'
TELEGRAM_ALERTS_ENABLED='${_tg_alerts}'
TELEGRAM_DAILY_SUMMARY='${_tg_daily}'
TELEGRAM_WEEKLY_SUMMARY='${_tg_weekly}'
TELEGRAM_SERVER_LABEL='${_safe_tg_label}'
TELEGRAM_START_HOUR='${_tg_start_hour}'

# Docker Resource Limits (per-container overrides)
DOCKER_CPUS=''
DOCKER_MEMORY=''
EOF

    # Add per-container overrides (sanitize to strip quotes/shell metacharacters)
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        local rt_var="RELAY_TYPE_${i}"
        local bw_var="BANDWIDTH_${i}"
        local cpus_var="CPUS_${i}"
        local mem_var="MEMORY_${i}"
        local orport_var="ORPORT_${i}"
        local ptport_var="PT_PORT_${i}"
        # Relay type: only allow known values
        if [ -n "${!rt_var}" ]; then
            local _srt="${!rt_var}"
            case "$_srt" in bridge|middle|exit) ;; *) _srt="bridge" ;; esac
            echo "${rt_var}='${_srt}'" >> "$_tmp"
        fi
        # Numeric values: strip non-numeric/dot chars
        if [ -n "${!bw_var}" ]; then echo "${bw_var}='$(printf '%s' "${!bw_var}" | tr -cd '0-9.\-')'" >> "$_tmp"; fi
        if [ -n "${!cpus_var}" ]; then echo "${cpus_var}='$(printf '%s' "${!cpus_var}" | tr -cd '0-9.')'" >> "$_tmp"; fi
        if [ -n "${!mem_var}" ]; then echo "${mem_var}='$(printf '%s' "${!mem_var}" | tr -cd '0-9a-zA-Z')'" >> "$_tmp"; fi
        if [ -n "${!orport_var}" ]; then echo "${orport_var}='$(printf '%s' "${!orport_var}" | tr -cd '0-9')'" >> "$_tmp"; fi
        if [ -n "${!ptport_var}" ]; then echo "${ptport_var}='$(printf '%s' "${!ptport_var}" | tr -cd '0-9')'" >> "$_tmp"; fi
    done

    if ! chmod 600 "$_tmp" 2>/dev/null; then
        log_warn "Could not set permissions on settings file — check filesystem"
    fi
    if ! mv "$_tmp" "$INSTALL_DIR/settings.conf"; then
        log_error "Failed to save settings (mv failed). Check disk space and permissions."
        rm -f "$_tmp" 2>/dev/null
        return 1
    fi

    if [ ! -f "$INSTALL_DIR/settings.conf" ]; then
        log_error "Failed to save settings. File missing after write."
        return 1
    fi

    log_success "Settings saved"
}

load_settings() {
    if [ -f "$INSTALL_DIR/settings.conf" ]; then
        # Migration: Update old Freddie URL to new one (Lantern moved from Heroku)
        if grep -q 'bf-freddie\.herokuapp\.com' "$INSTALL_DIR/settings.conf" 2>/dev/null; then
            sed -i 's|bf-freddie\.herokuapp\.com|freddie.iantem.io|g' "$INSTALL_DIR/settings.conf" 2>/dev/null
        fi
        # Copy to temp file to avoid TOCTOU race between validation and parse
        local _tmp_settings
        _tmp_settings=$(mktemp "${TMPDIR:-/tmp}/.tor_settings.XXXXXX") || return 1
        cp "$INSTALL_DIR/settings.conf" "$_tmp_settings" || { rm -f "$_tmp_settings"; return 1; }
        chmod 600 "$_tmp_settings" 2>/dev/null
        # Whitelist validation on the copy
        if grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$_tmp_settings" 2>/dev/null | grep -q .; then
            log_error "settings.conf contains unsafe content. Refusing to load."
            rm -f "$_tmp_settings"
            return 1
        fi
        # Parse key=value explicitly instead of sourcing (safer)
        local key val line
        while IFS= read -r line || [[ -n "$line" ]]; do
            # Skip empty lines and comments
            [[ "$line" =~ ^[[:space:]]*$ ]] && continue
            [[ "$line" =~ ^[[:space:]]*# ]] && continue
            # Match single-quoted string: VAR='value'
            if [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=\'([^\']*)\' ]]; then
                key="${BASH_REMATCH[1]}"
                val="${BASH_REMATCH[2]}"
            # Match numeric: VAR=123
            elif [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=([0-9]+)$ ]]; then
                key="${BASH_REMATCH[1]}"
                val="${BASH_REMATCH[2]}"
            # Match boolean: VAR=true or VAR=false
            elif [[ "$line" =~ ^([A-Za-z_][A-Za-z0-9_]*)=(true|false)$ ]]; then
                key="${BASH_REMATCH[1]}"
                val="${BASH_REMATCH[2]}"
            else
                continue
            fi
            # Use declare -g to set variable in global scope safely
            declare -g "$key=$val"
        done < "$_tmp_settings"
        rm -f "$_tmp_settings"
        # Sync loaded values to CONFIG array
        config_sync_from_globals
    fi
}

#═══════════════════════════════════════════════════════════════════════
# Docker Container Lifecycle
#═══════════════════════════════════════════════════════════════════════

get_docker_image() {
    local idx=${1:-1}
    local rtype=$(get_container_relay_type $idx)
    case "$rtype" in
        bridge) echo "$BRIDGE_IMAGE" ;;
        *)      echo "$RELAY_IMAGE" ;;
    esac
}

run_relay_container() {
    local idx=$1
    local cname=$(get_container_name $idx)
    local vname=$(get_volume_name $idx)
    local orport=$(get_container_orport $idx)
    local controlport=$(get_container_controlport $idx)
    local ptport=$(get_container_ptport $idx)
    local image=$(get_docker_image $idx)

    # Validate ports
    if ! validate_port "$orport" || ! validate_port "$controlport" || ! validate_port "$ptport"; then
        log_error "Invalid port configuration for container $idx (OR:$orport CP:$controlport PT:$ptport)"
        return 1
    fi

    # Generate torrc for this container (only needed for middle/exit — bridges use env vars)
    local rtype=$(get_container_relay_type $idx)
    if [ "$rtype" != "bridge" ]; then
        generate_torrc $idx
    fi

    # Remove existing container
    docker rm -f "$cname" 2>/dev/null || true

    # Ensure volume exists
    docker volume create "$vname" 2>/dev/null || true

    # Resource limits (use arrays for safe word splitting)
    local resource_args=()
    local cpus=$(get_container_cpus $idx)
    local mem=$(get_container_memory $idx)
    # Auto-calculate defaults if not explicitly set
    if [ -z "$cpus" ] && [ -z "$DOCKER_CPUS" ]; then
        local _sys_cores=$(get_cpu_cores)
        local _count=${CONTAINER_COUNT:-1}
        # Reserve 1 core for the host, split the rest among containers (min 0.5 per container)
        cpus=$(awk -v c="$_sys_cores" -v n="$_count" 'BEGIN {v=(c>1)?(c-1)/n:0.5; if(v<0.5)v=0.5; printf "%.1f",v}')
        # Validate cpus is a valid number (some awk implementations return "inf" on edge cases)
        if ! [[ "$cpus" =~ ^[0-9]+\.?[0-9]*$ ]]; then
            cpus="0.5"
        fi
    elif [ -z "$cpus" ] && [ -n "$DOCKER_CPUS" ]; then
        cpus="$DOCKER_CPUS"
    fi
    if [ -z "$mem" ] && [ -z "$DOCKER_MEMORY" ]; then
        local _sys_ram=$(get_ram_mb)
        local _count=${CONTAINER_COUNT:-1}
        # Reserve 512MB for host, split rest among containers (min 256MB, max 2GB per container)
        local _per_mb=$(awk -v r="$_sys_ram" -v n="$_count" 'BEGIN {v=(r-512)/n; if(v<256)v=256; if(v>2048)v=2048; printf "%.0f",v}')
        # Validate memory is a valid number
        if [[ "$_per_mb" =~ ^[0-9]+$ ]]; then
            mem="${_per_mb}m"
        else
            mem="256m"
        fi
    elif [ -z "$mem" ] && [ -n "$DOCKER_MEMORY" ]; then
        mem="$DOCKER_MEMORY"
    fi
    [ -n "$cpus" ] && resource_args+=(--cpus "$cpus")
    [ -n "$mem" ] && resource_args+=(--memory "$mem")

    local torrc_path="$CONTAINERS_DIR/relay-${idx}/torrc"

    # Compute bandwidth in bytes/sec for env vars
    local bw=$(get_container_bandwidth $idx)
    local bw_bytes=""
    if [ "$bw" != "-1" ] && [ -n "$bw" ]; then
        bw_bytes=$(awk -v b="$bw" 'BEGIN {printf "%.0f", b * 125000}')
    fi

    if [ "$rtype" = "bridge" ]; then
        # For the official bridge image, use environment variables
        # Enable ControlPort via OBFS4V_ env vars for monitoring
        local bw_env=()
        if [ -n "$bw_bytes" ]; then
            bw_env=(-e "OBFS4V_BandwidthRate=${bw_bytes}" -e "OBFS4V_BandwidthBurst=$((bw_bytes * 2))")
        fi
        # NOTE: --network host is required for Tor relays: ORPort must bind directly on the
        # host interface, and ControlPort cookie auth requires shared localhost access.
        if ! docker run -d \
            --name "$cname" \
            --restart unless-stopped \
            --log-opt max-size=15m \
            --log-opt max-file=3 \
            -v "${vname}:/var/lib/tor" \
            --network host \
            -e "OR_PORT=${orport}" \
            -e "PT_PORT=${ptport}" \
            -e "EMAIL=${CONTACT_INFO}" \
            -e "NICKNAME=$(get_container_nickname $idx)" \
            -e "OBFS4_ENABLE_ADDITIONAL_VARIABLES=1" \
            -e "OBFS4V_ControlPort=127.0.0.1:${controlport}" \
            -e "OBFS4V_CookieAuthentication=1" \
            --health-cmd "nc -z 127.0.0.1 ${controlport} || exit 1" \
            --health-interval=60s \
            --health-timeout=10s \
            --health-retries=3 \
            --health-start-period=120s \
            "${bw_env[@]}" \
            "${resource_args[@]}" \
            "$image"; then
            log_error "Failed to start $cname (bridge)"
            return 1
        fi
    else
        # For middle/exit relays, mount our custom torrc
        # NOTE: --network host required for Tor ORPort binding and ControlPort cookie auth
        if ! docker run -d \
            --name "$cname" \
            --restart unless-stopped \
            --log-opt max-size=15m \
            --log-opt max-file=3 \
            -v "${vname}:/var/lib/tor" \
            -v "${torrc_path}:/etc/tor/torrc:ro" \
            --network host \
            --health-cmd "nc -z 127.0.0.1 ${controlport} || exit 1" \
            --health-interval=60s \
            --health-timeout=10s \
            --health-retries=3 \
            --health-start-period=120s \
            "${resource_args[@]}" \
            "$image"; then
            log_error "Failed to start $cname (relay)"
            return 1
        fi
    fi

    log_success "$cname started (ORPort: $orport, ControlPort: $controlport)"
}

run_all_containers() {
    local count=${CONTAINER_COUNT:-1}

    # Proxy-only mode: skip relay containers entirely
    if [ "$count" -le 0 ] 2>/dev/null || [ "$RELAY_TYPE" = "none" ]; then
        log_info "Starting Torware (proxy-only mode)..."
        run_all_snowflake_containers
        run_unbounded_container
        run_mtproxy_container
        local _any_proxy=false
        is_snowflake_running && _any_proxy=true
        is_unbounded_running && _any_proxy=true
        is_mtproxy_running && _any_proxy=true
        if [ "$_any_proxy" = "true" ]; then
            log_success "Proxy containers started"
        else
            log_error "No proxy containers started"
            exit 1
        fi
        return 0
    fi

    log_info "Starting Torware ($count container(s))..."

    # Pull required images (may need both bridge and relay images for mixed types)
    local needs_bridge=false needs_relay=false
    for i in $(seq 1 $count); do
        local rt=$(get_container_relay_type $i)
        [ "$rt" = "bridge" ] && needs_bridge=true || needs_relay=true
    done
    if [ "$needs_bridge" = "true" ]; then
        log_info "Pulling bridge image ($BRIDGE_IMAGE)..."
        if ! docker pull "$BRIDGE_IMAGE"; then
            log_error "Failed to pull bridge image. Check your internet connection."
            exit 1
        fi
    fi
    if [ "$needs_relay" = "true" ]; then
        log_info "Pulling relay image ($RELAY_IMAGE)..."
        if ! docker pull "$RELAY_IMAGE"; then
            log_error "Failed to pull relay image. Check your internet connection."
            exit 1
        fi
    fi

    # Pull Alpine image used for cookie auth reading
    log_info "Pulling utility image (alpine:latest)..."
    docker pull alpine:latest 2>/dev/null || log_warn "Could not pre-pull alpine image (cookie auth may be slower on first use)"

    for i in $(seq 1 $count); do
        run_relay_container $i
    done

    # Start Snowflake proxy if enabled
    run_all_snowflake_containers

    # Start Unbounded proxy if enabled
    run_unbounded_container

    # Wait for relay container to be running and bootstrapping
    local _retries=0
    local _max_retries=12
    local _relay_started=false
    local _cname=$(get_container_name 1)
    while [ $_retries -lt $_max_retries ]; do
        sleep 5
        # Check if container is running or restarting
        if docker ps -a --format '{{.Names}} {{.Status}}' | grep -q "^${_cname} "; then
            local _status=$(docker ps -a --format '{{.Status}}' --filter "name=^${_cname}$" | head -1)
            # Check logs for bootstrap progress
            local _logs=$(docker logs "$_cname" 2>&1 | tail -20)
            if echo "$_logs" | grep -q "Bootstrapped 100%"; then
                _relay_started=true
                break
            elif echo "$_logs" | grep -q "Bootstrapped"; then
                local _pct=$(echo "$_logs" | sed -n 's/.*Bootstrapped \([0-9]*\).*/\1/p' | tail -1)
                log_info "Relay bootstrapping... ${_pct}%"
            fi
            # If container is running (not crashed), keep waiting
            if docker ps --format '{{.Names}}' | grep -q "^${_cname}$"; then
                : # still running, keep waiting
            elif echo "$_status" | grep -qi "exited"; then
                log_error "Tor relay container exited unexpectedly"
                docker logs "$_cname" 2>&1 | tail -10
                exit 1
            fi
        fi
        _retries=$((_retries + 1))
    done
    if [ "$_relay_started" = "true" ] || docker ps --format '{{.Names}}' | grep -q "^${_cname}$"; then
        local bw_display="$BANDWIDTH Mbps"
        [ "$BANDWIDTH" = "-1" ] && bw_display="Unlimited"
        log_success "Settings: default_type=$RELAY_TYPE, bandwidth=$bw_display, containers=$count"
        if [ "$SNOWFLAKE_ENABLED" = "true" ] && is_snowflake_running; then
            log_success "Snowflake proxy: running (WebRTC transport)"
        fi
    else
        log_error "Tor relay failed to start"
        docker logs "$_cname" 2>&1 | tail -10
        exit 1
    fi
}

start_relay() {
    local count=${CONTAINER_COUNT:-1}
    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        if docker ps -a --format '{{.Names}}' | grep -q "^${cname}$"; then
            if docker start "$cname" 2>/dev/null; then
                log_success "$cname started"
            else
                log_error "Failed to start $cname, recreating..."
                run_relay_container $i
            fi
        else
            run_relay_container $i
        fi
    done
}

stop_relay() {
    log_info "Stopping Tor relay containers..."
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        local cname=$(get_container_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            docker stop --timeout 30 "$cname" 2>/dev/null || true
            log_success "$cname stopped"
        fi
    done
}

restart_relay() {
    log_info "Restarting Tor relay containers..."
    local count=${CONTAINER_COUNT:-1}
    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)

        # Regenerate torrc in case settings changed (only for non-bridge; bridges use env vars)
        local _rtype=$(get_container_relay_type $i)
        if [ "$_rtype" != "bridge" ]; then
            generate_torrc $i
        fi

        # Check if container exists
        if docker ps -a --format '{{.Names}}' | grep -q "^${cname}$"; then
            docker rm -f "$cname" 2>/dev/null || true
        fi

        run_relay_container $i
    done
}

#═══════════════════════════════════════════════════════════════════════
# Snowflake Proxy Container Lifecycle
#═══════════════════════════════════════════════════════════════════════

run_snowflake_container() {
    local idx=${1:-1}
    if [ "$SNOWFLAKE_ENABLED" != "true" ]; then
        return 0
    fi

    local cname=$(get_snowflake_name $idx)
    local vname=$(get_snowflake_volume $idx)
    local mport=$(get_snowflake_metrics_port $idx)
    local sf_cpus=$(get_snowflake_cpus $idx)
    local sf_memory=$(get_snowflake_memory $idx)

    log_info "Starting Snowflake proxy ($cname)..."

    # Pull image if not already cached locally
    if ! docker image inspect "$SNOWFLAKE_IMAGE" &>/dev/null; then
        if ! docker pull "$SNOWFLAKE_IMAGE"; then
            log_error "Failed to pull Snowflake image."
            return 1
        fi
    fi

    # Remove existing
    docker rm -f "$cname" 2>/dev/null || true

    # Ensure volume exists for data persistence
    docker volume create "$vname" 2>/dev/null || true

    if ! docker run -d \
        --name "$cname" \
        --restart unless-stopped \
        --log-opt max-size=10m \
        --log-opt max-file=3 \
        --cpus "$(awk -v req="${sf_cpus}" -v cores="$(nproc 2>/dev/null || echo 1)" 'BEGIN{c=req+0; if(c>cores+0) c=cores+0; printf "%.2f",c}')" \
        --memory "${sf_memory}" \
        --memory-swap "${sf_memory}" \
        --network host \
        --health-cmd "wget -q -O /dev/null http://127.0.0.1:${mport}/ || exit 1" \
        --health-interval=300s \
        --health-timeout=10s \
        --health-retries=5 \
        --health-start-period=3600s \
        -v "${vname}:/var/lib/snowflake" \
        "$SNOWFLAKE_IMAGE" \
        -metrics -metrics-address "127.0.0.1" -metrics-port "${mport}"; then
        log_error "Failed to start Snowflake proxy ($cname)"
        return 1
    fi
    log_success "Snowflake proxy started: $cname (metrics on port $mport)"
}

run_all_snowflake_containers() {
    if [ "$SNOWFLAKE_ENABLED" != "true" ]; then
        return 0
    fi
    # Pull image once
    if ! docker pull "$SNOWFLAKE_IMAGE"; then
        log_error "Failed to pull Snowflake image."
        return 1
    fi
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        run_snowflake_container $i
    done
}

stop_snowflake_container() {
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local cname=$(get_snowflake_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            docker stop --timeout 10 "$cname" 2>/dev/null || true
            log_success "$cname stopped"
        fi
    done
}

start_snowflake_container() {
    if [ "$SNOWFLAKE_ENABLED" != "true" ]; then
        return 0
    fi
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local cname=$(get_snowflake_name $i)
        if docker ps -a --format '{{.Names}}' | grep -q "^${cname}$"; then
            if docker start "$cname" 2>/dev/null; then
                log_success "$cname started"
            else
                log_warn "Failed to start $cname, recreating..."
                run_snowflake_container $i
            fi
        else
            run_snowflake_container $i
        fi
    done
}

restart_snowflake_container() {
    if [ "$SNOWFLAKE_ENABLED" != "true" ]; then
        return 0
    fi
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local cname=$(get_snowflake_name $i)
        docker rm -f "$cname" 2>/dev/null || true
        run_snowflake_container $i
    done
}

is_snowflake_running() {
    # Returns true if at least one snowflake instance is running
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local cname=$(get_snowflake_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            return 0
        fi
    done
    return 1
}

get_snowflake_stats() {
    # Aggregate stats across all snowflake instances
    local total_connections=0 total_inbound=0 total_outbound=0

    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local cname=$(get_snowflake_name $i)
        local mport=$(get_snowflake_metrics_port $i)

        # Get connections from Prometheus metrics
        local metrics=""
        metrics=$(curl -s --max-time 3 "http://127.0.0.1:${mport}/internal/metrics" 2>/dev/null)
        if [ -n "$metrics" ]; then
            local conns=$(echo "$metrics" | awk '
                /^tor_snowflake_proxy_connections_total[{ ]/ { sum += $NF }
                END { printf "%.0f", sum }
            ' 2>/dev/null)
            total_connections=$((total_connections + ${conns:-0}))
        fi

        # Get cumulative traffic from docker logs
        local log_data
        log_data=$(docker logs "$cname" 2>&1 | grep "Traffic Relayed" 2>/dev/null)
        if [ -n "$log_data" ]; then
            local ib=$(echo "$log_data" | awk -F'[↓↑]' '{
                split($2, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1]
            } END { printf "%.0f", sum * 1024 }' 2>/dev/null)
            local ob=$(echo "$log_data" | awk -F'[↓↑]' '{
                split($3, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1]
            } END { printf "%.0f", sum * 1024 }' 2>/dev/null)
            total_inbound=$((total_inbound + ${ib:-0}))
            total_outbound=$((total_outbound + ${ob:-0}))
        fi
    done

    echo "${total_connections} ${total_inbound} ${total_outbound}"
}

get_snowflake_instance_stats() {
    # Get stats for a single instance
    local idx=${1:-1}
    local cname=$(get_snowflake_name $idx)
    local mport=$(get_snowflake_metrics_port $idx)

    local connections=0 inbound=0 outbound=0
    local metrics=""
    metrics=$(curl -s --max-time 3 "http://127.0.0.1:${mport}/internal/metrics" 2>/dev/null)
    if [ -n "$metrics" ]; then
        connections=$(echo "$metrics" | awk '
            /^tor_snowflake_proxy_connections_total[{ ]/ { sum += $NF }
            END { printf "%.0f", sum }
        ' 2>/dev/null)
    fi

    local log_data
    log_data=$(docker logs "$cname" 2>&1 | grep "Traffic Relayed" 2>/dev/null)
    if [ -n "$log_data" ]; then
        inbound=$(echo "$log_data" | awk -F'[↓↑]' '{
            split($2, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1]
        } END { printf "%.0f", sum * 1024 }' 2>/dev/null)
        outbound=$(echo "$log_data" | awk -F'[↓↑]' '{
            split($3, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1]
        } END { printf "%.0f", sum * 1024 }' 2>/dev/null)
    fi

    echo "${connections:-0} ${inbound:-0} ${outbound:-0}"
}

get_snowflake_country_stats() {
    # Aggregate country stats across all snowflake instances
    local all_metrics=""
    for i in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
        local mport=$(get_snowflake_metrics_port $i)
        local metrics=""
        metrics=$(curl -s --max-time 3 "http://127.0.0.1:${mport}/internal/metrics" 2>/dev/null) || continue
        all_metrics+="$metrics"$'\n'
    done

    [ -z "$all_metrics" ] && return 1

    echo "$all_metrics" | awk '
        /^tor_snowflake_proxy_connections_total\{/ {
            val = $NF + 0
            country = ""
            s = $0
            idx = index(s, "country=\"")
            if (idx > 0) {
                s = substr(s, idx + 9)
                end = index(s, "\"")
                if (end > 0) country = substr(s, 1, end - 1)
            }
            if (country != "" && val > 0) counts[country] += val
        }
        END {
            for (c in counts) print counts[c] "|" c
        }
    ' 2>/dev/null | sort -t'|' -k1 -nr
}

#═══════════════════════════════════════════════════════════════════════
# Unbounded (Lantern) Proxy Container Lifecycle
#═══════════════════════════════════════════════════════════════════════

build_unbounded_image() {
    if docker image inspect "$UNBOUNDED_IMAGE" &>/dev/null; then
        return 0
    fi
    log_info "Building Unbounded widget image (this may take a few minutes on first run)..."

    # Pin to commit b53a6690f363 (May 2025) — matches production freddie server (v0.0.2 protocol)
    # The main branch has v2.x which is rejected by production servers still running v0.x
    log_info "Building unbounded widget (pinned to production-compatible commit)..."

    local build_dir
    build_dir=$(mktemp -d)
    cat > "${build_dir}/Dockerfile" <<'DOCKERFILE'
FROM golang:1.24-alpine AS builder
RUN apk add --no-cache git
WORKDIR /src
RUN git clone https://github.com/getlantern/unbounded.git . && git checkout b53a6690f363
WORKDIR /src/cmd
RUN go build -o /go/bin/widget --ldflags="-X 'main.clientType=widget'"

FROM alpine:3.19
RUN apk add --no-cache ca-certificates procps
COPY --from=builder /go/bin/widget /usr/local/bin/widget
ENTRYPOINT ["widget"]
DOCKERFILE
    if ! docker build -t "$UNBOUNDED_IMAGE" "$build_dir"; then
        log_error "Failed to build Unbounded image."
        rm -rf "$build_dir"
        return 1
    fi
    rm -rf "$build_dir"
    log_success "Unbounded image built: $UNBOUNDED_IMAGE"
}

run_unbounded_container() {
    if [ "$UNBOUNDED_ENABLED" != "true" ]; then
        return 0
    fi

    local cname="$UNBOUNDED_CONTAINER"
    local vname="$UNBOUNDED_VOLUME"
    local ub_cpus="${UNBOUNDED_CPUS:-0.5}"
    local ub_memory="${UNBOUNDED_MEMORY:-256m}"
    local ub_tag="${UNBOUNDED_TAG:-torware-$(hostname 2>/dev/null || echo node)}"

    log_info "Starting Unbounded proxy ($cname)..."

    build_unbounded_image || return 1

    # Remove existing
    docker rm -f "$cname" 2>/dev/null || true

    # Ensure volume exists
    docker volume create "$vname" 2>/dev/null || true

    if ! docker run -d \
        --name "$cname" \
        --restart unless-stopped \
        --log-opt max-size=10m \
        --log-opt max-file=3 \
        --cpus "$(awk -v req="${ub_cpus}" -v cores="$(nproc 2>/dev/null || echo 1)" 'BEGIN{c=req+0; if(c>cores+0) c=cores+0; printf "%.2f",c}')" \
        --memory "${ub_memory}" \
        --memory-swap "${ub_memory}" \
        --health-cmd "pgrep widget || exit 1" \
        --health-interval=300s \
        --health-timeout=10s \
        --health-retries=5 \
        --health-start-period=60s \
        -e "FREDDIE=${UNBOUNDED_FREDDIE:-https://freddie.iantem.io}" \
        -e "EGRESS=${UNBOUNDED_EGRESS:-wss://unbounded.iantem.io}" \
        -e "TAG=${ub_tag}" \
        -v "${vname}:/var/lib/unbounded" \
        "$UNBOUNDED_IMAGE"; then
        log_error "Failed to start Unbounded proxy ($cname)"
        return 1
    fi
    log_success "Unbounded proxy started: $cname"
}

stop_unbounded_container() {
    local cname="$UNBOUNDED_CONTAINER"
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
        docker stop --timeout 10 "$cname" 2>/dev/null || true
        log_success "$cname stopped"
    fi
}

start_unbounded_container() {
    if [ "$UNBOUNDED_ENABLED" != "true" ]; then
        return 0
    fi
    local cname="$UNBOUNDED_CONTAINER"
    if docker ps -a --format '{{.Names}}' | grep -q "^${cname}$"; then
        if docker start "$cname" 2>/dev/null; then
            log_success "$cname started"
        else
            log_warn "Failed to start $cname, recreating..."
            run_unbounded_container
        fi
    else
        run_unbounded_container
    fi
}

restart_unbounded_container() {
    if [ "$UNBOUNDED_ENABLED" != "true" ]; then
        return 0
    fi
    local cname="$UNBOUNDED_CONTAINER"
    docker rm -f "$cname" 2>/dev/null || true
    run_unbounded_container
}

get_unbounded_stats() {
    # Returns: "live_connections all_time_connections"
    local cname="$UNBOUNDED_CONTAINER"

    if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
        echo "0 0"
        return
    fi

    local live=0 total=0

    # Parse widget log messages for connection events
    local log_data
    log_data=$(docker logs "$cname" 2>&1)
    if [ -n "$log_data" ]; then
        local opened=$(echo "$log_data" | grep -c "datachannel has opened" 2>/dev/null || echo 0)
        local closed=$(echo "$log_data" | grep -c "datachannel has closed" 2>/dev/null || echo 0)
        total=${opened:-0}
        live=$(( ${opened:-0} - ${closed:-0} ))
        [ "$live" -lt 0 ] && live=0
    fi

    echo "${live:-0} ${total:-0}"
}

#═══════════════════════════════════════════════════════════════════════
# MTProxy (Telegram) Management
#═══════════════════════════════════════════════════════════════════════

generate_mtproxy_secret() {
    local domain="${1:-$MTPROXY_DOMAIN}"
    domain="${domain:-cloudflare.com}"
    # Generate secret using mtg container
    docker run --rm "$MTPROXY_IMAGE" generate-secret --hex "$domain" 2>/dev/null
}

get_mtproxy_link() {
    local server_ip="${1:-$(get_public_ip)}"
    local port="${MTPROXY_PORT:-8443}"
    local secret="$MTPROXY_SECRET"

    if [ -z "$secret" ]; then
        return 1
    fi

    echo "tg://proxy?server=${server_ip}&port=${port}&secret=${secret}"
}

get_mtproxy_link_https() {
    local server_ip="${1:-$(get_public_ip)}"
    local port="${MTPROXY_PORT:-8443}"
    local secret="$MTPROXY_SECRET"

    if [ -z "$secret" ]; then
        return 1
    fi

    echo "https://t.me/proxy?server=${server_ip}&port=${port}&secret=${secret}"
}

show_mtproxy_qr() {
    local link
    link=$(get_mtproxy_link_https "$1")
    if [ -z "$link" ]; then
        log_error "MTProxy secret not configured"
        return 1
    fi

    # Generate QR code using Unicode block characters
    # Check if qrencode is available
    if command -v qrencode &>/dev/null; then
        echo ""
        echo -e "${BOLD}Scan this QR code in Telegram:${NC}"
        echo ""
        qrencode -t ANSIUTF8 "$link"
    else
        # Fallback: try using Docker with qrencode image (pass link via env var for safety)
        if docker run --rm -e "QR_LINK=$link" alpine:latest sh -c 'apk add --no-cache qrencode >/dev/null 2>&1 && qrencode -t ANSIUTF8 "$QR_LINK"' 2>/dev/null; then
            :
        else
            # Final fallback: just show the link
            echo ""
            echo -e "${YELLOW}QR code generation not available (install qrencode for QR support)${NC}"
            echo -e "${DIM}Install with: apt install qrencode${NC}"
        fi
    fi
    echo ""
    echo -e "${BOLD}Or share this link:${NC}"
    echo -e "${CYAN}$link${NC}"
    echo ""
}

is_mtproxy_running() {
    docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${MTPROXY_CONTAINER}$"
}

run_mtproxy_container() {
    if [ "$MTPROXY_ENABLED" != "true" ]; then
        return 0
    fi

    local cname="$MTPROXY_CONTAINER"
    local port="${MTPROXY_PORT:-8443}"
    local metrics_port="${MTPROXY_METRICS_PORT:-3129}"
    local cpus="${MTPROXY_CPUS:-0.5}"
    local memory="${MTPROXY_MEMORY:-128m}"
    local secret="$MTPROXY_SECRET"
    local concurrency="${MTPROXY_CONCURRENCY:-8192}"
    local blocklist_countries="${MTPROXY_BLOCKLIST_COUNTRIES:-}"

    # Pull image if not present (needed for secret generation)
    if ! docker image inspect "$MTPROXY_IMAGE" &>/dev/null; then
        log_info "Pulling MTProxy image..."
        if ! docker pull "$MTPROXY_IMAGE"; then
            log_error "Failed to pull MTProxy image"
            return 1
        fi
    fi

    # Generate secret if not set (requires image to be present)
    if [ -z "$secret" ]; then
        log_info "Generating MTProxy secret..."
        secret=$(generate_mtproxy_secret)
        if [ -z "$secret" ]; then
            log_error "Failed to generate MTProxy secret"
            return 1
        fi
        MTPROXY_SECRET="$secret"
        save_settings
    fi

    # Create config directory
    local config_dir="$INSTALL_DIR/mtproxy"
    mkdir -p "$config_dir"

    # Build blocklist URLs from country codes
    # Uses ipdeny.com country CIDR lists (reliable, updated daily)
    local blocklist_urls=""
    if [ -n "$blocklist_countries" ]; then
        for cc in $(echo "$blocklist_countries" | tr ',' ' ' | tr '[:upper:]' '[:lower:]'); do
            # Validate country code: must be exactly 2 lowercase letters
            if [[ "$cc" =~ ^[a-z]{2}$ ]]; then
                blocklist_urls+="  \"https://www.ipdeny.com/ipblocks/data/aggregated/${cc}-aggregated.zone\","$'\n'
            fi
        done
    fi

    # Generate TOML config (uses actual ports since we use host networking)
    cat > "$config_dir/config.toml" << EOF
# MTProxy configuration - generated by Torware
secret = "$secret"
bind-to = "0.0.0.0:${port}"
concurrency = $concurrency

[stats.prometheus]
enabled = true
bind-to = "127.0.0.1:${metrics_port}"

[defense.anti-replay]
enabled = true
max-size = "1mib"
error-rate = 0.001
EOF

    # Add blocklist if countries specified
    if [ -n "$blocklist_urls" ]; then
        cat >> "$config_dir/config.toml" << EOF

[defense.blocklist]
enabled = true
download-concurrency = 2
update-each = "24h"
urls = [
$blocklist_urls]
EOF
        log_info "Geo-blocking enabled for: $blocklist_countries"
    fi

    # Remove existing container
    docker rm -f "$cname" 2>/dev/null || true

    # Check if port is available
    if ss -tln 2>/dev/null | grep -q ":${port} " || netstat -tln 2>/dev/null | grep -q ":${port} "; then
        log_error "Port ${port} is already in use. Change MTProxy port in settings."
        return 1
    fi

    log_info "Starting MTProxy container..."
    if docker run -d \
        --name "$cname" \
        --restart unless-stopped \
        --network host \
        --log-opt max-size=10m \
        --log-opt max-file=3 \
        --cpus "$cpus" \
        --memory "$memory" \
        --memory-swap "$memory" \
        -v "${config_dir}/config.toml:/config.toml:ro" \
        "$MTPROXY_IMAGE" run /config.toml; then
        log_success "MTProxy started on port $port (FakeTLS: ${MTPROXY_DOMAIN}, max connections: $concurrency)"
        # Send Telegram notification with link and QR code (async, don't block startup)
        telegram_notify_mtproxy_started &>/dev/null &
        return 0
    else
        log_error "Failed to start MTProxy"
        return 1
    fi
}

stop_mtproxy_container() {
    local cname="$MTPROXY_CONTAINER"
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
        docker stop --timeout 10 "$cname" 2>/dev/null || true
        log_success "MTProxy stopped"
    fi
}

start_mtproxy_container() {
    if [ "$MTPROXY_ENABLED" != "true" ]; then
        return 0
    fi
    local cname="$MTPROXY_CONTAINER"
    if docker ps -a --format '{{.Names}}' | grep -q "^${cname}$"; then
        if docker start "$cname" 2>/dev/null; then
            log_success "MTProxy started"
        else
            log_warn "Failed to start MTProxy, recreating..."
            run_mtproxy_container
        fi
    else
        run_mtproxy_container
    fi
}

restart_mtproxy_container() {
    if [ "$MTPROXY_ENABLED" != "true" ]; then
        return 0
    fi
    local cname="$MTPROXY_CONTAINER"
    docker rm -f "$cname" 2>/dev/null || true
    run_mtproxy_container
}

get_mtproxy_stats() {
    # Returns: "traffic_in traffic_out"
    # Uses prometheus metrics (works with host networking)
    if ! is_mtproxy_running; then
        echo "0 0"
        return
    fi

    local metrics_port="${MTPROXY_METRICS_PORT:-3129}"

    # mtg serves prometheus metrics at "/" by default (not "/metrics")
    local metrics
    metrics=$(curl -s --max-time 2 "http://127.0.0.1:${metrics_port}/" 2>/dev/null)

    if [ -n "$metrics" ]; then
        # Parse Prometheus metrics - mtg uses prefix "mtg_" by default:
        # - mtg_telegram_traffic{direction="to_client"} = bytes downloaded (to user)
        # - mtg_telegram_traffic{direction="from_client"} = bytes uploaded (from user)
        local traffic_in traffic_out
        traffic_in=$(echo "$metrics" | awk '/^mtg_telegram_traffic\{.*direction="to_client"/ {sum+=$NF} END {printf "%.0f", sum}' 2>/dev/null)
        traffic_out=$(echo "$metrics" | awk '/^mtg_telegram_traffic\{.*direction="from_client"/ {sum+=$NF} END {printf "%.0f", sum}' 2>/dev/null)
        echo "${traffic_in:-0} ${traffic_out:-0}"
        return
    fi

    # Fallback: return zeros (docker stats doesn't work with host networking)
    echo "0 0"
}

#═══════════════════════════════════════════════════════════════════════
# Status Display
#═══════════════════════════════════════════════════════════════════════

show_status() {
    load_settings
    local count=${CONTAINER_COUNT:-1}

    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}              🧅 TORWARE STATUS                              ${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo ""

    echo -e "  ${BOLD}Default Type:${NC} ${GREEN}${RELAY_TYPE}${NC}"
    echo -e "  ${BOLD}Nickname:${NC}    ${GREEN}${NICKNAME}${NC}"

    if [ "$BANDWIDTH" = "-1" ]; then
        echo -e "  ${BOLD}Bandwidth:${NC}   ${GREEN}Unlimited${NC}"
    else
        echo -e "  ${BOLD}Bandwidth:${NC}   ${GREEN}${BANDWIDTH} Mbps${NC}"
    fi
    echo ""

    local total_read=0
    local total_written=0
    local total_circuits=0
    local total_conns=0
    local running=0

    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        local orport=$(get_container_orport $i)
        local controlport=$(get_container_controlport $i)

        local status="STOPPED"
        local status_color="${RED}"
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            status="RUNNING"
            status_color="${GREEN}"
            running=$((running + 1))

            # Get uptime
            local started_at
            started_at=$(docker inspect --format '{{.State.StartedAt}}' "$cname" 2>/dev/null)
            local uptime_str=""
            if [ -n "$started_at" ]; then
                local start_epoch
                start_epoch=$(date -d "${started_at}" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%S" "${started_at%%.*}" +%s 2>/dev/null || echo "0")
                local now_epoch=$(date +%s)
                if [ "$start_epoch" -gt 0 ] 2>/dev/null; then
                    uptime_str=$(format_duration $((now_epoch - start_epoch)))
                fi
            fi

            # Get traffic
            local traffic
            traffic=$(get_tor_traffic $i)
            local rb=$(echo "$traffic" | awk '{print $1}')
            local wb=$(echo "$traffic" | awk '{print $2}')
            rb=${rb:-0}; wb=${wb:-0}
            total_read=$((total_read + rb))
            total_written=$((total_written + wb))

            # Get circuits
            local circuits=$(get_tor_circuits $i)
            circuits=${circuits//[^0-9]/}; circuits=${circuits:-0}
            total_circuits=$((total_circuits + circuits))

            # Get connections
            local conns=$(get_tor_connections $i)
            conns=${conns//[^0-9]/}; conns=${conns:-0}
            total_conns=$((total_conns + conns))

            local c_rtype=$(get_container_relay_type $i)
            echo -e "  ${BOLD}Container ${i} [${c_rtype}]:${NC} ${status_color}${status}${NC} (up ${uptime_str:-unknown})"
            echo -e "    ORPort: ${orport} | ControlPort: ${controlport}"
            echo -e "    Traffic: ↓ $(format_bytes $rb)  ↑ $(format_bytes $wb)"
            echo -e "    Circuits: ${circuits} | Connections: ${conns}"

            # Show fingerprint
            local fp=$(get_tor_fingerprint $i)
            if [ -n "$fp" ]; then
                echo -e "    Fingerprint: ${DIM}${fp}${NC}"
            fi

            # Show bridge line for bridges
            if [ "$c_rtype" = "bridge" ]; then
                local bl=$(get_bridge_line $i)
                if [ -n "$bl" ]; then
                    echo -e "    Bridge Line: ${DIM}${bl:0:120}...${NC}"
                fi
            fi
        else
            echo -e "  ${BOLD}Container ${i}:${NC} ${status_color}${status}${NC}"
        fi
        echo ""
    done

    # Snowflake status
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        echo -e "  ${BOLD}Snowflake Proxy:${NC}"
        if is_snowflake_running; then
            local sf_stats=$(get_snowflake_stats 2>/dev/null)
            local sf_conns=$(echo "$sf_stats" | awk '{print $1}')
            local sf_in=$(echo "$sf_stats" | awk '{print $2}')
            local sf_out=$(echo "$sf_stats" | awk '{print $3}')
            echo -e "    Status: ${GREEN}RUNNING${NC}"
            echo -e "    Connections: ${sf_conns:-0}  Traffic: ↓ $(format_bytes ${sf_in:-0})  ↑ $(format_bytes ${sf_out:-0})"
        else
            echo -e "    Status: ${RED}STOPPED${NC}"
        fi
        echo ""
    fi

    # Unbounded status
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        echo -e "  ${BOLD}Unbounded Proxy (Lantern):${NC}"
        if is_unbounded_running; then
            local ub_stats=$(get_unbounded_stats 2>/dev/null)
            local ub_live=$(echo "$ub_stats" | awk '{print $1}')
            local ub_total=$(echo "$ub_stats" | awk '{print $2}')
            echo -e "    Status: ${GREEN}RUNNING${NC}"
            echo -e "    Live connections: ${ub_live:-0}  |  All-time: ${ub_total:-0}"
        else
            echo -e "    Status: ${RED}STOPPED${NC}"
        fi
        echo ""
    fi

    # MTProxy status
    if [ "$MTPROXY_ENABLED" = "true" ]; then
        echo -e "  ${BOLD}MTProxy (Telegram):${NC}"
        if is_mtproxy_running; then
            local mtp_stats=$(get_mtproxy_stats 2>/dev/null)
            local mtp_in=$(echo "$mtp_stats" | awk '{print $1}')
            local mtp_out=$(echo "$mtp_stats" | awk '{print $2}')
            echo -e "    Status: ${GREEN}RUNNING${NC}"
            echo -e "    Traffic: ↓ $(format_bytes ${mtp_in:-0})  ↑ $(format_bytes ${mtp_out:-0})"
            echo -e "    Port: ${MTPROXY_PORT}  |  Domain: ${MTPROXY_DOMAIN}"
        else
            echo -e "    Status: ${RED}STOPPED${NC}"
        fi
        echo ""
    fi

    # Include snowflake in totals
    local total_containers=$count
    local total_running=$running
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_snowflake_running; then
            total_running=$((total_running + 1))
            local sf_stats=$(get_snowflake_stats 2>/dev/null)
            local sf_in=$(echo "$sf_stats" | awk '{print $2}')
            local sf_out=$(echo "$sf_stats" | awk '{print $3}')
            total_read=$((total_read + ${sf_in:-0}))
            total_written=$((total_written + ${sf_out:-0}))
        fi
    fi
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_unbounded_running; then
            total_running=$((total_running + 1))
        fi
    fi
    if [ "$MTPROXY_ENABLED" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_mtproxy_running; then
            total_running=$((total_running + 1))
            local mtp_stats=$(get_mtproxy_stats 2>/dev/null)
            local mtp_in=$(echo "$mtp_stats" | awk '{print $1}')
            local mtp_out=$(echo "$mtp_stats" | awk '{print $2}')
            total_read=$((total_read + ${mtp_in:-0}))
            total_written=$((total_written + ${mtp_out:-0}))
        fi
    fi

    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo -e "  ${BOLD}Totals:${NC}"
    echo -e "    Containers: ${GREEN}${total_running}${NC}/${total_containers} running"
    echo -e "    Traffic:    ↓ $(format_bytes $total_read)  ↑ $(format_bytes $total_written)"
    echo -e "    Circuits:   ${total_circuits}"
    echo -e "    Connections: ${total_conns}"
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo ""
}

#═══════════════════════════════════════════════════════════════════════
# Backup & Restore
#═══════════════════════════════════════════════════════════════════════

backup_keys() {
    load_settings
    local count=${CONTAINER_COUNT:-1}
    mkdir -p "$BACKUP_DIR"

    local timestamp=$(date '+%Y%m%d_%H%M%S')

    for i in $(seq 1 $count); do
        local vname=$(get_volume_name $i)
        local backup_file="$BACKUP_DIR/tor_keys_relay${i}_${timestamp}.tar.gz"

        if docker volume inspect "$vname" &>/dev/null; then
            ( umask 077; docker run --rm -v "${vname}:/data:ro" alpine \
                sh -c 'cd /data && tar -czf - keys fingerprint pt_state state 2>/dev/null || tar -czf - keys fingerprint state 2>/dev/null' \
                > "$backup_file" 2>/dev/null )

            if [ -s "$backup_file" ]; then
                chmod 600 "$backup_file"
                local fp=$(get_tor_fingerprint $i)
                log_success "Relay $i backed up: $backup_file"
                if [ -n "$fp" ]; then
                    echo -e "    Fingerprint: ${DIM}${fp}${NC}"
                fi
            else
                rm -f "$backup_file"
                log_warn "Relay $i: No key data found to backup"
            fi
        else
            log_warn "Relay $i: Volume $vname does not exist"
        fi
    done

    # Rotate old backups — keep only the 10 most recent per relay
    for i in $(seq 1 $count); do
        local old_backups
        old_backups=$(find "$BACKUP_DIR" -maxdepth 1 -name "tor_keys_relay${i}_*.tar.gz" 2>/dev/null | sort -r | tail -n +11)
        if [ -n "$old_backups" ]; then
            echo "$old_backups" | xargs rm -f 2>/dev/null
            log_info "Rotated old backups for relay $i (keeping 10 most recent)"
        fi
    done
}

restore_keys() {
    load_settings

    if [ ! -d "$BACKUP_DIR" ]; then
        log_warn "No backups directory found."
        return 1
    fi

    local backups=()
    while IFS= read -r -d '' f; do
        backups+=("$f")
    done < <(find "$BACKUP_DIR" -maxdepth 1 -name 'tor_keys_*.tar.gz' -print0 2>/dev/null | sort -z -r)

    if [ ${#backups[@]} -eq 0 ]; then
        log_warn "No backup files found."
        return 1
    fi

    echo ""
    echo -e "${CYAN}  Available Backups:${NC}"
    echo ""
    local idx=1
    for backup in "${backups[@]}"; do
        local fname=$(basename "$backup")
        echo -e "    ${GREEN}${idx}.${NC} $fname"
        idx=$((idx + 1))
    done
    echo ""

    read -p "  Select backup number (or 'q' to cancel): " choice < /dev/tty || true

    if [ "$choice" = "q" ] || [ -z "$choice" ]; then
        return 0
    fi

    if ! [[ "$choice" =~ ^[0-9]+$ ]] || [ "$choice" -lt 1 ] || [ "$choice" -gt ${#backups[@]} ]; then
        log_error "Invalid selection."
        return 1
    fi

    local selected="${backups[$((choice - 1))]}"
    local target_relay=1

    # Try to detect which relay this backup is for
    local fname=$(basename "$selected")
    if [[ "$fname" =~ relay([0-9]+) ]]; then
        target_relay="${BASH_REMATCH[1]}"
    fi

    echo ""
    read -p "  Restore to relay container $target_relay? [Y/n] " confirm < /dev/tty || true
    if [[ "$confirm" =~ ^[Nn]$ ]]; then
        return 0
    fi

    local vname=$(get_volume_name $target_relay)
    local cname=$(get_container_name $target_relay)

    # Stop container
    docker stop --timeout 30 "$cname" 2>/dev/null || true

    # Ensure volume exists
    docker volume create "$vname" 2>/dev/null || true

    # Validate backup filename (prevent path traversal)
    local restore_basename
    restore_basename=$(basename "$selected")
    if [[ ! "$restore_basename" =~ ^tor_keys_relay[0-9]+_[0-9]+_[0-9]+\.tar\.gz$ ]]; then
        log_error "Invalid backup filename: $restore_basename"
        return 1
    fi

    # Validate backup integrity
    if ! tar -tzf "$selected" &>/dev/null; then
        log_error "Backup file is corrupt or not a valid tar.gz: $restore_basename"
        return 1
    fi

    # Restore from backup
    if docker run --rm -v "${vname}:/data" -v "$(dirname "$selected"):/backup:ro" alpine \
        sh -c "cd /data && tar -xzf '/backup/$restore_basename'" 2>/dev/null; then
        log_success "Keys restored to relay $target_relay"
        # Restart container
        docker start "$cname" 2>/dev/null || run_relay_container $target_relay
    else
        log_error "Failed to restore keys"
        return 1
    fi
}

check_and_offer_backup_restore() {
    if [ ! -d "$BACKUP_DIR" ]; then
        return 0
    fi

    local latest_backup
    latest_backup=$(find "$BACKUP_DIR" -maxdepth 1 -name 'tor_keys_*.tar.gz' -print 2>/dev/null | sort -r | head -1)

    if [ -z "$latest_backup" ]; then
        return 0
    fi

    local backup_filename=$(basename "$latest_backup")

    # Validate filename to prevent path traversal
    if ! [[ "$backup_filename" =~ ^tor_keys_relay[0-9]+_[0-9]+_[0-9]+\.tar\.gz$ ]]; then
        log_warn "Backup filename has unexpected format: $backup_filename — skipping"
        return 0
    fi
    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}  📁 PREVIOUS RELAY IDENTITY BACKUP FOUND${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════════${NC}"
    echo ""
    echo -e "  A backup of your relay identity keys was found:"
    echo -e "    ${YELLOW}File:${NC} $backup_filename"
    echo ""
    echo -e "  Restoring will:"
    echo -e "    • Preserve your relay's identity on the Tor network"
    echo -e "    • Maintain your relay's reputation and consensus weight"
    echo -e "    • Keep the same fingerprint and bridge line"
    echo ""
    echo -e "  ${YELLOW}Note:${NC} If you don't restore, a new identity will be generated."
    echo ""

    while true; do
        read -p "  Restore your previous relay identity? (y/n): " restore_choice < /dev/tty || true

        if [[ "$restore_choice" =~ ^[Yy]$ ]]; then
            echo ""
            log_info "Restoring relay identity from backup..."

            # Determine target relay
            local target_relay=1
            if [[ "$backup_filename" =~ relay([0-9]+) ]]; then
                target_relay="${BASH_REMATCH[1]}"
            fi

            local vname=$(get_volume_name $target_relay)
            docker volume create "$vname" 2>/dev/null || true

            local restore_ok=false
            if docker run --rm -v "${vname}:/data" -v "$BACKUP_DIR":/backup:ro alpine \
                sh -c 'cd /data && tar -xzf "/backup/$1"' -- "$backup_filename" 2>/dev/null; then
                restore_ok=true
            fi

            if [ "$restore_ok" = "true" ]; then
                log_success "Relay identity restored successfully!"
                echo ""
                return 0
            else
                log_error "Failed to restore backup. Proceeding with fresh install."
                echo ""
                return 1
            fi
        elif [[ "$restore_choice" =~ ^[Nn]$ ]]; then
            echo ""
            log_info "Skipping restore. A new relay identity will be generated."
            echo ""
            return 1
        else
            echo "  Please enter y or n."
        fi
    done
}

#═══════════════════════════════════════════════════════════════════════
# Auto-Start Services
#═══════════════════════════════════════════════════════════════════════

setup_autostart() {
    log_info "Setting up auto-start on boot..."

    if [ "$HAS_SYSTEMD" = "true" ]; then
        cat > /etc/systemd/system/torware.service << EOF
[Unit]
Description=Torware Service
After=network.target docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutStartSec=300
TimeoutStopSec=120
ExecStart=/usr/local/bin/torware start
ExecStop=/usr/local/bin/torware stop

[Install]
WantedBy=multi-user.target
EOF

        systemctl daemon-reload 2>/dev/null || true
        systemctl enable torware.service 2>/dev/null || true
        systemctl start torware.service 2>/dev/null || true
        log_success "Systemd service created, enabled, and started"

    elif command -v rc-update &>/dev/null; then
        cat > /etc/init.d/torware << 'EOF'
#!/sbin/openrc-run

name="torware"
description="Torware Service"
depend() {
    need docker
    after network
}
start() {
    ebegin "Starting Torware"
    /usr/local/bin/torware start
    eend $?
}
stop() {
    ebegin "Stopping Torware"
    /usr/local/bin/torware stop
    eend $?
}
status() {
    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^torware'; then
        einfo "Torware is running"
        return 0
    else
        einfo "Torware is stopped"
        return 3
    fi
}
EOF
        chmod +x /etc/init.d/torware
        rc-update add torware default 2>/dev/null || true
        log_success "OpenRC service created and enabled"

    elif [ -d /etc/init.d ]; then
        cat > /etc/init.d/torware << 'EOF'
#!/bin/sh
### BEGIN INIT INFO
# Provides:          torware
# Required-Start:    docker
# Required-Stop:     docker
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Torware Service
### END INIT INFO

case "$1" in
    start)
        /usr/local/bin/torware start
        ;;
    stop)
        /usr/local/bin/torware stop
        ;;
    restart)
        /usr/local/bin/torware restart
        ;;
    status)
        docker ps | grep -q torware && echo "Running" || echo "Stopped"
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|status}"
        exit 1
        ;;
esac
EOF
        chmod +x /etc/init.d/torware
        if command -v update-rc.d &>/dev/null; then
            update-rc.d torware defaults 2>/dev/null || true
        elif command -v chkconfig &>/dev/null; then
            chkconfig torware on 2>/dev/null || true
        fi
        log_success "SysVinit service created and enabled"

    else
        log_warn "Could not set up auto-start. Docker's restart policy will handle restarts."
    fi
}

#═══════════════════════════════════════════════════════════════════════
# Doctor - Comprehensive Diagnostics
#═══════════════════════════════════════════════════════════════════════

run_doctor() {
    load_settings
    local issues=0
    local warnings=0

    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}              🩺 TORWARE DOCTOR                               ${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo ""
    echo -e "  ${BOLD}Running comprehensive diagnostics...${NC}"
    echo ""

    # 1. System Requirements
    echo -e "  ${BOLD}[System Requirements]${NC}"

    # Check disk space
    echo -n "    Disk space:           "
    local free_space=$(df -BG "$INSTALL_DIR" 2>/dev/null | awk 'NR==2 {print $4}' | tr -d 'G')
    if [ "${free_space:-0}" -ge 5 ] 2>/dev/null; then
        echo -e "${GREEN}OK${NC} (${free_space}GB free)"
    elif [ "${free_space:-0}" -ge 2 ] 2>/dev/null; then
        echo -e "${YELLOW}LOW${NC} (${free_space}GB free - recommend 5GB+)"
        ((warnings++))
    else
        echo -e "${RED}CRITICAL${NC} (${free_space:-?}GB free)"
        ((issues++))
    fi

    # Check RAM
    echo -n "    Available RAM:        "
    local free_ram=$(free -m 2>/dev/null | awk '/^Mem:/ {print $7}')
    if [ "${free_ram:-0}" -ge 512 ] 2>/dev/null; then
        echo -e "${GREEN}OK${NC} (${free_ram}MB available)"
    elif [ "${free_ram:-0}" -ge 256 ] 2>/dev/null; then
        echo -e "${YELLOW}LOW${NC} (${free_ram}MB available)"
        ((warnings++))
    else
        echo -e "${RED}CRITICAL${NC} (${free_ram:-?}MB available)"
        ((issues++))
    fi

    # Check CPU load
    echo -n "    CPU load:             "
    local load=$(awk '{print $1}' /proc/loadavg 2>/dev/null)
    local cores=$(get_cpu_cores)
    local load_pct=$(awk "BEGIN {printf \"%.0f\", ($load / $cores) * 100}" 2>/dev/null || echo "?")
    if [ "${load_pct:-100}" -le 80 ] 2>/dev/null; then
        echo -e "${GREEN}OK${NC} (${load_pct}%)"
    else
        echo -e "${YELLOW}HIGH${NC} (${load_pct}%)"
        ((warnings++))
    fi

    echo ""
    echo -e "  ${BOLD}[Docker Environment]${NC}"

    # Check Docker daemon
    echo -n "    Docker daemon:        "
    if docker info &>/dev/null; then
        local docker_ver=$(docker --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
        echo -e "${GREEN}OK${NC} (v${docker_ver})"
    else
        echo -e "${RED}FAILED${NC} - Docker is not running"
        ((issues++))
    fi

    # Check Docker images
    echo -n "    Bridge image:         "
    if docker image inspect "$BRIDGE_IMAGE" &>/dev/null; then
        echo -e "${GREEN}OK${NC}"
    else
        echo -e "${YELLOW}NOT PULLED${NC} (will download on first run)"
        ((warnings++))
    fi

    echo -n "    Relay image:          "
    if docker image inspect "$RELAY_IMAGE" &>/dev/null; then
        echo -e "${GREEN}OK${NC}"
    else
        echo -e "${YELLOW}NOT PULLED${NC}"
        ((warnings++))
    fi

    echo ""
    echo -e "  ${BOLD}[Network Connectivity]${NC}"

    # Check outbound connectivity
    echo -n "    Internet access:      "
    if curl -s --max-time 5 https://check.torproject.org &>/dev/null; then
        echo -e "${GREEN}OK${NC}"
    elif curl -s --max-time 5 https://www.google.com &>/dev/null; then
        echo -e "${GREEN}OK${NC} (via Google)"
    else
        echo -e "${RED}FAILED${NC} - No internet connectivity"
        ((issues++))
    fi

    # Check DNS resolution
    echo -n "    DNS resolution:       "
    if host torproject.org &>/dev/null || nslookup torproject.org &>/dev/null 2>&1; then
        echo -e "${GREEN}OK${NC}"
    else
        echo -e "${RED}FAILED${NC} - DNS not working"
        ((issues++))
    fi

    # Check external IP
    echo -n "    External IP:          "
    local ext_ip=$(get_external_ip 2>/dev/null)
    if [ -n "$ext_ip" ]; then
        echo -e "${GREEN}OK${NC} (${ext_ip})"
    else
        echo -e "${YELLOW}UNKNOWN${NC} - Could not detect"
        ((warnings++))
    fi

    # Check if ORPort is likely reachable
    echo -n "    ORPort reachability:  "
    local orport=${ORPORT_BASE:-9001}
    if command -v nc &>/dev/null && timeout 3 nc -z 127.0.0.1 "$orport" 2>/dev/null; then
        echo -e "${GREEN}OK${NC} (port $orport listening)"
    elif docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^torware"; then
        echo -e "${GREEN}OK${NC} (container running)"
    else
        echo -e "${YELLOW}NOT TESTED${NC} (container not running)"
    fi

    echo ""
    echo -e "  ${BOLD}[Configuration]${NC}"

    # Check settings file
    echo -n "    Settings file:        "
    if [ -f "$INSTALL_DIR/settings.conf" ]; then
        # Validate format
        if grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$INSTALL_DIR/settings.conf" 2>/dev/null | grep -q .; then
            echo -e "${RED}INVALID${NC} - Contains unsafe content"
            ((issues++))
        else
            echo -e "${GREEN}OK${NC}"
        fi
    else
        echo -e "${YELLOW}MISSING${NC}"
        ((warnings++))
    fi

    # Check data volumes
    echo -n "    Data volumes:         "
    local vol_count=$(docker volume ls --format '{{.Name}}' 2>/dev/null | grep -c "^relay-data" || echo 0)
    if [ "$vol_count" -gt 0 ]; then
        echo -e "${GREEN}OK${NC} (${vol_count} volume(s))"
    else
        echo -e "${YELLOW}NONE${NC} (will be created on first run)"
    fi

    # Check relay keys backup
    echo -n "    Relay key backups:    "
    local backup_count=$(ls -1 "$BACKUP_DIR"/*.tar.gz 2>/dev/null | wc -l)
    if [ "$backup_count" -gt 0 ]; then
        echo -e "${GREEN}OK${NC} (${backup_count} backup(s))"
    else
        echo -e "${YELLOW}NONE${NC} - Consider running 'torware backup'"
        ((warnings++))
    fi

    echo ""
    echo -e "  ${BOLD}[Container Health]${NC}"

    # Check running containers
    local count=${CONTAINER_COUNT:-1}
    if [ "$count" -gt 0 ] && [ "$RELAY_TYPE" != "none" ]; then
        for i in $(seq 1 $count); do
            local cname=$(get_container_name $i)
            echo -n "    ${cname}:  "
            if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
                local health=$(docker inspect --format='{{.State.Health.Status}}' "$cname" 2>/dev/null || echo "none")
                case "$health" in
                    healthy) echo -e "${GREEN}HEALTHY${NC}" ;;
                    unhealthy) echo -e "${RED}UNHEALTHY${NC}"; ((issues++)) ;;
                    starting) echo -e "${YELLOW}STARTING${NC}" ;;
                    *) echo -e "${GREEN}RUNNING${NC} (no health check)" ;;
                esac
            elif docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
                echo -e "${RED}STOPPED${NC}"
                ((issues++))
            else
                echo -e "${DIM}NOT CREATED${NC}"
            fi
        done
    fi

    # Check proxy containers
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        echo -n "    snowflake-proxy:      "
        if is_snowflake_running; then
            echo -e "${GREEN}RUNNING${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            ((issues++))
        fi
    fi

    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        echo -n "    unbounded-proxy:      "
        if is_unbounded_running; then
            echo -e "${GREEN}RUNNING${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            ((issues++))
        fi
    fi

    if [ "$MTPROXY_ENABLED" = "true" ]; then
        echo -n "    mtproxy:              "
        if is_mtproxy_running; then
            echo -e "${GREEN}RUNNING${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            ((issues++))
        fi
    fi

    # Summary
    echo ""
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    if [ "$issues" -eq 0 ] && [ "$warnings" -eq 0 ]; then
        echo -e "  ${GREEN}${BOLD}✓ All checks passed!${NC}"
    elif [ "$issues" -eq 0 ]; then
        echo -e "  ${YELLOW}${BOLD}⚠ ${warnings} warning(s), no critical issues${NC}"
    else
        echo -e "  ${RED}${BOLD}✗ ${issues} issue(s), ${warnings} warning(s)${NC}"
    fi
    echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
    echo ""

    return $issues
}

#═══════════════════════════════════════════════════════════════════════
# Health Check
#═══════════════════════════════════════════════════════════════════════

health_check() {
    load_settings
    local count=${CONTAINER_COUNT:-1}
    local all_ok=true

    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}              🧅 TORWARE HEALTH CHECK                        ${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo ""

    # 1. Docker daemon
    echo -n "  Docker daemon:        "
    if docker info &>/dev/null; then
        echo -e "${GREEN}OK${NC}"
    else
        echo -e "${RED}FAILED${NC} - Docker is not running"
        all_ok=false
    fi

    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        local controlport=$(get_container_controlport $i)
        echo ""
        echo -e "  ${BOLD}--- Container $i ($cname) ---${NC}"

        # 2. Container exists
        echo -n "  Container exists:     "
        if docker ps -a --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}NOT FOUND${NC}"
            all_ok=false
            continue
        fi

        # 3. Container running
        echo -n "  Container running:    "
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            all_ok=false
            continue
        fi

        # 4. Restart count
        local restarts
        restarts=$(docker inspect --format '{{.RestartCount}}' "$cname" 2>/dev/null || echo "0")
        echo -n "  Restart count:        "
        if [ "$restarts" -eq 0 ] 2>/dev/null; then
            echo -e "${GREEN}0 (healthy)${NC}"
        elif [ "$restarts" -lt 5 ] 2>/dev/null; then
            echo -e "${YELLOW}${restarts} (some restarts)${NC}"
        else
            echo -e "${RED}${restarts} (excessive)${NC}"
            all_ok=false
        fi

        # 5. ControlPort accessible
        echo -n "  ControlPort:          "
        local nc_cmd=$(get_nc_cmd)
        if [ -n "$nc_cmd" ] && timeout 3 $nc_cmd -z 127.0.0.1 "$controlport" 2>/dev/null; then
            echo -e "${GREEN}OK (port $controlport)${NC}"
        else
            echo -e "${YELLOW}NOT ACCESSIBLE (port $controlport)${NC}"
        fi

        # 6. Cookie auth
        echo -n "  Cookie auth:          "
        local cookie=$(get_control_cookie $i)
        if [ -n "$cookie" ] && [ "$cookie" != "" ]; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${YELLOW}NO COOKIE (relay may still be bootstrapping)${NC}"
        fi

        # 7. Data volume
        local vname=$(get_volume_name $i)
        echo -n "  Data volume:          "
        if docker volume inspect "$vname" &>/dev/null; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}MISSING${NC}"
            all_ok=false
        fi

        # 8. Network mode
        echo -n "  Network (host mode):  "
        local netmode
        netmode=$(docker inspect --format '{{.HostConfig.NetworkMode}}' "$cname" 2>/dev/null)
        if [ "$netmode" = "host" ]; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}${netmode} (should be host)${NC}"
            all_ok=false
        fi

        # 9. Fingerprint
        echo -n "  Relay fingerprint:    "
        local fp=$(get_tor_fingerprint $i)
        if [ -n "$fp" ]; then
            echo -e "${GREEN}OK${NC} (${fp:0:20}...)"
        else
            echo -e "${YELLOW}NOT YET GENERATED${NC}"
        fi

        # 10. Logs check
        echo -n "  Recent activity:      "
        local recent_logs
        recent_logs=$(docker logs --tail 30 "$cname" 2>&1)
        if echo "$recent_logs" | grep -qi "bootstrapped 100%\|self-testing indicates"; then
            echo -e "${GREEN}OK (fully bootstrapped)${NC}"
        elif echo "$recent_logs" | grep -qi "bootstrapped"; then
            local pct
            pct=$(echo "$recent_logs" | sed -n 's/.*Bootstrapped \([0-9]*\).*/\1/p' | tail -1)
            echo -e "${YELLOW}Bootstrapping (${pct}%)${NC}"
        else
            echo -e "${YELLOW}Checking...${NC}"
        fi
    done

    echo ""

    # 11. GeoIP (bridges use Tor's built-in CLIENTS_SEEN; relays need system GeoIP)
    echo -n "  GeoIP available:      "
    if command -v geoiplookup &>/dev/null; then
        echo -e "${GREEN}OK (geoiplookup)${NC}"
    elif command -v mmdblookup &>/dev/null; then
        echo -e "${GREEN}OK (mmdblookup)${NC}"
    else
        # Check if any non-bridge containers exist
        local _needs_geoip=false
        for _gi in $(seq 1 $count); do
            [ "$(get_container_relay_type $_gi)" != "bridge" ] && _needs_geoip=true
        done
        if [ "$_needs_geoip" = "true" ]; then
            echo -e "${YELLOW}NOT INSTALLED (needed for relay country stats)${NC}"
        else
            echo -e "${GREEN}N/A (bridges use Tor's built-in country data)${NC}"
        fi
    fi

    # 12. netcat
    echo -n "  netcat available:     "
    if command -v nc &>/dev/null || command -v ncat &>/dev/null; then
        echo -e "${GREEN}OK${NC}"
    else
        echo -e "${RED}NOT INSTALLED (ControlPort queries will fail)${NC}"
        all_ok=false
    fi

    # 13. od (used for cookie hex conversion — always available in Alpine/busybox)
    echo -n "  od available:         "
    if command -v od &>/dev/null; then
        echo -e "${GREEN}OK (host)${NC}"
    elif docker image inspect alpine &>/dev/null; then
        echo -e "${GREEN}OK (Alpine has od via busybox)${NC}"
    else
        echo -e "${YELLOW}UNCHECKED (Alpine image not cached)${NC}"
    fi

    # Snowflake proxy health
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
            local _sfn=$(get_snowflake_name $_sfi)
            local _sfm=$(get_snowflake_metrics_port $_sfi)
            echo ""
            echo -e "  ${BOLD}--- ${_sfn} ---${NC}"

            echo -n "  Container running:    "
            if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_sfn}$"; then
                echo -e "${GREEN}OK${NC}"
            else
                echo -e "${RED}STOPPED${NC}"
                all_ok=false
            fi

            echo -n "  Metrics endpoint:     "
            if curl -s --max-time 3 "http://127.0.0.1:${_sfm}/internal/metrics" &>/dev/null; then
                echo -e "${GREEN}OK (port $_sfm)${NC}"
            else
                echo -e "${YELLOW}NOT ACCESSIBLE${NC}"
            fi
        done
    fi

    # Unbounded proxy health
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        local _ubn="$UNBOUNDED_CONTAINER"
        echo ""
        echo -e "  ${BOLD}--- ${_ubn} ---${NC}"

        echo -n "  Container running:    "
        if is_unbounded_running; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            all_ok=false
        fi

        echo -n "  Process alive:        "
        if docker exec "$_ubn" pgrep widget &>/dev/null; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}NOT RUNNING${NC}"
            all_ok=false
        fi
    fi

    # MTProxy health
    if [ "$MTPROXY_ENABLED" = "true" ]; then
        local _mtpn="$MTPROXY_CONTAINER"
        local _mtpm="${MTPROXY_METRICS_PORT:-3129}"
        echo ""
        echo -e "  ${BOLD}--- ${_mtpn} ---${NC}"

        echo -n "  Container running:    "
        if is_mtproxy_running; then
            echo -e "${GREEN}OK${NC}"
        else
            echo -e "${RED}STOPPED${NC}"
            all_ok=false
        fi

        echo -n "  Metrics endpoint:     "
        if curl -s --max-time 3 "http://127.0.0.1:${_mtpm}/" &>/dev/null; then
            echo -e "${GREEN}OK (port $_mtpm)${NC}"
        else
            echo -e "${YELLOW}NOT ACCESSIBLE${NC}"
        fi
    fi

    echo ""
    if [ "$all_ok" = "true" ]; then
        echo -e "  ${GREEN}✓ All health checks passed${NC}"
    else
        echo -e "  ${YELLOW}⚠ Some checks failed. Review issues above.${NC}"
    fi
    echo ""
}

#═══════════════════════════════════════════════════════════════════════
# Container Stats Aggregation
#═══════════════════════════════════════════════════════════════════════

get_container_stats() {
    # Get CPU and RAM usage across all torware containers
    local names=""
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        names+=" $(get_container_name $i)"
    done
    if [ "$SNOWFLAKE_ENABLED" = "true" ] && is_snowflake_running; then
        for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
            local _sfn=$(get_snowflake_name $_sfi)
            docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_sfn}$" && names+=" $_sfn"
        done
    fi
    if [ "$UNBOUNDED_ENABLED" = "true" ] && is_unbounded_running; then
        names+=" $UNBOUNDED_CONTAINER"
    fi
    if [ "$MTPROXY_ENABLED" = "true" ] && is_mtproxy_running; then
        names+=" $MTPROXY_CONTAINER"
    fi
    local all_stats=$(timeout 10 docker stats --no-stream --format "{{.CPUPerc}} {{.MemUsage}}" $names 2>/dev/null)
    local _nlines=$(echo "$all_stats" | wc -l)
    if [ -z "$all_stats" ]; then
        echo "0% 0MiB"
    elif [ "$_nlines" -le 1 ]; then
        echo "$all_stats"
    else
        echo "$all_stats" | awk '{
            cpu = $1; gsub(/%/, "", cpu); total_cpu += cpu + 0
            mem = $2; gsub(/[^0-9.]/, "", mem); mem += 0
            if ($2 ~ /GiB/) mem *= 1024
            else if ($2 ~ /KiB/) mem /= 1024
            total_mem += mem
            if (mem_limit == "") mem_limit = $4
            found = 1
        } END {
            if (!found) { print "0% 0MiB"; exit }
            if (total_mem >= 1024) mem_display = sprintf("%.2fGiB", total_mem/1024)
            else mem_display = sprintf("%.1fMiB", total_mem)
            printf "%.2f%% %s / %s\n", total_cpu, mem_display, mem_limit
        }'
    fi
}

#═══════════════════════════════════════════════════════════════════════
# Live TUI Dashboard (Phase 2)
#═══════════════════════════════════════════════════════════════════════

print_dashboard_header() {
    local EL="\033[K"
    local bar="═══════════════════════════════════════════════════════════════════"
    echo -e "${CYAN}╔${bar}╗${NC}${EL}"
    # 🧅 emoji = 2 display cols but 1 char, so printf sees 4 cols for "  🧅 " but display is 5; use %-62s
    printf "${CYAN}║${NC}  🧅 ${BOLD}%-62s${NC}${CYAN}║${NC}${EL}\n" "TORWARE v${VERSION}       TORWARE LIVE STATISTICS"
    echo -e "${CYAN}╠${bar}╣${NC}${EL}"
    # Detect mixed relay types for dashboard header
    local _dh_type="${RELAY_TYPE}"
    for _dhi in $(seq 1 ${CONTAINER_COUNT:-1}); do
        [ "$(get_container_relay_type $_dhi)" != "$RELAY_TYPE" ] && _dh_type="mixed" && break
    done
    # Inner width=67: "  Relay Type: "(14) + type(10) + "  Nickname: "(12) + nick(31) = 67
    local _type_pad=$(printf '%-10s' "$_dh_type")
    local _nick_pad=$(printf '%-31s' "$NICKNAME")
    echo -e "${CYAN}║${NC}  Relay Type: ${GREEN}${_type_pad}${NC}  Nickname: ${GREEN}${_nick_pad}${NC}${CYAN}║${NC}${EL}"
    local _bw_text
    if [ "$BANDWIDTH" = "-1" ]; then
        _bw_text="Unlimited"
    else
        _bw_text="${BANDWIDTH} Mbps"
    fi
    # "  Bandwidth:  "(14) + bw(53) = 67
    local _bw_pad=$(printf '%-53s' "$_bw_text")
    echo -e "${CYAN}║${NC}  Bandwidth:  ${GREEN}${_bw_pad}${NC}${CYAN}║${NC}${EL}"
    echo -e "${CYAN}╚${bar}╝${NC}${EL}"
}

show_dashboard() {
    load_settings
    local stop_dashboard=0
    local _dash_pid=$$
    # Pre-seed CPU state file so first iteration has a valid delta
    local _cpu_seed="${TMPDIR:-/tmp}/torware_cpu_state_$$"
    if [ -f /proc/stat ] && [ ! -f "$_cpu_seed" ]; then
        read -r _cpu user nice system idle iowait irq softirq steal guest < /proc/stat 2>/dev/null
        echo "$(( user + nice + system + idle + iowait + irq + softirq + steal )) $(( user + nice + system + irq + softirq + steal ))" > "$_cpu_seed" 2>/dev/null
    fi
    _dashboard_cleanup() {
        echo -ne "\033[?25h"
        tput rmcup 2>/dev/null || true
        rm -rf "/tmp/.tor_dash.${_dash_pid}."* 2>/dev/null
    }
    trap '_dashboard_cleanup; stop_dashboard=1' INT TERM
    trap '_dashboard_cleanup' RETURN

    # Alternate screen buffer
    tput smcup 2>/dev/null || true
    echo -ne "\033[?25l" # Hide cursor
    clear

    while [ $stop_dashboard -eq 0 ]; do
        # Cursor home (no clear = no flicker)
        if ! tput cup 0 0 2>/dev/null; then
            printf "\033[H"
        fi

        local EL="\033[K"
        local count=${CONTAINER_COUNT:-1}

        print_dashboard_header

        echo -e "${EL}"

        # Collect stats from all containers in parallel
        local _tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/.tor_dash.${_dash_pid}.XXXXXX")

        # Cache docker ps once per cycle
        local _running_containers
        _running_containers=$(docker ps --format '{{.Names}}' 2>/dev/null)
        echo "$_running_containers" > "$_tmpdir/ps_cache"

        # ControlPort queries in parallel per container
        # Note: subshells inherit env (including TELEGRAM_BOT_TOKEN) but only write to temp files
        for i in $(seq 1 $count); do
            (
                local cname=$(get_container_name $i)
                local port=$(get_container_controlport $i)
                local running=0

                if echo "$_running_containers" | grep -q "^${cname}$"; then
                    running=1

                    # Uptime
                    local started_at
                    started_at=$(docker inspect --format '{{.State.StartedAt}}' "$cname" 2>/dev/null)
                    local start_epoch=0
                    if [ -n "$started_at" ]; then
                        start_epoch=$(date -d "$started_at" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%S" "${started_at%%.*}" +%s 2>/dev/null || echo "0")
                    fi

                    # Traffic via ControlPort
                    local result
                    result=$(controlport_query "$port" \
                        "GETINFO traffic/read" \
                        "GETINFO traffic/written" \
                        "GETINFO circuit-status" \
                        "GETINFO orconn-status" 2>/dev/null)

                    local rb=$(echo "$result" | sed -n 's/.*traffic\/read=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")
                    local wb=$(echo "$result" | sed -n 's/.*traffic\/written=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")
                    local circuits=$(echo "$result" | grep -cE '^[0-9]+ (BUILT|EXTENDED|LAUNCHED)' 2>/dev/null || echo "0")
                    local conns=$(echo "$result" | grep -c '\$' 2>/dev/null || echo "0")
                    rb=${rb//[^0-9]/}; rb=${rb:-0}
                    wb=${wb//[^0-9]/}; wb=${wb:-0}
                    circuits=${circuits//[^0-9]/}; circuits=${circuits:-0}
                    conns=${conns//[^0-9]/}; conns=${conns:-0}

                    echo "$running $rb $wb $circuits $conns $start_epoch" > "$_tmpdir/c_${i}"
                else
                    echo "0 0 0 0 0 0" > "$_tmpdir/c_${i}"
                fi
            ) &
        done

        # System stats + proxy stats in parallel
        ( get_container_stats > "$_tmpdir/cstats" ) &
        ( get_net_speed > "$_tmpdir/net" ) &
        if [ "$SNOWFLAKE_ENABLED" = "true" ] && echo "$_running_containers" | grep -q "^snowflake-proxy$"; then
            ( get_snowflake_stats > "$_tmpdir/sf_stats" ) 2>/dev/null &
            ( get_snowflake_country_stats > "$_tmpdir/sf_countries" ) 2>/dev/null &
        fi
        if [ "$UNBOUNDED_ENABLED" = "true" ] && echo "$_running_containers" | grep -q "^${UNBOUNDED_CONTAINER}$"; then
            ( get_unbounded_stats > "$_tmpdir/ub_stats" ) 2>/dev/null &
        fi
        if [ "$MTPROXY_ENABLED" = "true" ] && echo "$_running_containers" | grep -q "^${MTPROXY_CONTAINER}$"; then
            ( get_mtproxy_stats > "$_tmpdir/mtp_stats" ) 2>/dev/null &
        fi
        if [ "${DATA_CAP_GB}" -gt 0 ] 2>/dev/null; then
            ( controlport_query "$(get_container_controlport 1)" \
                "GETINFO accounting/bytes" \
                "GETINFO accounting/bytes-left" \
                "GETINFO accounting/interval-end" > "$_tmpdir/acct" ) 2>/dev/null &
        fi
        wait

        # Aggregate
        local total_read=0 total_written=0 total_circuits=0 total_conns=0 running=0
        local earliest_start=0

        for i in $(seq 1 $count); do
            if [ -f "$_tmpdir/c_${i}" ]; then
                read -r c_run c_rb c_wb c_circ c_conn c_start < "$_tmpdir/c_${i}"
                c_run=${c_run:-0}; c_rb=${c_rb:-0}; c_wb=${c_wb:-0}; c_circ=${c_circ:-0}; c_conn=${c_conn:-0}; c_start=${c_start:-0}
                if [ "$c_run" = "1" ]; then
                    running=$((running + 1))
                    total_read=$((total_read + c_rb))
                    total_written=$((total_written + c_wb))
                    total_circuits=$((total_circuits + c_circ))
                    total_conns=$((total_conns + c_conn))
                    if [ "$earliest_start" -eq 0 ] || { [ "$c_start" -gt 0 ] && [ "$c_start" -lt "$earliest_start" ]; }; then
                        earliest_start=$c_start
                    fi
                fi
            fi
        done

        # Include snowflake in totals (from parallel-fetched cache)
        local _cached_sf_stats=""
        if [ -f "$_tmpdir/sf_stats" ]; then
            _cached_sf_stats=$(cat "$_tmpdir/sf_stats")
            local _sf_in=$(echo "$_cached_sf_stats" | awk '{print $2}'); _sf_in=${_sf_in:-0}
            local _sf_out=$(echo "$_cached_sf_stats" | awk '{print $3}'); _sf_out=${_sf_out:-0}
            total_read=$((total_read + _sf_in))
            total_written=$((total_written + _sf_out))
        fi

        local uptime_str="N/A"
        if [ "$earliest_start" -gt 0 ]; then
            uptime_str=$(format_duration $(($(date +%s) - earliest_start)))
        fi

        # Resource stats
        local stats=$(cat "$_tmpdir/cstats" 2>/dev/null)
        local net_speed=$(cat "$_tmpdir/net" 2>/dev/null)

        # Normalize App CPU
        local raw_app_cpu=$(echo "$stats" | awk '{print $1}' | tr -d '%')
        local num_cores=$(get_cpu_cores)
        # Ensure num_cores is at least 1 to prevent division by zero
        [ "${num_cores:-0}" -lt 1 ] 2>/dev/null && num_cores=1
        local app_cpu_display="0%"
        if [[ "$raw_app_cpu" =~ ^[0-9.]+$ ]]; then
            app_cpu_display=$(awk -v cpu="$raw_app_cpu" -v cores="$num_cores" 'BEGIN {printf "%.2f%%", (cores > 0) ? cpu / cores : 0}')
            if [ "$num_cores" -gt 1 ]; then
                app_cpu_display="${app_cpu_display} (${raw_app_cpu}% vCPU)"
            fi
        fi
        local app_ram=$(echo "$stats" | awk '{print $2, $3, $4}')

        # System CPU/RAM inline (quick /proc read)
        local sys_cpu="N/A" sys_ram_used="N/A" sys_ram_total="N/A"
        local cpu_tmp="${TMPDIR:-/tmp}/torware_cpu_state_$$"
        if [ -f /proc/stat ]; then
            read -r _cpu user nice system idle iowait irq softirq steal guest < /proc/stat
            local total_curr=$((user + nice + system + idle + iowait + irq + softirq + steal))
            local work_curr=$((user + nice + system + irq + softirq + steal))
            if [ -f "$cpu_tmp" ]; then
                read -r total_prev work_prev < "$cpu_tmp"
                local dt=$((total_curr - total_prev))
                local dw=$((work_curr - work_prev))
                if [ "$dt" -gt 0 ]; then
                    sys_cpu=$(awk -v w="$dw" -v t="$dt" 'BEGIN { printf "%.1f%%", w * 100 / t }')
                fi
            fi
            echo "$total_curr $work_curr" > "$cpu_tmp"
        fi
        if command -v free &>/dev/null; then
            local free_out=$(free -m 2>/dev/null)
            sys_ram_used=$(echo "$free_out" | awk '/^Mem:/{if ($3>=1024) printf "%.1fGiB",$3/1024; else printf "%.0fMiB",$3}')
            sys_ram_total=$(echo "$free_out" | awk '/^Mem:/{if ($2>=1024) printf "%.1fGiB",$2/1024; else printf "%.0fMiB",$2}')
        fi

        local rx_mbps=$(echo "$net_speed" | awk '{print $1}')
        local tx_mbps=$(echo "$net_speed" | awk '{print $2}')

        # ── Display ──
        if [ "$running" -gt 0 ]; then
            echo -e "${BOLD}Status:${NC} ${GREEN}Running${NC} (${uptime_str})${EL}"
            echo -e "  Containers: ${GREEN}${running}${NC}/${count}    Circuits: ${GREEN}${total_circuits}${NC}    Connections: ${GREEN}${total_conns}${NC}${EL}"

            # Include unbounded in totals (from parallel-fetched cache)
            local _cached_ub_stats=""
            if [ -f "$_tmpdir/ub_stats" ]; then
                _cached_ub_stats=$(cat "$_tmpdir/ub_stats")
                local _ub_in=$(echo "$_cached_ub_stats" | awk '{print $2}'); _ub_in=${_ub_in:-0}
                local _ub_out=$(echo "$_cached_ub_stats" | awk '{print $3}'); _ub_out=${_ub_out:-0}
                total_read=$((total_read + _ub_in))
                total_written=$((total_written + _ub_out))
            fi

            # Include MTProxy in totals (from parallel-fetched cache)
            local _cached_mtp_stats=""
            if [ -f "$_tmpdir/mtp_stats" ]; then
                _cached_mtp_stats=$(cat "$_tmpdir/mtp_stats")
                local _mtp_in=$(echo "$_cached_mtp_stats" | awk '{print $1}'); _mtp_in=${_mtp_in:-0}
                local _mtp_out=$(echo "$_cached_mtp_stats" | awk '{print $2}'); _mtp_out=${_mtp_out:-0}
                total_read=$((total_read + _mtp_in))
                total_written=$((total_written + _mtp_out))
            fi

            echo -e "${EL}"
            echo -e "${CYAN}═══ Traffic (total) ═══${NC}${EL}"
            echo -e "  Downloaded:   ${CYAN}$(format_bytes $total_read)${NC}${EL}"
            echo -e "  Uploaded:     ${CYAN}$(format_bytes $total_written)${NC}${EL}"

            echo -e "${EL}"
            echo -e "${CYAN}═══ Resource Usage ═══${NC}${EL}"
            local _acpu=$(printf '%-24s' "$app_cpu_display")
            local _aram=$(printf '%-20s' "$app_ram")
            echo -e "  App:     CPU: ${YELLOW}${_acpu}${NC}| RAM: ${YELLOW}${_aram}${NC}${EL}"
            local _scpu=$(printf '%-24s' "$sys_cpu")
            local _sram=$(printf '%-20s' "$sys_ram_used / $sys_ram_total")
            echo -e "  System:  CPU: ${YELLOW}${_scpu}${NC}| RAM: ${YELLOW}${_sram}${NC}${EL}"
            local _rx=$(printf '%-10s' "$rx_mbps")
            local _tx=$(printf '%-10s' "$tx_mbps")
            echo -e "  Total:   Net: ${YELLOW}↓ ${_rx}Mbps  ↑ ${_tx}Mbps${NC}${EL}"

            # Data cap from Tor accounting (from parallel-fetched cache)
            if [ "${DATA_CAP_GB}" -gt 0 ] 2>/dev/null; then
                echo -e "${EL}"
                echo -e "${CYAN}═══ DATA CAP ═══${NC}${EL}"
                local acct_result
                acct_result=$(cat "$_tmpdir/acct" 2>/dev/null)
                local acct_bytes=$(echo "$acct_result" | sed -n 's/.*accounting\/bytes=\([^\r]*\)/\1/p' | head -1 2>/dev/null)
                local acct_left=$(echo "$acct_result" | sed -n 's/.*accounting\/bytes-left=\([^\r]*\)/\1/p' | head -1 2>/dev/null)
                local acct_end=$(echo "$acct_result" | sed -n 's/.*accounting\/interval-end=\([^\r]*\)/\1/p' | head -1 2>/dev/null)
                if [ -n "$acct_bytes" ]; then
                    local acct_read=$(echo "$acct_bytes" | awk '{print $1}')
                    local acct_write=$(echo "$acct_bytes" | awk '{print $2}')
                    local acct_total=$((acct_read + acct_write))
                    echo -e "  Used: ${YELLOW}$(format_bytes $acct_total)${NC} / ${GREEN}${DATA_CAP_GB} GB${NC}${EL}"
                    [ -n "$acct_end" ] && echo -e "  Resets: ${DIM}${acct_end}${NC}${EL}"
                fi
            fi

            # Country breakdown — try tracker snapshot, fallback to CLIENTS_SEEN for bridges
            local snap_file="$STATS_DIR/tracker_snapshot"
            local data_file="$STATS_DIR/cumulative_data"

            # If no tracker data, try querying CLIENTS_SEEN directly for bridges
            if [ ! -s "$snap_file" ]; then
                local _any_bridge_running=false
                for _bi in $(seq 1 $count); do
                    [ "$(get_container_relay_type $_bi)" = "bridge" ] && _any_bridge_running=true && break
                done
                if [ "$_any_bridge_running" = "true" ]; then
                    local cs_data=$(get_tor_clients_seen 1)
                    if [ -n "$cs_data" ]; then
                        # Write a temporary snap file from CLIENTS_SEEN
                        local _tmp_snap=""
                        IFS=',' read -ra _cs_entries <<< "$cs_data"
                        for _cse in "${_cs_entries[@]}"; do
                            local _cc=$(echo "$_cse" | cut -d= -f1)
                            local _cn=$(echo "$_cse" | cut -d= -f2)
                            [ -z "$_cc" ] || [ -z "$_cn" ] && continue
                            local _country
                            _country=$(country_code_to_name "$_cc")
                            _tmp_snap+="UP|${_country}|${_cn}|bridge\n"
                        done
                        [ -n "$_tmp_snap" ] && printf '%b' "$_tmp_snap" > "$snap_file"
                    fi
                fi
            fi

            if [ -s "$snap_file" ] || [ -s "$data_file" ]; then
                echo -e "${EL}"

                # Left: Active Circuits by Country
                local left_lines=()
                if [ -s "$snap_file" ] && [ "$total_circuits" -gt 0 ]; then
                    local snap_data
                    snap_data=$(awk -F'|' '{c[$2]+=$3} END{for(co in c) if(co!="") print c[co]"|"co}' "$snap_file" 2>/dev/null | sort -t'|' -k1 -nr | head -5)
                    local snap_total=0
                    if [ -n "$snap_data" ]; then
                        while IFS='|' read -r cnt co; do
                            snap_total=$((snap_total + cnt))
                        done <<< "$snap_data"
                    fi
                    [ "$snap_total" -eq 0 ] && snap_total=1
                    if [ -n "$snap_data" ]; then
                        while IFS='|' read -r cnt country; do
                            [ -z "$country" ] && continue
                            local pct=$((cnt * 100 / snap_total))
                            [ "$pct" -gt 100 ] && pct=100
                            local bl=$((pct / 20)); [ "$bl" -lt 1 ] && bl=1; [ "$bl" -gt 5 ] && bl=5
                            local bf=""; local bp=""; for ((bi=0; bi<bl; bi++)); do bf+="█"; done; for ((bi=bl; bi<5; bi++)); do bp+=" "; done
                            left_lines+=("$(printf "%-11.11s %3d%% \033[32m%s%s\033[0m %5s" "$country" "$pct" "$bf" "$bp" "$(format_number $cnt)")")
                        done <<< "$snap_data"
                    fi
                fi

                # Right: Top 5 Upload (cumulative)
                local right_lines=()
                if [ -s "$data_file" ]; then
                    local all_upload
                    all_upload=$(awk -F'|' '{if($1!="" && $3+0>0) print $3"|"$1}' "$data_file" 2>/dev/null | sort -t'|' -k1 -nr)
                    local top5_upload=$(echo "$all_upload" | head -5)
                    local total_upload=0
                    if [ -n "$all_upload" ]; then
                        while IFS='|' read -r bytes co; do
                            bytes=$(printf '%.0f' "${bytes:-0}" 2>/dev/null) || bytes=0
                            total_upload=$((total_upload + bytes))
                        done <<< "$all_upload"
                    fi
                    [ "$total_upload" -eq 0 ] && total_upload=1
                    if [ -n "$top5_upload" ]; then
                        while IFS='|' read -r bytes country; do
                            [ -z "$country" ] && continue
                            bytes=$(printf '%.0f' "${bytes:-0}" 2>/dev/null) || bytes=0
                            local pct=$((bytes * 100 / total_upload))
                            local bl=$((pct / 20)); [ "$bl" -lt 1 ] && bl=1; [ "$bl" -gt 5 ] && bl=5
                            local bf=""; local bp=""; for ((bi=0; bi<bl; bi++)); do bf+="█"; done; for ((bi=bl; bi<5; bi++)); do bp+=" "; done
                            local fmt_bytes=$(format_bytes $bytes)
                            right_lines+=("$(printf "%-11.11s %3d%% \033[35m%s%s\033[0m %9s" "$country" "$pct" "$bf" "$bp" "$fmt_bytes")")
                        done <<< "$top5_upload"
                    fi
                fi

                # Print side by side
                if [ ${#left_lines[@]} -gt 0 ] || [ ${#right_lines[@]} -gt 0 ]; then
                    # Use "CLIENTS" for bridges, "CIRCUITS" for relays
                    local _country_label="CIRCUITS BY COUNTRY"
                    local _any_b=false
                    for _li in $(seq 1 $count); do [ "$(get_container_relay_type $_li)" = "bridge" ] && _any_b=true; done
                    [ "$_any_b" = "true" ] && _country_label="CLIENTS BY COUNTRY"
                    printf "  ${GREEN}${BOLD}%-30s${NC} ${YELLOW}${BOLD}%s${NC}${EL}\n" "$_country_label" "TOP 5 UPLOAD (cumulative)"
                    local max_rows=${#left_lines[@]}
                    [ ${#right_lines[@]} -gt $max_rows ] && max_rows=${#right_lines[@]}
                    for ((ri=0; ri<max_rows; ri++)); do
                        local lc="${left_lines[$ri]:-}"
                        local rc="${right_lines[$ri]:-}"
                        if [ -n "$lc" ] && [ -n "$rc" ]; then
                            printf "  "
                            echo -ne "$lc"
                            printf "   "
                            echo -e "$rc${EL}"
                        elif [ -n "$lc" ]; then
                            printf "  "
                            echo -e "$lc${EL}"
                        elif [ -n "$rc" ]; then
                            printf "  %-30s " ""
                            echo -e "$rc${EL}"
                        fi
                    done
                fi
            fi

            echo -e "${EL}"
        elif [ "$SNOWFLAKE_ENABLED" = "true" ] && [ -f "$_tmpdir/sf_stats" ]; then
            # Snowflake-only mode (no relay containers)
            local _sf_only_t="$_cached_sf_stats"
            local _sf_only_in=$(echo "$_sf_only_t" | awk '{print $2}')
            local _sf_only_out=$(echo "$_sf_only_t" | awk '{print $3}')
            echo -e "${BOLD}Status:${NC} ${GREEN}Running (Snowflake only)${NC}${EL}"
            echo -e "${EL}"
            echo -e "${CYAN}═══ Traffic (total) ═══${NC}${EL}"
            echo -e "  Downloaded:   ${CYAN}$(format_bytes ${_sf_only_in:-0})${NC}${EL}"
            echo -e "  Uploaded:     ${CYAN}$(format_bytes ${_sf_only_out:-0})${NC}${EL}"
            echo -e "${EL}"
        else
            echo -e "${BOLD}Status:${NC} ${RED}Stopped${NC}${EL}"
            echo -e "  All container(s) are stopped.${EL}"
            echo -e "${EL}"
        fi

        # Snowflake stats (from parallel-fetched cache)
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            local _sf_label="Snowflake Proxy (WebRTC)"
            [ "${SNOWFLAKE_COUNT:-1}" -gt 1 ] && _sf_label="Snowflake Proxy (WebRTC) x${SNOWFLAKE_COUNT}"
            echo -e "${CYAN}═══ ${_sf_label} ═══${NC}${EL}"
            if [ -f "$_tmpdir/sf_stats" ]; then
                local sf_stats="$_cached_sf_stats"
                local sf_conns=$(echo "$sf_stats" | awk '{print $1}')
                local sf_in=$(echo "$sf_stats" | awk '{print $2}')
                local sf_out=$(echo "$sf_stats" | awk '{print $3}')
                echo -e "  Status: ${GREEN}Running${NC}  Connections: ${GREEN}${sf_conns:-0}${NC}  Traffic: ↓ $(format_bytes ${sf_in:-0})  ↑ $(format_bytes ${sf_out:-0})${EL}"

                # Snowflake country breakdown (top 5)
                local sf_countries=$(cat "$_tmpdir/sf_countries" 2>/dev/null | head -5)
                if [ -n "$sf_countries" ]; then
                    local sf_total=0
                    while IFS='|' read -r cnt co; do
                        sf_total=$((sf_total + cnt))
                    done <<< "$sf_countries"
                    [ "$sf_total" -eq 0 ] && sf_total=1
                    while IFS='|' read -r cnt country; do
                        [ -z "$country" ] && continue
                        local pct=$((cnt * 100 / sf_total))
                        local _sfname=$(country_code_to_name "$country")
                        printf "  %-14s %3d%%  %5s connections${EL}\n" "$_sfname" "$pct" "$cnt"
                    done <<< "$sf_countries"
                fi
            else
                echo -e "  Status: ${RED}Stopped${NC}${EL}"
            fi
            echo -e "${EL}"
        fi

        # Unbounded (Lantern) stats (from parallel-fetched cache)
        if [ "$UNBOUNDED_ENABLED" = "true" ]; then
            echo -e "${CYAN}═══ Unbounded Proxy (Lantern) ═══${NC}${EL}"
            if [ -f "$_tmpdir/ub_stats" ]; then
                local ub_stats="$_cached_ub_stats"
                local ub_live=$(echo "$ub_stats" | awk '{print $1}')
                local ub_total=$(echo "$ub_stats" | awk '{print $2}')
                echo -e "  Status: ${GREEN}Running${NC}  Live: ${GREEN}${ub_live:-0}${NC}  All-time: ${ub_total:-0}${EL}"
            else
                echo -e "  Status: ${RED}Stopped${NC}${EL}"
            fi
            echo -e "${EL}"
        fi

        # MTProxy stats (from parallel-fetched cache)
        if [ "$MTPROXY_ENABLED" = "true" ]; then
            echo -e "${CYAN}═══ MTProxy (Telegram) ═══${NC}${EL}"
            if [ -f "$_tmpdir/mtp_stats" ]; then
                local mtp_stats=$(cat "$_tmpdir/mtp_stats")
                local mtp_in=$(echo "$mtp_stats" | awk '{print $1}')
                local mtp_out=$(echo "$mtp_stats" | awk '{print $2}')
                echo -e "  Status: ${GREEN}Running${NC}  Traffic: ↓ $(format_bytes ${mtp_in:-0})  ↑ $(format_bytes ${mtp_out:-0})${EL}"
                echo -e "  Port: ${MTPROXY_PORT}  |  FakeTLS Domain: ${MTPROXY_DOMAIN}${EL}"
            else
                echo -e "  Status: ${RED}Stopped${NC}${EL}"
            fi
            echo -e "${EL}"
        fi

        # Per-container status (compact) — reuse parallel-fetched data
        if [ "$count" -gt 1 ]; then
            echo -e "${CYAN}═══ Per-Container ═══${NC}${EL}"
            for i in $(seq 1 $count); do
                local cname=$(get_container_name $i)
                local c_status="${RED}STOP${NC}"
                local c_info=""
                if [ -f "$_tmpdir/c_${i}" ]; then
                    read -r c_run c_rb c_wb c_circ c_conn c_start < "$_tmpdir/c_${i}"
                    if [ "${c_run:-0}" = "1" ]; then
                        c_status="${GREEN} UP ${NC}"
                        c_info="↓$(format_bytes ${c_rb:-0}) ↑$(format_bytes ${c_wb:-0}) C:${c_circ:-0}"
                    fi
                fi
                printf "  %-14s [${c_status}] %s${EL}\n" "$cname" "$c_info"
            done
            echo -e "${EL}"
        fi

        rm -rf "$_tmpdir"

        echo -e "${BOLD}Refreshes every 5 seconds. Press any key to return to menu...${NC}${EL}"

        # Clear leftover lines
        if ! tput ed 2>/dev/null; then
            printf "\033[J"
        fi

        # Wait 4s for keypress
        if read -t 4 -n 1 -s < /dev/tty 2>/dev/null; then
            stop_dashboard=1
        fi
    done

    _dashboard_cleanup
    trap - INT TERM RETURN
}

#═══════════════════════════════════════════════════════════════════════
# Advanced Stats (Phase 3)
#═══════════════════════════════════════════════════════════════════════

show_advanced_stats() {
    load_settings
    local stop_stats=0
    _stats_cleanup() {
        echo -ne "\033[?25h"
        tput rmcup 2>/dev/null || true
    }
    trap '_stats_cleanup; stop_stats=1' INT TERM
    trap '_stats_cleanup' RETURN

    tput smcup 2>/dev/null || true
    echo -ne "\033[?25l"
    clear

    while [ $stop_stats -eq 0 ]; do
        if ! tput cup 0 0 2>/dev/null; then
            printf "\033[H"
        fi

        local EL="\033[K"
        local count=${CONTAINER_COUNT:-1}

        local _bar="═══════════════════════════════════════════════════════════════════"
        echo -e "${CYAN}╔${_bar}╗${NC}${EL}"
        printf "${CYAN}║${NC}  🧅 %-62s${CYAN}║${NC}${EL}\n" "TORWARE ADVANCED STATISTICS"
        echo -e "${CYAN}╚${_bar}╝${NC}${EL}"
        echo -e "${EL}"

        # Per-container detailed stats
        echo -e "${CYAN}═══ Container Details ═══${NC}${EL}"
        printf "  ${BOLD}%-18s %-8s %-10s %-10s %-8s %-8s %-8s${NC}${EL}\n" "Name" "Status" "Download" "Upload" "Circuits" "Conns" "CPU"

        # Cache docker ps and docker stats once
        local _adv_running
        _adv_running=$(docker ps --format '{{.Names}}' 2>/dev/null)
        local docker_stats_out
        docker_stats_out=$(timeout 10 docker stats --no-stream --format "{{.Name}} {{.CPUPerc}} {{.MemUsage}}" 2>/dev/null)

        # Parallel ControlPort queries for all containers
        local _adv_tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/.tor_adv.$$.XXXXXX")
        for i in $(seq 1 $count); do
            (
                local cname=$(get_container_name $i)
                local port=$(get_container_controlport $i)
                if echo "$_adv_running" | grep -q "^${cname}$"; then
                    local result
                    result=$(controlport_query "$port" \
                        "GETINFO traffic/read" \
                        "GETINFO traffic/written" \
                        "GETINFO circuit-status" \
                        "GETINFO orconn-status" 2>/dev/null)
                    local rb=$(echo "$result" | sed -n 's/.*traffic\/read=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")
                    local wb=$(echo "$result" | sed -n 's/.*traffic\/written=\([0-9]*\).*/\1/p' | head -1 2>/dev/null || echo "0")
                    local circ=$(echo "$result" | grep -cE '^[0-9]+ (BUILT|EXTENDED|LAUNCHED)' 2>/dev/null || echo "0")
                    local conn=$(echo "$result" | grep -c '\$' 2>/dev/null || echo "0")
                    rb=${rb//[^0-9]/}; rb=${rb:-0}
                    wb=${wb//[^0-9]/}; wb=${wb:-0}
                    circ=${circ//[^0-9]/}; circ=${circ:-0}
                    conn=${conn//[^0-9]/}; conn=${conn:-0}
                    echo "1 $rb $wb $circ $conn" > "$_adv_tmpdir/c_${i}"
                else
                    echo "0 0 0 0 0" > "$_adv_tmpdir/c_${i}"
                fi
            ) &
        done
        # Snowflake + Unbounded stats in parallel too
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
                ( get_snowflake_instance_stats $_sfi > "$_adv_tmpdir/sf_${_sfi}" ) 2>/dev/null &
            done
            ( get_snowflake_country_stats > "$_adv_tmpdir/sf_countries" ) 2>/dev/null &
        fi
        if [ "$UNBOUNDED_ENABLED" = "true" ] && echo "$_adv_running" | grep -q "^${UNBOUNDED_CONTAINER}$"; then
            ( get_unbounded_stats > "$_adv_tmpdir/ub_stats" ) 2>/dev/null &
        fi
        wait

        for i in $(seq 1 $count); do
            local cname=$(get_container_name $i)
            local status="${RED}STOPPED${NC}"
            local dl="" ul="" circ="" conn="" cpu=""

            if [ -f "$_adv_tmpdir/c_${i}" ]; then
                read -r _arun _arb _awb _acirc _aconn < "$_adv_tmpdir/c_${i}"
                if [ "${_arun:-0}" = "1" ]; then
                    status="${GREEN}RUNNING${NC}"
                    dl=$(format_bytes ${_arb:-0})
                    ul=$(format_bytes ${_awb:-0})
                    circ=${_acirc:-0}
                    conn=${_aconn:-0}
                    cpu=$(echo "$docker_stats_out" | grep "^${cname} " | awk '{print $2}')
                fi
            fi
            printf "  %-18s %-20b %-10s %-10s %-8s %-8s %-8s${EL}\n" \
                "$cname" "$status" "${dl:-–}" "${ul:-–}" "${circ:-–}" "${conn:-–}" "${cpu:-–}"
        done

        # Snowflake rows (from cached parallel data)
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
                local _sf_cname=$(get_snowflake_name $_sfi)
                local sf_status="${RED}STOPPED${NC}"
                local sf_dl="" sf_ul="" sf_conns_adv="" sf_cpu=""
                if echo "$_adv_running" | grep -q "^${_sf_cname}$"; then
                    sf_status="${GREEN}RUNNING${NC}"
                    if [ -f "$_adv_tmpdir/sf_${_sfi}" ]; then
                        local sf_s=$(cat "$_adv_tmpdir/sf_${_sfi}")
                        sf_conns_adv=$(echo "$sf_s" | awk '{print $1}')
                        sf_dl=$(format_bytes $(echo "$sf_s" | awk '{print $2}'))
                        sf_ul=$(format_bytes $(echo "$sf_s" | awk '{print $3}'))
                    fi
                    sf_cpu=$(echo "$docker_stats_out" | grep "^${_sf_cname} " | awk '{print $2}')
                fi
                printf "  %-18s %-20b %-10s %-10s %-8s %-8s %-8s${EL}\n" \
                    "$_sf_cname" "$sf_status" "${sf_dl:-–}" "${sf_ul:-–}" "${sf_conns_adv:-–}" "–" "${sf_cpu:-–}"
            done
        fi

        # Unbounded row (from cached parallel data)
        if [ "$UNBOUNDED_ENABLED" = "true" ]; then
            local _ub_cname="$UNBOUNDED_CONTAINER"
            local ub_status="${RED}STOPPED${NC}"
            local ub_live_adv=0 ub_total_adv=0 ub_cpu=""
            if echo "$_adv_running" | grep -q "^${_ub_cname}$"; then
                ub_status="${GREEN}RUNNING${NC}"
                if [ -f "$_adv_tmpdir/ub_stats" ]; then
                    local ub_s=$(cat "$_adv_tmpdir/ub_stats")
                    ub_live_adv=$(echo "$ub_s" | awk '{print $1}')
                    ub_total_adv=$(echo "$ub_s" | awk '{print $2}')
                fi
                ub_cpu=$(echo "$docker_stats_out" | grep "^${_ub_cname} " | awk '{print $2}')
            fi
            printf "  %-18s %-20b %-10s %-10s %-8s %-8s %-8s${EL}\n" \
                "$_ub_cname" "$ub_status" "–" "–" "–" "${ub_live_adv:-0}" "${ub_cpu:-–}"
        fi

        # MTProxy row
        if [ "$MTPROXY_ENABLED" = "true" ]; then
            local _mtp_cname="$MTPROXY_CONTAINER"
            local mtp_status="${RED}STOPPED${NC}"
            local mtp_dl="" mtp_ul="" mtp_cpu=""
            if echo "$_adv_running" | grep -q "^${_mtp_cname}$"; then
                mtp_status="${GREEN}RUNNING${NC}"
                local mtp_stats=$(get_mtproxy_stats 2>/dev/null)
                local mtp_in=$(echo "$mtp_stats" | awk '{print $1}')
                local mtp_out=$(echo "$mtp_stats" | awk '{print $2}')
                mtp_dl=$(format_bytes ${mtp_in:-0})
                mtp_ul=$(format_bytes ${mtp_out:-0})
                mtp_cpu=$(echo "$docker_stats_out" | grep "^${_mtp_cname} " | awk '{print $2}')
            fi
            printf "  %-18s %-20b %-10s %-10s %-8s %-8s %-8s${EL}\n" \
                "$_mtp_cname" "$mtp_status" "${mtp_dl:-–}" "${mtp_ul:-–}" "–" "–" "${mtp_cpu:-–}"
        fi

        echo -e "${EL}"

        # Snowflake detailed stats (from cached parallel data)
        if [ "$SNOWFLAKE_ENABLED" = "true" ] && echo "$_adv_running" | grep -q "^snowflake-proxy$"; then
            echo -e "${CYAN}═══ Snowflake Proxy Details ═══${NC}${EL}"
            local _adv_sf_country
            _adv_sf_country=$(cat "$_adv_tmpdir/sf_countries" 2>/dev/null)
            if [ -n "$_adv_sf_country" ]; then
                local _adv_sf_total=0
                while IFS='|' read -r _asc _asco; do
                    _adv_sf_total=$((_adv_sf_total + _asc))
                done <<< "$_adv_sf_country"
                [ "$_adv_sf_total" -eq 0 ] && _adv_sf_total=1

                echo -e "  ${BOLD}Top 5 Countries by Connections${NC}${EL}"
                printf "  ${BOLD}%-20s %8s %6s   %-20s${NC}${EL}\n" "Country" "Conns" "Pct" "Activity"
                echo "$_adv_sf_country" | head -5 | while IFS='|' read -r _asc _asco; do
                    [ -z "$_asco" ] && continue
                    _asco=$(country_code_to_name "$_asco")
                    local _aspct=$((_asc * 100 / _adv_sf_total))
                    local _asbl=$((_aspct / 5)); [ "$_asbl" -lt 1 ] && _asbl=1; [ "$_asbl" -gt 20 ] && _asbl=20
                    local _asbf=""; for ((_asi=0; _asi<_asbl; _asi++)); do _asbf+="█"; done
                    printf "  %-20.20s %8s %5d%%   ${MAGENTA}%s${NC}${EL}\n" "$_asco" "$_asc" "$_aspct" "$_asbf"
                done
            fi
            echo -e "${EL}"
        fi

        # Country charts from tracker data
        local data_file="$STATS_DIR/cumulative_data"
        local ips_file="$STATS_DIR/cumulative_ips"

        if [ -s "$data_file" ]; then
            echo -e "${CYAN}═══ Top 5 Countries by Traffic (All-Time) ═══${NC}${EL}"
            # Combine upload+download per country, sort by total
            local _combined_traffic
            _combined_traffic=$(awk -F'|' '{if($1!="") { dl[$1]+=$2; ul[$1]+=$3 }} END { for(c in dl) printf "%d|%d|%s\n", dl[c]+ul[c], ul[c], c }' "$data_file" 2>/dev/null | sort -t'|' -k1 -nr)
            local top5_traffic=$(echo "$_combined_traffic" | head -5)
            local _total_traffic=0
            if [ -n "$_combined_traffic" ]; then
                while IFS='|' read -r tot rest; do
                    tot=$(printf '%.0f' "${tot:-0}" 2>/dev/null) || tot=0
                    _total_traffic=$((_total_traffic + tot))
                done <<< "$_combined_traffic"
            fi
            [ "$_total_traffic" -eq 0 ] && _total_traffic=1

            printf "  ${BOLD}%-14s %4s %-12s %10s %10s${NC}${EL}\n" "Country" "Pct" "" "Upload" "Download"
            if [ -n "$top5_traffic" ]; then
                while IFS='|' read -r total_bytes up_bytes country; do
                    [ -z "$country" ] && continue
                    total_bytes=$(printf '%.0f' "${total_bytes:-0}" 2>/dev/null) || total_bytes=0
                    up_bytes=$(printf '%.0f' "${up_bytes:-0}" 2>/dev/null) || up_bytes=0
                    local dl_bytes=$((total_bytes - up_bytes))
                    local pct=$((total_bytes * 100 / _total_traffic))
                    local bl=$((pct / 5)); [ "$bl" -lt 1 ] && bl=1; [ "$bl" -gt 12 ] && bl=12
                    local bf=""; for ((bi=0; bi<bl; bi++)); do bf+="█"; done
                    printf "  %-14.14s %3d%% ${MAGENTA}%-12s${NC} %10s %10s${EL}\n" "$country" "$pct" "$bf" "$(format_bytes $up_bytes)" "$(format_bytes $dl_bytes)"
                done <<< "$top5_traffic"
            fi
            echo -e "${EL}"
        fi

        if [ -s "$ips_file" ]; then
            local total_ips
            total_ips=$(wc -l < "$ips_file" 2>/dev/null || echo "0")
            local unique_countries
            unique_countries=$(awk -F'|' '{print $1}' "$ips_file" 2>/dev/null | sort -u | wc -l)
            echo -e "  ${BOLD}Lifetime:${NC} ${GREEN}${total_ips}${NC} unique IPs from ${GREEN}${unique_countries}${NC} countries${EL}"
            echo -e "${EL}"
        fi

        # Unbounded detailed stats
        if [ "$UNBOUNDED_ENABLED" = "true" ] && echo "$_adv_running" | grep -q "^${UNBOUNDED_CONTAINER}$"; then
            echo -e "${CYAN}═══ Unbounded Proxy (Lantern) ═══${NC}${EL}"
            if [ -f "$_adv_tmpdir/ub_stats" ]; then
                local _ub_detail=$(cat "$_adv_tmpdir/ub_stats")
                local _ub_live=$(echo "$_ub_detail" | awk '{print $1}')
                local _ub_alltime=$(echo "$_ub_detail" | awk '{print $2}')
                echo -e "  Live connections: ${GREEN}${_ub_live:-0}${NC}  |  All-time served: ${_ub_alltime:-0}${EL}"
            fi
            echo -e "${EL}"
        fi

        # MTProxy detailed stats
        if [ "$MTPROXY_ENABLED" = "true" ] && is_mtproxy_running; then
            echo -e "${CYAN}═══ MTProxy (Telegram) ═══${NC}${EL}"
            local _mtp_detail=$(get_mtproxy_stats 2>/dev/null)
            local _mtp_in=$(echo "$_mtp_detail" | awk '{print $1}')
            local _mtp_out=$(echo "$_mtp_detail" | awk '{print $2}')
            echo -e "  Traffic: ↓ $(format_bytes ${_mtp_in:-0})  ↑ $(format_bytes ${_mtp_out:-0})${EL}"
            echo -e "  Port: ${CYAN}${MTPROXY_PORT}${NC}  |  FakeTLS Domain: ${CYAN}${MTPROXY_DOMAIN}${NC}${EL}"
            echo -e "${EL}"
        fi

        rm -rf "$_adv_tmpdir"

        echo -e "${BOLD}Refreshes every 15 seconds. Press any key to return...${NC}${EL}"

        if ! tput ed 2>/dev/null; then
            printf "\033[J"
        fi

        if read -t 14 -n 1 -s < /dev/tty 2>/dev/null; then
            stop_stats=1
        fi
    done

    _stats_cleanup
    trap - INT TERM RETURN
}

#═══════════════════════════════════════════════════════════════════════
# Live Peers by Country (Phase 3)
#═══════════════════════════════════════════════════════════════════════

show_peers() {
    load_settings
    local stop_peers=0
    _peers_cleanup() {
        echo -ne "\033[?25h"
        tput rmcup 2>/dev/null || true
    }
    trap '_peers_cleanup; stop_peers=1' INT TERM
    trap '_peers_cleanup' RETURN

    tput smcup 2>/dev/null || true
    echo -ne "\033[?25l"
    clear

    while [ $stop_peers -eq 0 ]; do
        if ! tput cup 0 0 2>/dev/null; then
            printf "\033[H"
        fi

        local EL="\033[K"
        local _bar="═══════════════════════════════════════════════════════════════════"
        echo -e "${CYAN}╔${_bar}╗${NC}${EL}"
        printf "${CYAN}║${NC}  🧅 %-62s${CYAN}║${NC}${EL}\n" "LIVE CONNECTIONS BY COUNTRY"
        echo -e "${CYAN}╚${_bar}╝${NC}${EL}"
        echo -e "${EL}"

        local count=${CONTAINER_COUNT:-1}
        local snap_file="$STATS_DIR/tracker_snapshot"

        # If no tracker snapshot, try direct ControlPort query as fallback
        if [ ! -s "$snap_file" ]; then
            local _fb_lines=""
            for _pi in $(seq 1 $count); do
                local _pport=$(get_container_controlport $_pi)
                local _prtype=$(get_container_relay_type $_pi)
                if [ "$_prtype" = "bridge" ]; then
                    local _cs=$(controlport_query "$_pport" "GETINFO status/clients-seen" 2>/dev/null)
                    local _csdata=$(echo "$_cs" | sed -n 's/.*CountrySummary=\([^ \r]*\).*/\1/p' | head -1 2>/dev/null)
                    if [ -n "$_csdata" ]; then
                        IFS=',' read -ra _cse <<< "$_csdata"
                        for _ce in "${_cse[@]}"; do
                            local _cc=$(echo "$_ce" | cut -d= -f1)
                            local _cn=$(echo "$_ce" | cut -d= -f2)
                            [ -z "$_cc" ] || [ -z "$_cn" ] && continue
                            _fb_lines+="UP|$(country_code_to_name "$_cc")|${_cn}|bridge\n"
                        done
                    fi
                else
                    local _oc=$(controlport_query "$_pport" "GETINFO orconn-status" 2>/dev/null)
                    local _ips=$(echo "$_oc" | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' 2>/dev/null | sort -u)
                    if [ -n "$_ips" ]; then
                        while read -r _ip; do
                            [ -z "$_ip" ] && continue
                            local _geo=$(tor_geo_lookup "$_ip" 2>/dev/null)
                            _fb_lines+="UP|${_geo:-Unknown}|1|${_ip}\n"
                        done <<< "$_ips"
                    fi
                fi
            done
            if [ -n "$_fb_lines" ]; then
                printf '%b' "$_fb_lines" > "$snap_file.tmp.$$"
                mv "$snap_file.tmp.$$" "$snap_file"
            fi
        fi

        if [ -s "$snap_file" ]; then
            local snap_data
            snap_data=$(awk -F'|' '{c[$2]+=$3} END{for(co in c) if(co!="") print c[co]"|"co}' "$snap_file" 2>/dev/null | sort -t'|' -k1 -nr)

            if [ -n "$snap_data" ]; then
                local total=0
                while IFS='|' read -r cnt co; do
                    total=$((total + cnt))
                done <<< "$snap_data"
                [ "$total" -eq 0 ] && total=1

                # Limit to top 5-10 countries based on terminal size
                local _term_rows=$(tput lines 2>/dev/null || echo 24)
                local _max_countries=$((_term_rows - 27))
                [ "$_max_countries" -lt 5 ] && _max_countries=5
                [ "$_max_countries" -gt 10 ] && _max_countries=10

                printf "  ${BOLD}%-20s %6s %8s   %-30s${NC}${EL}\n" "Country" "Traffic" "Pct" "Activity"

                local _country_count=0
                while IFS='|' read -r cnt country; do
                    [ -z "$country" ] && continue
                    _country_count=$((_country_count + 1))
                    [ "$_country_count" -gt "$_max_countries" ] && break
                    local pct=$((cnt * 100 / total))
                    local bl=$((pct / 5)); [ "$bl" -lt 1 ] && bl=1; [ "$bl" -gt 20 ] && bl=20
                    local bf=""; for ((bi=0; bi<bl; bi++)); do bf+="█"; done
                    printf "  %-20.20s %6s %7d%%   ${GREEN}%s${NC}${EL}\n" "$country" "$(format_bytes $cnt)" "$pct" "$bf"
                done <<< "$snap_data"
                local _total_countries=$(echo "$snap_data" | wc -l)
                if [ "$_total_countries" -gt "$_max_countries" ]; then
                    echo -e "  ${DIM}... and $((_total_countries - _max_countries)) more countries${NC}${EL}"
                fi
            else
                echo -e "  ${DIM}No circuit or client data available yet.${NC}${EL}"
            fi
        else
            echo -e "  ${DIM}No connections yet. Bridge may still be bootstrapping.${NC}${EL}"
            echo -e "  ${DIM}New bridges can take hours to receive clients from Tor's distributor.${NC}${EL}"
        fi

        # Snowflake section (parallel fetch)
        local _peers_running
        _peers_running=$(docker ps --format '{{.Names}}' 2>/dev/null)
        local _peers_tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/.tor_peers.$$.XXXXXX")
        if [ "$SNOWFLAKE_ENABLED" = "true" ] && echo "$_peers_running" | grep -q "^snowflake-proxy$"; then
            ( get_snowflake_country_stats > "$_peers_tmpdir/sf_countries" ) 2>/dev/null &
            ( get_snowflake_stats > "$_peers_tmpdir/sf_stats" ) 2>/dev/null &
            wait
            echo -e "${EL}"
            local _sf_label2="Snowflake Proxy (WebRTC)"
            [ "${SNOWFLAKE_COUNT:-1}" -gt 1 ] && _sf_label2="Snowflake Proxy (WebRTC) x${SNOWFLAKE_COUNT}"
            echo -e "${CYAN}═══ ${_sf_label2} ═══${NC}${EL}"
            local _sf_country=$(cat "$_peers_tmpdir/sf_countries" 2>/dev/null)
            local _sf_stats=$(cat "$_peers_tmpdir/sf_stats" 2>/dev/null)
            local _sf_conns=$(echo "$_sf_stats" | awk '{print $1}')
            local _sf_in=$(echo "$_sf_stats" | awk '{print $2}')
            local _sf_out=$(echo "$_sf_stats" | awk '{print $3}')
            echo -e "  Total connections: ${GREEN}${_sf_conns:-0}${NC}  Traffic: ↓ $(format_bytes ${_sf_in:-0})  ↑ $(format_bytes ${_sf_out:-0})${EL}"

            if [ -n "$_sf_country" ]; then
                local _sf_total=0
                while IFS='|' read -r _sc _sco; do
                    _sf_total=$((_sf_total + _sc))
                done <<< "$_sf_country"
                [ "$_sf_total" -eq 0 ] && _sf_total=1
                echo -e "${EL}"
                printf "  ${BOLD}%-20s %6s %8s   %-30s${NC}${EL}\n" "Country" "Conns" "Pct" "Activity"
                echo "$_sf_country" | head -5 | while IFS='|' read -r _scnt _scountry; do
                    [ -z "$_scountry" ] && continue
                    _scountry=$(country_code_to_name "$_scountry")
                    local _spct=$((_scnt * 100 / _sf_total))
                    local _sbl=$((_spct / 5)); [ "$_sbl" -lt 1 ] && _sbl=1; [ "$_sbl" -gt 20 ] && _sbl=20
                    local _sbf=""; for ((_si=0; _si<_sbl; _si++)); do _sbf+="█"; done
                    printf "  %-20.20s %6s %7d%%   ${MAGENTA}%s${NC}${EL}\n" "$_scountry" "$_scnt" "$_spct" "$_sbf"
                done
            else
                echo -e "  ${DIM}No Snowflake clients yet. Waiting for broker to assign connections...${NC}${EL}"
            fi
        fi
        rm -rf "$_peers_tmpdir" 2>/dev/null

        echo -e "${EL}"
        echo -e "${BOLD}Refreshes every 15 seconds. Press any key to return...${NC}${EL}"

        if ! tput ed 2>/dev/null; then
            printf "\033[J"
        fi

        if read -t 14 -n 1 -s < /dev/tty 2>/dev/null; then
            stop_peers=1
        fi
    done

    _peers_cleanup
    trap - INT TERM RETURN
}

#═══════════════════════════════════════════════════════════════════════
# Background Tracker Service (Phase 3)
#═══════════════════════════════════════════════════════════════════════

is_tracker_active() {
    if command -v systemctl &>/dev/null; then
        systemctl is-active torware-tracker.service &>/dev/null
        return $?
    fi
    pgrep -f "torware-tracker.sh" &>/dev/null
}

geo_lookup() {
    local ip="$1"
    local cache_file="$STATS_DIR/geoip_cache"

    # Check cache
    if [ -f "$cache_file" ]; then
        local cached
        local escaped_ip="${ip//./\\.}"
        cached=$(grep "^${escaped_ip}|" "$cache_file" 2>/dev/null | head -1 | cut -d'|' -f2)
        if [ -n "$cached" ]; then
            echo "$cached"
            return
        fi
    fi

    # Try Tor's built-in GeoIP via ControlPort
    local country=""
    local port=$(get_container_controlport 1)
    local result
    result=$(controlport_query "$port" "GETINFO ip-to-country/$ip" 2>/dev/null)
    local code
    code=$(echo "$result" | sed -n "s/.*ip-to-country\/$ip=\([a-z]*\).*/\1/p" | head -1 2>/dev/null)

    if [ -n "$code" ] && [ "$code" != "??" ]; then
        country=$(country_code_to_name "$code")
    fi

    # Fallback to system GeoIP
    if [ -z "$country" ]; then
        if command -v geoiplookup &>/dev/null; then
            country=$(geoiplookup "$ip" 2>/dev/null | awk -F: '/Country Edition/{gsub(/^ +/,"",$2); print $2}' | head -1)
            country=$(echo "$country" | sed 's/,.*//')
        elif command -v mmdblookup &>/dev/null; then
            local db=""
            [ -f /usr/share/GeoIP/GeoLite2-Country.mmdb ] && db="/usr/share/GeoIP/GeoLite2-Country.mmdb"
            [ -f /var/lib/GeoIP/GeoLite2-Country.mmdb ] && db="/var/lib/GeoIP/GeoLite2-Country.mmdb"
            if [ -n "$db" ]; then
                country=$(mmdblookup --file "$db" --ip "$ip" country names en 2>/dev/null | grep '"' | sed 's/.*"\(.*\)".*/\1/')
            fi
        fi
    fi

    [ -z "$country" ] && country="Unknown"
    # Sanitize country name (strip pipe, newlines, control chars)
    country=$(printf '%s' "$country" | tr -d '|\n\r' | tr -cd '[:print:]' | head -c 50)
    [ -z "$country" ] && country="Unknown"

    # Cache it
    if [ -n "$cache_file" ]; then
        mkdir -p "$(dirname "$cache_file")"
        [ ! -f "$cache_file" ] && ( umask 077; touch "$cache_file" )
        echo "${ip}|${country}" >> "$cache_file"
        # Trim cache if too large
        local cache_lines
        cache_lines=$(wc -l < "$cache_file" 2>/dev/null || echo "0")
        if [ "$cache_lines" -gt 10000 ]; then
            tail -5000 "$cache_file" > "${cache_file}.tmp"
            mv "${cache_file}.tmp" "$cache_file"
        fi
    fi

    echo "$country"
}

regenerate_tracker_script() {
    mkdir -p "$STATS_DIR"

    cat > "$INSTALL_DIR/torware-tracker.sh" << 'TRACKER_EOF'
#!/bin/bash
# Torware Tracker - Background ControlPort Monitor
# Generated by torware.sh

if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ] || { [ "${BASH_VERSINFO[0]:-0}" -eq 4 ] && [ "${BASH_VERSINFO[1]:-0}" -lt 2 ]; }; then
    echo "Error: torware-tracker requires bash 4.2+ (for associative arrays)" >&2
    exit 1
fi

INSTALL_DIR="REPLACE_INSTALL_DIR"
STATS_DIR="$INSTALL_DIR/relay_stats"
CONTROLPORT_BASE=REPLACE_CONTROLPORT_BASE
CONTAINER_COUNT=REPLACE_CONTAINER_COUNT

mkdir -p "$STATS_DIR"

# Source settings (with whitelist validation)
if [ -f "$INSTALL_DIR/settings.conf" ]; then
    if ! grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$INSTALL_DIR/settings.conf" 2>/dev/null | grep -q .; then
        source "$INSTALL_DIR/settings.conf"
    fi
fi

get_nc_cmd() {
    if command -v ncat &>/dev/null; then echo "ncat"
    elif command -v nc &>/dev/null; then echo "nc"
    else echo ""; fi
}

get_control_cookie() {
    local idx=$1
    local vol="relay-data-${idx}"
    local cache_file="${TMPDIR:-/tmp}/.tor_cookie_cache_${idx}"
    [ -L "$cache_file" ] && rm -f "$cache_file"
    if [ -f "$cache_file" ]; then
        local mtime
        mtime=$(stat -c %Y "$cache_file" 2>/dev/null || stat -f %m "$cache_file" 2>/dev/null || echo 0)
        local age=$(( $(date +%s) - mtime ))
        if [ "$age" -lt 60 ] && [ "$age" -ge 0 ]; then cat "$cache_file"; return; fi
    fi
    local cookie
    cookie=$(docker run --rm -v "${vol}:/data:ro" alpine \
        sh -c 'od -A n -t x1 /data/control_auth_cookie 2>/dev/null | tr -d " \n"' 2>/dev/null)
    if [ -n "$cookie" ]; then
        ( umask 077; echo "$cookie" > "$cache_file" )
    fi
    echo "$cookie"
}

controlport_query() {
    local port=$1; shift
    local nc_cmd=$(get_nc_cmd)
    [ -z "$nc_cmd" ] && return 1
    local idx=$((port - CONTROLPORT_BASE + 1))
    local cookie=$(get_control_cookie $idx)
    [ -z "$cookie" ] && return 1
    {
        printf 'AUTHENTICATE %s\r\n' "$cookie"
        for cmd in "$@"; do printf "%s\r\n" "$cmd"; done
        printf "QUIT\r\n"
    } | timeout 5 "$nc_cmd" 127.0.0.1 "$port" 2>/dev/null | tr -d '\r'
}

country_code_to_name() {
    local cc="$1"
    case "$cc" in
        # Americas (18)
        us) echo "United States" ;; ca) echo "Canada" ;; mx) echo "Mexico" ;;
        br) echo "Brazil" ;; ar) echo "Argentina" ;; co) echo "Colombia" ;;
        cl) echo "Chile" ;; pe) echo "Peru" ;; ve) echo "Venezuela" ;;
        ec) echo "Ecuador" ;; bo) echo "Bolivia" ;; py) echo "Paraguay" ;;
        uy) echo "Uruguay" ;; cu) echo "Cuba" ;; cr) echo "Costa Rica" ;;
        pa) echo "Panama" ;; do) echo "Dominican Rep." ;; gt) echo "Guatemala" ;;
        # Europe West (16)
        gb|uk) echo "United Kingdom" ;; de) echo "Germany" ;; fr) echo "France" ;;
        nl) echo "Netherlands" ;; be) echo "Belgium" ;; at) echo "Austria" ;;
        ch) echo "Switzerland" ;; ie) echo "Ireland" ;; lu) echo "Luxembourg" ;;
        es) echo "Spain" ;; pt) echo "Portugal" ;; it) echo "Italy" ;;
        gr) echo "Greece" ;; mt) echo "Malta" ;; cy) echo "Cyprus" ;;
        is) echo "Iceland" ;;
        # Europe North (7)
        se) echo "Sweden" ;; no) echo "Norway" ;; fi) echo "Finland" ;;
        dk) echo "Denmark" ;; ee) echo "Estonia" ;; lv) echo "Latvia" ;;
        lt) echo "Lithuania" ;;
        # Europe East (16)
        pl) echo "Poland" ;; cz) echo "Czech Rep." ;; sk) echo "Slovakia" ;;
        hu) echo "Hungary" ;; ro) echo "Romania" ;; bg) echo "Bulgaria" ;;
        hr) echo "Croatia" ;; rs) echo "Serbia" ;; si) echo "Slovenia" ;;
        ba) echo "Bosnia" ;; mk) echo "N. Macedonia" ;; al) echo "Albania" ;;
        me) echo "Montenegro" ;; ua) echo "Ukraine" ;; md) echo "Moldova" ;;
        by) echo "Belarus" ;;
        # Russia & Central Asia (6)
        ru) echo "Russia" ;; kz) echo "Kazakhstan" ;; uz) echo "Uzbekistan" ;;
        tm) echo "Turkmenistan" ;; kg) echo "Kyrgyzstan" ;; tj) echo "Tajikistan" ;;
        # Middle East (10)
        tr) echo "Turkey" ;; il) echo "Israel" ;; sa) echo "Saudi Arabia" ;;
        ae) echo "UAE" ;; ir) echo "Iran" ;; iq) echo "Iraq" ;;
        sy) echo "Syria" ;; jo) echo "Jordan" ;; lb) echo "Lebanon" ;;
        qa) echo "Qatar" ;;
        # Africa (12)
        za) echo "South Africa" ;; ng) echo "Nigeria" ;; ke) echo "Kenya" ;;
        eg) echo "Egypt" ;; ma) echo "Morocco" ;; tn) echo "Tunisia" ;;
        gh) echo "Ghana" ;; et) echo "Ethiopia" ;; tz) echo "Tanzania" ;;
        ug) echo "Uganda" ;; dz) echo "Algeria" ;; ly) echo "Libya" ;;
        # Asia East (8)
        cn) echo "China" ;; jp) echo "Japan" ;; kr) echo "South Korea" ;;
        tw) echo "Taiwan" ;; hk) echo "Hong Kong" ;; mn) echo "Mongolia" ;;
        kp) echo "North Korea" ;; mo) echo "Macau" ;;
        # Asia South & Southeast (14)
        in) echo "India" ;; pk) echo "Pakistan" ;; bd) echo "Bangladesh" ;;
        np) echo "Nepal" ;; lk) echo "Sri Lanka" ;; mm) echo "Myanmar" ;;
        th) echo "Thailand" ;; vn) echo "Vietnam" ;; ph) echo "Philippines" ;;
        id) echo "Indonesia" ;; my) echo "Malaysia" ;; sg) echo "Singapore" ;;
        kh) echo "Cambodia" ;; la) echo "Laos" ;;
        # Oceania & Caucasus (6)
        au) echo "Australia" ;; nz) echo "New Zealand" ;; ge) echo "Georgia" ;;
        am) echo "Armenia" ;; az) echo "Azerbaijan" ;; bh) echo "Bahrain" ;;
        mu) echo "Mauritius" ;; zm) echo "Zambia" ;; sd) echo "Sudan" ;;
        zw) echo "Zimbabwe" ;; mz) echo "Mozambique" ;; cm) echo "Cameroon" ;;
        ci) echo "Ivory Coast" ;; sn) echo "Senegal" ;; cd) echo "DR Congo" ;;
        ao) echo "Angola" ;; om) echo "Oman" ;; kw) echo "Kuwait" ;;
        '??') echo "Unknown" ;;
        *) echo "$cc" | tr '[:lower:]' '[:upper:]' ;;
    esac
}

# GeoIP lookup (simple version for tracker)
geo_lookup() {
    local ip="$1"
    local cache_file="$STATS_DIR/geoip_cache"
    if [ -f "$cache_file" ]; then
        local escaped_ip=$(printf '%s' "$ip" | sed 's/[.]/\\./g')
        local cached=$(grep "^${escaped_ip}|" "$cache_file" 2>/dev/null | head -1 | cut -d'|' -f2)
        [ -n "$cached" ] && echo "$cached" && return
    fi

    local port=$((CONTROLPORT_BASE))
    local result=$(controlport_query "$port" "GETINFO ip-to-country/$ip" 2>/dev/null)
    local sed_safe_ip=$(printf '%s' "$ip" | sed 's/[.]/\\./g; s/[/]/\\//g')
    local code=$(echo "$result" | sed -n "s/.*ip-to-country\/${sed_safe_ip}=\([a-z]*\).*/\1/p" | head -1 2>/dev/null)
    local country=""

    if [ -n "$code" ] && [ "$code" != "??" ]; then
        country=$(country_code_to_name "$code")
    fi

    if [ -z "$country" ] && command -v geoiplookup &>/dev/null; then
        country=$(geoiplookup "$ip" 2>/dev/null | awk -F: '/Country Edition/{gsub(/^ +/,"",$2); print $2}' | head -1 | sed 's/,.*//')
    fi

    [ -z "$country" ] && country="Unknown"

    mkdir -p "$(dirname "$cache_file")"
    [ ! -f "$cache_file" ] && ( umask 077; touch "$cache_file" )
    echo "${ip}|${country}" >> "$cache_file"
    cl=$(wc -l < "$cache_file" 2>/dev/null || echo "0")
    [ "$cl" -gt 10000 ] && { tail -5000 "$cache_file" > "${cache_file}.tmp"; mv "${cache_file}.tmp" "$cache_file"; }

    echo "$country"
}

# Track previous traffic totals per container for delta calculation
declare -A prev_read prev_written

# Determine relay type for each container
get_relay_type_for() {
    local idx=$1
    local var="RELAY_TYPE_${idx}"
    local val="${!var}"
    if [ -n "$val" ]; then echo "$val"; else echo "${RELAY_TYPE:-bridge}"; fi
}

# Main tracker loop
while true; do
    # Reload settings safely
    if [ -f "$INSTALL_DIR/settings.conf" ]; then
        if ! grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$INSTALL_DIR/settings.conf" 2>/dev/null | grep -q .; then
            source "$INSTALL_DIR/settings.conf"
        fi
    fi

    # Collect data from all containers (unset first to clear stale keys)
    unset country_up country_down 2>/dev/null
    declare -A country_up country_down
    snap_lines=""

    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        port=$((CONTROLPORT_BASE + i - 1))
        cname="torware"
        [ "$i" -gt 1 ] && cname="torware-${i}"

        # Check if running
        docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$" || continue

        rtype=$(get_relay_type_for $i)

        if [ "$rtype" = "bridge" ]; then
            # --- BRIDGE: Use Tor's native CLIENTS_SEEN for country data ---
            # This is Tor's built-in GeoIP-resolved per-country client count
            clients_seen=$(controlport_query "$port" "GETINFO status/clients-seen" 2>/dev/null)
            country_summary=$(echo "$clients_seen" | sed -n 's/.*CountrySummary=\([^ \r]*\).*/\1/p' | head -1 2>/dev/null)

            if [ -n "$country_summary" ]; then
                # Parse cc=num,cc=num,...
                IFS=',' read -ra cc_entries <<< "$country_summary"
                for entry in "${cc_entries[@]}"; do
                    cc=$(echo "$entry" | cut -d= -f1)
                    num=$(echo "$entry" | cut -d= -f2)
                    [ -z "$cc" ] || [ -z "$num" ] && continue
                    country=$(country_code_to_name "$cc")
                    snap_lines+="UP|${country}|${num}|bridge\n"
                done
            fi
        else
            # --- RELAY: Use orconn-status to get peer relay IPs, then GeoIP ---
            orconn=$(controlport_query "$port" "GETINFO orconn-status" 2>/dev/null)
            ips=$(echo "$orconn" | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' 2>/dev/null | awk -F. '{if($1<=255 && $2<=255 && $3<=255 && $4<=255) print}' | sort -u)

            # Resolve all IPs once and cache country per IP for reuse in traffic distribution
            unset _ip_country 2>/dev/null
            declare -A _ip_country
            if [ -n "$ips" ]; then
                while read -r ip; do
                    [ -z "$ip" ] && continue
                    country=$(geo_lookup "$ip")
                    _ip_country["$ip"]="$country"
                    snap_lines+="UP|${country}|1|${ip}\n"

                    if ! grep -qF "${country}|${ip}" "$STATS_DIR/cumulative_ips" 2>/dev/null; then
                        echo "${country}|${ip}" >> "$STATS_DIR/cumulative_ips"
                        # Cap cumulative_ips at 50000 lines
                        ip_lines=$(wc -l < "$STATS_DIR/cumulative_ips" 2>/dev/null || echo 0)
                        if [ "$ip_lines" -gt 50000 ]; then
                            tail -25000 "$STATS_DIR/cumulative_ips" > "$STATS_DIR/cumulative_ips.tmp"
                            mv "$STATS_DIR/cumulative_ips.tmp" "$STATS_DIR/cumulative_ips"
                        fi
                    fi
                done <<< "$ips"
            fi
        fi

        # Get traffic totals and compute deltas (works for all relay types)
        traffic=$(controlport_query "$port" "GETINFO traffic/read" "GETINFO traffic/written" 2>/dev/null)
        rb=$(echo "$traffic" | sed -n 's/.*traffic\/read=\([0-9]*\).*/\1/p' | head -1)
        wb=$(echo "$traffic" | sed -n 's/.*traffic\/written=\([0-9]*\).*/\1/p' | head -1)
        [ -z "$rb" ] && rb=0
        [ -z "$wb" ] && wb=0

        # Compute deltas from previous reading (fixes double-counting)
        p_rb=${prev_read[$i]:-0}
        p_wb=${prev_written[$i]:-0}
        delta_rb=$((rb - p_rb))
        delta_wb=$((wb - p_wb))
        # Handle container restart (counter reset)
        [ "$delta_rb" -lt 0 ] && delta_rb=$rb
        [ "$delta_wb" -lt 0 ] && delta_wb=$wb
        prev_read[$i]=$rb
        prev_written[$i]=$wb

        if [ "$rtype" = "bridge" ]; then
            # For bridges, distribute traffic evenly across seen countries
            if [ -n "$country_summary" ]; then
                total_clients=0
                IFS=',' read -ra cc_entries <<< "$country_summary"
                for entry in "${cc_entries[@]}"; do
                    num=$(echo "$entry" | cut -d= -f2)
                    total_clients=$((total_clients + ${num:-0}))
                done
                [ "$total_clients" -eq 0 ] && total_clients=1
                for entry in "${cc_entries[@]}"; do
                    cc=$(echo "$entry" | cut -d= -f1)
                    num=$(echo "$entry" | cut -d= -f2)
                    [ -z "$cc" ] || [ -z "$num" ] && continue
                    country=$(country_code_to_name "$cc")
                    frac_up=$((delta_wb * num / total_clients))
                    frac_down=$((delta_rb * num / total_clients))
                    country_up["$country"]=$(( ${country_up["$country"]:-0} + frac_up ))
                    country_down["$country"]=$(( ${country_down["$country"]:-0} + frac_down ))
                done
            fi
        else
            # For relays, distribute delta traffic using cached country lookups (no repeat geo_lookup)
            ip_count=${#_ip_country[@]}
            [ "$ip_count" -eq 0 ] && ip_count=1
            per_ip_up=$((delta_wb / ip_count))
            per_ip_down=$((delta_rb / ip_count))

            for ip in "${!_ip_country[@]}"; do
                country="${_ip_country[$ip]}"
                country_up["$country"]=$(( ${country_up["$country"]:-0} + per_ip_up ))
                country_down["$country"]=$(( ${country_down["$country"]:-0} + per_ip_down ))
            done
            unset _ip_country
        fi
    done

    # Write tracker snapshot atomically (last 15s window)
    if [ -n "$snap_lines" ]; then
        printf '%b' "$snap_lines" > "$STATS_DIR/tracker_snapshot.tmp.$$"
        mv "$STATS_DIR/tracker_snapshot.tmp.$$" "$STATS_DIR/tracker_snapshot"
    fi

    # Merge into cumulative_data (country|from_bytes|to_bytes)
    if [ ${#country_up[@]} -gt 0 ] || [ ${#country_down[@]} -gt 0 ]; then
        tmp_cum="$STATS_DIR/cumulative_data.tmp.$$"

        unset cum_down cum_up 2>/dev/null
        declare -A cum_down cum_up
        if [ -f "$STATS_DIR/cumulative_data" ]; then
            while IFS='|' read -r co dl ul; do
                [ -z "$co" ] && continue
                cum_down["$co"]=$((${cum_down["$co"]:-0} + ${dl:-0}))
                cum_up["$co"]=$((${cum_up["$co"]:-0} + ${ul:-0}))
            done < "$STATS_DIR/cumulative_data"
        fi

        for co in "${!country_down[@]}"; do
            cum_down["$co"]=$((${cum_down["$co"]:-0} + ${country_down["$co"]:-0}))
        done
        for co in "${!country_up[@]}"; do
            cum_up["$co"]=$((${cum_up["$co"]:-0} + ${country_up["$co"]:-0}))
        done

        > "$tmp_cum"
        for co in $(echo "${!cum_down[@]} ${!cum_up[@]}" | tr ' ' '\n' | sort -u); do
            echo "${co}|${cum_down["$co"]:-0}|${cum_up["$co"]:-0}" >> "$tmp_cum"
        done
        mv "$tmp_cum" "$STATS_DIR/cumulative_data"

        unset cum_down cum_up
    fi

    unset country_up country_down

    # Uptime tracking
    running=0
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        cname="torware"
        [ "$i" -gt 1 ] && cname="torware-${i}"
        docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$" && running=$((running + 1))
    done
    echo "$(date +%s)|${running}" >> "$STATS_DIR/uptime_log"

    # Rotate uptime log: trim at 10080 entries (~7 days at 15s intervals), keep 7200 (~5 days)
    ul_lines=$(wc -l < "$STATS_DIR/uptime_log" 2>/dev/null || echo "0")
    if [ "$ul_lines" -gt 10080 ]; then
        tail -7200 "$STATS_DIR/uptime_log" > "$STATS_DIR/uptime_log.tmp"
        mv "$STATS_DIR/uptime_log.tmp" "$STATS_DIR/uptime_log"
    fi

    sleep 15
done
TRACKER_EOF

    # Replace placeholders (portable sed without -i)
    # Escape & and \ for sed replacement; use # as delimiter (safe for paths)
    local escaped_dir=$(printf '%s\n' "$INSTALL_DIR" | sed 's/[&\\]/\\&/g')
    sed "s#REPLACE_INSTALL_DIR#${escaped_dir}#g" "$INSTALL_DIR/torware-tracker.sh" > "$INSTALL_DIR/torware-tracker.sh.tmp" && mv "$INSTALL_DIR/torware-tracker.sh.tmp" "$INSTALL_DIR/torware-tracker.sh"
    sed "s#REPLACE_CONTROLPORT_BASE#$CONTROLPORT_BASE#g" "$INSTALL_DIR/torware-tracker.sh" > "$INSTALL_DIR/torware-tracker.sh.tmp" && mv "$INSTALL_DIR/torware-tracker.sh.tmp" "$INSTALL_DIR/torware-tracker.sh"
    sed "s#REPLACE_CONTAINER_COUNT#${CONTAINER_COUNT:-1}#g" "$INSTALL_DIR/torware-tracker.sh" > "$INSTALL_DIR/torware-tracker.sh.tmp" && mv "$INSTALL_DIR/torware-tracker.sh.tmp" "$INSTALL_DIR/torware-tracker.sh"

    chmod +x "$INSTALL_DIR/torware-tracker.sh"
}

setup_tracker_service() {
    regenerate_tracker_script

    # Detect systemd if not already set
    if [ -z "$HAS_SYSTEMD" ]; then
        if command -v systemctl &>/dev/null && [ -d /run/systemd/system ]; then
            HAS_SYSTEMD=true
        else
            HAS_SYSTEMD=false
        fi
    fi

    if [ "$HAS_SYSTEMD" = "true" ]; then
        cat > /etc/systemd/system/torware-tracker.service << EOF
[Unit]
Description=Torware Traffic Tracker
After=network.target docker.service
Requires=docker.service
StartLimitIntervalSec=300
StartLimitBurst=5

[Service]
Type=simple
ExecStart=/bin/bash "${INSTALL_DIR}/torware-tracker.sh"
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF

        systemctl daemon-reload 2>/dev/null || true
        systemctl enable torware-tracker.service 2>/dev/null || true
        systemctl start torware-tracker.service 2>/dev/null || true
        log_success "Tracker service started"
    else
        log_warn "Tracker service requires systemd. Run manually: bash $INSTALL_DIR/torware-tracker.sh &"
    fi
}

stop_tracker_service() {
    if [ "$HAS_SYSTEMD" = "true" ]; then
        systemctl stop torware-tracker.service 2>/dev/null || true
    fi
    pkill -f "torware-tracker.sh" 2>/dev/null || true
}

#═══════════════════════════════════════════════════════════════════════
# Telegram Integration (Phase 4)
#═══════════════════════════════════════════════════════════════════════

telegram_send_message() {
    local msg="$1"
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"

    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 1

    # Add server label + IP header
    local label="${TELEGRAM_SERVER_LABEL:-Torware}"
    local ip
    ip=$(curl -s --max-time 3 https://api.ipify.org 2>/dev/null \
        || curl -s --max-time 3 https://ifconfig.me 2>/dev/null \
        || echo "")
    local escaped_label=$(escape_md "$label")
    local header
    if [ -n "$ip" ]; then
        header="[${escaped_label} | ${ip}]"
    else
        header="[${escaped_label}]"
    fi

    local full_msg="${header} ${msg}"

    # Use curl config file to avoid leaking token in process list
    local _curl_cfg
    _curl_cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return 1
    chmod 600 "$_curl_cfg"
    printf 'url = "https://api.telegram.org/bot%s/sendMessage"\n' "$token" > "$_curl_cfg"
    local response
    response=$(curl -s --max-time 10 --max-filesize 1048576 -X POST \
        -K "$_curl_cfg" \
        --data-urlencode "chat_id=${chat_id}" \
        --data-urlencode "text=${full_msg}" \
        --data-urlencode "parse_mode=Markdown" \
        2>/dev/null)
    local rc=$?
    rm -f "$_curl_cfg"
    [ $rc -ne 0 ] && return 1
    echo "$response" | grep -q '"ok":true' && return 0
    return 1
}

telegram_send_photo_message() {
    local photo_url="$1"
    local caption="${2:-}"
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"
    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 1
    local label="${TELEGRAM_SERVER_LABEL:-Torware}"
    if [ -n "$caption" ]; then
        caption="[${label}] ${caption}"
    fi
    local _cfg
    _cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return 1
    chmod 600 "$_cfg"
    printf 'url = "https://api.telegram.org/bot%s/sendPhoto"\n' "$token" > "$_cfg"
    curl -s --max-time 15 --max-filesize 10485760 -X POST \
        -K "$_cfg" \
        --data-urlencode "chat_id=${chat_id}" \
        --data-urlencode "photo=${photo_url}" \
        --data-urlencode "caption=${caption}" \
        --data-urlencode "parse_mode=Markdown" \
        >/dev/null 2>&1
    local rc=$?
    rm -f "$_cfg"
    return $rc
}

telegram_notify_mtproxy_started() {
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"
    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 0
    [ "$TELEGRAM_ENABLED" != "true" ] && return 0
    [ "$MTPROXY_ENABLED" != "true" ] && return 0

    local server_ip
    server_ip=$(get_public_ip)
    [ -z "$server_ip" ] && return 1

    local port="${MTPROXY_PORT:-8443}"
    local secret="$MTPROXY_SECRET"
    [ -z "$secret" ] && return 1

    local https_link="https://t.me/proxy?server=${server_ip}&port=${port}&secret=${secret}"
    local tg_link="tg://proxy?server=${server_ip}&port=${port}&secret=${secret}"

    local encoded_link
    encoded_link=$(printf '%s' "$https_link" | sed 's/&/%26/g; s/?/%3F/g; s/=/%3D/g; s/:/%3A/g; s|/|%2F|g')
    local qr_url="https://api.qrserver.com/v1/create-qr-code/?size=300x300&data=${encoded_link}"

    local message="📱 *MTProxy Started*

🔗 *Proxy Link (tap to add):*
\`${tg_link}\`

🌐 *Web Link:*
${https_link}

📊 Port: ${port} | Domain: ${MTPROXY_DOMAIN}

_Share the QR code below with users who need access._"

    telegram_send_message "$message"
    telegram_send_photo_message "$qr_url" "📱 *MTProxy QR Code* — Scan in Telegram to connect"
}

telegram_get_chat_id() {
    local token="${TELEGRAM_BOT_TOKEN}"
    [ -z "$token" ] && return 1
    local _curl_cfg
    _curl_cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return 1
    chmod 600 "$_curl_cfg"
    printf 'url = "https://api.telegram.org/bot%s/getUpdates"\n' "$token" > "$_curl_cfg"
    local response
    response=$(curl -s --max-time 10 --max-filesize 1048576 -K "$_curl_cfg" 2>/dev/null)
    rm -f "$_curl_cfg"
    [ -z "$response" ] && return 1
    echo "$response" | grep -q '"ok":true' || return 1

    local chat_id=""
    if command -v python3 &>/dev/null; then
        chat_id=$(python3 -c "
import json,sys
try:
    d=json.loads(sys.stdin.read())
    for u in reversed(d.get('result',[])):
        if 'message' in u:
            print(u['message']['chat']['id']); break
        elif 'my_chat_member' in u:
            print(u['my_chat_member']['chat']['id']); break
except: pass
" <<< "$response" 2>/dev/null)
    fi
    # Fallback: POSIX-compatible grep extraction
    if [ -z "$chat_id" ]; then
        chat_id=$(echo "$response" | grep -o '"chat"[[:space:]]*:[[:space:]]*{[[:space:]]*"id"[[:space:]]*:[[:space:]]*-*[0-9]*' | grep -o -- '-*[0-9]*$' | tail -1 2>/dev/null)
    fi
    if [ -n "$chat_id" ]; then
        if ! echo "$chat_id" | grep -qE '^-?[0-9]+$'; then
            return 1
        fi
        TELEGRAM_CHAT_ID="$chat_id"
        return 0
    fi
    return 1
}

telegram_test_message() {
    local interval_label="${TELEGRAM_INTERVAL:-6}"
    local container_count="${CONTAINER_COUNT:-1}"

    local report=$(telegram_build_report_text)

    local message="✅ *Torware Monitor Connected!*

🧅 *What is Torware?*
You are running a Tor relay node helping people in censored regions access the open internet.

📬 *What this bot sends every ${interval_label}h:*
Container status, uptime, circuits, CPU/RAM, data cap & fingerprints.

⚠️ *Alerts:*
High CPU, high RAM, all containers down, or zero connections 2+ hours.

━━━━━━━━━━━━━━━━━━━━
🎮 *Available Commands:*
━━━━━━━━━━━━━━━━━━━━
/tor\_status — Full status report
/tor\_peers — Current connections
/tor\_uptime — Container uptime
/tor\_containers — Container list
/tor\_snowflake — Snowflake proxy details
/tor\_start\_N / /tor\_stop\_N / /tor\_restart\_N
/tor\_help — Show all commands

${report}"

    telegram_send_message "$message"
}

telegram_build_report_text() {
    load_settings
    local count=${CONTAINER_COUNT:-1}
    local report="📊 *Torware Status Report*"
    report+=$'\n'
    report+="🕐 $(date '+%Y-%m-%d %H:%M %Z')"
    report+=$'\n'

    # Container status & uptime
    local running=0
    local total_read=0 total_written=0 total_circuits=0 total_conns=0
    local earliest_start=""

    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            running=$((running + 1))
            local started=$(docker inspect --format='{{.State.StartedAt}}' "$cname" 2>/dev/null | cut -d'.' -f1)
            if [ -n "$started" ]; then
                local se=$(date -d "$started" +%s 2>/dev/null || echo 0)
                if [ -z "$earliest_start" ] || [ "$se" -lt "$earliest_start" ] 2>/dev/null; then
                    earliest_start=$se
                fi
            fi
            local traffic=$(get_tor_traffic $i)
            local rb=$(echo "$traffic" | awk '{print $1}'); rb=${rb:-0}
            local wb=$(echo "$traffic" | awk '{print $2}'); wb=${wb:-0}
            total_read=$((total_read + rb))
            total_written=$((total_written + wb))
            local circ=$(get_tor_circuits $i); circ=${circ//[^0-9]/}; circ=${circ:-0}
            total_circuits=$((total_circuits + circ))
            local conn=$(get_tor_connections $i); conn=${conn//[^0-9]/}; conn=${conn:-0}
            total_conns=$((total_conns + conn))
        fi
    done

    # Include snowflake in totals
    local total_containers=$count
    local total_running=$running
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_snowflake_running 2>/dev/null; then
            total_running=$((total_running + 1))
            local sf_stats=$(get_snowflake_stats 2>/dev/null)
            local sf_in=$(echo "$sf_stats" | awk '{print $2}'); sf_in=${sf_in:-0}
            local sf_out=$(echo "$sf_stats" | awk '{print $3}'); sf_out=${sf_out:-0}
            total_read=$((total_read + sf_in))
            total_written=$((total_written + sf_out))
        fi
    fi

    # Include unbounded in totals
    if [ "${UNBOUNDED_ENABLED:-false}" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_unbounded_running 2>/dev/null; then
            total_running=$((total_running + 1))
            # Unbounded traffic not measurable (--network host), skip traffic totals
        fi
    fi

    # Uptime from earliest container
    if [ -n "$earliest_start" ] && [ "$earliest_start" -gt 0 ] 2>/dev/null; then
        local now=$(date +%s)
        local up=$((now - earliest_start))
        local days=$((up / 86400)) hours=$(( (up % 86400) / 3600 )) mins=$(( (up % 3600) / 60 ))
        if [ "$days" -gt 0 ]; then
            report+="⏱ Uptime: ${days}d ${hours}h ${mins}m"
        else
            report+="⏱ Uptime: ${hours}h ${mins}m"
        fi
        report+=$'\n'
    fi

    report+="📦 Containers: ${total_running}/${total_containers} running"
    report+=$'\n'
    report+="🔗 Circuits: ${total_circuits} | Connections: ${total_conns}"
    report+=$'\n'
    report+="📊 Traffic: ↓ $(format_bytes $total_read) ↑ $(format_bytes $total_written)"
    report+=$'\n'

    # CPU / RAM (system-wide)
    local stats=$(get_container_stats 2>/dev/null)
    if [ -n "$stats" ]; then
        local raw_cpu=$(echo "$stats" | awk '{print $1}')
        local cores=$(get_cpu_cores)
        local cpu=$(awk "BEGIN {printf \"%.1f%%\", ${raw_cpu%\%} / $cores}" 2>/dev/null || echo "$raw_cpu")
        local sys_ram=""
        if command -v free &>/dev/null; then
            local free_out=$(free -m 2>/dev/null)
            local ram_used=$(echo "$free_out" | awk '/^Mem:/{if ($3>=1024) printf "%.1fGiB",$3/1024; else printf "%dMiB",$3}')
            local ram_total=$(echo "$free_out" | awk '/^Mem:/{if ($2>=1024) printf "%.1fGiB",$2/1024; else printf "%dMiB",$2}')
            sys_ram="${ram_used} / ${ram_total}"
        fi
        if [ -n "$sys_ram" ]; then
            report+="🖥 CPU: ${cpu} | RAM: ${sys_ram}"
        else
            local ram=$(echo "$stats" | awk '{print $2, $3, $4}')
            report+="🖥 CPU: ${cpu} | RAM: ${ram}"
        fi
        report+=$'\n'
    fi

    # Fingerprints
    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            local fp=$(get_tor_fingerprint $i 2>/dev/null)
            if [ -n "$fp" ]; then
                local rtype=$(get_container_relay_type $i)
                report+="🆔 C${i} [${rtype}]: ${fp}"
                report+=$'\n'
            fi
        fi
    done

    # Snowflake details
    if [ "$SNOWFLAKE_ENABLED" = "true" ] && is_snowflake_running 2>/dev/null; then
        local sf_stats=$(get_snowflake_stats 2>/dev/null)
        local sf_conns=$(echo "$sf_stats" | awk '{print $1}'); sf_conns=${sf_conns:-0}
        local sf_in=$(echo "$sf_stats" | awk '{print $2}'); sf_in=${sf_in:-0}
        local sf_out=$(echo "$sf_stats" | awk '{print $3}'); sf_out=${sf_out:-0}
        local sf_total=$((sf_in + sf_out))
        report+="❄ Snowflake: ${sf_conns} conns | $(format_bytes $sf_total) transferred"
        report+=$'\n'
    fi

    echo "$report"
}

telegram_build_report() {
    local msg=$(telegram_build_report_text)
    telegram_send_message "$msg"
}

telegram_setup_wizard() {
    # Save and restore variables on Ctrl+C
    local _saved_token="$TELEGRAM_BOT_TOKEN"
    local _saved_chatid="$TELEGRAM_CHAT_ID"
    local _saved_interval="$TELEGRAM_INTERVAL"
    local _saved_enabled="$TELEGRAM_ENABLED"
    local _saved_starthour="$TELEGRAM_START_HOUR"
    local _saved_label="$TELEGRAM_SERVER_LABEL"
    local _saved_alerts="$TELEGRAM_ALERTS_ENABLED"
    local _saved_daily="$TELEGRAM_DAILY_SUMMARY"
    local _saved_weekly="$TELEGRAM_WEEKLY_SUMMARY"
    trap 'TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"; trap - SIGINT; echo; return' SIGINT
    clear
    echo -e "${CYAN}══════════════════════════════════════════════════════════════════${NC}"
    echo -e "              ${BOLD}TELEGRAM NOTIFICATIONS SETUP${NC}"
    echo -e "${CYAN}══════════════════════════════════════════════════════════════════${NC}"
    echo ""
    echo -e "  ${BOLD}Step 1: Create a Telegram Bot${NC}"
    echo -e "  ${CYAN}─────────────────────────────${NC}"
    echo -e "  1. Open Telegram and search for ${BOLD}@BotFather${NC}"
    echo -e "  2. Send ${YELLOW}/newbot${NC}"
    echo -e "  3. Choose a name (e.g. \"My Tor Monitor\")"
    echo -e "  4. Choose a username (e.g. \"my_tor_relay_bot\")"
    echo -e "  5. BotFather will give you a token like:"
    echo -e "     ${YELLOW}123456789:ABCdefGHIjklMNOpqrsTUVwxyz${NC}"
    echo ""
    echo -e "  ${BOLD}Recommended:${NC} Send these commands to @BotFather:"
    echo -e "     ${YELLOW}/setjoingroups${NC} → Disable (prevents adding to groups)"
    echo -e "     ${YELLOW}/setprivacy${NC}   → Enable (limits message access)"
    echo ""
    echo -e "  ${YELLOW}⚠ OPSEC Note:${NC} Enabling Telegram notifications creates"
    echo -e "  outbound connections to api.telegram.org from this server."
    echo -e "  This traffic may be visible to your network provider."
    echo ""
    read -p "  Enter your bot token: " TELEGRAM_BOT_TOKEN < /dev/tty || { trap - SIGINT; TELEGRAM_BOT_TOKEN="$_saved_token"; return; }
    echo ""
    # Trim whitespace
    TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN## }"
    TELEGRAM_BOT_TOKEN="${TELEGRAM_BOT_TOKEN%% }"
    if [ -z "$TELEGRAM_BOT_TOKEN" ]; then
        echo -e "  ${RED}No token entered. Setup cancelled.${NC}"
        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
        trap - SIGINT; return
    fi

    # Validate token format
    if ! echo "$TELEGRAM_BOT_TOKEN" | grep -qE '^[0-9]+:[A-Za-z0-9_-]+$'; then
        echo -e "  ${RED}Invalid token format. Should be like: 123456789:ABCdefGHI...${NC}"
        TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"
        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
        trap - SIGINT; return
    fi

    # Validate token is a real bot by calling getMe
    echo -ne "  Verifying bot token... "
    local _me_cfg
    _me_cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || true
    if [ -n "$_me_cfg" ]; then
        chmod 600 "$_me_cfg"
        printf 'url = "https://api.telegram.org/bot%s/getMe"\n' "$TELEGRAM_BOT_TOKEN" > "$_me_cfg"
        local _me_resp
        _me_resp=$(curl -s --max-time 10 -K "$_me_cfg" 2>/dev/null)
        rm -f "$_me_cfg"
        if echo "$_me_resp" | grep -q '"ok":true'; then
            echo -e "${GREEN}✓ Valid${NC}"
        else
            echo -e "${RED}✗ Invalid token${NC}"
            echo -e "  ${RED}The Telegram API rejected this token. Please check it and try again.${NC}"
            TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"
            read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
            trap - SIGINT; return
        fi
    fi

    echo ""
    echo -e "  ${BOLD}Step 2: Get Your Chat ID${NC}"
    echo -e "  ${CYAN}────────────────────────${NC}"
    echo -e "  1. Open your new bot in Telegram"
    echo -e "  2. Send it the message: ${YELLOW}/start${NC}"
    echo -e ""
    echo -e "  ${YELLOW}Important:${NC} You MUST send ${BOLD}/start${NC} to the bot first!"
    echo -e "  The bot cannot respond to you until you do this."
    echo -e ""
    echo -e "  3. Press Enter here when done..."
    echo ""
    read -p "  Press Enter after sending /start to your bot... " < /dev/tty || { trap - SIGINT; TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"; return; }

    echo -ne "  Detecting chat ID... "
    local attempts=0
    TELEGRAM_CHAT_ID=""
    while [ $attempts -lt 3 ] && [ -z "$TELEGRAM_CHAT_ID" ]; do
        if telegram_get_chat_id; then
            break
        fi
        attempts=$((attempts + 1))
        sleep 2
    done

    if [ -z "$TELEGRAM_CHAT_ID" ]; then
        echo -e "${RED}✗ Could not auto-detect chat ID${NC}"
        echo ""
        echo -e "  ${BOLD}You can enter it manually:${NC}"
        echo -e "  ${CYAN}────────────────────────────${NC}"
        echo -e "  Option 1: Send /start to your bot, then press Enter to retry"
        echo -e "  Option 2: Find your chat ID via @userinfobot on Telegram"
        echo -e "            and enter it below"
        echo ""
        read -p "  Enter chat ID (or press Enter to retry): " _manual_chatid < /dev/tty || true
        if [ -z "$_manual_chatid" ]; then
            # Retry detection
            echo -ne "  Retrying detection... "
            attempts=0
            while [ $attempts -lt 5 ] && [ -z "$TELEGRAM_CHAT_ID" ]; do
                if telegram_get_chat_id; then
                    break
                fi
                attempts=$((attempts + 1))
                sleep 2
            done
        elif echo "$_manual_chatid" | grep -qE '^-?[0-9]+$'; then
            TELEGRAM_CHAT_ID="$_manual_chatid"
        else
            echo -e "  ${RED}Invalid chat ID. Must be a number.${NC}"
        fi

        if [ -z "$TELEGRAM_CHAT_ID" ]; then
            echo -e "  ${RED}✗ Could not get chat ID. Setup cancelled.${NC}"
            TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"
            read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
            trap - SIGINT; return
        fi
    fi
    echo -e "${GREEN}✓ Chat ID: ${TELEGRAM_CHAT_ID}${NC}"

    echo ""
    echo -e "  ${BOLD}Step 3: Notification Mode${NC}"
    echo -e "  ${CYAN}─────────────────────────────${NC}"
    echo -e "  1. 📬 Enable notifications (reports, alerts, summaries) ${DIM}(recommended)${NC}"
    echo -e "  2. 🔇 Bot only (no auto-notifications, manual use only)"
    echo ""
    read -p "  Choice [1-2] (default 1): " _notif_choice < /dev/tty || true

    if [ "${_notif_choice:-1}" = "2" ]; then
        # Bot only — skip interval/start hour, disable auto-notifications
        TELEGRAM_ALERTS_ENABLED=false
        TELEGRAM_DAILY_SUMMARY=false
        TELEGRAM_WEEKLY_SUMMARY=false
        TELEGRAM_INTERVAL=6
        TELEGRAM_START_HOUR=0
    else
        # Full notifications — ask interval and start hour
        TELEGRAM_ALERTS_ENABLED=true
        TELEGRAM_DAILY_SUMMARY=true
        TELEGRAM_WEEKLY_SUMMARY=true

        echo ""
        echo -e "  ${BOLD}Step 4: Notification Interval${NC}"
        echo -e "  ${CYAN}─────────────────────────────${NC}"
        echo -e "  1. Every 1 hour"
        echo -e "  2. Every 3 hours"
        echo -e "  3. Every 6 hours (recommended)"
        echo -e "  4. Every 12 hours"
        echo -e "  5. Every 24 hours"
        echo ""
        read -p "  Choice [1-5] (default 3): " ichoice < /dev/tty || true
        case "$ichoice" in
            1) TELEGRAM_INTERVAL=1 ;;
            2) TELEGRAM_INTERVAL=3 ;;
            4) TELEGRAM_INTERVAL=12 ;;
            5) TELEGRAM_INTERVAL=24 ;;
            *) TELEGRAM_INTERVAL=6 ;;
        esac

        echo ""
        echo -e "  ${BOLD}Step 5: Start Hour${NC}"
        echo -e "  ${CYAN}─────────────────────────────${NC}"
        echo -e "  What hour should reports start? (0-23, e.g. 8 = 8:00 AM)"
        echo -e "  Reports will repeat every ${TELEGRAM_INTERVAL}h from this hour."
        echo ""
        read -p "  Start hour [0-23] (default 0): " shchoice < /dev/tty || true
        if [ -n "$shchoice" ] && [ "$shchoice" -ge 0 ] 2>/dev/null && [ "$shchoice" -le 23 ] 2>/dev/null; then
            TELEGRAM_START_HOUR=$shchoice
        else
            TELEGRAM_START_HOUR=0
        fi
    fi

    TELEGRAM_ENABLED=true
    save_settings

    echo ""
    echo -ne "  Sending test message... "
    if telegram_test_message; then
        echo -e "${GREEN}✓ Success!${NC}"
    else
        echo -e "${RED}✗ Failed to send. Check your token.${NC}"
        TELEGRAM_BOT_TOKEN="$_saved_token"; TELEGRAM_CHAT_ID="$_saved_chatid"; TELEGRAM_INTERVAL="$_saved_interval"; TELEGRAM_ENABLED="$_saved_enabled"; TELEGRAM_START_HOUR="$_saved_starthour"; TELEGRAM_SERVER_LABEL="$_saved_label"; TELEGRAM_ALERTS_ENABLED="$_saved_alerts"; TELEGRAM_DAILY_SUMMARY="$_saved_daily"; TELEGRAM_WEEKLY_SUMMARY="$_saved_weekly"
        save_settings
        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
        trap - SIGINT; return
    fi
    # Only start the notification service if at least one notification type is enabled
    if [ "$TELEGRAM_ALERTS_ENABLED" = "true" ] || [ "$TELEGRAM_DAILY_SUMMARY" = "true" ] || [ "$TELEGRAM_WEEKLY_SUMMARY" = "true" ]; then
        telegram_start_notify
    else
        telegram_disable_service
    fi

    trap - SIGINT
    echo ""
    if [ "$TELEGRAM_ALERTS_ENABLED" = "true" ]; then
        echo -e "  ${GREEN}${BOLD}✓ Telegram notifications enabled!${NC}"
        echo -e "  You'll receive reports every ${TELEGRAM_INTERVAL}h starting at ${TELEGRAM_START_HOUR}:00."
    else
        echo -e "  ${GREEN}${BOLD}✓ Telegram bot connected!${NC}"
        echo -e "  Auto-notifications are off. Use the menu to send reports manually."
    fi
    echo ""
    read -n 1 -s -r -p "  Press any key to return..." < /dev/tty || true
}

telegram_generate_notify_script() {
    cat > "$INSTALL_DIR/torware-telegram.sh" << 'TGEOF'
#!/bin/bash
# Torware Telegram Notification Service
# Runs as a systemd service, sends periodic status reports
INSTALL_DIR="REPLACE_INSTALL_DIR"

# Safe settings load with whitelist validation
if [ -f "$INSTALL_DIR/settings.conf" ]; then
    if ! grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$INSTALL_DIR/settings.conf" 2>/dev/null | grep -q .; then
        source "$INSTALL_DIR/settings.conf"
    fi
fi

# Exit if not configured
[ "$TELEGRAM_ENABLED" != "true" ] && exit 0
[ -z "$TELEGRAM_BOT_TOKEN" ] && exit 0
[ -z "$TELEGRAM_CHAT_ID" ] && exit 0

# Cache server IP once at startup
_server_ip=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null \
    || curl -s --max-time 5 https://ifconfig.me 2>/dev/null \
    || echo "")

escape_md() {
    local text="$1"
    text="${text//\\/\\\\}"
    text="${text//\*/\\*}"
    text="${text//_/\\_}"
    text="${text//\`/\\\`}"
    text="${text//\[/\\[}"
    text="${text//\]/\\]}"
    echo "$text"
}

telegram_send() {
    local message="$1"
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"
    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 1
    local label="${TELEGRAM_SERVER_LABEL:-$(hostname 2>/dev/null || echo 'unknown')}"
    label=$(escape_md "$label")
    if [ -n "$_server_ip" ]; then
        message="[${label} | ${_server_ip}] ${message}"
    else
        message="[${label}] ${message}"
    fi
    local _cfg
    _cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return 1
    chmod 600 "$_cfg"
    printf 'url = "https://api.telegram.org/bot%s/sendMessage"\n' "$token" > "$_cfg"
    curl -s --max-time 10 --max-filesize 1048576 -X POST \
        -K "$_cfg" \
        --data-urlencode "chat_id=${chat_id}" \
        --data-urlencode "text=${message}" \
        --data-urlencode "parse_mode=Markdown" \
        >/dev/null 2>&1
    rm -f "$_cfg"
}

telegram_send_photo() {
    local photo_url="$1"
    local caption="${2:-}"
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"
    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 1
    local label="${TELEGRAM_SERVER_LABEL:-$(hostname 2>/dev/null || echo 'unknown')}"
    if [ -n "$caption" ]; then
        caption="[${label}] ${caption}"
    fi
    local _cfg
    _cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return 1
    chmod 600 "$_cfg"
    printf 'url = "https://api.telegram.org/bot%s/sendPhoto"\n' "$token" > "$_cfg"
    curl -s --max-time 15 --max-filesize 10485760 -X POST \
        -K "$_cfg" \
        --data-urlencode "chat_id=${chat_id}" \
        --data-urlencode "photo=${photo_url}" \
        --data-urlencode "caption=${caption}" \
        --data-urlencode "parse_mode=Markdown" \
        >/dev/null 2>&1
    rm -f "$_cfg"
}

telegram_notify_mtproxy_started() {
    # Send MTProxy link and QR code to Telegram when proxy starts
    local token="${TELEGRAM_BOT_TOKEN}"
    local chat_id="${TELEGRAM_CHAT_ID}"
    { [ -z "$token" ] || [ -z "$chat_id" ]; } && return 0
    [ "$TELEGRAM_ENABLED" != "true" ] && return 0
    [ "$MTPROXY_ENABLED" != "true" ] && return 0

    local server_ip
    server_ip=$(get_public_ip)
    [ -z "$server_ip" ] && return 1

    local port="${MTPROXY_PORT:-8443}"
    local secret="$MTPROXY_SECRET"
    [ -z "$secret" ] && return 1

    local https_link="https://t.me/proxy?server=${server_ip}&port=${port}&secret=${secret}"
    local tg_link="tg://proxy?server=${server_ip}&port=${port}&secret=${secret}"

    # URL-encode the link for QR code API
    local encoded_link
    encoded_link=$(printf '%s' "$https_link" | sed 's/&/%26/g; s/?/%3F/g; s/=/%3D/g; s/:/%3A/g; s|/|%2F|g')
    local qr_url="https://api.qrserver.com/v1/create-qr-code/?size=300x300&data=${encoded_link}"

    # Send message with links
    local message="📱 *MTProxy Started*

🔗 *Proxy Link (tap to add):*
\`${tg_link}\`

🌐 *Web Link:*
${https_link}

📊 Port: ${port} | Domain: ${MTPROXY_DOMAIN}

_Share the QR code below with users who need access._"

    telegram_send "$message"

    # Send QR code as photo
    telegram_send_photo "$qr_url" "📱 *MTProxy QR Code* — Scan in Telegram to connect"
}

get_container_name() {
    local i=$1
    if [ "$i" -le 1 ]; then
        echo "torware"
    else
        echo "torware-${i}"
    fi
}

get_cpu_cores() {
    local cores=1
    if command -v nproc &>/dev/null; then
        cores=$(nproc)
    elif [ -f /proc/cpuinfo ]; then
        cores=$(grep -c '^processor' /proc/cpuinfo 2>/dev/null || echo 1)
    fi
    [ "$cores" -lt 1 ] 2>/dev/null && cores=1
    echo "$cores"
}

track_uptime() {
    local running=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -c "^torware" 2>/dev/null || true)
    running=${running:-0}
    echo "$(date +%s)|${running}" >> "$INSTALL_DIR/relay_stats/uptime_log"
    # Trim to 10080 lines (7 days of per-minute entries)
    local log_file="$INSTALL_DIR/relay_stats/uptime_log"
    local lines=$(wc -l < "$log_file" 2>/dev/null || echo 0)
    if [ "$lines" -gt 10080 ] 2>/dev/null; then
        tail -10080 "$log_file" > "${log_file}.tmp" && mv "${log_file}.tmp" "$log_file"
    fi
}

calc_uptime_pct() {
    local period_secs=${1:-86400}
    local log_file="$INSTALL_DIR/relay_stats/uptime_log"
    [ ! -s "$log_file" ] && echo "0" && return
    local cutoff=$(( $(date +%s) - period_secs ))
    local total=0
    local up=0
    while IFS='|' read -r ts count; do
        [ "$ts" -lt "$cutoff" ] 2>/dev/null && continue
        total=$((total + 1))
        [ "$count" -gt 0 ] 2>/dev/null && up=$((up + 1))
    done < "$log_file"
    [ "$total" -eq 0 ] && echo "0" && return
    awk "BEGIN {printf \"%.1f\", ($up/$total)*100}" 2>/dev/null || echo "0"
}

#═══════════════════════════════════════════════════════════════════════
# Bandwidth History & Graphs
#═══════════════════════════════════════════════════════════════════════

record_bandwidth_sample() {
    # Record current bandwidth to hourly history file
    # Format: timestamp|download_bytes|upload_bytes
    local history_file="$STATS_DIR/bandwidth_history"
    local now=$(date +%s)
    local hour=$(date +%Y-%m-%d-%H)

    # Get current total traffic
    local total_down=0 total_up=0
    local count=${CONTAINER_COUNT:-1}

    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            local stats=$(docker logs --tail 1000 "$cname" 2>&1 | grep -oE 'Heartbeat:.*' | tail -1)
            local down=$(echo "$stats" | grep -oE 'Read [0-9]+' | grep -oE '[0-9]+' || echo 0)
            local up=$(echo "$stats" | grep -oE 'Written [0-9]+' | grep -oE '[0-9]+' || echo 0)
            total_down=$((total_down + ${down:-0}))
            total_up=$((total_up + ${up:-0}))
        fi
    done

    # Add snowflake traffic
    if is_snowflake_running; then
        local sf_stats=$(get_snowflake_stats 2>/dev/null)
        local sf_in=$(echo "$sf_stats" | awk '{print $2}')
        local sf_out=$(echo "$sf_stats" | awk '{print $3}')
        total_down=$((total_down + ${sf_in:-0}))
        total_up=$((total_up + ${sf_out:-0}))
    fi

    # Add MTProxy traffic
    if is_mtproxy_running; then
        local mtp_stats=$(get_mtproxy_stats 2>/dev/null)
        local mtp_in=$(echo "$mtp_stats" | awk '{print $1}')
        local mtp_out=$(echo "$mtp_stats" | awk '{print $2}')
        total_down=$((total_down + ${mtp_in:-0}))
        total_up=$((total_up + ${mtp_out:-0}))
    fi

    # Append to history (keep last 24 hours = 24 entries max)
    echo "${hour}|${total_down}|${total_up}" >> "$history_file"

    # Trim to last 24 entries
    if [ -f "$history_file" ]; then
        tail -24 "$history_file" > "${history_file}.tmp"
        mv "${history_file}.tmp" "$history_file"
    fi
}

draw_ascii_graph() {
    # Draw an ASCII bar graph
    # Args: title, max_width, values (space-separated)
    local title="$1"
    local max_width=${2:-40}
    shift 2
    local values=("$@")
    local max_val=1

    # Find max value
    for v in "${values[@]}"; do
        [ "${v:-0}" -gt "$max_val" ] 2>/dev/null && max_val="$v"
    done

    echo -e "  ${BOLD}${title}${NC}"
    echo -e "  ${DIM}$(printf '%.0s─' $(seq 1 $((max_width + 10))))${NC}"

    local hour_offset=$((24 - ${#values[@]}))
    local idx=0
    for v in "${values[@]}"; do
        local bar_len=0
        if [ "$max_val" -gt 0 ] 2>/dev/null; then
            bar_len=$((v * max_width / max_val))
        fi
        [ "$bar_len" -lt 0 ] && bar_len=0
        [ "$bar_len" -gt "$max_width" ] && bar_len=$max_width

        local hour_label=$((hour_offset + idx))
        local bar=""
        if [ "$bar_len" -gt 0 ]; then
            bar=$(printf '█%.0s' $(seq 1 $bar_len))
        fi

        # Format value for display
        local display_val
        if [ "$v" -ge 1073741824 ] 2>/dev/null; then
            display_val=$(awk "BEGIN {printf \"%.1fG\", $v/1073741824}")
        elif [ "$v" -ge 1048576 ] 2>/dev/null; then
            display_val=$(awk "BEGIN {printf \"%.1fM\", $v/1048576}")
        elif [ "$v" -ge 1024 ] 2>/dev/null; then
            display_val=$(awk "BEGIN {printf \"%.1fK\", $v/1024}")
        else
            display_val="${v}B"
        fi

        printf "  %2dh │${GREEN}%-${max_width}s${NC}│ %s\n" "$hour_label" "$bar" "$display_val"
        ((idx++))
    done
    echo ""
}

show_bandwidth_graphs() {
    local history_file="$STATS_DIR/bandwidth_history"

    if [ ! -f "$history_file" ] || [ ! -s "$history_file" ]; then
        echo -e "  ${YELLOW}No bandwidth history available yet.${NC}"
        echo -e "  ${DIM}History is recorded hourly. Check back later.${NC}"
        return
    fi

    # Read history into arrays
    local -a hours=() downloads=() uploads=()
    while IFS='|' read -r hour down up; do
        hours+=("$hour")
        downloads+=("${down:-0}")
        uploads+=("${up:-0}")
    done < "$history_file"

    # Calculate deltas (difference between consecutive readings)
    local -a down_deltas=() up_deltas=()
    local prev_down=0 prev_up=0
    for i in "${!downloads[@]}"; do
        local d=${downloads[$i]:-0}
        local u=${uploads[$i]:-0}
        if [ "$i" -eq 0 ]; then
            down_deltas+=(0)
            up_deltas+=(0)
        else
            local dd=$((d - prev_down))
            local ud=$((u - prev_up))
            [ "$dd" -lt 0 ] && dd=0
            [ "$ud" -lt 0 ] && ud=0
            down_deltas+=("$dd")
            up_deltas+=("$ud")
        fi
        prev_down=$d
        prev_up=$u
    done

    echo ""
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}              📊 BANDWIDTH GRAPHS (Last 24h)                   ${NC}"
    echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
    echo ""

    draw_ascii_graph "Download Traffic (hourly)" 35 "${down_deltas[@]}"
    draw_ascii_graph "Upload Traffic (hourly)" 35 "${up_deltas[@]}"

    # Summary
    local total_down=0 total_up=0
    for d in "${down_deltas[@]}"; do total_down=$((total_down + d)); done
    for u in "${up_deltas[@]}"; do total_up=$((total_up + u)); done

    echo -e "  ${BOLD}24h Summary:${NC}"
    echo -e "    Download: ${GREEN}$(format_bytes $total_down)${NC}"
    echo -e "    Upload:   ${GREEN}$(format_bytes $total_up)${NC}"
    echo -e "    Total:    ${GREEN}$(format_bytes $((total_down + total_up)))${NC}"
    echo ""
}

rotate_cumulative_data() {
    local data_file="$INSTALL_DIR/relay_stats/cumulative_data"
    local marker="$INSTALL_DIR/relay_stats/.last_rotation_month"
    local current_month=$(date '+%Y-%m')
    local last_month=""
    [ -f "$marker" ] && last_month=$(cat "$marker" 2>/dev/null)
    if [ -z "$last_month" ]; then
        echo "$current_month" > "$marker"
        return
    fi
    if [ "$current_month" != "$last_month" ] && [ -s "$data_file" ]; then
        cp "$data_file" "${data_file}.${last_month}"
        echo "$current_month" > "$marker"
        local cutoff_ts=$(( $(date +%s) - 7776000 ))
        for archive in "$INSTALL_DIR/relay_stats/cumulative_data."[0-9][0-9][0-9][0-9]-[0-9][0-9]; do
            [ ! -f "$archive" ] && continue
            local archive_mtime=$(stat -c %Y "$archive" 2>/dev/null || stat -f %m "$archive" 2>/dev/null || echo 0)
            if [ "$archive_mtime" -gt 0 ] && [ "$archive_mtime" -lt "$cutoff_ts" ] 2>/dev/null; then
                rm -f "$archive"
            fi
        done
    fi
}

check_alerts() {
    [ "$TELEGRAM_ALERTS_ENABLED" != "true" ] && return
    local now=$(date +%s)
    local cooldown=3600

    # CPU + RAM check
    local torware_containers=$(docker ps --format '{{.Names}}' 2>/dev/null | grep "^torware" 2>/dev/null || true)
    local stats_line=""
    if [ -n "$torware_containers" ]; then
        stats_line=$(timeout 10 docker stats --no-stream --format "{{.CPUPerc}} {{.MemPerc}}" $torware_containers 2>/dev/null | head -1)
    fi
    local raw_cpu=$(echo "$stats_line" | awk '{print $1}')
    local ram_pct=$(echo "$stats_line" | awk '{print $2}')

    local cores=$(get_cpu_cores)
    local cpu_val=$(awk "BEGIN {printf \"%.0f\", ${raw_cpu%\%} / $cores}" 2>/dev/null || echo 0)
    if [ "${cpu_val:-0}" -gt 90 ] 2>/dev/null; then
        cpu_breach=$((cpu_breach + 1))
    else
        cpu_breach=0
    fi
    if [ "$cpu_breach" -ge 3 ] && [ $((now - last_alert_cpu)) -ge $cooldown ] 2>/dev/null; then
        telegram_send "⚠️ *Alert: High CPU*
CPU usage at ${cpu_val}% for 3+ minutes"
        last_alert_cpu=$now
        cpu_breach=0
    fi

    local ram_val=${ram_pct%\%}
    ram_val=${ram_val%%.*}
    if [ "${ram_val:-0}" -gt 90 ] 2>/dev/null; then
        ram_breach=$((ram_breach + 1))
    else
        ram_breach=0
    fi
    if [ "$ram_breach" -ge 3 ] && [ $((now - last_alert_ram)) -ge $cooldown ] 2>/dev/null; then
        telegram_send "⚠️ *Alert: High RAM*
Memory usage at ${ram_pct} for 3+ minutes"
        last_alert_ram=$now
        ram_breach=0
    fi

    # All containers down
    local running=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -c "^torware" 2>/dev/null || true)
    running=${running:-0}
    if [ "$running" -eq 0 ] 2>/dev/null && [ $((now - last_alert_down)) -ge $cooldown ] 2>/dev/null; then
        telegram_send "🔴 *Alert: All containers down*
No Torware containers are running!"
        last_alert_down=$now
    fi

    # Zero connections for 2+ hours
    local total_circuits=0
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        local cname=$(get_container_name $i)
        local circ=$(timeout 5 docker exec "$cname" sh -c 'echo "GETINFO circuit-status" | nc 127.0.0.1 9051 2>/dev/null | grep -c BUILT' 2>/dev/null || echo 0)
        total_circuits=$((total_circuits + ${circ:-0}))
    done
    if [ "$total_circuits" -eq 0 ] 2>/dev/null; then
        if [ "$zero_peers_since" -eq 0 ] 2>/dev/null; then
            zero_peers_since=$now
        elif [ $((now - zero_peers_since)) -ge 7200 ] && [ $((now - last_alert_peers)) -ge $cooldown ] 2>/dev/null; then
            telegram_send "⚠️ *Alert: Zero connections*
No active circuits for 2+ hours"
            last_alert_peers=$now
            zero_peers_since=$now
        fi
    else
        zero_peers_since=0
    fi
}

record_snapshot() {
    local running=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -c "^torware" 2>/dev/null || true)
    running=${running:-0}
    local total_circuits=0
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        local cname=$(get_container_name $i)
        local circ=$(timeout 5 docker exec "$cname" sh -c 'echo "GETINFO circuit-status" | nc 127.0.0.1 9051 2>/dev/null | grep -c BUILT' 2>/dev/null || echo 0)
        total_circuits=$((total_circuits + ${circ:-0}))
    done
    local data_file="$INSTALL_DIR/relay_stats/cumulative_data"
    local total_bw=0
    [ -s "$data_file" ] && total_bw=$(awk -F'|' '{s+=$2+$3} END{print s+0}' "$data_file" 2>/dev/null)
    echo "$(date +%s)|${total_circuits}|${total_bw:-0}|${running}" >> "$INSTALL_DIR/relay_stats/report_snapshots"
    local snap_file="$INSTALL_DIR/relay_stats/report_snapshots"
    local lines=$(wc -l < "$snap_file" 2>/dev/null || echo 0)
    if [ "$lines" -gt 720 ] 2>/dev/null; then
        tail -720 "$snap_file" > "${snap_file}.tmp" && mv "${snap_file}.tmp" "$snap_file"
    fi
}

build_summary() {
    local period_label="$1"
    local period_secs="$2"
    local snap_file="$INSTALL_DIR/relay_stats/report_snapshots"
    [ ! -s "$snap_file" ] && return
    local cutoff=$(( $(date +%s) - period_secs ))
    local peak_circuits=0
    local sum_circuits=0
    local count=0
    local first_bw=0
    local last_bw=0
    local got_first=false
    while IFS='|' read -r ts circuits bw running; do
        [ "$ts" -lt "$cutoff" ] 2>/dev/null && continue
        count=$((count + 1))
        sum_circuits=$((sum_circuits + ${circuits:-0}))
        [ "${circuits:-0}" -gt "$peak_circuits" ] 2>/dev/null && peak_circuits=${circuits:-0}
        if [ "$got_first" = false ]; then
            first_bw=${bw:-0}
            got_first=true
        fi
        last_bw=${bw:-0}
    done < "$snap_file"
    [ "$count" -eq 0 ] && return

    local avg_circuits=$((sum_circuits / count))
    local period_bw=$((${last_bw:-0} - ${first_bw:-0}))
    [ "$period_bw" -lt 0 ] 2>/dev/null && period_bw=0
    local bw_fmt=$(awk "BEGIN {b=$period_bw; if(b>1099511627776) printf \"%.2f TB\",b/1099511627776; else if(b>1073741824) printf \"%.2f GB\",b/1073741824; else printf \"%.1f MB\",b/1048576}" 2>/dev/null)
    local uptime_pct=$(calc_uptime_pct "$period_secs")

    local msg="📋 *${period_label} Summary*"
    msg+=$'\n'"🕐 $(date '+%Y-%m-%d %H:%M %Z')"
    msg+=$'\n'$'\n'"📊 Bandwidth served: ${bw_fmt}"
    msg+=$'\n'"🔗 Peak circuits: ${peak_circuits} | Avg: ${avg_circuits}"
    msg+=$'\n'"⏱ Uptime: ${uptime_pct}%"
    msg+=$'\n'"📈 Data points: ${count}"

    # New countries detection
    local countries_file="$INSTALL_DIR/relay_stats/known_countries"
    local data_file="$INSTALL_DIR/relay_stats/cumulative_data"
    local new_countries=""
    if [ -s "$data_file" ]; then
        local current_countries=$(awk -F'|' '{if($1!="") print $1}' "$data_file" 2>/dev/null | sort -u)
        if [ -f "$countries_file" ]; then
            new_countries=$(comm -23 <(echo "$current_countries") <(sort "$countries_file") 2>/dev/null | head -5 | tr '\n' ', ' | sed 's/,$//')
        fi
        echo "$current_countries" > "$countries_file"
    fi
    if [ -n "$new_countries" ]; then
        local safe_new=$(escape_md "$new_countries")
        msg+=$'\n'"🆕 New countries: ${safe_new}"
    fi

    telegram_send "$msg"
}

format_bytes() {
    local bytes=$1
    [ -z "$bytes" ] || [ "$bytes" -eq 0 ] 2>/dev/null && echo "0 B" && return
    if [ "$bytes" -ge 1073741824 ] 2>/dev/null; then
        awk "BEGIN {printf \"%.2f GB\", $bytes/1073741824}"
    elif [ "$bytes" -ge 1048576 ] 2>/dev/null; then
        awk "BEGIN {printf \"%.2f MB\", $bytes/1048576}"
    elif [ "$bytes" -ge 1024 ] 2>/dev/null; then
        awk "BEGIN {printf \"%.1f KB\", $bytes/1024}"
    else
        echo "${bytes} B"
    fi
}

build_report() {
    local count=${CONTAINER_COUNT:-1}
    local report="📊 *Torware Status Report*"
    report+=$'\n'
    report+="🕐 $(date '+%Y-%m-%d %H:%M %Z')"
    report+=$'\n'

    local running=0 total_read=0 total_written=0 total_circuits=0 total_conns=0
    local earliest_start=""

    for i in $(seq 1 $count); do
        local cname=$(get_container_name $i)
        if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${cname}$"; then
            running=$((running + 1))
            local started=$(docker inspect --format='{{.State.StartedAt}}' "$cname" 2>/dev/null | cut -d'.' -f1)
            if [ -n "$started" ]; then
                local se=$(date -d "$started" +%s 2>/dev/null || echo 0)
                if [ -z "$earliest_start" ] || [ "$se" -lt "$earliest_start" ] 2>/dev/null; then
                    earliest_start=$se
                fi
            fi
            # Traffic via ControlPort
            local cport=$((9051 + i - 1))
            local cp_out=$(timeout 5 docker exec "$cname" sh -c "printf 'AUTHENTICATE\r\nGETINFO traffic/read\r\nGETINFO traffic/written\r\nQUIT\r\n' | nc 127.0.0.1 9051" 2>/dev/null)
            local rb=$(echo "$cp_out" | sed -n 's/.*traffic\/read=\([0-9]*\).*/\1/p' | head -1); rb=${rb:-0}
            local wb=$(echo "$cp_out" | sed -n 's/.*traffic\/written=\([0-9]*\).*/\1/p' | head -1); wb=${wb:-0}
            total_read=$((total_read + rb))
            total_written=$((total_written + wb))
            # Circuits
            local circ_out=$(timeout 5 docker exec "$cname" sh -c "printf 'AUTHENTICATE\r\nGETINFO circuit-status\r\nQUIT\r\n' | nc 127.0.0.1 9051" 2>/dev/null)
            local circ=$(echo "$circ_out" | grep -cE '^[0-9]+ (BUILT|EXTENDED|LAUNCHED)' 2>/dev/null || echo 0)
            circ=${circ//[^0-9]/}; circ=${circ:-0}
            total_circuits=$((total_circuits + circ))
            # Connections
            local conn_out=$(timeout 5 docker exec "$cname" sh -c "printf 'AUTHENTICATE\r\nGETINFO orconn-status\r\nQUIT\r\n' | nc 127.0.0.1 9051" 2>/dev/null)
            local conn=$(echo "$conn_out" | grep -c '\$' 2>/dev/null || echo 0)
            conn=${conn//[^0-9]/}; conn=${conn:-0}
            total_conns=$((total_conns + conn))
        fi
    done

    # Include snowflake
    local total_containers=$count
    local total_running=$running
    local sf_conns=0 sf_in=0 sf_out=0
    if [ "${SNOWFLAKE_ENABLED:-false}" = "true" ]; then
        total_containers=$((total_containers + ${SNOWFLAKE_COUNT:-1}))
        for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
            local _sfn=$(get_snowflake_name $_sfi)
            local _sfm=$(get_snowflake_metrics_port $_sfi)
            if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_sfn}$"; then
                total_running=$((total_running + 1))
                local sf_metrics=$(curl -s --max-time 3 "http://127.0.0.1:${_sfm}/internal/metrics" 2>/dev/null)
                [ -n "$sf_metrics" ] && sf_conns=$((sf_conns + $(echo "$sf_metrics" | awk '/^tor_snowflake_proxy_connections_total[{ ]/ { sum += $NF } END { printf "%.0f", sum }' 2>/dev/null || echo 0)))
                local sf_log=$(docker logs "$_sfn" 2>&1 | grep "Traffic Relayed" 2>/dev/null)
                if [ -n "$sf_log" ]; then
                    sf_in=$((sf_in + $(echo "$sf_log" | awk -F'[↓↑]' '{ split($2, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1] } END { printf "%.0f", sum * 1024 }' 2>/dev/null || echo 0)))
                    sf_out=$((sf_out + $(echo "$sf_log" | awk -F'[↓↑]' '{ split($3, a, " "); gsub(/[^0-9.]/, "", a[1]); sum += a[1] } END { printf "%.0f", sum * 1024 }' 2>/dev/null || echo 0)))
                fi
            fi
        done
        total_read=$((total_read + sf_in))
        total_written=$((total_written + sf_out))
    fi

    # Include Unbounded in totals
    local ub_rpt_conns=0
    if [ "${UNBOUNDED_ENABLED:-false}" = "true" ]; then
        total_containers=$((total_containers + 1))
        if is_unbounded_running; then
            total_running=$((total_running + 1))
            local ub_rpt_s=$(get_unbounded_stats 2>/dev/null)
            ub_rpt_conns=$(echo "$ub_rpt_s" | awk '{print $2}')
        fi
    fi

    if [ -n "$earliest_start" ] && [ "$earliest_start" -gt 0 ] 2>/dev/null; then
        local now=$(date +%s) up=$(($(date +%s) - earliest_start))
        local days=$((up / 86400)) hours=$(( (up % 86400) / 3600 )) mins=$(( (up % 3600) / 60 ))
        if [ "$days" -gt 0 ]; then
            report+="⏱ Uptime: ${days}d ${hours}h ${mins}m"
        else
            report+="⏱ Uptime: ${hours}h ${mins}m"
        fi
        report+=$'\n'
    fi

    report+="📦 Containers: ${total_running}/${total_containers} running"
    report+=$'\n'
    report+="🔗 Circuits: ${total_circuits} | Connections: ${total_conns}"
    report+=$'\n'
    report+="📊 Traffic: ↓ $(format_bytes $total_read) ↑ $(format_bytes $total_written)"
    report+=$'\n'

    # Snowflake detail line
    if [ "${SNOWFLAKE_ENABLED:-false}" = "true" ] && [ "$sf_conns" -gt 0 ] 2>/dev/null; then
        local sf_total=$((sf_in + sf_out))
        report+="❄ Snowflake: ${sf_conns} conns | $(format_bytes $sf_total) transferred"
        report+=$'\n'
    fi

    # Unbounded detail line
    if [ "${UNBOUNDED_ENABLED:-false}" = "true" ] && [ "${ub_rpt_conns:-0}" -gt 0 ] 2>/dev/null; then
        report+="🌐 Unbounded: ${ub_rpt_conns} connections served"
        report+=$'\n'
    fi

    # Uptime %
    local uptime_pct=$(calc_uptime_pct 86400)
    [ "${uptime_pct}" != "0" ] && report+="📈 Availability: ${uptime_pct}% (24h)"$'\n'

    # CPU / RAM
    local names=""
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        names+=" $(get_container_name $i)"
    done
    if [ "${SNOWFLAKE_ENABLED:-false}" = "true" ]; then
        for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
            local _sfn=$(get_snowflake_name $_sfi)
            docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_sfn}$" && names+=" $_sfn"
        done
    fi
    local stats=$(timeout 10 docker stats --no-stream --format "{{.CPUPerc}} {{.MemUsage}}" $names 2>/dev/null | head -1)
    if [ -n "$stats" ]; then
        local raw_cpu=$(echo "$stats" | awk '{print $1}')
        local cores=$(get_cpu_cores)
        local cpu=$(awk "BEGIN {printf \"%.1f%%\", ${raw_cpu%\%} / $cores}" 2>/dev/null || echo "$raw_cpu")
        local sys_ram=""
        if command -v free &>/dev/null; then
            local free_out=$(free -m 2>/dev/null)
            local ram_used=$(echo "$free_out" | awk '/^Mem:/{if ($3>=1024) printf "%.1fGiB",$3/1024; else printf "%dMiB",$3}')
            local ram_total=$(echo "$free_out" | awk '/^Mem:/{if ($2>=1024) printf "%.1fGiB",$2/1024; else printf "%dMiB",$2}')
            sys_ram="${ram_used} / ${ram_total}"
        fi
        if [ -n "$sys_ram" ]; then
            report+="🖥 CPU: ${cpu} | RAM: ${sys_ram}"
        else
            local ram=$(echo "$stats" | awk '{print $2, $3, $4}')
            report+="🖥 CPU: ${cpu} | RAM: ${ram}"
        fi
        report+=$'\n'
    fi

    printf '%s' "$report"
}

process_commands() {
    local offset_file="$INSTALL_DIR/relay_stats/tg_offset"
    local offset=0
    [ -f "$offset_file" ] && offset=$(cat "$offset_file" 2>/dev/null)
    offset=${offset:-0}
    [ "$offset" -eq "$offset" ] 2>/dev/null || offset=0

    local _cfg
    _cfg=$(mktemp "${TMPDIR:-/tmp}/.tg_curl.XXXXXX") || return
    chmod 600 "$_cfg"
    printf 'url = "https://api.telegram.org/bot%s/getUpdates?offset=%s&timeout=0"\n' "$TELEGRAM_BOT_TOKEN" "$((offset + 1))" > "$_cfg"
    local response
    response=$(curl -s --max-time 10 --max-filesize 1048576 -K "$_cfg" 2>/dev/null)
    rm -f "$_cfg"
    [ -z "$response" ] && return

    if ! command -v python3 &>/dev/null; then
        return
    fi

    local parsed
    parsed=$(python3 -c "
import json, sys
try:
    data = json.loads(sys.argv[1])
    if not data.get('ok'): sys.exit(0)
    results = data.get('result', [])
    if not results: sys.exit(0)
    for r in results:
        uid = r.get('update_id', 0)
        msg = r.get('message', {})
        chat_id = msg.get('chat', {}).get('id', 0)
        text = msg.get('text', '')
        if str(chat_id) == '$TELEGRAM_CHAT_ID' and text.startswith('/tor_'):
            print(f'{uid}|{text}')
        else:
            print(f'{uid}|')
except Exception:
    try:
        data = json.loads(sys.argv[1])
        results = data.get('result', [])
        if results:
            max_uid = max(r.get('update_id', 0) for r in results)
            if max_uid > 0:
                print(f'{max_uid}|')
    except Exception:
        pass
" "$response" 2>/dev/null)

    [ -z "$parsed" ] && return

    local max_id=$offset
    while IFS='|' read -r uid cmd; do
        [ -z "$uid" ] && continue
        [ "$uid" -gt "$max_id" ] 2>/dev/null && max_id=$uid
        case "$cmd" in
            /tor_status|/tor_status@*)
                local report=$(build_report)
                telegram_send "$report"
                ;;
            /tor_peers|/tor_peers@*)
                local total_circuits=0
                for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
                    local cname=$(get_container_name $i)
                    local circ=$(timeout 5 docker exec "$cname" sh -c 'echo "GETINFO circuit-status" | nc 127.0.0.1 9051 2>/dev/null | grep -c BUILT' 2>/dev/null || echo 0)
                    total_circuits=$((total_circuits + ${circ:-0}))
                done
                telegram_send "🔗 Active circuits: ${total_circuits}"
                ;;
            /tor_uptime|/tor_uptime@*)
                local ut_msg="⏱ *Uptime Report*"
                ut_msg+="\n"
                for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
                    local cname=$(get_container_name $i)
                    local is_running=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -c "^${cname}$" || true)
                    if [ "${is_running:-0}" -gt 0 ]; then
                        local started=$(docker inspect --format='{{.State.StartedAt}}' "$cname" 2>/dev/null)
                        if [ -n "$started" ]; then
                            local se=$(date -d "$started" +%s 2>/dev/null || echo 0)
                            local diff=$(( $(date +%s) - se ))
                            local d=$((diff / 86400)) h=$(( (diff % 86400) / 3600 )) m=$(( (diff % 3600) / 60 ))
                            ut_msg+="\n📦 Container ${i}: ${d}d ${h}h ${m}m"
                        else
                            ut_msg+="\n📦 Container ${i}: ⚠ unknown"
                        fi
                    else
                        ut_msg+="\n📦 Container ${i}: 🔴 stopped"
                    fi
                done
                local avail=$(calc_uptime_pct 86400)
                ut_msg+="\n\n📈 Availability: ${avail}% (24h)"
                telegram_send "$ut_msg"
                ;;
            /tor_containers|/tor_containers@*)
                local ct_msg="📦 *Container Status*"
                ct_msg+="\n"
                local docker_names=$(docker ps --format '{{.Names}}' 2>/dev/null)
                for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
                    local cname=$(get_container_name $i)
                    ct_msg+="\n"
                    if echo "$docker_names" | grep -q "^${cname}$"; then
                        local safe_cname=$(escape_md "$cname")
                        ct_msg+="C${i} (${safe_cname}): 🟢 Running"
                        local circ=$(timeout 5 docker exec "$cname" sh -c 'echo "GETINFO circuit-status" | nc 127.0.0.1 9051 2>/dev/null | grep -c BUILT' 2>/dev/null || echo 0)
                        ct_msg+="\n  🔗 Circuits: ${circ:-0}"
                    else
                        local safe_cname=$(escape_md "$cname")
                        ct_msg+="C${i} (${safe_cname}): 🔴 Stopped"
                    fi
                    ct_msg+="\n"
                done
                ct_msg+="\n/tor\_restart\_N  /tor\_stop\_N  /tor\_start\_N — manage containers"
                telegram_send "$ct_msg"
                ;;
            /tor_restart_*|/tor_stop_*|/tor_start_*)
                local action="${cmd%%_*}"     # /tor_restart, /tor_stop, or /tor_start
                # Remove the /tor_ prefix to get restart, stop, start
                action="${action#/tor_}"
                local num="${cmd##*_}"
                num="${num%%@*}"              # strip @botname suffix
                if ! [[ "$num" =~ ^[0-9]+$ ]] || [ "$num" -lt 1 ] || [ "$num" -gt "${CONTAINER_COUNT:-1}" ]; then
                    telegram_send "❌ Invalid container number: ${num}. Use 1-${CONTAINER_COUNT:-1}."
                else
                    local cname=$(get_container_name "$num")
                    if docker "$action" "$cname" >/dev/null 2>&1; then
                        local emoji="✅"
                        [ "$action" = "stop" ] && emoji="🛑"
                        [ "$action" = "start" ] && emoji="🟢"
                        local safe_cname=$(escape_md "$cname")
                        telegram_send "${emoji} Container ${num} (${safe_cname}): ${action} successful"
                    else
                        local safe_cname=$(escape_md "$cname")
                        telegram_send "❌ Failed to ${action} container ${num} (${safe_cname})"
                    fi
                fi
                ;;
            /tor_snowflake|/tor_snowflake@*)
                if [ "${SNOWFLAKE_ENABLED:-false}" != "true" ]; then
                    telegram_send "❄ Snowflake proxy is not enabled."
                elif ! is_snowflake_running; then
                    telegram_send "❄ *Snowflake Proxy*
🔴 Status: Stopped"
                else
                    local _sf_agg=$(get_snowflake_stats 2>/dev/null)
                    local sf_total_conns=$(echo "$_sf_agg" | awk '{print $1}')
                    local sf_in=$(echo "$_sf_agg" | awk '{print $2}')
                    local sf_out=$(echo "$_sf_agg" | awk '{print $3}')
                    sf_total_conns=${sf_total_conns:-0}; sf_in=${sf_in:-0}; sf_out=${sf_out:-0}
                    local sf_total=$((sf_in + sf_out))
                    local sf_started=$(docker inspect --format='{{.State.StartedAt}}' "$(get_snowflake_name 1)" 2>/dev/null | cut -d'.' -f1)
                    local sf_uptime="unknown"
                    if [ -n "$sf_started" ]; then
                        local sf_se=$(date -d "$sf_started" +%s 2>/dev/null || echo 0)
                        if [ "$sf_se" -gt 0 ] 2>/dev/null; then
                            local sf_diff=$(( $(date +%s) - sf_se ))
                            local sf_d=$((sf_diff / 86400)) sf_h=$(( (sf_diff % 86400) / 3600 )) sf_m=$(( (sf_diff % 3600) / 60 ))
                            [ "$sf_d" -gt 0 ] && sf_uptime="${sf_d}d ${sf_h}h ${sf_m}m" || sf_uptime="${sf_h}h ${sf_m}m"
                        fi
                    fi
                    # Top countries
                    local sf_countries=""
                    sf_countries=$(get_snowflake_country_stats 2>/dev/null | head -5)
                    local sf_msg="❄ *Snowflake Proxy* (${SNOWFLAKE_COUNT:-1} instance(s))
🟢 Status: Running
⏱ Uptime: ${sf_uptime}
👥 Total connections: ${sf_total_conns}
📊 Traffic: ↓ $(format_bytes $sf_in) ↑ $(format_bytes $sf_out)
💾 Total transferred: $(format_bytes $sf_total)"
                    if [ -n "$sf_countries" ]; then
                        sf_msg+=$'\n'"🗺 Top countries:"
                        while IFS='|' read -r cnt cc; do
                            [ -z "$cc" ] && continue
                            sf_msg+=$'\n'"  ${cc}: ${cnt}"
                        done <<< "$sf_countries"
                    fi
                    telegram_send "$sf_msg"
                fi
                ;;
            /tor_unbounded|/tor_unbounded@*)
                if [ "${UNBOUNDED_ENABLED:-false}" != "true" ]; then
                    telegram_send "🌐 Unbounded proxy is not enabled."
                elif ! is_unbounded_running; then
                    telegram_send "🌐 *Unbounded Proxy (Lantern)*
🔴 Status: Stopped"
                else
                    local _ub_agg=$(get_unbounded_stats 2>/dev/null)
                    local ub_live_conns=$(echo "$_ub_agg" | awk '{print $1}')
                    local ub_total_conns=$(echo "$_ub_agg" | awk '{print $2}')
                    ub_live_conns=${ub_live_conns:-0}; ub_total_conns=${ub_total_conns:-0}
                    local ub_started=$(docker inspect --format='{{.State.StartedAt}}' "$UNBOUNDED_CONTAINER" 2>/dev/null | cut -d'.' -f1)
                    local ub_uptime="unknown"
                    if [ -n "$ub_started" ]; then
                        local ub_se=$(date -d "$ub_started" +%s 2>/dev/null || echo 0)
                        if [ "$ub_se" -gt 0 ] 2>/dev/null; then
                            local ub_diff=$(( $(date +%s) - ub_se ))
                            local ub_d=$((ub_diff / 86400)) ub_h=$(( (ub_diff % 86400) / 3600 )) ub_m=$(( (ub_diff % 3600) / 60 ))
                            [ "$ub_d" -gt 0 ] && ub_uptime="${ub_d}d ${ub_h}h ${ub_m}m" || ub_uptime="${ub_h}h ${ub_m}m"
                        fi
                    fi
                    local ub_msg="🌐 *Unbounded Proxy (Lantern)*
🟢 Status: Running
⏱ Uptime: ${ub_uptime}
👥 Live connections: ${ub_live_conns}
📊 All-time connections: ${ub_total_conns}"
                    telegram_send "$ub_msg"
                fi
                ;;
            /tor_mtproxy|/tor_mtproxy@*)
                if [ "${MTPROXY_ENABLED:-false}" != "true" ]; then
                    telegram_send "📱 MTProxy is not enabled."
                elif ! is_mtproxy_running; then
                    telegram_send "📱 *MTProxy (Telegram)*
🔴 Status: Stopped"
                else
                    local _mtp_agg=$(get_mtproxy_stats 2>/dev/null)
                    local mtp_in=$(echo "$_mtp_agg" | awk '{print $1}')
                    local mtp_out=$(echo "$_mtp_agg" | awk '{print $2}')
                    mtp_in=${mtp_in:-0}; mtp_out=${mtp_out:-0}
                    local mtp_started=$(docker inspect --format='{{.State.StartedAt}}' "$MTPROXY_CONTAINER" 2>/dev/null | cut -d'.' -f1)
                    local mtp_uptime="unknown"
                    if [ -n "$mtp_started" ]; then
                        local mtp_se=$(date -d "$mtp_started" +%s 2>/dev/null || echo 0)
                        if [ "$mtp_se" -gt 0 ] 2>/dev/null; then
                            local mtp_diff=$(( $(date +%s) - mtp_se ))
                            local mtp_d=$((mtp_diff / 86400)) mtp_h=$(( (mtp_diff % 86400) / 3600 )) mtp_m=$(( (mtp_diff % 3600) / 60 ))
                            [ "$mtp_d" -gt 0 ] && mtp_uptime="${mtp_d}d ${mtp_h}h ${mtp_m}m" || mtp_uptime="${mtp_h}h ${mtp_m}m"
                        fi
                    fi
                    local mtp_msg="📱 *MTProxy (Telegram)*
🟢 Status: Running
⏱ Uptime: ${mtp_uptime}
📊 Traffic: ↓ $(format_bytes $mtp_in) ↑ $(format_bytes $mtp_out)
🔗 Port: ${MTPROXY_PORT} | Domain: ${MTPROXY_DOMAIN}

_Use /tor\_mtproxy\_qr to get the proxy link and QR code._"
                    telegram_send "$mtp_msg"
                fi
                ;;
            /tor_mtproxy_qr|/tor_mtproxy_qr@*)
                if [ "${MTPROXY_ENABLED:-false}" != "true" ]; then
                    telegram_send "📱 MTProxy is not enabled."
                elif ! is_mtproxy_running; then
                    telegram_send "📱 MTProxy is not running. Start it first."
                else
                    # Send the link and QR code
                    telegram_notify_mtproxy_started
                fi
                ;;
            /tor_help|/tor_help@*)
                telegram_send "📖 *Available Commands*
/tor\_status — Full status report
/tor\_peers — Current circuit count
/tor\_uptime — Per-container uptime + 24h availability
/tor\_containers — Per-container status
/tor\_snowflake — Snowflake proxy details
/tor\_unbounded — Unbounded (Lantern) proxy details
/tor\_mtproxy — MTProxy (Telegram) proxy details
/tor\_mtproxy\_qr — Get MTProxy link and QR code
/tor\_restart\_N — Restart container N
/tor\_stop\_N — Stop container N
/tor\_start\_N — Start container N
/tor\_help — Show this help"
                ;;
        esac
    done <<< "$parsed"

    [ "$max_id" -gt "$offset" ] 2>/dev/null && echo "$max_id" > "$offset_file"
}

# State variables
cpu_breach=0
ram_breach=0
zero_peers_since=0
last_alert_cpu=0
last_alert_ram=0
last_alert_down=0
last_alert_peers=0
last_rotation_ts=0

# Ensure data directory exists
mkdir -p "$INSTALL_DIR/relay_stats"

# Persist daily/weekly timestamps across restarts
_ts_dir="$INSTALL_DIR/relay_stats"
last_daily_ts=$(cat "$_ts_dir/.last_daily_ts" 2>/dev/null || echo 0)
[ "$last_daily_ts" -eq "$last_daily_ts" ] 2>/dev/null || last_daily_ts=0
last_weekly_ts=$(cat "$_ts_dir/.last_weekly_ts" 2>/dev/null || echo 0)
[ "$last_weekly_ts" -eq "$last_weekly_ts" ] 2>/dev/null || last_weekly_ts=0
last_report_ts=$(cat "$_ts_dir/.last_report_ts" 2>/dev/null || echo 0)
[ "$last_report_ts" -eq "$last_report_ts" ] 2>/dev/null || last_report_ts=0

while true; do
    sleep 60

    # Re-read settings (with validation)
    if [ -f "$INSTALL_DIR/settings.conf" ]; then
        if ! grep -vE '^\s*$|^\s*#|^[A-Za-z_][A-Za-z0-9_]*='\''[^'\'']*'\''$|^[A-Za-z_][A-Za-z0-9_]*=[0-9]+$|^[A-Za-z_][A-Za-z0-9_]*=(true|false)$' "$INSTALL_DIR/settings.conf" 2>/dev/null | grep -q .; then
            source "$INSTALL_DIR/settings.conf"
        fi
    fi

    # Exit if disabled
    [ "$TELEGRAM_ENABLED" != "true" ] && exit 0
    [ -z "$TELEGRAM_BOT_TOKEN" ] && exit 0

    # Core per-minute tasks
    process_commands
    track_uptime
    check_alerts

    # Daily rotation check
    now_ts=$(date +%s)
    if [ $((now_ts - last_rotation_ts)) -ge 86400 ] 2>/dev/null; then
        rotate_cumulative_data
        last_rotation_ts=$now_ts
    fi

    # Daily summary
    if [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] && [ $((now_ts - last_daily_ts)) -ge 86400 ] 2>/dev/null; then
        build_summary "Daily" 86400
        last_daily_ts=$now_ts
        echo "$now_ts" > "$_ts_dir/.last_daily_ts"
    fi

    # Weekly summary
    if [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ] && [ $((now_ts - last_weekly_ts)) -ge 604800 ] 2>/dev/null; then
        build_summary "Weekly" 604800
        last_weekly_ts=$now_ts
        echo "$now_ts" > "$_ts_dir/.last_weekly_ts"
    fi

    # Regular periodic report (wall-clock aligned to start hour)
    # Skip if all notification types are disabled (bot-only mode)
    if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ] || [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] || [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
    interval_hours=${TELEGRAM_INTERVAL:-6}
    start_hour=${TELEGRAM_START_HOUR:-0}
    interval_secs=$((interval_hours * 3600))
    current_hour=$(date +%-H)
    hour_diff=$(( (current_hour - start_hour + 24) % 24 ))
    if [ "$interval_hours" -gt 0 ] && [ $((hour_diff % interval_hours)) -eq 0 ] 2>/dev/null; then
        if [ $((now_ts - last_report_ts)) -ge $((interval_secs - 120)) ] 2>/dev/null; then
            report=$(build_report)
            telegram_send "$report"
            record_snapshot
            last_report_ts=$now_ts
            echo "$now_ts" > "$_ts_dir/.last_report_ts"
        fi
    fi
    fi
done
TGEOF

    local escaped_dir=$(printf '%s\n' "$INSTALL_DIR" | sed 's/[&\\]/\\&/g')
    sed "s#REPLACE_INSTALL_DIR#${escaped_dir}#g" "$INSTALL_DIR/torware-telegram.sh" > "$INSTALL_DIR/torware-telegram.sh.tmp" && mv "$INSTALL_DIR/torware-telegram.sh.tmp" "$INSTALL_DIR/torware-telegram.sh"
    chmod 700 "$INSTALL_DIR/torware-telegram.sh"
}

setup_telegram_service() {
    telegram_generate_notify_script
    if command -v systemctl &>/dev/null; then
        cat > /etc/systemd/system/torware-telegram.service << EOF
[Unit]
Description=Torware Telegram Notifications
After=network.target docker.service
Requires=docker.service

[Service]
Type=simple
ExecStart=/bin/bash $INSTALL_DIR/torware-telegram.sh
Restart=on-failure
RestartSec=30

[Install]
WantedBy=multi-user.target
EOF
        systemctl daemon-reload 2>/dev/null || true
        systemctl enable torware-telegram.service 2>/dev/null || true
        systemctl restart torware-telegram.service 2>/dev/null || true
    fi
}

telegram_stop_notify() {
    if command -v systemctl &>/dev/null && [ -f /etc/systemd/system/torware-telegram.service ]; then
        systemctl stop torware-telegram.service 2>/dev/null || true
    fi
    # Clean up legacy PID-based loop if present
    if [ -f "$INSTALL_DIR/telegram_notify.pid" ]; then
        local pid=$(cat "$INSTALL_DIR/telegram_notify.pid" 2>/dev/null)
        if echo "$pid" | grep -qE '^[0-9]+$' && kill -0 "$pid" 2>/dev/null; then
            kill -- -"$pid" 2>/dev/null || kill "$pid" 2>/dev/null || true
        fi
        rm -f "$INSTALL_DIR/telegram_notify.pid"
    fi
    pkill -f "torware-telegram.sh" 2>/dev/null || true
}

telegram_start_notify() {
    telegram_stop_notify
    if [ "$TELEGRAM_ENABLED" = "true" ] && [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        setup_telegram_service
    fi
}

telegram_disable_service() {
    if command -v systemctl &>/dev/null && [ -f /etc/systemd/system/torware-telegram.service ]; then
        systemctl stop torware-telegram.service 2>/dev/null || true
        systemctl disable torware-telegram.service 2>/dev/null || true
    fi
    pkill -f "torware-telegram.sh" 2>/dev/null || true
}

show_telegram_menu() {
    while true; do
        # Reload settings from disk to reflect any changes
        load_settings
        clear
        print_header
        if [ "$TELEGRAM_ENABLED" = "true" ] && [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
            # Already configured — show management menu
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo -e "${CYAN}  TELEGRAM NOTIFICATIONS${NC}"
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo ""
            local _sh="${TELEGRAM_START_HOUR:-0}"
            local alerts_st="${GREEN}ON${NC}"
            [ "${TELEGRAM_ALERTS_ENABLED:-true}" != "true" ] && alerts_st="${RED}OFF${NC}"
            local daily_st="${GREEN}ON${NC}"
            [ "${TELEGRAM_DAILY_SUMMARY:-true}" != "true" ] && daily_st="${RED}OFF${NC}"
            local weekly_st="${GREEN}ON${NC}"
            [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" != "true" ] && weekly_st="${RED}OFF${NC}"
            # Check if any notification type is active
            local _any_notif=false
            if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ] || [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] || [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
                _any_notif=true
            fi
            if [ "$_any_notif" = "true" ]; then
                echo -e "  Status: ${GREEN}✓ Enabled${NC} (every ${TELEGRAM_INTERVAL}h starting at ${_sh}:00)"
            else
                echo -e "  Status: ${GREEN}✓ Connected${NC} ${DIM}(bot only — no auto-notifications)${NC}"
            fi
            echo ""
            echo -e "  1. 📩 Send test message"
            if [ "$_any_notif" = "true" ]; then
                echo -e "  2. ⏱  Change interval"
            else
                echo -e "  2. 📬 Enable notifications"
            fi
            echo -e "  3. ❌ Disconnect bot"
            echo -e "  4. 🔄 Reconfigure (new bot/chat)"
            echo -e "  5. 🚨 Alerts (CPU/RAM/down):    ${alerts_st}"
            echo -e "  6. 📋 Daily summary:            ${daily_st}"
            echo -e "  7. 📊 Weekly summary:           ${weekly_st}"
            local cur_label="${TELEGRAM_SERVER_LABEL:-$(hostname 2>/dev/null || echo 'unknown')}"
            echo -e "  8. 🏷  Server label:            ${CYAN}${cur_label}${NC}"
            if [ "$MTPROXY_ENABLED" = "true" ]; then
                echo -e "  9. 📱 Send MTProxy link & QR"
            fi
            echo -e "  0. ← Back"
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo ""
            read -p "  Enter choice: " tchoice < /dev/tty || return
            case "$tchoice" in
                1)
                    echo ""
                    echo -ne "  Sending test message... "
                    if telegram_test_message; then
                        echo -e "${GREEN}✓ Sent!${NC}"
                    else
                        echo -e "${RED}✗ Failed. Check your token/chat ID.${NC}"
                    fi
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                2)
                    echo ""
                    if [ "$_any_notif" != "true" ]; then
                        # Bot-only mode — enable notifications first
                        TELEGRAM_ALERTS_ENABLED=true
                        TELEGRAM_DAILY_SUMMARY=true
                        TELEGRAM_WEEKLY_SUMMARY=true
                    fi
                    echo -e "  Select notification interval:"
                    echo -e "  1. Every 1 hour"
                    echo -e "  2. Every 3 hours"
                    echo -e "  3. Every 6 hours (recommended)"
                    echo -e "  4. Every 12 hours"
                    echo -e "  5. Every 24 hours"
                    echo ""
                    read -p "  Choice [1-5]: " ichoice < /dev/tty || true
                    case "$ichoice" in
                        1) TELEGRAM_INTERVAL=1 ;;
                        2) TELEGRAM_INTERVAL=3 ;;
                        3) TELEGRAM_INTERVAL=6 ;;
                        4) TELEGRAM_INTERVAL=12 ;;
                        5) TELEGRAM_INTERVAL=24 ;;
                        *) echo -e "  ${RED}Invalid choice${NC}"; read -n 1 -s -r -p "  Press any key..." < /dev/tty || true; continue ;;
                    esac
                    echo ""
                    echo -e "  What hour should reports start? (0-23, e.g. 8 = 8:00 AM)"
                    echo -e "  Reports will repeat every ${TELEGRAM_INTERVAL}h from this hour."
                    read -p "  Start hour [0-23] (default ${TELEGRAM_START_HOUR:-0}): " shchoice < /dev/tty || true
                    if [ -n "$shchoice" ] && [ "$shchoice" -ge 0 ] 2>/dev/null && [ "$shchoice" -le 23 ] 2>/dev/null; then
                        TELEGRAM_START_HOUR=$shchoice
                    fi
                    save_settings
                    telegram_start_notify
                    echo -e "  ${GREEN}✓ Reports every ${TELEGRAM_INTERVAL}h starting at ${TELEGRAM_START_HOUR:-0}:00${NC}"
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                3)
                    TELEGRAM_ENABLED=false
                    save_settings
                    telegram_disable_service
                    echo -e "  ${GREEN}✓ Telegram notifications disabled${NC}"
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                4)
                    telegram_setup_wizard
                    ;;
                5)
                    if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ]; then
                        TELEGRAM_ALERTS_ENABLED=false
                        echo -e "  ${RED}✗ Alerts disabled${NC}"
                    else
                        TELEGRAM_ALERTS_ENABLED=true
                        echo -e "  ${GREEN}✓ Alerts enabled${NC}"
                    fi
                    save_settings
                    if [ "$TELEGRAM_ALERTS_ENABLED" = "true" ] || [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] || [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
                        telegram_start_notify
                    else
                        telegram_disable_service
                    fi
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                6)
                    if [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ]; then
                        TELEGRAM_DAILY_SUMMARY=false
                        echo -e "  ${RED}✗ Daily summary disabled${NC}"
                    else
                        TELEGRAM_DAILY_SUMMARY=true
                        echo -e "  ${GREEN}✓ Daily summary enabled${NC}"
                    fi
                    save_settings
                    if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ] || [ "$TELEGRAM_DAILY_SUMMARY" = "true" ] || [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
                        telegram_start_notify
                    else
                        telegram_disable_service
                    fi
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                7)
                    if [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
                        TELEGRAM_WEEKLY_SUMMARY=false
                        echo -e "  ${RED}✗ Weekly summary disabled${NC}"
                    else
                        TELEGRAM_WEEKLY_SUMMARY=true
                        echo -e "  ${GREEN}✓ Weekly summary enabled${NC}"
                    fi
                    save_settings
                    if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ] || [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] || [ "$TELEGRAM_WEEKLY_SUMMARY" = "true" ]; then
                        telegram_start_notify
                    else
                        telegram_disable_service
                    fi
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                8)
                    echo ""
                    local cur_label="${TELEGRAM_SERVER_LABEL:-$(hostname 2>/dev/null || echo 'unknown')}"
                    echo -e "  Current label: ${CYAN}${cur_label}${NC}"
                    echo -e "  This label appears in all Telegram messages to identify the server."
                    echo -e "  Leave blank to use hostname ($(hostname 2>/dev/null || echo 'unknown'))"
                    echo ""
                    read -p "  New label: " new_label < /dev/tty || true
                    TELEGRAM_SERVER_LABEL="${new_label}"
                    save_settings
                    if [ "${TELEGRAM_ALERTS_ENABLED:-true}" = "true" ] || [ "${TELEGRAM_DAILY_SUMMARY:-true}" = "true" ] || [ "${TELEGRAM_WEEKLY_SUMMARY:-true}" = "true" ]; then
                        telegram_start_notify
                    fi
                    local display_label="${TELEGRAM_SERVER_LABEL:-$(hostname 2>/dev/null || echo 'unknown')}"
                    echo -e "  ${GREEN}✓ Server label set to: ${display_label}${NC}"
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                9)
                    echo ""
                    if [ "$MTPROXY_ENABLED" != "true" ]; then
                        log_warn "MTProxy is not enabled. Enable it first from the main menu."
                        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    elif ! is_mtproxy_running; then
                        log_warn "MTProxy is not running. Start it first with 'torware start'."
                        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    else
                        echo -ne "  Sending MTProxy link & QR code... "
                        if telegram_notify_mtproxy_started; then
                            echo -e "${GREEN}✓ Sent!${NC}"
                        else
                            echo -e "${RED}✗ Failed${NC}"
                        fi
                        read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    fi
                    ;;
                0) return ;;
            esac
        elif [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
            # Disabled but credentials exist — offer re-enable
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo -e "${CYAN}  TELEGRAM NOTIFICATIONS${NC}"
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo ""
            echo -e "  Status: ${RED}✗ Disabled${NC} (credentials saved)"
            echo ""
            echo -e "  1. ✅ Re-enable notifications (every ${TELEGRAM_INTERVAL:-6}h)"
            echo -e "  2. 🔄 Reconfigure (new bot/chat)"
            echo -e "  0. ← Back"
            echo -e "${CYAN}─────────────────────────────────────────────────────────────────${NC}"
            echo ""
            read -p "  Enter choice: " tchoice < /dev/tty || return
            case "$tchoice" in
                1)
                    TELEGRAM_ENABLED=true
                    save_settings
                    telegram_start_notify
                    echo -e "  ${GREEN}✓ Telegram notifications re-enabled${NC}"
                    read -n 1 -s -r -p "  Press any key..." < /dev/tty || true
                    ;;
                2)
                    telegram_setup_wizard
                    ;;
                0) return ;;
            esac
        else
            # Not configured — run wizard
            telegram_setup_wizard
            return
        fi
    done
}

#═══════════════════════════════════════════════════════════════════════
# Fingerprint & Bridge Line Display
#═══════════════════════════════════════════════════════════════════════

show_fingerprint() {
    load_settings
    local count=${CONTAINER_COUNT:-1}

    echo ""
    echo -e "${CYAN}  Relay Fingerprints:${NC}"
    echo ""
    for i in $(seq 1 $count); do
        local fp=$(get_tor_fingerprint $i)
        local cname=$(get_container_name $i)
        local c_rtype=$(get_container_relay_type $i)
        if [ -n "$fp" ]; then
            echo -e "    ${BOLD}$cname${NC} [${c_rtype}]: $fp"
        else
            echo -e "    ${BOLD}$cname${NC} [${c_rtype}]: ${DIM}(not yet generated)${NC}"
        fi
    done
    echo ""
}

show_bridge_line() {
    load_settings

    # Check if any container is a bridge
    local count=${CONTAINER_COUNT:-1}
    local any_bridge=false
    for i in $(seq 1 $count); do
        [ "$(get_container_relay_type $i)" = "bridge" ] && any_bridge=true
    done
    if [ "$any_bridge" = "false" ]; then
        log_warn "Bridge lines are only available for bridge relays. No bridge containers configured."
        return 1
    fi

    echo ""
    echo -e "${CYAN}  Bridge Lines (share these with users who need to bypass censorship):${NC}"
    echo ""
    for i in $(seq 1 $count); do
        # Skip non-bridge containers
        [ "$(get_container_relay_type $i)" != "bridge" ] && continue
        local bl=$(get_bridge_line $i)
        local cname=$(get_container_name $i)
        if [ -n "$bl" ]; then
            echo -e "    ${BOLD}$cname:${NC}"
            echo -e "    ${GREEN}$bl${NC}"
            echo ""
            # QR code if available
            if command -v qrencode &>/dev/null; then
                echo -e "    ${DIM}QR Code:${NC}"
                echo "$bl" | qrencode -t ANSIUTF8 2>/dev/null | sed 's/^/      /'
                echo ""
            fi
        else
            echo -e "    ${BOLD}$cname:${NC} ${DIM}(not yet available - relay may still be bootstrapping)${NC}"
        fi
    done
}

#═══════════════════════════════════════════════════════════════════════
# Uninstall
#═══════════════════════════════════════════════════════════════════════

uninstall() {
    echo ""
    echo -e "${RED}╔═════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${RED}║                     UNINSTALL TORWARE                     ║${NC}"
    echo -e "${RED}╠═════════════════════════════════════════════════════════════╣${NC}"
    echo -e "${RED}║                                                           ║${NC}"
    echo -e "${RED}║  This will remove:                                        ║${NC}"
    echo -e "${RED}║  • All containers (Tor, Snowflake, Unbounded, MTProxy)    ║${NC}"
    echo -e "${RED}║  • All Docker volumes (relay data & keys)                 ║${NC}"
    echo -e "${RED}║  • Systemd/OpenRC services                                ║${NC}"
    echo -e "${RED}║  • Configuration files in /opt/torware                    ║${NC}"
    echo -e "${RED}║  • Management CLI (/usr/local/bin/torware)                ║${NC}"
    echo -e "${RED}║                                                           ║${NC}"
    echo -e "${RED}║  Docker itself will NOT be removed.                       ║${NC}"
    echo -e "${RED}║                                                           ║${NC}"
    echo -e "${RED}╚═════════════════════════════════════════════════════════════╝${NC}"
    echo ""

    read -p "  Type 'yes' to confirm uninstall: " confirm < /dev/tty || true
    if [ "$confirm" != "yes" ]; then
        log_info "Uninstall cancelled."
        return 0
    fi

    # Offer to keep backups
    local keep_backups=false
    if [ -d "$BACKUP_DIR" ] && ls "$BACKUP_DIR"/tor_keys_*.tar.gz &>/dev/null; then
        echo ""
        read -p "  Keep backup files? [Y/n] " keep_choice < /dev/tty || true
        if [[ ! "$keep_choice" =~ ^[Nn]$ ]]; then
            keep_backups=true
        fi
    fi

    echo ""
    log_info "Uninstalling Torware..."

    # Detect systemd if not already set (cli_main skips detect_os)
    if [ -z "$HAS_SYSTEMD" ]; then
        if command -v systemctl &>/dev/null && [ -d /run/systemd/system ]; then
            HAS_SYSTEMD=true
        else
            HAS_SYSTEMD=false
        fi
    fi

    # Stop services
    if [ "$HAS_SYSTEMD" = "true" ]; then
        systemctl stop torware 2>/dev/null || true
        systemctl disable torware 2>/dev/null || true
        rm -f /etc/systemd/system/torware.service
        systemctl stop torware-tracker 2>/dev/null || true
        systemctl disable torware-tracker 2>/dev/null || true
        rm -f /etc/systemd/system/torware-tracker.service
        systemctl stop torware-telegram 2>/dev/null || true
        systemctl disable torware-telegram 2>/dev/null || true
        rm -f /etc/systemd/system/torware-telegram.service
        systemctl daemon-reload 2>/dev/null || true
    elif command -v rc-update &>/dev/null; then
        rc-service torware stop 2>/dev/null || true
        rc-update del torware 2>/dev/null || true
        rm -f /etc/init.d/torware
    elif [ -f /etc/init.d/torware ]; then
        service torware stop 2>/dev/null || true
        if command -v update-rc.d &>/dev/null; then
            update-rc.d torware remove 2>/dev/null || true
        fi
        rm -f /etc/init.d/torware
    fi

    # Kill any lingering service processes
    pkill -f "torware-tracker.sh" 2>/dev/null || true
    pkill -f "torware-telegram.sh" 2>/dev/null || true

    # Stop and remove containers (always check 1-5 to catch orphaned containers)
    for i in $(seq 1 5); do
        local cname=$(get_container_name $i)
        docker stop --timeout 30 "$cname" 2>/dev/null || true
        docker rm -f "$cname" 2>/dev/null || true
    done

    # Remove volumes
    for i in $(seq 1 5); do
        local vname=$(get_volume_name $i)
        docker volume rm "$vname" 2>/dev/null || true
    done

    # Stop and remove Snowflake (check up to 2 for orphaned instances)
    for _sfi in 1 2; do
        local _sfn=$(get_snowflake_name $_sfi)
        local _sfv=$(get_snowflake_volume $_sfi)
        docker stop --timeout 10 "$_sfn" 2>/dev/null || true
        docker rm -f "$_sfn" 2>/dev/null || true
        docker volume rm "$_sfv" 2>/dev/null || true
    done

    # Stop and remove Unbounded
    docker stop --timeout 10 "$UNBOUNDED_CONTAINER" 2>/dev/null || true
    docker rm -f "$UNBOUNDED_CONTAINER" 2>/dev/null || true
    docker volume rm "$UNBOUNDED_VOLUME" 2>/dev/null || true

    # Stop and remove MTProxy
    docker stop --timeout 10 "$MTPROXY_CONTAINER" 2>/dev/null || true
    docker rm -f "$MTPROXY_CONTAINER" 2>/dev/null || true

    # Remove images
    docker rmi "$BRIDGE_IMAGE" 2>/dev/null || true
    docker rmi "$RELAY_IMAGE" 2>/dev/null || true
    docker rmi "$SNOWFLAKE_IMAGE" 2>/dev/null || true
    docker rmi "$UNBOUNDED_IMAGE" 2>/dev/null || true
    docker rmi "$MTPROXY_IMAGE" 2>/dev/null || true

    # Remove files
    if [ "$keep_backups" = "true" ]; then
        # Remove everything except backups
        find "$INSTALL_DIR" -mindepth 1 -maxdepth 1 ! -name backups -exec rm -rf {} + 2>/dev/null || true
        log_info "Backups preserved in $BACKUP_DIR"
    else
        rm -rf "$INSTALL_DIR"
    fi

    rm -f /usr/local/bin/torware

    # Clean up cookie cache and generated scripts
    rm -f /tmp/.tor_cookie_cache_* "${TMPDIR:-/tmp}"/.tor_cookie_cache_* 2>/dev/null || true
    rm -f /usr/local/bin/torware-tracker.sh /usr/local/bin/torware-telegram.sh 2>/dev/null || true

    echo ""
    log_success "Torware has been uninstalled."
    echo ""
}

#═══════════════════════════════════════════════════════════════════════
# CLI Logs
#═══════════════════════════════════════════════════════════════════════

show_logs() {
    load_settings
    local count=${CONTAINER_COUNT:-1}

    echo ""
    echo -e "  ${BOLD}View Logs:${NC}"
    echo ""
    local _opt=1
    for i in $(seq 1 $count); do
        local _cn=$(get_container_name $i)
        local _rt=$(get_container_relay_type $i)
        echo -e "    ${GREEN}${_opt}.${NC} ${_cn} (${_rt})"
        _opt=$((_opt + 1))
    done
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        for _sfi in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
            echo -e "    ${GREEN}${_opt}.${NC} $(get_snowflake_name $_sfi) (WebRTC proxy)"
            _opt=$((_opt + 1))
        done
    fi
    local _ub_opt=""
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        _ub_opt=$_opt
        echo -e "    ${GREEN}${_opt}.${NC} ${UNBOUNDED_CONTAINER} (Lantern proxy)"
        _opt=$((_opt + 1))
    fi
    local _mtp_opt=""
    if [ "$MTPROXY_ENABLED" = "true" ]; then
        _mtp_opt=$_opt
        echo -e "    ${GREEN}${_opt}.${NC} ${MTPROXY_CONTAINER} (Telegram proxy)"
        _opt=$((_opt + 1))
    fi
    echo -e "    ${GREEN}0.${NC} ← Back"
    echo ""
    read -p "  choice: " choice < /dev/tty || return

    [ "$choice" = "0" ] && return

    local cname=""
    local _sf_start=$((count + 1))
    local _sf_end=$((count + ${SNOWFLAKE_COUNT:-1}))
    if [ -n "$_mtp_opt" ] && [ "$choice" = "$_mtp_opt" ] 2>/dev/null; then
        cname="$MTPROXY_CONTAINER"
    elif [ -n "$_ub_opt" ] && [ "$choice" = "$_ub_opt" ] 2>/dev/null; then
        cname="$UNBOUNDED_CONTAINER"
    elif [ "$SNOWFLAKE_ENABLED" = "true" ] && [ "$choice" -ge "$_sf_start" ] 2>/dev/null && [ "$choice" -le "$_sf_end" ] 2>/dev/null; then
        local _sf_idx=$((choice - count))
        cname=$(get_snowflake_name $_sf_idx)
    elif [[ "$choice" =~ ^[1-9]$ ]] && [ "$choice" -le "$count" ]; then
        cname=$(get_container_name $choice)
    else
        log_warn "Invalid choice"
        return
    fi

    log_info "Streaming logs for $cname (Ctrl+C to return to menu)..."
    # Trap SIGINT so it doesn't propagate to the parent menu
    trap 'true' INT
    docker logs -f --tail 50 "$cname" 2>&1 || true
    trap - INT
    echo ""
    log_info "Log stream ended."
}

#═══════════════════════════════════════════════════════════════════════
# Version & Help
#═══════════════════════════════════════════════════════════════════════

show_version() {
    load_settings
    echo -e "  Torware v${VERSION}"
    for i in $(seq 1 ${CONTAINER_COUNT:-1}); do
        local image=$(get_docker_image $i)
        local digest
        digest=$(docker inspect --format '{{index .RepoDigests 0}}' "$image" 2>/dev/null || echo "unknown")
        local rtype=$(get_container_relay_type $i)
        echo -e "  Container $i ($rtype): $image"
        echo -e "    Digest: ${digest}"
    done
}

show_help() {
    echo ""
    echo -e "${CYAN}  Torware v${VERSION}${NC}"
    echo ""
    echo -e "  ${BOLD}Usage:${NC} torware <command>"
    echo ""
    echo -e "  ${BOLD}Commands:${NC}"
    echo -e "    ${GREEN}menu${NC}          Open interactive management menu"
    echo -e "    ${GREEN}status${NC}        Show relay status"
    echo -e "    ${GREEN}dashboard${NC}     Live TUI dashboard (auto-refresh)"
    echo -e "    ${GREEN}stats${NC}         Advanced stats with country charts"
    echo -e "    ${GREEN}peers${NC}         Live circuits by country"
    echo -e "    ${GREEN}start${NC}         Start all relay containers"
    echo -e "    ${GREEN}stop${NC}          Stop all relay containers"
    echo -e "    ${GREEN}restart${NC}       Restart all relay containers"
    echo -e "    ${GREEN}logs${NC}          Stream container logs"
    echo -e "    ${GREEN}health${NC}        Run health diagnostics"
    echo -e "    ${GREEN}fingerprint${NC}   Show relay fingerprint(s)"
    echo -e "    ${GREEN}bridge-line${NC}   Show bridge line(s) for sharing"
    echo -e "    ${GREEN}backup${NC}        Backup relay identity keys"
    echo -e "    ${GREEN}restore${NC}       Restore relay keys from backup"
    echo -e "    ${GREEN}snowflake${NC}     Toggle/manage Snowflake proxy"
    echo -e "    ${GREEN}unbounded${NC}     Toggle/manage Unbounded (Lantern) proxy"
    echo -e "    ${GREEN}mtproxy${NC}       Toggle/manage MTProxy (Telegram) proxy"
    echo -e "    ${GREEN}version${NC}       Show version info"
    echo -e "    ${GREEN}uninstall${NC}     Remove Torware"
    echo ""
}

#═══════════════════════════════════════════════════════════════════════
# Interactive Menu
#═══════════════════════════════════════════════════════════════════════

show_about() {
    local _back=false
    while [ "$_back" = "false" ]; do
        clear
        echo -e "${CYAN}"
        echo "═══════════════════════════════════════════════════════════════"
        echo "                    ABOUT & LEARN"
        echo "═══════════════════════════════════════════════════════════════"
        echo -e "${NC}"
        echo -e "    ${GREEN}1.${NC} 🧅 What is Tor?"
        echo -e "    ${GREEN}2.${NC} 🌉 Bridge Relays (obfs4)"
        echo -e "    ${GREEN}3.${NC} 🔁 Middle Relays"
        echo -e "    ${GREEN}4.${NC} 🚪 Exit Relays"
        echo -e "    ${GREEN}5.${NC} ❄  Snowflake Proxy"
        echo -e "    ${GREEN}6.${NC} 🌐 Lantern Unbounded Proxy"
        echo -e "    ${GREEN}7.${NC} 📱 MTProxy (Telegram Proxy)"
        echo -e "    ${GREEN}8.${NC} 🔒 How Tor Circuits Work"
        echo -e "    ${GREEN}9.${NC} 📊 Understanding Your Dashboard"
        echo -e "   ${GREEN}10.${NC} ⚖  Legal & Safety Considerations"
        echo -e "   ${GREEN}11.${NC} 📖 About Torware"
        echo -e "    ${GREEN}0.${NC} ← Back"
        echo ""
        read -p "  Choose a topic [0-11]: " _topic < /dev/tty || { _back=true; continue; }

        echo ""
        case "$_topic" in
            1)
                echo -e "${CYAN}═══ What is Tor? ═══${NC}"
                echo ""
                echo -e "  Tor (The Onion Router) is free, open-source software that enables"
                echo -e "  anonymous communication over the internet. It works by encrypting"
                echo -e "  your traffic in multiple layers (like an onion) and routing it"
                echo -e "  through a series of volunteer-operated servers called relays."
                echo ""
                echo -e "  ${BOLD}How it protects users:${NC}"
                echo -e "  • Each relay only knows the previous and next hop, never the full path"
                echo -e "  • The entry relay knows your IP but not your destination"
                echo -e "  • The exit relay knows the destination but not your IP"
                echo -e "  • No single relay can link you to your activity"
                echo ""
                echo -e "  ${BOLD}Who uses Tor:${NC}"
                echo -e "  • Journalists protecting sources in authoritarian countries"
                echo -e "  • Activists and dissidents communicating safely"
                echo -e "  • Whistleblowers submitting sensitive information"
                echo -e "  • Ordinary people who value their privacy"
                echo -e "  • Researchers studying censorship and surveillance"
                echo ""
                echo -e "  ${BOLD}The Tor network consists of ~7,000 relays run by volunteers"
                echo -e "  worldwide. By running Torware, you are one of them.${NC}"
                ;;
            2)
                echo -e "${CYAN}═══ Bridge Relays (obfs4) ═══${NC}"
                echo ""
                echo -e "  Bridges are special Tor relays that are ${BOLD}not listed${NC} in the"
                echo -e "  public Tor directory. They serve as secret entry points for"
                echo -e "  users in countries that block access to known Tor relays."
                echo ""
                echo -e "  ${BOLD}How bridges work:${NC}"
                echo -e "  • Bridge addresses are distributed privately via BridgeDB"
                echo -e "  • Users request bridges via bridges.torproject.org or email"
                echo -e "  • The obfs4 pluggable transport disguises Tor traffic to look"
                echo -e "    like random data, making it hard to detect and block"
                echo ""
                echo -e "  ${BOLD}What happens when you run a bridge:${NC}"
                echo -e "  • Your IP is NOT published in the public Tor consensus"
                echo -e "  • BridgeDB distributes your bridge line to users who need it"
                echo -e "  • It can take ${YELLOW}hours to days${NC} for clients to find your bridge"
                echo -e "  • You help users in censored regions bypass internet blocks"
                echo ""
                echo -e "  ${BOLD}Bridge is the safest relay type to run.${NC} Your IP stays"
                echo -e "  unlisted and you only serve as an entry point, never an exit."
                echo ""
                echo ""
                echo -e "  ${BOLD}🏠 Running from home? Port forwarding required:${NC}"
                echo -e "  Your router blocks incoming connections by default. You must"
                echo -e "  forward these ports in your router settings:"
                echo ""
                echo -e "    ${GREEN}ORPort (9001 TCP)${NC}  → your server's local IP"
                echo -e "    ${GREEN}obfs4  (9002 TCP)${NC}  → your server's local IP"
                echo ""
                echo -e "  How: Log into your router (usually 192.168.1.1 or 10.0.0.1),"
                echo -e "  find 'Port Forwarding' and add both TCP port forwards."
                echo -e "  Without this, Tor cannot confirm reachability and your bridge"
                echo -e "  will NOT be published or receive clients."
                echo ""
                echo -e "  ${DIM}Snowflake does NOT need port forwarding — WebRTC handles"
                echo -e "  NAT traversal automatically.${NC}"
                echo ""
                echo -e "  ${BOLD}🕐 Bridge line availability:${NC}"
                echo -e "  After starting, your bridge line (option 'b' in the menu) will"
                echo -e "  show 'not yet available' until Tor completes these steps:"
                echo -e "  1. Bootstrap to 100% and self-test ORPort reachability"
                echo -e "  2. Publish descriptor to bridge authority"
                echo -e "  3. Get included in BridgeDB for distribution"
                echo -e "  This process takes ${YELLOW}a few hours to 1-2 days${NC}. You can verify"
                echo -e "  progress with Health Check (option 8) — look for a valid"
                echo -e "  fingerprint and 'ORPort reachable' in your Tor logs."
                echo -e "  Once the bridge line appears, share it with users who need"
                echo -e "  to bypass censorship — or let BridgeDB distribute it."
                echo ""
                echo -e "  ${DIM}Docker image: thetorproject/obfs4-bridge${NC}"
                ;;
            3)
                echo -e "${CYAN}═══ Middle Relays ═══${NC}"
                echo ""
                echo -e "  Middle relays are the backbone of the Tor network. They sit"
                echo -e "  between the entry (guard) and exit relays in a Tor circuit."
                echo ""
                echo -e "  ${BOLD}What middle relays do:${NC}"
                echo -e "  • Receive encrypted traffic from one relay and pass it to the next"
                echo -e "  • Cannot see the original source or final destination"
                echo -e "  • Cannot decrypt the traffic content"
                echo -e "  • Add hops to increase anonymity for users"
                echo ""
                echo -e "  ${BOLD}Running a middle relay:${NC}"
                echo -e "  • Your IP IS listed in the public Tor consensus"
                echo -e "  • This is generally safe — you only relay encrypted traffic"
                echo -e "  • No abuse complaints since you're not an exit"
                echo -e "  • The ExitPolicy is set to 'reject *:*' (no exit traffic)"
                echo ""
                echo -e "  ${BOLD}Guard status:${NC} After running reliably for ~2 months, your"
                echo -e "  relay may earn the 'Guard' flag, meaning Tor clients trust it"
                echo -e "  enough to use as their entry relay. This is a sign of good"
                echo -e "  reputation in the network."
                ;;
            4)
                echo -e "${CYAN}═══ Exit Relays ═══${NC}"
                echo ""
                echo -e "  Exit relays are the ${BOLD}final hop${NC} in a Tor circuit. They"
                echo -e "  decrypt the outermost layer of encryption and forward the"
                echo -e "  traffic to its final destination on the regular internet."
                echo ""
                echo -e "  ${BOLD}What exit relays do:${NC}"
                echo -e "  • Connect to the destination website/service on behalf of the user"
                echo -e "  • Can see the destination (but NOT who is connecting)"
                echo -e "  • Handle the 'last mile' of the anonymized connection"
                echo ""
                echo -e "  ${RED}${BOLD}⚠ Important considerations:${NC}"
                echo -e "  ${RED}• Your IP appears as the source of all traffic exiting through you${NC}"
                echo -e "  ${RED}• You may receive abuse complaints (DMCA, hacking reports, etc.)${NC}"
                echo -e "  ${RED}• Some ISPs and hosting providers prohibit exit relays${NC}"
                echo -e "  ${RED}• Legal implications vary by jurisdiction${NC}"
                echo ""
                echo -e "  ${BOLD}Exit policies:${NC}"
                echo -e "  • ${GREEN}Reduced${NC} — Only allows common ports (80, 443, etc.)"
                echo -e "  • ${YELLOW}Default${NC} — Tor's standard exit policy"
                echo -e "  • ${RED}Full${NC} — Allows all traffic (most complaints)"
                echo ""
                echo -e "  ${BOLD}Only run an exit relay if you understand the legal risks${NC}"
                echo -e "  ${BOLD}and your hosting provider explicitly permits it.${NC}"
                ;;
            5)
                local _sf_menu_label="Snowflake Proxy (WebRTC)"
                [ "${SNOWFLAKE_COUNT:-1}" -gt 1 ] && _sf_menu_label="Snowflake Proxy (WebRTC) x${SNOWFLAKE_COUNT}"
                echo -e "${CYAN}═══ ${_sf_menu_label} ═══${NC}"
                echo ""
                echo -e "  Snowflake is a pluggable transport that uses ${BOLD}WebRTC${NC} to help"
                echo -e "  censored users connect to the Tor network. It's different from"
                echo -e "  running a Tor relay."
                echo ""
                echo -e "  ${BOLD}How Snowflake works:${NC}"
                echo -e "  1. A censored user's Tor client contacts a ${CYAN}broker${NC}"
                echo -e "  2. The broker matches them with an available proxy (${GREEN}you${NC})"
                echo -e "  3. A WebRTC peer-to-peer connection is established"
                echo -e "  4. Your proxy forwards their traffic to a Tor bridge"
                echo -e "  5. The bridge connects them to the Tor network"
                echo ""
                echo -e "  ${BOLD}You are NOT an exit point.${NC} You're a temporary relay between"
                echo -e "  the censored user and a Tor bridge. The traffic is encrypted"
                echo -e "  end-to-end — you cannot see what the user is doing."
                echo ""
                echo -e "  ${BOLD}NAT types (from your logs):${NC}"
                echo -e "  • ${GREEN}unrestricted${NC} — Best. Direct peer connections. Most clients."
                echo -e "  • ${YELLOW}restricted${NC}   — OK. Uses TURN relay for some connections."
                echo -e "  • ${RED}unknown${NC}      — May have connectivity issues."
                echo ""
                echo -e "  ${BOLD}Resource usage:${NC} Very lightweight (0.5 CPU, 128MB RAM)."
                echo -e "  Can run safely alongside any relay type."
                ;;
            6)
                echo -e "${CYAN}═══ Lantern Unbounded Proxy ═══${NC}"
                echo ""
                echo -e "  Lantern is a free, open-source censorship circumvention tool"
                echo -e "  that helps users in restricted countries access the open internet."
                echo -e "  ${BOLD}Unbounded${NC} is Lantern's volunteer proxy network — similar in spirit"
                echo -e "  to Snowflake, but for the Lantern network instead of Tor."
                echo ""
                echo -e "  ${BOLD}How Unbounded works:${NC}"
                echo -e "  1. You run a lightweight ${CYAN}widget${NC} process (Go binary)"
                echo -e "  2. The widget registers with Lantern's ${CYAN}FREDDIE${NC} signaling server"
                echo -e "  3. Censored users connect to you via ${CYAN}WebRTC${NC} (peer-to-peer)"
                echo -e "  4. Your proxy forwards their traffic to Lantern's ${CYAN}EGRESS${NC} server"
                echo -e "  5. The egress server delivers the traffic to its destination"
                echo ""
                echo -e "  ${BOLD}You are NOT an exit point.${NC} All traffic exits through Lantern's"
                echo -e "  egress servers — your IP is never exposed as the source. The"
                echo -e "  traffic between you and the egress server is encrypted."
                echo ""
                echo -e "  ${BOLD}Key differences from Snowflake:${NC}"
                echo -e "  • Snowflake serves the ${CYAN}Tor${NC} network; Unbounded serves ${CYAN}Lantern${NC}"
                echo -e "  • Unbounded multiplexes many users on a single instance"
                echo -e "  • Uses ${GREEN}--network host${NC} for WebRTC NAT traversal (no port forwarding)"
                echo -e "  • Built from source (Go) — Docker image is compiled on first run"
                echo ""
                echo -e "  ${BOLD}Resource usage:${NC} Very lightweight (0.5 CPU, 256MB RAM)."
                echo -e "  Can run safely alongside any relay type and Snowflake."
                echo ""
                echo -e "  ${BOLD}Learn more:${NC} ${CYAN}https://unbounded.lantern.io${NC}"
                ;;
            7)
                echo -e "${CYAN}═══ MTProxy (Telegram Proxy) ═══${NC}"
                echo ""
                echo -e "  MTProxy is an official proxy protocol for Telegram, designed to"
                echo -e "  help users in censored countries access the messaging app."
                echo -e "  Torware uses ${BOLD}mtg${NC}, a modern Go implementation with ${BOLD}FakeTLS${NC}."
                echo ""
                echo -e "  ${BOLD}How MTProxy works:${NC}"
                echo -e "  1. You run an MTProxy server with a unique ${CYAN}secret key${NC}"
                echo -e "  2. Users connect using a ${CYAN}tg://proxy${NC} link or QR code"
                echo -e "  3. Traffic is encrypted and proxied through your server"
                echo -e "  4. Telegram servers receive the connection from your IP"
                echo ""
                echo -e "  ${BOLD}FakeTLS (Traffic Obfuscation):${NC}"
                echo -e "  FakeTLS makes your proxy traffic look like normal HTTPS traffic"
                echo -e "  to a legitimate website (like cloudflare.com). When censors"
                echo -e "  inspect the connection, they see what appears to be standard"
                echo -e "  TLS handshakes to a popular CDN. This makes it much harder to"
                echo -e "  detect and block."
                echo ""
                echo -e "  ${BOLD}The 'ee' secret prefix:${NC}"
                echo -e "  MTProxy secrets starting with ${CYAN}ee${NC} indicate FakeTLS mode."
                echo -e "  The domain (e.g., cloudflare.com) is encoded in the secret."
                echo -e "  Older 'dd' secrets are deprecated and easier to detect."
                echo ""
                echo -e "  ${BOLD}Sharing your proxy:${NC}"
                echo -e "  • ${CYAN}tg://proxy?...${NC} — Deep link opens directly in Telegram app"
                echo -e "  • ${CYAN}https://t.me/proxy?...${NC} — Web link works in any browser"
                echo -e "  • ${CYAN}QR code${NC} — Users can scan with Telegram's camera feature"
                echo ""
                echo -e "  ${BOLD}Security features:${NC}"
                echo -e "  • ${GREEN}Concurrency limit${NC} — Caps max simultaneous connections"
                echo -e "  • ${GREEN}Geo-blocking${NC} — Block connections from specific countries"
                echo -e "  • ${GREEN}Anti-replay${NC} — Prevents replay attacks (built-in)"
                echo ""
                echo -e "  ${BOLD}You are NOT an exit point.${NC} Your proxy forwards traffic to"
                echo -e "  Telegram's servers. Users' actual messages are end-to-end"
                echo -e "  encrypted by Telegram — you cannot read them."
                echo ""
                echo -e "  ${BOLD}Resource usage:${NC} Very lightweight (0.5 CPU, 128MB RAM)."
                echo -e "  Can run safely alongside any relay type and other proxies."
                echo ""
                echo -e "  ${BOLD}Docker image:${NC} ${DIM}nineseconds/mtg:2${NC}"
                ;;
            8)
                echo -e "${CYAN}═══ How Tor Circuits Work ═══${NC}"
                echo ""
                echo -e "  A Tor circuit is a path through 3 relays:"
                echo ""
                echo -e "  ${GREEN}You${NC} → [${CYAN}Guard/Bridge${NC}] → [${YELLOW}Middle${NC}] → [${RED}Exit${NC}] → ${BOLD}Destination${NC}"
                echo ""
                echo -e "  ${BOLD}Each layer of encryption:${NC}"
                echo -e "  ┌──────────────────────────────────────────────┐"
                echo -e "  │ Layer 3 (Guard key):                         │"
                echo -e "  │  ┌──────────────────────────────────────┐    │"
                echo -e "  │  │ Layer 2 (Middle key):                │    │"
                echo -e "  │  │  ┌──────────────────────────────┐    │    │"
                echo -e "  │  │  │ Layer 1 (Exit key):          │    │    │"
                echo -e "  │  │  │  ┌──────────────────────┐    │    │    │"
                echo -e "  │  │  │  │ Your actual data     │    │    │    │"
                echo -e "  │  │  │  └──────────────────────┘    │    │    │"
                echo -e "  │  │  └──────────────────────────────┘    │    │"
                echo -e "  │  └──────────────────────────────────────┘    │"
                echo -e "  └──────────────────────────────────────────────┘"
                echo ""
                echo -e "  • The Guard peels Layer 3, sees the Middle address"
                echo -e "  • The Middle peels Layer 2, sees the Exit address"
                echo -e "  • The Exit peels Layer 1, sees the destination"
                echo -e "  • ${BOLD}No single relay knows both source and destination${NC}"
                echo ""
                echo -e "  Circuits are rebuilt every ~10 minutes for extra security."
                ;;
            9)
                echo -e "${CYAN}═══ Understanding Your Dashboard ═══${NC}"
                echo ""
                echo -e "  ${BOLD}Circuits:${NC}"
                echo -e "  Active Tor circuits passing through your relay right now."
                echo -e "  Each circuit is a 3-hop encrypted path. One user can have"
                echo -e "  multiple circuits open (Tor rotates every ~10 minutes),"
                echo -e "  so circuits ≠ users. 9 circuits might be 3-5 users."
                echo ""
                echo -e "  ${BOLD}Connections:${NC}"
                echo -e "  Number of OR (Onion Router) connections to other relays."
                echo -e "  These are connections to Tor infrastructure (directory"
                echo -e "  authorities, other relays), not direct user connections."
                echo -e "  A new bridge with 15 connections is normal — most are"
                echo -e "  Tor network overhead, not individual users."
                echo ""
                echo -e "  ${BOLD}Traffic (Downloaded/Uploaded):${NC}"
                echo -e "  Total bytes relayed since the container started."
                echo -e "  Includes both user traffic and Tor protocol overhead"
                echo -e "  (consensus downloads, descriptor fetches, etc.)."
                echo -e "  Low traffic (KB range) in the first hours is normal."
                echo ""
                echo -e "  ${BOLD}App CPU / RAM:${NC}"
                echo -e "  Resource usage of your Tor container(s). CPU is normalized"
                echo -e "  per-core (e.g. 0.33% of one core), with total vCPU usage"
                echo -e "  shown in parentheses (e.g. 3.95% across all cores)."
                echo ""
                echo -e "  ${BOLD}Snowflake section:${NC}"
                echo -e "  Connections: total clients matched to your proxy by the"
                echo -e "  Snowflake broker (cumulative, not concurrent)."
                echo -e "  Traffic: WebRTC data relayed to Tor bridges."
                echo ""
                echo -e "  ${BOLD}Country breakdown (CLIENTS BY COUNTRY):${NC}"
                echo -e "  ${YELLOW}Important: This is NOT real-time connected users.${NC}"
                echo -e "  For bridges, this shows unique clients seen in the ${BOLD}last 24"
                echo -e "  hours${NC} (from Tor's CLIENTS_SEEN). So '8 from Estonia' means"
                echo -e "  8 unique clients from Estonia used your bridge in the past"
                echo -e "  day, not 8 people connected right now."
                echo -e "  For relays: countries of peer relays you're connected to."
                echo -e "  For Snowflake: countries of users you've proxied for."
                echo ""
                echo -e "  ${BOLD}Data Cap:${NC}"
                echo -e "  If configured, shows Tor's AccountingMax usage. Tor will"
                echo -e "  hibernate automatically when the cap is reached and resume"
                echo -e "  at the start of the next accounting period."
                echo ""
                echo -e "  ${BOLD}What's normal for a new bridge?${NC}"
                echo -e "  • First few minutes: 0 circuits, low KB traffic (just Tor overhead)"
                echo -e "  • After 1-3 hours: a few circuits, some client countries appear"
                echo -e "  • After 24 hours: steady circuits, growing country list"
                echo -e "  • After days/weeks: stable traffic as BridgeDB distributes you"
                ;;
            10)
                echo -e "${CYAN}═══ Legal & Safety Considerations ═══${NC}"
                echo ""
                echo -e "  ${BOLD}Bridges (safest):${NC}"
                echo -e "  • IP not publicly listed. Minimal legal risk."
                echo -e "  • No abuse complaints. You're an unlisted entry point."
                echo -e "  • Recommended for home connections and most hosting."
                echo ""
                echo -e "  ${BOLD}Middle relays (safe):${NC}"
                echo -e "  • IP is publicly listed as a Tor relay."
                echo -e "  • Very rarely generates complaints — you're not an exit."
                echo -e "  • Some organizations may flag Tor relay IPs."
                echo ""
                echo -e "  ${BOLD}Exit relays (requires caution):${NC}"
                echo -e "  • Your IP is the apparent source of users' traffic."
                echo -e "  • You WILL receive abuse complaints."
                echo -e "  • Check with your ISP/hosting provider first."
                echo -e "  • Consider running a reduced exit policy."
                echo -e "  • The Tor Project provides a legal FAQ:"
                echo -e "    ${CYAN}https://community.torproject.org/relay/community-resources/eff-tor-legal-faq/${NC}"
                echo ""
                echo -e "  ${BOLD}Snowflake (very safe):${NC}"
                echo -e "  • You're a temporary WebRTC proxy, not an exit."
                echo -e "  • Traffic is encrypted end-to-end."
                echo -e "  • Very low legal risk."
                echo ""
                echo -e "  ${BOLD}Unbounded / Lantern (very safe):${NC}"
                echo -e "  • You relay encrypted traffic to Lantern's egress servers."
                echo -e "  • Your IP is never the exit point — Lantern handles that."
                echo -e "  • Very low legal risk, similar to Snowflake."
                echo ""
                echo -e "  ${BOLD}General tips:${NC}"
                echo -e "  • Run on a VPS/dedicated server rather than home if possible"
                echo -e "  • Use a separate IP from your personal services"
                echo -e "  • Set a contact email so Tor directory authorities can reach you"
                echo -e "  • Keep your relay updated (Torware handles Docker image updates)"
                ;;
            11)
                echo -e "${CYAN}═══ About Torware ═══${NC}"
                echo ""
                echo -e "  ${BOLD}Torware v${VERSION}${NC}"
                echo -e "  An all-in-one tool for running Tor relays with Docker."
                echo ""
                echo -e "  ${BOLD}Features:${NC}"
                echo -e "  • Setup wizard — Bridge, Middle, or Exit relay in minutes"
                echo -e "  • Multi-container — Run up to 5 relays on one host"
                echo -e "  • Mixed types — Different relay types per container"
                echo -e "  • Snowflake — Run a WebRTC proxy alongside your relay"
                echo -e "  • Unbounded — Help Lantern network with WebRTC proxy"
                echo -e "  • MTProxy — Telegram proxy with FakeTLS obfuscation"
                echo -e "  • Live dashboard — Real-time stats from Tor's ControlPort"
                echo -e "  • Country tracking — See where your traffic goes"
                echo -e "  • Telegram alerts — Get notified about your relay"
                echo -e "  • Backup/restore — Preserve your relay identity keys"
                echo -e "  • Health checks — 15-point diagnostic system"
                echo -e "  • Auto-start — Systemd service for boot persistence"
                echo ""
                echo -e "  ${BOLD}How it works:${NC}"
                echo -e "  Torware manages Docker containers running official Tor images."
                echo -e "  Each container gets a generated torrc config, unique ports,"
                echo -e "  and resource limits. Stats are collected via Tor's ControlPort"
                echo -e "  protocol (port 9051+) using cookie authentication."
                echo ""
                echo -e "  ${BOLD}Open source:${NC}"
                echo -e "  ${CYAN}https://github.com/SamNet-dev/torware${NC}"
                ;;
            0)
                _back=true
                continue
                ;;
            *)
                echo -e "  ${RED}Invalid choice${NC}"
                ;;
        esac

        if [ "$_back" = "false" ]; then
            echo ""
            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
        fi
    done
}

show_menu() {
    load_settings
    local redraw=true

    while true; do
        if [ "$redraw" = "true" ]; then
            clear
            print_header
        fi
        redraw=true

        echo -e "  ${BOLD}Main Menu:${NC}"
        echo ""
        echo -e "    ${GREEN}1.${NC} 📊 Live Dashboard"
        echo -e "    ${GREEN}2.${NC} 📈 Advanced Stats"
        echo -e "    ${GREEN}3.${NC} 🌍 Live Peers by Country"
        echo -e "    ${GREEN}4.${NC} 📜 View Logs"
        echo -e "    ${GREEN}5.${NC} ▶  Start Relay"
        echo -e "    ${GREEN}6.${NC} ⏹  Stop Relay"
        echo -e "    ${GREEN}7.${NC} 🔄 Restart Relay"
        echo -e "    ${GREEN}8.${NC} 🔍 Health Check"
        echo -e "    ${GREEN}9.${NC} ⚙  Settings & Tools"
        echo -e "    ${GREEN}f.${NC} 🔑 Show Fingerprint(s)"
        # Show bridge option if any container is a bridge
        local _any_bridge=false
        for _mi in $(seq 1 ${CONTAINER_COUNT:-1}); do
            [ "$(get_container_relay_type $_mi)" = "bridge" ] && _any_bridge=true
        done
        if [ "$_any_bridge" = "true" ]; then
            echo -e "    ${GREEN}b.${NC} 🌉 Show Bridge Line(s)"
        fi
        # Show Snowflake status
        if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
            local _sf_label="${GREEN}Running${NC}"
            is_snowflake_running || _sf_label="${RED}Stopped${NC}"
            local _sf_cnt_label=""
            [ "${SNOWFLAKE_COUNT:-1}" -gt 1 ] && _sf_cnt_label=" (${SNOWFLAKE_COUNT} instances)"
            echo -e "    ${GREEN}s.${NC} ❄  Snowflake Proxy [${_sf_label}]${_sf_cnt_label}"
        else
            echo -e "    ${GREEN}s.${NC} ❄  Enable Snowflake Proxy"
        fi
        # Show Unbounded status
        if [ "$UNBOUNDED_ENABLED" = "true" ]; then
            local _ub_label="${GREEN}Running${NC}"
            is_unbounded_running || _ub_label="${RED}Stopped${NC}"
            echo -e "    ${GREEN}u.${NC} 🌐 Unbounded Proxy (Lantern) [${_ub_label}]"
        else
            echo -e "    ${GREEN}u.${NC} 🌐 Enable Unbounded Proxy (Lantern)"
        fi
        # Show MTProxy status
        if [ "$MTPROXY_ENABLED" = "true" ]; then
            local _mtp_label="${GREEN}Running${NC}"
            is_mtproxy_running || _mtp_label="${RED}Stopped${NC}"
            echo -e "    ${GREEN}m.${NC} 📱 MTProxy (Telegram) [${_mtp_label}]"
        else
            echo -e "    ${GREEN}m.${NC} 📱 Enable MTProxy (Telegram)"
        fi
        echo -e "    ${GREEN}t.${NC} 💬 Telegram Notifications"
        echo -e "    ${GREEN}a.${NC} 📖 About & Learn"
        echo -e "    ${GREEN}0.${NC} 🚪 Exit"
        echo ""

        read -p "  Enter choice: " choice < /dev/tty || { echo ""; break; }

        case "$choice" in
            1)
                show_dashboard
                ;;
            2)
                show_advanced_stats
                ;;
            3)
                show_peers
                ;;
            4)
                show_logs
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            5)
                start_relay
                if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
                    start_snowflake_container
                fi
                if [ "$UNBOUNDED_ENABLED" = "true" ]; then
                    start_unbounded_container
                fi
                if [ "$MTPROXY_ENABLED" = "true" ]; then
                    start_mtproxy_container
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            6)
                stop_relay
                if [ "$RELAY_TYPE" = "none" ]; then
                    stop_snowflake_container
                    stop_unbounded_container
                    stop_mtproxy_container
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            7)
                restart_relay
                if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
                    restart_snowflake_container
                fi
                if [ "$UNBOUNDED_ENABLED" = "true" ]; then
                    restart_unbounded_container
                fi
                if [ "$MTPROXY_ENABLED" = "true" ]; then
                    restart_mtproxy_container
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            8)
                health_check
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            9)
                show_settings_menu
                ;;
            f|F)
                show_fingerprint
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            b|B)
                if [ "$_any_bridge" = "true" ]; then
                    show_bridge_line
                    read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                else
                    echo -e "  ${RED}Invalid choice${NC}"
                    redraw=false
                fi
                ;;
            s|S)
                if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
                    echo ""
                    echo -e "  Snowflake is currently ${GREEN}enabled${NC} (${SNOWFLAKE_COUNT:-1} instance(s))."
                    for _si in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
                        local _sn=$(get_snowflake_name $_si)
                        local _sc=$(get_snowflake_cpus $_si)
                        local _sm=$(get_snowflake_memory $_si)
                        local _ss="${RED}Stopped${NC}"
                        docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_sn}$" && _ss="${GREEN}Running${NC}"
                        echo -e "    ${_sn}: [${_ss}]  CPU: ${CYAN}${_sc}${NC}  RAM: ${CYAN}${_sm}${NC}"
                    done
                    echo ""
                    echo -e "    1. Restart all Snowflake proxies"
                    echo -e "    2. Stop all Snowflake proxies"
                    echo -e "    3. Disable Snowflake"
                    echo -e "    4. Change resource limits"
                    if [ "${SNOWFLAKE_COUNT:-1}" -lt 2 ]; then
                        echo -e "    5. Add another Snowflake instance"
                    fi
                    if [ "${SNOWFLAKE_COUNT:-1}" -gt 1 ]; then
                        echo -e "    6. Remove Snowflake instance #${SNOWFLAKE_COUNT} (keep #1 running)"
                    fi
                    echo -e "    0. Back"
                    read -p "  choice: " sf_choice < /dev/tty || true
                    case "${sf_choice:-0}" in
                        1) restart_snowflake_container ;;
                        2)
                            stop_snowflake_container
                            log_warn "Snowflake stopped but still enabled. It will restart on next 'torware start'. Use option 3 to disable permanently."
                            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                            echo ""
                            ;;
                        3)
                            SNOWFLAKE_ENABLED="false"
                            stop_snowflake_container
                            save_settings
                            log_success "Snowflake disabled"
                            ;;
                        4)
                            echo ""
                            echo -e "  ${DIM}CPU: number of cores (e.g. 0.5, 1.0, 2.0)${NC}"
                            echo -e "  ${DIM}RAM: amount with unit (e.g. 128m, 256m, 512m, 1g)${NC}"
                            echo ""
                            for _si in $(seq 1 ${SNOWFLAKE_COUNT:-1}); do
                                local _sn=$(get_snowflake_name $_si)
                                local _cur_cpu=$(get_snowflake_cpus $_si)
                                local _cur_mem=$(get_snowflake_memory $_si)
                                echo -e "  ${BOLD}${_sn}:${NC}"
                                read -p "    CPU cores [${_cur_cpu}]: " _sf_cpu < /dev/tty || true
                                read -p "    RAM limit [${_cur_mem}]: " _sf_mem < /dev/tty || true
                                if [ -n "$_sf_cpu" ]; then
                                    if [[ "$_sf_cpu" =~ ^[0-9]+\.?[0-9]*$ ]]; then
                                        eval "SNOWFLAKE_CPUS_${_si}=\"$_sf_cpu\""
                                    else
                                        log_warn "Invalid CPU value, keeping ${_cur_cpu}"
                                    fi
                                fi
                                if [ -n "$_sf_mem" ]; then
                                    if [[ "$_sf_mem" =~ ^[0-9]+[mMgG]$ ]]; then
                                        eval "SNOWFLAKE_MEMORY_${_si}=\"$(echo "$_sf_mem" | tr '[:upper:]' '[:lower:]')\""
                                    else
                                        log_warn "Invalid RAM value, keeping ${_cur_mem}"
                                    fi
                                fi
                            done
                            save_settings
                            log_success "Snowflake limits updated"
                            echo ""
                            read -p "  Restart Snowflake to apply? [Y/n] " _sf_rs < /dev/tty || true
                            if [[ ! "$_sf_rs" =~ ^[Nn]$ ]]; then
                                restart_snowflake_container
                            fi
                            ;;
                        5)
                            if [ "${SNOWFLAKE_COUNT:-1}" -ge 2 ]; then
                                log_warn "Maximum of 2 Snowflake instances supported."
                            else
                                local _new_idx=2
                                local _def_cpu=$(get_snowflake_default_cpus)
                                local _def_mem=$(get_snowflake_default_memory)
                                echo ""
                                echo -e "  ${BOLD}Adding Snowflake instance #${_new_idx}${NC}"
                                echo -e "  ${DIM}Each instance registers independently with the broker${NC}"
                                echo -e "  ${DIM}and receives its own client assignments.${NC}"
                                echo ""
                                read -p "  CPU cores [${_def_cpu}]: " _sf_cpu < /dev/tty || true
                                read -p "  RAM limit [${_def_mem}]: " _sf_mem < /dev/tty || true
                                [ -z "$_sf_cpu" ] && _sf_cpu="$_def_cpu"
                                [ -z "$_sf_mem" ] && _sf_mem="$_def_mem"
                                if [[ "$_sf_cpu" =~ ^[0-9]+\.?[0-9]*$ ]]; then
                                    eval "SNOWFLAKE_CPUS_${_new_idx}=\"$_sf_cpu\""
                                else
                                    log_warn "Invalid CPU, using default ${_def_cpu}"
                                    eval "SNOWFLAKE_CPUS_${_new_idx}=\"$_def_cpu\""
                                fi
                                if [[ "$_sf_mem" =~ ^[0-9]+[mMgG]$ ]]; then
                                    eval "SNOWFLAKE_MEMORY_${_new_idx}=\"$(echo "$_sf_mem" | tr '[:upper:]' '[:lower:]')\""
                                else
                                    log_warn "Invalid RAM, using default ${_def_mem}"
                                    eval "SNOWFLAKE_MEMORY_${_new_idx}=\"$_def_mem\""
                                fi
                                SNOWFLAKE_COUNT=$_new_idx
                                save_settings
                                run_snowflake_container $_new_idx
                            fi
                            ;;
                        6)
                            if [ "${SNOWFLAKE_COUNT:-1}" -le 1 ]; then
                                log_warn "Cannot remove the last instance. Use option 3 to disable Snowflake."
                            else
                                local _rm_idx=${SNOWFLAKE_COUNT}
                                local _rm_name=$(get_snowflake_name $_rm_idx)
                                docker stop --timeout 10 "$_rm_name" 2>/dev/null || true
                                docker rm -f "$_rm_name" 2>/dev/null || true
                                docker volume rm "$(get_snowflake_volume $_rm_idx)" 2>/dev/null || true
                                eval "SNOWFLAKE_CPUS_${_rm_idx}=''"
                                eval "SNOWFLAKE_MEMORY_${_rm_idx}=''"
                                SNOWFLAKE_COUNT=$((_rm_idx - 1))
                                save_settings
                                log_success "Removed $_rm_name (now running $SNOWFLAKE_COUNT instance(s))"
                                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                                echo ""
                            fi
                            ;;
                    esac
                else
                    echo ""
                    echo -e "  Snowflake is a WebRTC proxy that helps censored users"
                    echo -e "  connect to Tor. Runs as a lightweight separate container."
                    read -p "  Enable Snowflake proxy? [y/N] " sf_en < /dev/tty || true
                    if [[ "$sf_en" =~ ^[Yy]$ ]]; then
                        SNOWFLAKE_ENABLED="true"
                        SNOWFLAKE_COUNT=1
                        local _def_cpu=$(get_snowflake_default_cpus)
                        local _def_mem=$(get_snowflake_default_memory)
                        echo ""
                        read -p "  CPU cores [${_def_cpu}]: " _sf_cpu < /dev/tty || true
                        read -p "  RAM limit [${_def_mem}]: " _sf_mem < /dev/tty || true
                        [ -z "$_sf_cpu" ] && _sf_cpu="$_def_cpu"
                        [ -z "$_sf_mem" ] && _sf_mem="$_def_mem"
                        [[ "$_sf_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] && SNOWFLAKE_CPUS_1="$_sf_cpu" || SNOWFLAKE_CPUS_1="$_def_cpu"
                        [[ "$_sf_mem" =~ ^[0-9]+[mMgG]$ ]] && SNOWFLAKE_MEMORY_1="$(echo "$_sf_mem" | tr '[:upper:]' '[:lower:]')" || SNOWFLAKE_MEMORY_1="$_def_mem"
                        save_settings
                        run_snowflake_container 1
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            u|U)
                if [ "$UNBOUNDED_ENABLED" = "true" ]; then
                    echo ""
                    echo -e "  Unbounded (Lantern) is currently ${GREEN}enabled${NC}."
                    local _ubn="$UNBOUNDED_CONTAINER"
                    local _ubs="${RED}Stopped${NC}"
                    is_unbounded_running && _ubs="${GREEN}Running${NC}"
                    echo -e "    ${_ubn}: [${_ubs}]  CPU: ${CYAN}${UNBOUNDED_CPUS:-0.5}${NC}  RAM: ${CYAN}${UNBOUNDED_MEMORY:-256m}${NC}"
                    echo ""
                    echo -e "    1. Restart Unbounded proxy"
                    echo -e "    2. Stop Unbounded proxy"
                    echo -e "    3. Disable Unbounded"
                    echo -e "    4. Change resource limits"
                    echo -e "    ${RED}5. Remove Unbounded (stop, remove container & image)${NC}"
                    echo -e "    0. Back"
                    read -p "  choice: " ub_choice < /dev/tty || true
                    case "${ub_choice:-0}" in
                        1) restart_unbounded_container ;;
                        2)
                            stop_unbounded_container
                            log_warn "Unbounded stopped but still enabled. It will restart on next 'torware start'. Use option 3 to disable permanently."
                            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                            echo ""
                            ;;
                        3)
                            UNBOUNDED_ENABLED="false"
                            stop_unbounded_container
                            save_settings
                            log_success "Unbounded disabled"
                            ;;
                        5)
                            echo ""
                            read -p "  Are you sure? This will remove the container, volume, and image. [y/N] " _ub_rm < /dev/tty || true
                            if [[ "$_ub_rm" =~ ^[Yy]$ ]]; then
                                UNBOUNDED_ENABLED="false"
                                stop_unbounded_container
                                docker rm -f "$UNBOUNDED_CONTAINER" 2>/dev/null || true
                                docker volume rm "$UNBOUNDED_VOLUME" 2>/dev/null || true
                                docker rmi "$UNBOUNDED_IMAGE" 2>/dev/null || true
                                save_settings
                                log_success "Unbounded proxy fully removed"
                            else
                                log_info "Cancelled"
                            fi
                            ;;
                        4)
                            echo ""
                            echo -e "  ${DIM}CPU: number of cores (e.g. 0.25, 0.5, 1.0)${NC}"
                            echo -e "  ${DIM}RAM: amount with unit (e.g. 128m, 256m, 512m)${NC}"
                            echo ""
                            read -p "    CPU cores [${UNBOUNDED_CPUS:-0.5}]: " _ub_cpu < /dev/tty || true
                            read -p "    RAM limit [${UNBOUNDED_MEMORY:-256m}]: " _ub_mem < /dev/tty || true
                            if [ -n "$_ub_cpu" ]; then
                                if [[ "$_ub_cpu" =~ ^[0-9]+\.?[0-9]*$ ]]; then
                                    UNBOUNDED_CPUS="$_ub_cpu"
                                else
                                    log_warn "Invalid CPU value, keeping ${UNBOUNDED_CPUS:-0.5}"
                                fi
                            fi
                            if [ -n "$_ub_mem" ]; then
                                if [[ "$_ub_mem" =~ ^[0-9]+[mMgG]$ ]]; then
                                    UNBOUNDED_MEMORY="$(echo "$_ub_mem" | tr '[:upper:]' '[:lower:]')"
                                else
                                    log_warn "Invalid RAM value, keeping ${UNBOUNDED_MEMORY:-256m}"
                                fi
                            fi
                            save_settings
                            log_success "Unbounded limits updated"
                            echo ""
                            read -p "  Restart Unbounded to apply? [Y/n] " _ub_rs < /dev/tty || true
                            if [[ ! "$_ub_rs" =~ ^[Nn]$ ]]; then
                                restart_unbounded_container
                            fi
                            ;;
                    esac
                else
                    echo ""
                    echo -e "  Unbounded is a WebRTC proxy that helps censored users"
                    echo -e "  connect via the Lantern network. Runs as a lightweight container."
                    read -p "  Enable Unbounded proxy? [y/N] " ub_en < /dev/tty || true
                    if [[ "$ub_en" =~ ^[Yy]$ ]]; then
                        UNBOUNDED_ENABLED="true"
                        local _def_cpu=$(get_unbounded_default_cpus)
                        local _def_mem=$(get_unbounded_default_memory)
                        echo ""
                        read -p "  CPU cores [${_def_cpu}]: " _ub_cpu < /dev/tty || true
                        read -p "  RAM limit [${_def_mem}]: " _ub_mem < /dev/tty || true
                        [ -z "$_ub_cpu" ] && _ub_cpu="$_def_cpu"
                        [ -z "$_ub_mem" ] && _ub_mem="$_def_mem"
                        [[ "$_ub_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] && UNBOUNDED_CPUS="$_ub_cpu" || UNBOUNDED_CPUS="$_def_cpu"
                        [[ "$_ub_mem" =~ ^[0-9]+[mMgG]$ ]] && UNBOUNDED_MEMORY="$(echo "$_ub_mem" | tr '[:upper:]' '[:lower:]')" || UNBOUNDED_MEMORY="$_def_mem"
                        save_settings
                        run_unbounded_container
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            m|M)
                show_mtproxy_menu
                ;;
            t|T)
                show_telegram_menu
                ;;
            a|A)
                show_about
                ;;
            0|q|Q)
                echo "  Goodbye!"
                exit 0
                ;;
            "")
                redraw=false
                ;;
            *)
                echo -e "  ${RED}Invalid choice: ${NC}${YELLOW}$choice${NC}"
                redraw=false
                ;;
        esac
    done
}

manage_containers() {
    load_settings
    local redraw=true

    while true; do
        if [ "$redraw" = "true" ]; then
            clear
            echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
            echo -e "${CYAN}                   MANAGE CONTAINERS                            ${NC}"
            echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
        fi
        redraw=true

        echo ""
        echo -e "  ${BOLD}Current containers: ${GREEN}${CONTAINER_COUNT:-0}${NC}"
        echo ""
        for i in $(seq 1 ${CONTAINER_COUNT:-0}); do
            local _rt=$(get_container_relay_type $i)
            local _cn=$(get_container_name $i)
            local _or=$(get_container_orport $i)
            local _pt=$(get_container_ptport $i)
            local _st="${RED}stopped${NC}"
            docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_cn}$" && _st="${GREEN}running${NC}"
            echo -e "    ${GREEN}${i}.${NC} ${_cn} — type: ${BOLD}${_rt}${NC}, ORPort: ${_or}, PTPort: ${_pt} [${_st}]"
        done

        echo ""
        echo -e "    ${GREEN}a.${NC} ➕ Add container"
        if [ "${CONTAINER_COUNT:-1}" -gt 1 ]; then
            echo -e "    ${GREEN}r.${NC} ➖ Remove last container"
        fi
        echo -e "    ${GREEN}c.${NC} 🔄 Change container type"
        echo -e "    ${GREEN}0.${NC} ← Back"
        echo ""
        read -p "  choice: " _mc < /dev/tty || { echo ""; break; }

        case "$_mc" in
            a|A)
                local _cur=${CONTAINER_COUNT:-0}
                if [ "$_cur" -ge 5 ]; then
                    log_warn "Maximum 5 containers supported"
                else
                    # If coming from proxy-only mode and no relay settings yet, prompt for them
                    if [ "$RELAY_TYPE" = "none" ] && { [ -z "$NICKNAME" ] || [ "$NICKNAME" = "" ]; }; then
                        echo ""
                        echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
                        echo -e "${CYAN}                   TOR RELAY SETUP                              ${NC}"
                        echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
                        echo ""
                        echo -e "  ${BOLD}This is your first Tor relay. Please provide some details:${NC}"
                        echo ""

                        # Nickname
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        echo -e "  Enter a nickname for your relay (1-19 chars, alphanumeric)"
                        echo -e "  Press Enter for default: ${GREEN}Torware${NC}"
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        read -p "  nickname: " _input_nick < /dev/tty || true
                        if [ -z "$_input_nick" ]; then
                            NICKNAME="Torware"
                        elif [[ "$_input_nick" =~ ^[A-Za-z0-9]{1,19}$ ]]; then
                            NICKNAME="$_input_nick"
                        else
                            log_warn "Invalid nickname. Using default: Torware"
                            NICKNAME="Torware"
                        fi
                        echo ""

                        # Contact email
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        echo -e "  Enter contact email (shown to Tor Project, not public)"
                        echo -e "  Press Enter to skip"
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        read -p "  email: " _input_email < /dev/tty || true
                        CONTACT_INFO="${_input_email:-nobody@example.com}"
                        echo ""

                        # Bandwidth
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        echo -e "  Enter bandwidth limit in Mbps (1-100, or -1 for unlimited)"
                        echo -e "  Press Enter for default: ${GREEN}5${NC} Mbps"
                        echo -e "${CYAN}───────────────────────────────────────────────────────────────${NC}"
                        read -p "  bandwidth: " _input_bw < /dev/tty || true
                        if [ -z "$_input_bw" ]; then
                            BANDWIDTH=5
                        elif [ "$_input_bw" = "-1" ]; then
                            BANDWIDTH="-1"
                        elif [[ "$_input_bw" =~ ^[0-9]+$ ]] && [ "$_input_bw" -ge 1 ] && [ "$_input_bw" -le 100 ]; then
                            BANDWIDTH="$_input_bw"
                        elif [[ "$_input_bw" =~ ^[0-9]*\.[0-9]+$ ]]; then
                            local _float_ok=$(awk -v val="$_input_bw" 'BEGIN { print (val >= 1 && val <= 100) ? "yes" : "no" }')
                            if [ "$_float_ok" = "yes" ]; then
                                BANDWIDTH="$_input_bw"
                            else
                                log_warn "Invalid bandwidth. Using default: 5 Mbps"
                                BANDWIDTH=5
                            fi
                        else
                            log_warn "Invalid bandwidth. Using default: 5 Mbps"
                            BANDWIDTH=5
                        fi
                        echo ""
                    fi

                    local _new=$((_cur + 1))
                    echo ""
                    echo -e "  ${BOLD}Select type for container ${_new}:${NC}"
                    echo ""
                    echo -e "    ${GREEN}1.${NC} 🌉 Bridge (obfs4)"
                    echo -e "       Secret entry point for censored users (Iran, China, etc.)"
                    echo -e "       IP stays ${GREEN}unlisted${NC}. Typical bandwidth: ${CYAN}1-10 Mbps${NC}"
                    echo ""
                    echo -e "    ${GREEN}2.${NC} 🔁 Middle Relay"
                    echo -e "       Backbone of the Tor network. Relays encrypted traffic."
                    echo -e "       IP is ${YELLOW}publicly listed${NC}. Typical bandwidth: ${CYAN}10-50+ Mbps${NC}"
                    echo ""
                    echo -e "    ${GREEN}3.${NC} 🚪 Exit Relay"
                    echo -e "       Final hop — traffic exits to the internet through you."
                    echo -e "       IP appears as ${RED}traffic source${NC}. Typical bandwidth: ${CYAN}20-100+ Mbps${NC}"
                    echo ""
                    read -p "  type [1-3]: " _type_choice < /dev/tty || continue
                    local _new_type=""

                    # Check if adding middle/exit alongside existing bridges
                    local _has_bridge=false
                    for _ci in $(seq 1 $_cur); do
                        [ "$(get_container_relay_type $_ci)" = "bridge" ] && _has_bridge=true
                    done

                    case "$_type_choice" in
                        1) _new_type="bridge" ;;
                        2)
                            _new_type="middle"
                            if [ "$_has_bridge" = "true" ]; then
                                echo ""
                                echo -e "  ${YELLOW}${BOLD}⚠  Note: You are currently running a bridge.${NC}"
                                echo -e "  ${YELLOW}Adding a middle relay will make your IP ${BOLD}publicly visible${NC}"
                                echo -e "  ${YELLOW}in the Tor consensus. This partly defeats the purpose of${NC}"
                                echo -e "  ${YELLOW}running a bridge (keeping your IP unlisted).${NC}"
                                echo ""
                                echo -e "  ${YELLOW}If you're on a home connection, consider running multiple${NC}"
                                echo -e "  ${YELLOW}bridges instead, or using a separate VPS for the middle relay.${NC}"
                                echo ""
                                read -p "  Continue anyway? [y/N] " _mconf < /dev/tty || continue
                                if [[ ! "$_mconf" =~ ^[Yy]$ ]]; then
                                    log_info "Cancelled."
                                    continue
                                fi
                            fi
                            ;;
                        3)
                            if [ "$_has_bridge" = "true" ]; then
                                echo ""
                                echo -e "  ${YELLOW}${BOLD}⚠  You are running a bridge — adding an exit relay will${NC}"
                                echo -e "  ${YELLOW}make your IP publicly visible AND the source of exit traffic.${NC}"
                            fi
                            echo ""
                            echo -e "  ${RED}${BOLD}╔═══════════════════════════════════════════════════════════╗${NC}"
                            echo -e "  ${RED}${BOLD}║              ⚠  EXIT RELAY WARNING  ⚠                   ║${NC}"
                            echo -e "  ${RED}${BOLD}╠═══════════════════════════════════════════════════════════╣${NC}"
                            echo -e "  ${RED}║ Your IP will appear as the source of ALL traffic         ║${NC}"
                            echo -e "  ${RED}║ exiting through this relay. This means:                  ║${NC}"
                            echo -e "  ${RED}║                                                          ║${NC}"
                            echo -e "  ${RED}║ • You WILL receive abuse complaints (DMCA, hacking, etc) ║${NC}"
                            echo -e "  ${RED}║ • Law enforcement may contact you about user traffic     ║${NC}"
                            echo -e "  ${RED}║ • Some ISPs/hosts explicitly prohibit exit relays        ║${NC}"
                            echo -e "  ${RED}║ • Your IP may be blacklisted by some services            ║${NC}"
                            echo -e "  ${RED}║                                                          ║${NC}"
                            echo -e "  ${RED}║ Only run an exit relay if:                               ║${NC}"
                            echo -e "  ${RED}║ • Your ISP/hosting provider explicitly allows it         ║${NC}"
                            echo -e "  ${RED}║ • You understand the legal implications                  ║${NC}"
                            echo -e "  ${RED}║ • You use a dedicated IP (not your personal one)         ║${NC}"
                            echo -e "  ${RED}${BOLD}╚═══════════════════════════════════════════════════════════╝${NC}"
                            echo ""
                            read -p "  Type 'I UNDERSTAND' to proceed (or anything else to cancel): " _confirm < /dev/tty || continue
                            if [ "$_confirm" = "I UNDERSTAND" ]; then
                                _new_type="exit"
                                echo ""
                                echo -e "  ${BOLD}Exit policy:${NC}"
                                echo -e "    ${GREEN}1.${NC} Reduced — web only (ports 80, 443) ${DIM}(recommended)${NC}"
                                echo -e "    ${GREEN}2.${NC} Default — Tor's standard exit policy"
                                echo -e "    ${GREEN}3.${NC} Full    — all traffic ${RED}(most abuse complaints)${NC}"
                                read -p "  policy [1-3, default=1]: " _pol < /dev/tty || true
                                case "${_pol:-1}" in
                                    2) EXIT_POLICY="default" ;;
                                    3) EXIT_POLICY="full" ;;
                                    *) EXIT_POLICY="reduced" ;;
                                esac
                            else
                                log_info "Exit relay cancelled."
                                continue
                            fi
                            ;;
                        *) log_warn "Invalid choice"; continue ;;
                    esac

                    CONTAINER_COUNT=$_new
                    eval "RELAY_TYPE_${_new}='${_new_type}'"
                    # Update main RELAY_TYPE if coming from proxy-only mode
                    if [ "$RELAY_TYPE" = "none" ] || [ -z "$RELAY_TYPE" ]; then
                        RELAY_TYPE="$_new_type"
                    fi
                    save_settings
                    generate_torrc $_new

                    local _new_or=$(get_container_orport $_new)
                    local _new_pt=$(get_container_ptport $_new)
                    echo ""
                    log_success "Container ${_new} added (type: ${_new_type})"
                    echo -e "  ORPort: ${_new_or}, PTPort: ${_new_pt}"
                    echo ""
                    echo -e "  ${YELLOW}⚠ Ports to forward (if running from home):${NC}"
                    echo -e "    ${GREEN}${_new_or} TCP${NC} (ORPort)"
                    [ "$_new_type" = "bridge" ] && echo -e "    ${GREEN}${_new_pt} TCP${NC} (obfs4)"
                    echo ""
                    read -p "  Start container now? [Y/n] " _start < /dev/tty || true
                    if [[ ! "$_start" =~ ^[Nn]$ ]]; then
                        local _img=$(get_docker_image $_new)
                        log_info "Pulling image (${_img})..."
                        docker pull "$_img" || { log_error "Failed to pull image"; continue; }
                        run_relay_container $_new
                        # Restart tracker to pick up new container
                        stop_tracker_service
                        setup_tracker_service
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            r|R)
                if [ "${CONTAINER_COUNT:-1}" -le 1 ]; then
                    log_warn "Cannot remove the last container"
                else
                    local _last=${CONTAINER_COUNT}
                    local _lname=$(get_container_name $_last)
                    local _ltype=$(get_container_relay_type $_last)
                    echo ""
                    echo -e "  Remove container ${_last} (${_lname}, type: ${_ltype})?"
                    read -p "  Confirm [y/N]: " _rc < /dev/tty || true
                    if [[ "$_rc" =~ ^[Yy]$ ]]; then
                        # Stop and remove the container
                        docker stop --timeout 30 "$_lname" 2>/dev/null || true
                        docker rm "$_lname" 2>/dev/null || true
                        # Clear per-container vars
                        eval "unset RELAY_TYPE_${_last}"
                        eval "unset BANDWIDTH_${_last}"
                        eval "unset ORPORT_${_last}"
                        eval "unset PT_PORT_${_last}"
                        CONTAINER_COUNT=$((_last - 1))
                        save_settings
                        # Restart tracker
                        stop_tracker_service
                        setup_tracker_service
                        log_success "Container ${_last} removed"
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            c|C)
                echo ""
                read -p "  Which container to change? [1-${CONTAINER_COUNT:-1}]: " _ci < /dev/tty || continue
                if ! [[ "$_ci" =~ ^[1-5]$ ]] || [ "$_ci" -gt "${CONTAINER_COUNT:-1}" ]; then
                    log_warn "Invalid container number"
                    continue
                fi
                local _old_rt=$(get_container_relay_type $_ci)
                echo ""
                echo -e "  Container ${_ci} is currently: ${BOLD}${_old_rt}${NC}"
                echo ""
                echo -e "    ${GREEN}1.${NC} 🌉 Bridge  — IP unlisted, ${CYAN}1-10 Mbps${NC}"
                echo -e "    ${GREEN}2.${NC} 🔁 Middle  — IP public, ${CYAN}10-50+ Mbps${NC}"
                echo -e "    ${GREEN}3.${NC} 🚪 Exit    — IP is traffic source, ${CYAN}20-100+ Mbps${NC}"
                echo ""
                read -p "  new type [1-3]: " _nt < /dev/tty || continue
                local _change_type=""

                # Check if other containers are bridges
                local _other_bridge=false
                for _oi in $(seq 1 ${CONTAINER_COUNT:-1}); do
                    [ "$_oi" = "$_ci" ] && continue
                    [ "$(get_container_relay_type $_oi)" = "bridge" ] && _other_bridge=true
                done

                case "$_nt" in
                    1) _change_type="bridge" ;;
                    2)
                        _change_type="middle"
                        if [ "$_old_rt" = "bridge" ] || [ "$_other_bridge" = "true" ]; then
                            echo ""
                            echo -e "  ${YELLOW}${BOLD}⚠  Warning: This will make your IP publicly visible${NC}"
                            echo -e "  ${YELLOW}in the Tor consensus. If you also run a bridge on this${NC}"
                            echo -e "  ${YELLOW}IP, the bridge's unlisted status is compromised.${NC}"
                            echo ""
                            read -p "  Continue? [y/N] " _mwarn < /dev/tty || continue
                            if [[ ! "$_mwarn" =~ ^[Yy]$ ]]; then
                                log_info "Cancelled."
                                continue
                            fi
                        fi
                        ;;
                    3)
                        if [ "$_old_rt" = "bridge" ] || [ "$_other_bridge" = "true" ]; then
                            echo ""
                            echo -e "  ${YELLOW}${BOLD}⚠  You have a bridge on this IP — an exit relay will${NC}"
                            echo -e "  ${YELLOW}expose your IP publicly AND attract abuse complaints.${NC}"
                        fi
                        echo ""
                        echo -e "  ${RED}${BOLD}⚠  EXIT RELAY WARNING${NC}"
                        echo -e "  ${RED}Your IP will be the apparent source of all exiting traffic.${NC}"
                        echo -e "  ${RED}You WILL receive abuse complaints. Your IP may be blacklisted.${NC}"
                        echo -e "  ${RED}Only proceed if your ISP/host allows it and you understand the risks.${NC}"
                        echo ""
                        read -p "  Type 'I UNDERSTAND' to proceed: " _ec < /dev/tty || continue
                        if [ "$_ec" = "I UNDERSTAND" ]; then
                            _change_type="exit"
                            echo ""
                            echo -e "  ${BOLD}Exit policy:${NC}"
                            echo -e "    ${GREEN}1.${NC} Reduced — web only (80, 443) ${DIM}(recommended)${NC}"
                            echo -e "    ${GREEN}2.${NC} Default — Tor standard"
                            echo -e "    ${GREEN}3.${NC} Full    — all traffic ${RED}(most complaints)${NC}"
                            read -p "  policy [1-3, default=1]: " _ep < /dev/tty || true
                            case "${_ep:-1}" in
                                2) EXIT_POLICY="default" ;;
                                3) EXIT_POLICY="full" ;;
                                *) EXIT_POLICY="reduced" ;;
                            esac
                        else
                            log_info "Cancelled."
                            continue
                        fi
                        ;;
                    *) log_warn "Invalid choice"; continue ;;
                esac

                if [ "$_change_type" = "$_old_rt" ]; then
                    log_info "Type unchanged"
                else
                    eval "RELAY_TYPE_${_ci}='${_change_type}'"
                    # Also update global RELAY_TYPE if container 1
                    [ "$_ci" = "1" ] && RELAY_TYPE="$_change_type"
                    save_settings
                    generate_torrc $_ci
                    log_success "Container ${_ci} changed to: ${_change_type}"
                    echo ""
                    local _cn=$(get_container_name $_ci)
                    if docker ps --format '{{.Names}}' 2>/dev/null | grep -q "^${_cn}$"; then
                        read -p "  Restart container to apply? [Y/n] " _rs < /dev/tty || true
                        if [[ ! "$_rs" =~ ^[Nn]$ ]]; then
                            docker stop --timeout 30 "$_cn" 2>/dev/null || true
                            docker rm "$_cn" 2>/dev/null || true
                            local _img=$(get_docker_image $_ci)
                            log_info "Pulling image (${_img})..."
                            docker pull "$_img" || { log_error "Failed to pull image"; continue; }
                            run_relay_container $_ci
                            stop_tracker_service
                            setup_tracker_service
                        fi
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            0|q|Q)
                return
                ;;
            "")
                redraw=false
                ;;
            *)
                echo -e "  ${RED}Invalid choice${NC}"
                redraw=false
                ;;
        esac
    done
}

show_settings_menu() {
    local redraw=true

    while true; do
        if [ "$redraw" = "true" ]; then
            clear
            echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
            echo -e "${CYAN}                    SETTINGS & TOOLS                           ${NC}"
            echo -e "${CYAN}═══════════════════════════════════════════════════════════════${NC}"
        fi
        redraw=true

        echo ""
        echo -e "    ${GREEN}1.${NC} 📋 View Status"
        echo -e "    ${GREEN}2.${NC} 💾 Backup Relay Keys"
        echo -e "    ${GREEN}3.${NC} 📥 Restore Relay Keys"
        echo -e "    ${GREEN}4.${NC} 🔄 Restart Tracker Service"
        echo -e "    ${GREEN}5.${NC} ℹ  Version Info"
        echo -e "    ${GREEN}6.${NC} 🐳 Manage Containers"
        echo -e "    ${GREEN}7.${NC} 🗑  Uninstall"
        echo -e "    ${GREEN}0.${NC} ← Back"
        echo ""

        read -p "  Enter choice: " choice < /dev/tty || { echo ""; break; }

        case "$choice" in
            1)
                show_status
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            2)
                backup_keys
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            3)
                restore_keys
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            4)
                stop_tracker_service
                setup_tracker_service
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            5)
                show_version
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                ;;
            6)
                manage_containers
                ;;
            7)
                uninstall
                exit 0
                ;;
            0|q|Q)
                return
                ;;
            "")
                redraw=false
                ;;
            *)
                echo -e "  ${RED}Invalid choice${NC}"
                redraw=false
                ;;
        esac
    done
}

#═══════════════════════════════════════════════════════════════════════
# Management Script Generation
#═══════════════════════════════════════════════════════════════════════

create_management_script() {
    log_info "Creating management script..."

    local script_url="https://raw.githubusercontent.com/SamNet-dev/torware/main/torware.sh"
    local source_file="$0"
    local dest_file="$INSTALL_DIR/torware"

    # Resolve symlinks to check if source and dest are the same file
    local resolved_source resolved_dest
    resolved_source=$(readlink -f "$source_file" 2>/dev/null || echo "$source_file")
    resolved_dest=$(readlink -f "$dest_file" 2>/dev/null || echo "$dest_file")

    # If source and dest are the same file, or running from pipe/stdin, download from GitHub
    if [ "$resolved_source" = "$resolved_dest" ] || [ ! -f "$source_file" ] || [ ! -r "$source_file" ]; then
        log_info "Downloading latest version from GitHub..."
        if ! curl -sL "$script_url" -o "$dest_file" 2>/dev/null; then
            log_error "Could not download management script."
            return 1
        fi
    else
        # Copy from local file (fresh install from downloaded script)
        if ! cp "$source_file" "$dest_file"; then
            log_error "Failed to copy management script"
            return 1
        fi
    fi

    chmod +x "$INSTALL_DIR/torware"
    ln -sf "$INSTALL_DIR/torware" /usr/local/bin/torware

    # Verify symlink
    if [ ! -x /usr/local/bin/torware ]; then
        log_warn "Symlink creation may have failed — try running 'torware' from $INSTALL_DIR/torware directly"
    fi

    log_success "Management CLI installed: /usr/local/bin/torware"
}

#═══════════════════════════════════════════════════════════════════════
# Installation Summary
#═══════════════════════════════════════════════════════════════════════

print_summary() {
    echo ""
    echo -e "${GREEN}╔═══════════════════════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}║         🧅 TORWARE INSTALLED SUCCESSFULLY!              ║${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}╠═══════════════════════════════════════════════════════════════════╣${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}║  Your Tor relay is now running!                                    ║${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}║  Commands:                                                        ║${NC}"
    echo -e "${GREEN}║    torware menu        - Interactive management menu             ║${NC}"
    echo -e "${GREEN}║    torware status       - View relay status                      ║${NC}"
    echo -e "${GREEN}║    torware health       - Run health diagnostics                 ║${NC}"
    echo -e "${GREEN}║    torware fingerprint  - Show relay fingerprint                 ║${NC}"
    local _s_any_bridge=false
    for _si in $(seq 1 ${CONTAINER_COUNT:-1}); do
        [ "$(get_container_relay_type $_si)" = "bridge" ] && _s_any_bridge=true
    done
    if [ "$_s_any_bridge" = "true" ]; then
    echo -e "${GREEN}║    torware bridge-line  - Show bridge line for sharing           ║${NC}"
    fi
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
    echo -e "${GREEN}║    torware snowflake    - Snowflake proxy status                 ║${NC}"
    fi
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
    echo -e "${GREEN}║    torware unbounded    - Unbounded (Lantern) proxy status       ║${NC}"
    fi
    if [ "$MTPROXY_ENABLED" = "true" ]; then
    echo -e "${GREEN}║    torware mtproxy      - MTProxy (Telegram) proxy status        ║${NC}"
    fi
    echo -e "${GREEN}║    torware logs         - Stream container logs                  ║${NC}"
    echo -e "${GREEN}║    torware --help       - Full command reference                 ║${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}║  Note: It may take a few minutes for your relay to bootstrap       ║${NC}"
    echo -e "${GREEN}║  and appear in the Tor consensus.                                  ║${NC}"
    echo -e "${GREEN}║                                                                   ║${NC}"
    echo -e "${GREEN}╚═══════════════════════════════════════════════════════════════════╝${NC}"
    echo ""

    # Show firewall reminder
    local count=${CONTAINER_COUNT:-1}
    echo -e "${YELLOW}  ⚠ If you have a firewall enabled, make sure these ports are open:${NC}"
    for i in $(seq 1 $count); do
        local orport=$(get_container_orport $i)
        local _rt=$(get_container_relay_type $i)
        if [ "$_rt" = "bridge" ]; then
            local ptport=$(get_container_ptport $i)
            echo -e "    Relay $i (bridge): ORPort ${GREEN}${orport}/tcp${NC}, obfs4 ${GREEN}${ptport}/tcp${NC}"
        else
            echo -e "    Relay $i ($_rt): ORPort ${GREEN}${orport}/tcp${NC}"
        fi
    done
    if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
        echo -e "    Snowflake: Uses ${GREEN}--network host${NC} — no port forwarding needed (WebRTC auto-traversal)"
    fi
    if [ "$UNBOUNDED_ENABLED" = "true" ]; then
        echo -e "    Unbounded: Uses ${GREEN}--network host${NC} — no port forwarding needed (WebRTC auto-traversal)"
    fi
    if [ "$MTPROXY_ENABLED" = "true" ]; then
        echo -e "    MTProxy: Port ${GREEN}${MTPROXY_PORT}/tcp${NC}"
    fi
    echo ""
}

#═══════════════════════════════════════════════════════════════════════
# MTProxy Menu (Telegram Proxy Settings)
#═══════════════════════════════════════════════════════════════════════

show_mtproxy_menu() {
                if [ "$MTPROXY_ENABLED" = "true" ]; then
                    echo ""
                    echo -e "${CYAN}═══ MTProxy (Telegram) ═══${NC}"
                    echo ""
                    local _mtpn="$MTPROXY_CONTAINER"
                    local _mtps="${RED}Stopped${NC}"
                    is_mtproxy_running && _mtps="${GREEN}Running${NC}"
                    local _mtp_stats=$(get_mtproxy_stats 2>/dev/null)
                    local _mtp_in=$(echo "$_mtp_stats" | awk '{print $1}')
                    local _mtp_out=$(echo "$_mtp_stats" | awk '{print $2}')
                    echo -e "  Status:      [${_mtps}]"
                    echo -e "  Traffic:     ↓ ${CYAN}$(format_bytes ${_mtp_in:-0})${NC}  ↑ ${CYAN}$(format_bytes ${_mtp_out:-0})${NC}"
                    echo -e "  Port:        ${CYAN}${MTPROXY_PORT}${NC}"
                    echo -e "  FakeTLS:     ${CYAN}${MTPROXY_DOMAIN}${NC}"
                    echo -e "  Max Conns:   ${CYAN}${MTPROXY_CONCURRENCY:-8192}${NC}"
                    if [ -n "$MTPROXY_BLOCKLIST_COUNTRIES" ]; then
                        echo -e "  Geo-Block:   ${YELLOW}${MTPROXY_BLOCKLIST_COUNTRIES}${NC}"
                    else
                        echo -e "  Geo-Block:   ${DIM}None${NC}"
                    fi
                    echo -e "  CPU/RAM:     ${CYAN}${MTPROXY_CPUS:-0.5}${NC} / ${CYAN}${MTPROXY_MEMORY:-128m}${NC}"
                    echo ""
                    echo -e "    1. Show proxy link & QR code"
                    echo -e "    2. Restart MTProxy"
                    echo -e "    3. Stop MTProxy"
                    echo -e "    4. Disable MTProxy"
                    echo -e "    5. Change settings (port/domain/resources)"
                    echo -e "    6. Regenerate secret"
                    echo -e "    7. Security settings (connection limit, geo-block)"
                    echo -e "    ${RED}8. Remove MTProxy (stop, remove container & image)${NC}"
                    if [ "$TELEGRAM_ENABLED" = "true" ]; then
                        echo -e "    9. 📱 Send link via Telegram"
                    fi
                    echo -e "    0. Back"
                    read -p "  choice: " mtp_choice < /dev/tty || true
                    case "${mtp_choice:-0}" in
                        1)
                            echo ""
                            show_mtproxy_qr
                            echo ""
                            echo -e "  ${BOLD}tg:// link (for sharing):${NC}"
                            echo -e "  ${CYAN}$(get_mtproxy_link)${NC}"
                            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                            echo ""
                            ;;
                        2) restart_mtproxy_container ;;
                        3)
                            stop_mtproxy_container
                            log_warn "MTProxy stopped but still enabled. It will restart on next 'torware start'. Use option 4 to disable permanently."
                            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                            echo ""
                            ;;
                        4)
                            MTPROXY_ENABLED="false"
                            stop_mtproxy_container
                            save_settings
                            log_success "MTProxy disabled"
                            ;;
                        5)
                            echo ""
                            echo -e "  ${BOLD}MTProxy Settings${NC}"
                            echo ""
                            local _mtp_old_port="$MTPROXY_PORT"
                            echo -e "  ${DIM}Note: MTProxy uses host networking. Choose an available port.${NC}"
                            echo -e "  ${DIM}Common choices: 443, 8443, 8080, 9443${NC}"
                            read -p "    Port [${MTPROXY_PORT}]: " _mtp_port < /dev/tty || true
                            if [ -n "$_mtp_port" ]; then
                                if [[ "$_mtp_port" =~ ^[0-9]+$ ]]; then
                                    # Check if port is available
                                    if ss -tln 2>/dev/null | grep -q ":${_mtp_port} " || netstat -tln 2>/dev/null | grep -q ":${_mtp_port} "; then
                                        log_warn "Port ${_mtp_port} is already in use. Please choose another port."
                                    else
                                        MTPROXY_PORT="$_mtp_port"
                                    fi
                                else
                                    log_warn "Invalid port"
                                fi
                            fi
                            echo ""
                            echo -e "  ${DIM}FakeTLS domain (traffic disguised as HTTPS to this domain):${NC}"
                            echo -e "  ${DIM}  1. cloudflare.com${NC}"
                            echo -e "  ${DIM}  2. google.com${NC}"
                            echo -e "  ${DIM}  3. Keep current (${MTPROXY_DOMAIN})${NC}"
                            echo -e "  ${DIM}  4. Custom domain${NC}"
                            read -p "    Domain choice [3]: " _mtp_dom < /dev/tty || true
                            case "${_mtp_dom:-3}" in
                                1) MTPROXY_DOMAIN="cloudflare.com"; MTPROXY_SECRET="" ;;
                                2) MTPROXY_DOMAIN="google.com"; MTPROXY_SECRET="" ;;
                                4)
                                    read -p "    Enter domain: " _mtp_cdom < /dev/tty || true
                                    if [ -n "$_mtp_cdom" ]; then
                                        MTPROXY_DOMAIN="$_mtp_cdom"
                                        MTPROXY_SECRET=""
                                    fi
                                    ;;
                            esac
                            echo ""
                            read -p "    CPU cores [${MTPROXY_CPUS:-0.5}]: " _mtp_cpu < /dev/tty || true
                            read -p "    RAM limit [${MTPROXY_MEMORY:-128m}]: " _mtp_mem < /dev/tty || true
                            if [ -n "$_mtp_cpu" ]; then
                                [[ "$_mtp_cpu" =~ ^[0-9]+\.?[0-9]*$ ]] && MTPROXY_CPUS="$_mtp_cpu" || log_warn "Invalid CPU"
                            fi
                            if [ -n "$_mtp_mem" ]; then
                                [[ "$_mtp_mem" =~ ^[0-9]+[mMgG]$ ]] && MTPROXY_MEMORY="$(echo "$_mtp_mem" | tr '[:upper:]' '[:lower:]')" || log_warn "Invalid RAM"
                            fi
                            save_settings
                            log_success "MTProxy settings updated"
                            # Warn if port changed - URL will be different
                            if [ "$MTPROXY_PORT" != "$_mtp_old_port" ]; then
                                echo ""
                                log_warn "Port changed from ${_mtp_old_port} to ${MTPROXY_PORT}"
                                log_warn "The proxy URL has changed! Old links will no longer work."
                                echo -e "  ${DIM}Users will need the new link to connect.${NC}"
                            fi
                            echo ""
                            read -p "  Restart MTProxy to apply? [Y/n] " _mtp_rs < /dev/tty || true
                            if [[ ! "$_mtp_rs" =~ ^[Nn]$ ]]; then
                                restart_mtproxy_container
                                # If port changed and Telegram enabled, offer to send new link
                                if [ "$MTPROXY_PORT" != "$_mtp_old_port" ] && [ "$TELEGRAM_ENABLED" = "true" ]; then
                                    echo ""
                                    read -p "  Send new proxy link to Telegram? [Y/n] " _mtp_tg < /dev/tty || true
                                    if [[ ! "$_mtp_tg" =~ ^[Nn]$ ]]; then
                                        telegram_notify_mtproxy_started
                                        log_success "New proxy link sent to Telegram"
                                    fi
                                fi
                            fi
                            ;;
                        6)
                            echo ""
                            read -p "  Regenerate secret? Old links will stop working. [y/N] " _mtp_regen < /dev/tty || true
                            if [[ "$_mtp_regen" =~ ^[Yy]$ ]]; then
                                MTPROXY_SECRET=""
                                save_settings
                                restart_mtproxy_container
                                log_success "New secret generated"
                                # Offer to send new link via Telegram
                                if [ "$TELEGRAM_ENABLED" = "true" ]; then
                                    echo ""
                                    read -p "  Send new proxy link to Telegram? [Y/n] " _mtp_tg < /dev/tty || true
                                    if [[ ! "$_mtp_tg" =~ ^[Nn]$ ]]; then
                                        telegram_notify_mtproxy_started
                                        log_success "New proxy link sent to Telegram"
                                    fi
                                fi
                            fi
                            ;;
                        7)
                            echo ""
                            echo -e "  ${BOLD}Security Settings${NC}"
                            echo ""
                            echo -e "  ${DIM}Max concurrent connections (default: 8192):${NC}"
                            read -p "    Max connections [${MTPROXY_CONCURRENCY:-8192}]: " _mtp_conc < /dev/tty || true
                            if [ -n "$_mtp_conc" ]; then
                                [[ "$_mtp_conc" =~ ^[0-9]+$ ]] && MTPROXY_CONCURRENCY="$_mtp_conc" || log_warn "Invalid number"
                            fi
                            echo ""
                            echo -e "  ${BOLD}Geo-blocking (block connections from specific countries)${NC}"
                            echo -e "  ${DIM}Block countries that don't need censorship circumvention${NC}"
                            echo -e "  ${DIM}(reduces abuse from data centers in open-internet regions)${NC}"
                            echo ""
                            if [ -n "$MTPROXY_BLOCKLIST_COUNTRIES" ]; then
                                echo -e "  Current blocklist: ${YELLOW}$MTPROXY_BLOCKLIST_COUNTRIES${NC}"
                            else
                                echo -e "  Current blocklist: ${GREEN}None (all allowed)${NC}"
                            fi
                            echo ""
                            echo -e "  ${DIM}Available countries to block:${NC}"
                            echo -e "    ${GREEN}1.${NC} US - United States"
                            echo -e "    ${GREEN}2.${NC} DE - Germany"
                            echo -e "    ${GREEN}3.${NC} NL - Netherlands"
                            echo -e "    ${GREEN}4.${NC} FR - France"
                            echo -e "    ${GREEN}5.${NC} GB - United Kingdom"
                            echo -e "    ${GREEN}6.${NC} SG - Singapore"
                            echo -e "    ${GREEN}7.${NC} JP - Japan"
                            echo -e "    ${GREEN}8.${NC} CA - Canada"
                            echo -e "    ${GREEN}9.${NC} AU - Australia"
                            echo -e "   ${GREEN}10.${NC} KR - South Korea"
                            echo -e "   ${GREEN}11.${NC} CN - China"
                            echo -e "   ${GREEN}12.${NC} RU - Russia"
                            echo ""
                            echo -e "  ${DIM}Enter numbers separated by commas (e.g., 1,2,3) or 'clear' to disable${NC}"
                            read -p "    Select countries to block: " _mtp_block_sel < /dev/tty || true
                            if [ -n "$_mtp_block_sel" ]; then
                                if [ "$_mtp_block_sel" = "clear" ] || [ "$_mtp_block_sel" = "none" ] || [ "$_mtp_block_sel" = "0" ]; then
                                    MTPROXY_BLOCKLIST_COUNTRIES=""
                                    log_info "Geo-blocking disabled"
                                else
                                    # Map numbers to country codes
                                    local _geo_codes=""
                                    local _geo_map=("" "US" "DE" "NL" "FR" "GB" "SG" "JP" "CA" "AU" "KR" "CN" "RU")
                                    for _num in $(echo "$_mtp_block_sel" | tr ',' ' '); do
                                        if [[ "$_num" =~ ^[0-9]+$ ]] && [ "$_num" -ge 1 ] && [ "$_num" -le 12 ]; then
                                            [ -n "$_geo_codes" ] && _geo_codes+=","
                                            _geo_codes+="${_geo_map[$_num]}"
                                        fi
                                    done
                                    if [ -n "$_geo_codes" ]; then
                                        MTPROXY_BLOCKLIST_COUNTRIES="$_geo_codes"
                                        log_info "Will block: $_geo_codes"
                                    fi
                                fi
                            fi
                            save_settings
                            log_success "Security settings updated"
                            echo ""
                            read -p "  Restart MTProxy to apply? [Y/n] " _mtp_sec_rs < /dev/tty || true
                            if [[ ! "$_mtp_sec_rs" =~ ^[Nn]$ ]]; then
                                restart_mtproxy_container
                            fi
                            ;;
                        8)
                            echo ""
                            read -p "  Are you sure? This will remove the container and image. [y/N] " _mtp_rm < /dev/tty || true
                            if [[ "$_mtp_rm" =~ ^[Yy]$ ]]; then
                                MTPROXY_ENABLED="false"
                                stop_mtproxy_container
                                docker rm -f "$MTPROXY_CONTAINER" 2>/dev/null || true
                                docker rmi "$MTPROXY_IMAGE" 2>/dev/null || true
                                rm -rf "$INSTALL_DIR/mtproxy" 2>/dev/null || true
                                MTPROXY_SECRET=""
                                save_settings
                                log_success "MTProxy fully removed"
                            else
                                log_info "Cancelled"
                            fi
                            ;;
                        9)
                            echo ""
                            if [ "$TELEGRAM_ENABLED" != "true" ]; then
                                log_warn "Telegram bot is not enabled."
                                echo -e "  ${DIM}Enable Telegram notifications first from the main menu.${NC}"
                            elif ! is_mtproxy_running; then
                                log_warn "MTProxy is not running. Start it first."
                            else
                                echo -ne "  Sending link & QR to Telegram... "
                                if telegram_notify_mtproxy_started; then
                                    echo -e "${GREEN}✓ Sent!${NC}"
                                else
                                    echo -e "${RED}✗ Failed${NC}"
                                fi
                            fi
                            read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
                            ;;
                    esac
                else
                    echo ""
                    echo -e "  ${BOLD}📱 MTProxy (Telegram Proxy)${NC}"
                    echo ""
                    echo -e "  Run a proxy that helps censored users access Telegram."
                    echo -e "  Uses FakeTLS to disguise traffic as normal HTTPS."
                    echo -e "  Very lightweight (~50MB RAM). Share link/QR with users."
                    echo ""
                    read -p "  Enable MTProxy? [y/N] " mtp_en < /dev/tty || true
                    if [[ "$mtp_en" =~ ^[Yy]$ ]]; then
                        MTPROXY_ENABLED="true"
                        echo ""
                        echo -e "  ${DIM}FakeTLS domain (traffic disguised as HTTPS to this domain):${NC}"
                        echo -e "  ${DIM}  1. cloudflare.com (recommended)${NC}"
                        echo -e "  ${DIM}  2. google.com${NC}"
                        echo -e "  ${DIM}  3. Custom domain${NC}"
                        read -p "  Domain choice [1]: " _mtp_dom < /dev/tty || true
                        case "${_mtp_dom:-1}" in
                            2) MTPROXY_DOMAIN="google.com" ;;
                            3)
                                read -p "  Enter domain: " _mtp_cdom < /dev/tty || true
                                MTPROXY_DOMAIN="${_mtp_cdom:-cloudflare.com}"
                                ;;
                            *) MTPROXY_DOMAIN="cloudflare.com" ;;
                        esac
                        echo ""
                        echo -e "  ${DIM}MTProxy uses host networking. Choose an available port.${NC}"
                        echo -e "  ${DIM}Common choices: 443, 8443, 8080, 9443${NC}"
                        read -p "  Port [8443]: " _mtp_port < /dev/tty || true
                        _mtp_port="${_mtp_port:-8443}"
                        if [[ "$_mtp_port" =~ ^[0-9]+$ ]]; then
                            if ss -tln 2>/dev/null | grep -q ":${_mtp_port} " || netstat -tln 2>/dev/null | grep -q ":${_mtp_port} "; then
                                log_warn "Port ${_mtp_port} appears to be in use. Trying anyway..."
                            fi
                            MTPROXY_PORT="$_mtp_port"
                        else
                            MTPROXY_PORT=8443
                        fi
                        MTPROXY_SECRET=""
                        save_settings
                        run_mtproxy_container
                    fi
                fi
                read -n 1 -s -r -p "  Press any key to continue..." < /dev/tty
}

#═══════════════════════════════════════════════════════════════════════
# CLI Entry Point
#═══════════════════════════════════════════════════════════════════════

cli_main() {
    load_settings

    case "${1:-}" in
        start)
            start_relay
            [ "$SNOWFLAKE_ENABLED" = "true" ] && start_snowflake_container
            [ "$UNBOUNDED_ENABLED" = "true" ] && start_unbounded_container
            [ "$MTPROXY_ENABLED" = "true" ] && start_mtproxy_container
            ;;
        stop)
            stop_relay
            if [ "$RELAY_TYPE" = "none" ]; then
                stop_snowflake_container
                stop_unbounded_container
                stop_mtproxy_container
            fi
            ;;
        restart)
            restart_relay
            [ "$SNOWFLAKE_ENABLED" = "true" ] && restart_snowflake_container
            [ "$UNBOUNDED_ENABLED" = "true" ] && restart_unbounded_container
            [ "$MTPROXY_ENABLED" = "true" ] && restart_mtproxy_container
            ;;
        status)
            show_status
            ;;
        dashboard|dash)
            show_dashboard
            ;;
        stats)
            show_advanced_stats
            ;;
        peers)
            show_peers
            ;;
        menu)
            show_menu
            ;;
        logs)
            show_logs
            ;;
        health)
            health_check
            ;;
        doctor)
            run_doctor
            ;;
        graphs|graph|bandwidth)
            show_bandwidth_graphs
            ;;
        fingerprint)
            show_fingerprint
            ;;
        bridge-line|bridgeline)
            show_bridge_line
            ;;
        backup)
            backup_keys
            ;;
        restore)
            restore_keys
            ;;
        snowflake)
            if [ "$SNOWFLAKE_ENABLED" = "true" ]; then
                echo -e "  Snowflake proxy: ${GREEN}enabled${NC}"
                if is_snowflake_running; then
                    echo -e "  Status: ${GREEN}running${NC}"
                    local sf_s=$(get_snowflake_stats 2>/dev/null)
                    echo -e "  Connections: $(echo "$sf_s" | awk '{print $1}')"
                    echo -e "  Traffic: ↓ $(format_bytes $(echo "$sf_s" | awk '{print $2}'))  ↑ $(format_bytes $(echo "$sf_s" | awk '{print $3}'))"
                else
                    echo -e "  Status: ${RED}stopped${NC}"
                    echo -e "  Run 'torware start' to start all containers"
                fi
            else
                echo -e "  Snowflake proxy: ${DIM}disabled${NC}"
                echo -e "  Enable via 'torware menu' > Snowflake option"
            fi
            ;;
        unbounded)
            if [ "$UNBOUNDED_ENABLED" = "true" ]; then
                echo -e "  Unbounded proxy (Lantern): ${GREEN}enabled${NC}"
                if is_unbounded_running; then
                    echo -e "  Status: ${GREEN}running${NC}"
                    local ub_s=$(get_unbounded_stats 2>/dev/null)
                    echo -e "  Live connections: $(echo "$ub_s" | awk '{print $1}')  |  All-time: $(echo "$ub_s" | awk '{print $2}')"
                else
                    echo -e "  Status: ${RED}stopped${NC}"
                    echo -e "  Run 'torware start' to start all containers"
                fi
            else
                echo -e "  Unbounded proxy (Lantern): ${DIM}disabled${NC}"
                echo -e "  Enable via 'torware menu' > Unbounded option"
            fi
            ;;
        mtproxy)
            show_mtproxy_menu
            ;;
        version|--version|-v)
            show_version
            ;;
        uninstall)
            uninstall
            ;;
        help|--help|-h)
            show_help
            ;;
        *)
            show_help
            ;;
    esac
}

#═══════════════════════════════════════════════════════════════════════
# Main Installer
#═══════════════════════════════════════════════════════════════════════

show_usage() {
    echo "Usage: $0 [--force]"
    echo ""
    echo "Options:"
    echo "  --force    Force reinstall even if already installed"
    echo "  --help     Show this help message"
}

main() {
    # Parse arguments — extract flags first, then dispatch commands
    local _args=()
    for _arg in "$@"; do
        case "$_arg" in
            --force) FORCE_REINSTALL=true ;;
            --help|-h) show_usage; exit 0 ;;
            *) _args+=("$_arg") ;;
        esac
    done

    # Dispatch CLI commands if any non-flag args remain
    if [ ${#_args[@]} -gt 0 ]; then
        case "${_args[0]}" in
            start|stop|restart|status|dashboard|dash|stats|peers|menu|logs|health|fingerprint|bridge-line|bridgeline|backup|restore|snowflake|unbounded|mtproxy|version|--version|-v|uninstall|help)
                cli_main "${_args[@]}"
                exit $?
                ;;
        esac
    fi

    # If we get here, we're in installer mode
    check_root
    print_header
    detect_os

    echo ""

    # Check if already installed
    if [ -f "$INSTALL_DIR/settings.conf" ] && [ "$FORCE_REINSTALL" != "true" ]; then
        echo -e "${CYAN}  Torware is already installed.${NC}"
        echo ""
        echo "  What would you like to do?"
        echo ""
        echo "  1. 📊 Open management menu"
        echo "  2. ⬆  Update Torware (keeps containers & settings)"
        echo "  3. 🔄 Reinstall (fresh install)"
        echo "  4. 🗑  Uninstall"
        echo "  0. 🚪 Exit"
        echo ""
        read -p "  Enter choice: " choice < /dev/tty || { echo -e "\n  ${RED}Input error.${NC}"; exit 1; }

        case "$choice" in
            1)
                echo -e "${CYAN}Opening management menu...${NC}"
                create_management_script
                exec "$INSTALL_DIR/torware" menu
                ;;
            2)
                echo ""
                log_info "Updating Torware script..."
                create_management_script
                log_success "Torware updated. Your containers and settings are unchanged."
                echo ""
                echo -e "  ${DIM}New features available in the management menu.${NC}"
                echo ""
                read -n 1 -s -r -p "  Press any key to open the menu..." < /dev/tty
                exec "$INSTALL_DIR/torware" menu
                ;;
            3)
                echo ""
                log_info "Starting fresh reinstall..."
                ;;
            4)
                uninstall
                exit 0
                ;;
            0)
                echo "Exiting."
                exit 0
                ;;
            *)
                echo -e "${RED}Invalid choice.${NC}"
                exit 1
                ;;
        esac
    fi

    # Check dependencies
    log_info "Checking dependencies..."
    check_dependencies

    echo ""

    # Interactive settings
    prompt_relay_settings

    echo ""
    echo -e "${CYAN}Starting installation...${NC}"
    echo ""

    #───────────────────────────────────────────────────────────────
    # Installation Steps
    #───────────────────────────────────────────────────────────────

    # Step 1: Install Docker
    log_info "Step 1/5: Installing Docker..."
    if ! install_docker; then
        log_error "Docker installation failed. Cannot continue."
        exit 1
    fi

    echo ""

    # Step 2: Check for backup restore
    log_info "Step 2/5: Checking for previous relay identity..."
    check_and_offer_backup_restore || true

    echo ""

    # Step 3: Start relay containers
    log_info "Step 3/5: Starting Torware..."
    # Clean up any existing containers (including Snowflake)
    for i in $(seq 1 5); do
        local cname=$(get_container_name $i)
        docker stop --timeout 30 "$cname" 2>/dev/null || true
        docker rm -f "$cname" 2>/dev/null || true
    done
    for _sfi in 1 2; do
        local _sfn=$(get_snowflake_name $_sfi)
        docker stop --timeout 10 "$_sfn" 2>/dev/null || true
        docker rm -f "$_sfn" 2>/dev/null || true
    done
    run_all_containers

    echo ""

    # Step 4: Save settings and auto-start
    log_info "Step 4/5: Setting up auto-start & tracker..."
    if ! save_settings; then
        log_error "Failed to save settings."
        exit 1
    fi
    setup_autostart
    setup_tracker_service 2>/dev/null || true

    echo ""

    # Step 5: Create management CLI
    log_info "Step 5/5: Creating management script..."
    create_management_script

    # Create stats directory
    mkdir -p "$STATS_DIR"

    print_summary

    read -p "Open management menu now? [Y/n] " open_menu < /dev/tty || true
    if [[ ! "$open_menu" =~ ^[Nn]$ ]]; then
        "$INSTALL_DIR/torware" menu
    fi
}

main "$@"