#!/usr/bin/env bash
# git-harden.sh — Audit and harden global git configuration
# Usage: git-harden.sh [--audit] [-y] [--help]

set -o errexit
set -o nounset
set -o pipefail
IFS=$'\n\t'

# ------------------------------------------------------------------------------
# Constants
# ------------------------------------------------------------------------------
readonly VERSION="0.2.3"
readonly BACKUP_DIR="${HOME}/.config/git"
readonly HOOKS_DIR="${HOME}/.config/git/hooks"
readonly ALLOWED_SIGNERS_FILE="${HOME}/.config/git/allowed_signers"
readonly GLOBAL_GITIGNORE="${HOME}/.config/git/ignore"
readonly SSH_DIR="${HOME}/.ssh"
readonly SSH_CONFIG="${SSH_DIR}/config"

# Color codes (empty if not a terminal)
if [ -t 2 ]; then
    readonly RED='\033[0;31m'
    readonly GREEN='\033[0;32m'
    readonly YELLOW='\033[0;33m'
    readonly BLUE='\033[0;34m'
    readonly BOLD='\033[1m'
    readonly RESET='\033[0m'
else
    readonly RED=''
    readonly GREEN=''
    readonly YELLOW=''
    readonly BLUE=''
    readonly BOLD=''
    readonly RESET=''
fi

# Mode flags (mutable — set by parse_args)
AUTO_YES=false
AUDIT_ONLY=false
PLATFORM=""

# Audit counters
AUDIT_OK=0
AUDIT_WARN=0
AUDIT_MISS=0

# Whether signing key was found
SIGNING_KEY_FOUND=false

SIGNING_PUB_PATH=""

# Credential helper detected for this platform
DETECTED_CRED_HELPER=""

# Optional tool availability
HAS_YKMAN=false
HAS_FIDO2_TOKEN=false

# ------------------------------------------------------------------------------
# Helpers
# ------------------------------------------------------------------------------

die() {
    printf '%bError:%b %s\n' "$RED" "$RESET" "$1" >&2
    exit 1
}

# Strip inline comments and surrounding quotes from an SSH config value.
# Handles: value # comment, "value", 'value', "value" # comment
strip_ssh_value() {
    local val="$1"
    # Remove inline comment (not inside quotes): strip ' #...' from end
    # Be careful: only strip ' #' preceded by space (not part of path)
    val="$(printf '%s' "$val" | sed 's/[[:space:]]#.*$//')"
    # Remove surrounding double quotes
    val="${val#\"}"
    val="${val%\"}"
    # Remove surrounding single quotes
    val="${val#\'}"
    val="${val%\'}"
    # Trim whitespace
    val="$(printf '%s' "$val" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
    printf '%s' "$val"
}

print_ok() {
    printf '%b[OK]%b   %s\n' "$GREEN" "$RESET" "$1" >&2
    AUDIT_OK=$((AUDIT_OK + 1))
}

print_warn() {
    printf '%b[WARN]%b %s\n' "$YELLOW" "$RESET" "$1" >&2
    AUDIT_WARN=$((AUDIT_WARN + 1))
}

print_miss() {
    printf '%b[MISS]%b %s\n' "$RED" "$RESET" "$1" >&2
    AUDIT_MISS=$((AUDIT_MISS + 1))
}

print_info() {
    printf '%b[INFO]%b %s\n' "$BLUE" "$RESET" "$1" >&2
}

print_header() {
    printf '\n%b── %s ──%b\n' "$BOLD" "$1" "$RESET" >&2
}

prompt_yn() {
    local prompt="$1"
    local default="${2:-y}"

    if [ "$AUTO_YES" = true ]; then
        return 0
    fi

    local yn_hint
    if [ "$default" = "y" ]; then
        yn_hint="[Y/n]"
    else
        yn_hint="[y/N]"
    fi

    local answer
    printf '%s %s ' "$prompt" "$yn_hint" >&2
    read -r answer </dev/tty || answer=""

    case "$answer" in
        [Yy]*) return 0 ;;
        [Nn]*) return 1 ;;
        "")
            if [ "$default" = "y" ]; then
                return 0
            else
                return 1
            fi
            ;;
        *) return 1 ;;
    esac
}

# ------------------------------------------------------------------------------
# Argument parsing
# ------------------------------------------------------------------------------

parse_args() {
    while [ $# -gt 0 ]; do
        case "$1" in
            -y|--yes)
                AUTO_YES=true
                shift
                ;;
            --audit)
                AUDIT_ONLY=true
                shift
                ;;
            --help|-h)
                usage
                exit 0
                ;;
            --version)
                printf 'git-harden.sh %s\n' "$VERSION"
                exit 0
                ;;
            *)
                die "Unknown option: $1. Use --help for usage."
                ;;
        esac
    done
}

usage() {
    cat >&2 <<'EOF'
Usage: git-harden.sh [OPTIONS]

Audit and harden your global git configuration.

Options:
  --audit       Run audit only (no changes), exit 0 if all OK, 2 if issues found
  -y, --yes     Auto-apply all recommended settings (no prompts)
  --help, -h    Show this help message
  --version     Show version

Exit codes:
  0  All settings OK, or changes successfully applied
  1  Error (missing dependencies, etc.)
  2  Audit found issues (--audit mode only)
EOF
}

# ------------------------------------------------------------------------------
# Platform detection
# ------------------------------------------------------------------------------

detect_platform() {
    local uname_out
    uname_out="$(uname -s)"
    case "$uname_out" in
        Darwin*) PLATFORM="macos" ;;
        Linux*)  PLATFORM="linux" ;;
        *)       die "Unsupported platform: $uname_out" ;;
    esac
}

# Compare version strings: returns 0 if $1 >= $2
version_gte() {
    local IFS_SAVE="$IFS"
    IFS='.'
    # shellcheck disable=SC2086
    set -- $1 $2
    IFS="$IFS_SAVE"
    # Force base-10 interpretation to avoid octal issues with leading zeros
    local a1=$((10#${1:-0})) a2=$((10#${2:-0})) a3=$((10#${3:-0}))
    local b1=$((10#${4:-0})) b2=$((10#${5:-0})) b3=$((10#${6:-0}))

    if [ "$a1" -gt "$b1" ]; then return 0; fi
    if [ "$a1" -lt "$b1" ]; then return 1; fi
    if [ "$a2" -gt "$b2" ]; then return 0; fi
    if [ "$a2" -lt "$b2" ]; then return 1; fi
    if [ "$a3" -ge "$b3" ]; then return 0; fi
    return 1
}

check_dependencies() {
    # git required
    if ! command -v git >/dev/null 2>&1; then
        die "git is not installed"
    fi

    local git_version
    git_version="$(git --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
    if [ -z "$git_version" ]; then
        die "Could not parse git version from: $(git --version)"
    fi
    if ! version_gte "$git_version" "2.34.0"; then
        die "git >= 2.34.0 required (found $git_version)"
    fi

    # ssh-keygen required
    if ! command -v ssh-keygen >/dev/null 2>&1; then
        die "ssh-keygen is not installed"
    fi

    # Optional: ykman
    if command -v ykman >/dev/null 2>&1; then
        HAS_YKMAN=true
    fi

    # Optional: fido2-token
    if command -v fido2-token >/dev/null 2>&1; then
        HAS_FIDO2_TOKEN=true
    fi

    # Detect credential helper
    detect_credential_helper
}

detect_credential_helper() {
    case "$PLATFORM" in
        macos)
            DETECTED_CRED_HELPER="osxkeychain"
            ;;
        linux)
            # Try to find libsecret credential helper
            local libsecret_path=""
            for path in \
                /usr/lib/git-core/git-credential-libsecret \
                /usr/libexec/git-core/git-credential-libsecret \
                /usr/lib/git/git-credential-libsecret; do
                if [ -x "$path" ]; then
                    libsecret_path="$path"
                    break
                fi
            done

            if [ -n "$libsecret_path" ]; then
                DETECTED_CRED_HELPER="$libsecret_path"
            else
                DETECTED_CRED_HELPER="cache --timeout=3600"
                print_info "libsecret not found; falling back to in-memory credential cache (1h TTL, not persistent)"
            fi
            ;;
    esac
}

# ------------------------------------------------------------------------------
# Audit functions
# ------------------------------------------------------------------------------

# Check a single git config key against expected value.
# Returns: prints status, updates counters.
audit_git_setting() {
    local key="$1"
    local expected="$2"
    local label="${3:-$key}"

    local current
    current="$(git config --global --get "$key" 2>/dev/null || true)"

    if [ -z "$current" ]; then
        print_miss "$label (expected: $expected)"
    elif [ "$current" = "$expected" ]; then
        print_ok "$label = $current"
    else
        print_warn "$label = $current (expected: $expected)"
    fi
}

audit_git_config() {
    print_header "Identity"
    audit_git_setting "user.useConfigOnly" "true"

    print_header "Object Integrity"
    audit_git_setting "transfer.fsckObjects" "true"
    audit_git_setting "fetch.fsckObjects" "true"
    audit_git_setting "receive.fsckObjects" "true"
    audit_git_setting "transfer.bundleURI" "false"
    audit_git_setting "fetch.prune" "true"

    print_header "Protocol Restrictions"
    audit_git_setting "protocol.version" "2"
    audit_git_setting "protocol.allow" "never"
    audit_git_setting "protocol.https.allow" "always"
    audit_git_setting "protocol.ssh.allow" "always"
    audit_git_setting "protocol.file.allow" "user"
    audit_git_setting "protocol.git.allow" "never"
    audit_git_setting "protocol.ext.allow" "never"

    print_header "Filesystem Protection"
    audit_git_setting "core.protectNTFS" "true"
    audit_git_setting "core.protectHFS" "true"
    audit_git_setting "core.fsmonitor" "false"
    audit_git_setting "core.symlinks" "false"

    print_header "Hook Control"
    # shellcheck disable=SC2088 # Intentional: git config stores literal ~
    audit_git_setting "core.hooksPath" "~/.config/git/hooks"

    print_header "Repository Safety"
    audit_git_setting "safe.bareRepository" "explicit"
    audit_git_setting "submodule.recurse" "false"

    # Detect dangerous safe.directory = * wildcard (CVE-2022-24765)
    local safe_dirs
    safe_dirs="$(git config --global --get-all safe.directory 2>/dev/null || true)"
    if printf '%s\n' "$safe_dirs" | grep -qx '\*'; then
        print_warn "safe.directory = * disables ownership checks (CVE-2022-24765). Remove this setting."
    fi

    print_header "Pull/Merge Hardening"
    audit_git_setting "pull.ff" "only"
    audit_git_setting "merge.ff" "only"

    # AC-15: warn if pull.rebase is set (conflicts with pull.ff=only)
    local pull_rebase
    pull_rebase="$(git config --global --get pull.rebase 2>/dev/null || true)"
    if [ -n "$pull_rebase" ]; then
        print_warn "pull.rebase = $pull_rebase (conflicts with pull.ff=only — consider unsetting)"
    fi

    print_header "Transport Security"
    # url.<base>.insteadOf needs special handling
    local instead_of
    instead_of="$(git config --global --get 'url.https://.insteadOf' 2>/dev/null || true)"
    if [ -z "$instead_of" ]; then
        print_miss "url.\"https://\".insteadOf (expected: http://)"
    elif [ "$instead_of" = "http://" ]; then
        print_ok "url.\"https://\".insteadOf = http://"
    else
        print_warn "url.\"https://\".insteadOf = $instead_of (expected: http://)"
    fi

    audit_git_setting "http.sslVerify" "true"

    print_header "Credential Storage"
    local cred_current
    cred_current="$(git config --global --get credential.helper 2>/dev/null || true)"
    if [ -z "$cred_current" ]; then
        print_miss "credential.helper (expected: $DETECTED_CRED_HELPER)"
    elif [ "$cred_current" = "store" ]; then
        print_warn "credential.helper = store (INSECURE: stores passwords in plaintext; expected: $DETECTED_CRED_HELPER)"
    elif [ "$cred_current" = "$DETECTED_CRED_HELPER" ]; then
        print_ok "credential.helper = $cred_current"
    else
        # Non-store, non-recommended — could be user's custom helper
        print_warn "credential.helper = $cred_current (expected: $DETECTED_CRED_HELPER)"
    fi

    print_header "Defaults"
    audit_git_setting "init.defaultBranch" "main"

    print_header "Forensic Readiness"
    audit_git_setting "gc.reflogExpire" "180.days"
    audit_git_setting "gc.reflogExpireUnreachable" "90.days"

    print_header "Visibility"
    audit_git_setting "log.showSignature" "true"
}

audit_precommit_hook() {
    print_header "Pre-commit Hook"

    local hook_path="${HOOKS_DIR}/pre-commit"

    if [ ! -f "$hook_path" ]; then
        print_miss "No pre-commit hook at $hook_path"
        return
    fi

    if [ ! -x "$hook_path" ]; then
        print_warn "Pre-commit hook exists but is not executable: $hook_path"
        return
    fi

    if grep -q 'gitleaks' "$hook_path" 2>/dev/null; then
        print_ok "Pre-commit hook with gitleaks at $hook_path"
    else
        print_warn "Pre-commit hook exists but does not reference gitleaks (user-managed)"
    fi
}

audit_global_gitignore() {
    print_header "Global Gitignore"

    local excludes_file
    excludes_file="$(git config --global --get core.excludesFile 2>/dev/null || true)"

    if [ -z "$excludes_file" ]; then
        print_miss "core.excludesFile (no global gitignore configured)"
        return
    fi

    # Expand tilde
    local expanded_path
    expanded_path="${excludes_file/#\~/$HOME}"

    if [ ! -f "$expanded_path" ]; then
        print_warn "core.excludesFile = $excludes_file (file does not exist)"
        return
    fi

    # Check for key security patterns
    local has_security_patterns=false
    if grep -q '\.env' "$expanded_path" 2>/dev/null && \
       grep -q '\*\.pem' "$expanded_path" 2>/dev/null; then
        has_security_patterns=true
    fi

    if [ "$has_security_patterns" = true ]; then
        print_ok "core.excludesFile = $excludes_file (contains security patterns)"
    else
        print_warn "core.excludesFile = $excludes_file (lacks secret patterns: .env, *.pem, *.key — consider adding them)"
    fi
}

audit_credential_hygiene() {
    print_header "Credential Hygiene"

    # shellcheck disable=SC2088 # Intentional: ~ used as display text
    # ~/.git-credentials — plaintext git passwords
    if [ -f "${HOME}/.git-credentials" ]; then
        print_warn "~/.git-credentials exists (plaintext git credentials — migrate to credential helper and delete this file)"
    fi

    # shellcheck disable=SC2088 # Intentional: ~ used as display text
    # ~/.netrc — plaintext network credentials
    if [ -f "${HOME}/.netrc" ]; then
        print_warn "~/.netrc exists (plaintext network credentials — may contain git hosting tokens)"
    fi

    # ~/.npmrc — check for actual auth tokens
    if [ -f "${HOME}/.npmrc" ]; then
        if grep -qE '_authToken=.+' "${HOME}/.npmrc" 2>/dev/null; then
            # shellcheck disable=SC2088 # Intentional: ~ used as display text
            print_warn "~/.npmrc contains auth token (plaintext npm registry token — use env vars instead)"
        fi
    fi

    # ~/.pypirc — check for password field
    if [ -f "${HOME}/.pypirc" ]; then
        if grep -qE '^[[:space:]]*password' "${HOME}/.pypirc" 2>/dev/null; then
            # shellcheck disable=SC2088 # Intentional: ~ used as display text
            print_warn "~/.pypirc contains password (plaintext PyPI credentials — use keyring or token-based auth)"
        fi
    fi
}

audit_ssh_key_hygiene() {
    print_header "SSH Key Hygiene"

    local pub_files=()
    local seen_files=""

    # Collect ~/.ssh/*.pub files
    local f
    for f in "${SSH_DIR}"/*.pub; do
        [ -f "$f" ] || continue
        pub_files+=("$f")
        seen_files="${seen_files}|${f}"
    done

    # Also collect keys from IdentityFile directives in ~/.ssh/config
    if [ -f "$SSH_CONFIG" ]; then
        local identity_path
        while IFS= read -r identity_path; do
            identity_path="$(strip_ssh_value "$identity_path")"
            [ -z "$identity_path" ] && continue
            identity_path="${identity_path/#\~/$HOME}"
            local pub_path="${identity_path}.pub"
            if [ -f "$pub_path" ]; then
                # Skip if already seen
                case "$seen_files" in
                    *"|${pub_path}"*) continue ;;
                esac
                pub_files+=("$pub_path")
                seen_files="${seen_files}|${pub_path}"
            fi
        done <<EOF
$(grep -i '^[[:space:]]*IdentityFile[[:space:]=]' "$SSH_CONFIG" 2>/dev/null | sed 's/^[[:space:]]*[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy][Ff][Ii][Ll][Ee][[:space:]=]*//')
EOF
    fi

    if [ ${#pub_files[@]} -eq 0 ]; then
        print_info "No SSH public keys found"
        return
    fi

    local key_type bits label
    for f in "${pub_files[@]}"; do
        key_type="$(awk '{print $1}' "$f" 2>/dev/null || true)"
        label="$(basename "$f")"

        case "$key_type" in
            ssh-ed25519)
                print_ok "SSH key $label (ed25519)"
                ;;
            sk-ssh-ed25519@openssh.com|sk-ssh-ed25519*)
                print_ok "SSH key $label (ed25519-sk, hardware-backed)"
                ;;
            sk-ecdsa-sha2-nistp256@openssh.com|sk-ecdsa-sha2*)
                print_ok "SSH key $label (ecdsa-sk, hardware-backed)"
                ;;
            ssh-rsa)
                bits="$(ssh-keygen -l -f "$f" 2>/dev/null | awk '{print $1}' || true)"
                if [ -n "$bits" ] && [ "$bits" -lt 2048 ] 2>/dev/null; then
                    print_warn "SSH key $label (RSA ${bits}-bit — weak, migrate to ed25519 immediately)"
                else
                    print_warn "SSH key $label (RSA ${bits:-?}-bit — consider migrating to ed25519)"
                fi
                ;;
            ssh-dss)
                print_warn "SSH key $label (DSA — deprecated, migrate to ed25519)"
                ;;
            ecdsa-sha2-*)
                print_warn "SSH key $label (ECDSA — consider migrating to ed25519)"
                ;;
            *)
                print_info "SSH key $label (unknown type: $key_type)"
                ;;
        esac
    done
}

audit_signing() {
    print_header "Signing Configuration"

    audit_git_setting "gpg.format" "ssh"
    # shellcheck disable=SC2088 # Intentional: git config stores literal ~
    audit_git_setting "gpg.ssh.allowedSignersFile" "~/.config/git/allowed_signers"

    # Check signing key
    local signing_key
    signing_key="$(git config --global --get user.signingkey 2>/dev/null || true)"
    if [ -z "$signing_key" ]; then
        print_miss "user.signingkey (no signing key configured)"
    else
        # Verify the key file exists
        local expanded_key
        expanded_key="${signing_key/#\~/$HOME}"
        if [ -f "$expanded_key" ]; then
            print_ok "user.signingkey = $signing_key"
        else
            # Key might be an inline key (starts with ssh-)
            case "$signing_key" in
                ssh-*|ecdsa-*|sk-*)
                    print_ok "user.signingkey = (inline key)"
                    ;;
                *)
                    print_warn "user.signingkey = $signing_key (file not found)"
                    ;;
            esac
        fi
    fi

    audit_git_setting "commit.gpgsign" "true"
    audit_git_setting "tag.gpgsign" "true"
    audit_git_setting "tag.forceSignAnnotated" "true"
}

audit_ssh_directive() {
    local directive="$1"
    local expected="$2"

    local current
    current="$(grep -i "^[[:space:]]*${directive}[[:space:]=]" "$SSH_CONFIG" 2>/dev/null | head -1 | sed 's/^[[:space:]]*[^[:space:]=]*[[:space:]=]*//' || true)"
    current="$(strip_ssh_value "$current")"

    if [ -z "$current" ]; then
        print_miss "SSH: $directive (expected: $expected)"
    elif [ "$current" = "$expected" ]; then
        print_ok "SSH: $directive = $current"
    else
        print_warn "SSH: $directive = $current (expected: $expected)"
    fi
}

audit_ssh_config() {
    print_header "SSH Configuration"

    if [ ! -f "$SSH_CONFIG" ]; then
        print_miss "$SSH_CONFIG does not exist"
        return
    fi

    audit_ssh_directive "StrictHostKeyChecking" "accept-new"
    audit_ssh_directive "HashKnownHosts" "yes"
    audit_ssh_directive "IdentitiesOnly" "yes"
    audit_ssh_directive "AddKeysToAgent" "yes"
    audit_ssh_directive "PubkeyAcceptedAlgorithms" "ssh-ed25519,sk-ssh-ed25519@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com"
}

print_audit_report() {
    print_header "Audit Summary"
    printf '%b  %d OK  /  %d WARN  /  %d MISS%b\n' \
        "$BOLD" "$AUDIT_OK" "$AUDIT_WARN" "$AUDIT_MISS" "$RESET" >&2

    if [ $((AUDIT_WARN + AUDIT_MISS)) -gt 0 ]; then
        return 2
    fi
    return 0
}

# ------------------------------------------------------------------------------
# Apply functions
# ------------------------------------------------------------------------------

backup_git_config() {
    local config_file="${HOME}/.gitconfig"
    local xdg_config="${HOME}/.config/git/config"

    mkdir -p "$BACKUP_DIR"

    local timestamp
    timestamp="$(date +%Y%m%d-%H%M%S)"
    local backup_file="${BACKUP_DIR}/pre-harden-backup-${timestamp}.txt"

    {
        echo "# git-harden.sh backup — $timestamp"
        echo "# Global git config snapshot"
        echo ""
        if [ -f "$config_file" ]; then
            echo "## ~/.gitconfig"
            cat "$config_file"
            echo ""
        fi
        if [ -f "$xdg_config" ]; then
            echo "## ~/.config/git/config"
            cat "$xdg_config"
            echo ""
        fi
        echo "## git config --global --list"
        git config --global --list 2>/dev/null || echo "(no global config)"
    } > "$backup_file"

    print_info "Config backed up to $backup_file"
}

# Check if a git config setting needs changing. Returns 0 if it does.
setting_needs_change() {
    local key="$1"
    local value="$2"
    local current
    current="$(git config --global --get "$key" 2>/dev/null || true)"
    [ "$current" != "$value" ]
}

# Apply a group of git config settings with a single prompt.
# Arguments: group_name description key1 value1 explanation1 key2 value2 explanation2 ...
apply_setting_group() {
    local group_name="$1"
    local description="$2"
    shift 2

    # Collect pending changes (settings that need updating)
    local pending_keys=""
    local pending_vals=""
    local pending_explanations=""
    local count=0

    while [ $# -ge 3 ]; do
        local key="$1" value="$2" explanation="$3"
        shift 3
        if setting_needs_change "$key" "$value"; then
            pending_keys="${pending_keys}${key}"$'\n'
            pending_vals="${pending_vals}${value}"$'\n'
            pending_explanations="${pending_explanations}${explanation}"$'\n'
            count=$((count + 1))
        fi
    done

    # Nothing to do
    if [ "$count" -eq 0 ]; then
        return 0
    fi

    print_header "$group_name"
    printf '  %s\n\n' "$description" >&2

    # Show what will change
    local i=0
    while [ "$i" -lt "$count" ]; do
        local key val expl
        key="$(printf '%s' "$pending_keys" | sed -n "$((i + 1))p")"
        val="$(printf '%s' "$pending_vals" | sed -n "$((i + 1))p")"
        expl="$(printf '%s' "$pending_explanations" | sed -n "$((i + 1))p")"
        printf '    %-40s %s\n' "${key} = ${val}" "# ${expl}" >&2
        i=$((i + 1))
    done
    printf '\n' >&2

    if prompt_yn "Apply these ${count} settings?"; then
        i=0
        while [ "$i" -lt "$count" ]; do
            local key val
            key="$(printf '%s' "$pending_keys" | sed -n "$((i + 1))p")"
            val="$(printf '%s' "$pending_vals" | sed -n "$((i + 1))p")"
            git config --global "$key" "$val"
            i=$((i + 1))
        done
        print_info "Applied ${count} settings"
    fi
}

apply_git_config() {

    # --- Group 1: Object Integrity ---
    apply_setting_group "Object Integrity" \
        "Validate all transferred git objects to catch corruption or malicious payloads." \
        "transfer.fsckObjects"  "true"       "Verify objects on transfer" \
        "fetch.fsckObjects"     "true"       "Verify objects on fetch" \
        "receive.fsckObjects"   "true"       "Verify objects on receive" \
        "transfer.bundleURI"    "false"      "Disable bundle URI fetching (attack surface)" \
        "fetch.prune"           "true"       "Auto-remove stale remote tracking refs"

    # --- Group 2: Protocol Restrictions ---
    apply_setting_group "Protocol Restrictions" \
        "Default-deny policy: only HTTPS and SSH allowed." \
        "protocol.version"      "2"          "Use wire protocol v2 (faster, smaller surface)" \
        "protocol.allow"        "never"      "Default-deny all protocols" \
        "protocol.https.allow"  "always"     "Allow HTTPS" \
        "protocol.ssh.allow"    "always"     "Allow SSH" \
        "protocol.file.allow"   "user"       "Allow local file protocol (user-initiated only)" \
        "protocol.git.allow"    "never"      "Block unencrypted git:// protocol" \
        "protocol.ext.allow"    "never"      "Block ext:// (arbitrary command execution)"

    # --- Group 3: Filesystem & Repository Safety ---
    # shellcheck disable=SC2088 # Intentional: git config stores literal ~
    local hooks_path_val="~/.config/git/hooks"

    apply_setting_group "Filesystem & Repository Safety" \
        "Prevent path traversal, malicious hooks, and unsafe repo configurations." \
        "core.protectNTFS"      "true"              "Block NTFS 8.3 short-name attacks" \
        "core.protectHFS"       "true"              "Block HFS+ Unicode normalization attacks" \
        "core.fsmonitor"        "false"             "Disable filesystem monitor (attack surface)" \
        "core.hooksPath"        "$hooks_path_val"   "Redirect hooks to central dir" \
        "safe.bareRepository"   "explicit"          "Require --git-dir for bare repos" \
        "submodule.recurse"     "false"             "Don't auto-recurse into submodules"

    # core.symlinks: interactive-only (may break symlink-dependent workflows)
    if [ "$AUTO_YES" = false ]; then
        local current_symlinks
        current_symlinks="$(git config --global --get core.symlinks 2>/dev/null || true)"
        if [ "$current_symlinks" != "false" ]; then
            if prompt_yn "Disable symlinks (CVE-2024-32002)? May break Node.js monorepos, etc."; then
                git config --global core.symlinks false
                print_info "Set core.symlinks = false"
            fi
        fi
    fi

    # Remove dangerous safe.directory = * wildcard if present
    local safe_dirs
    safe_dirs="$(git config --global --get-all safe.directory 2>/dev/null || true)"
    if printf '%s\n' "$safe_dirs" | grep -qx '\*'; then
        if prompt_yn "Remove dangerous safe.directory = * (disables ownership checks, CVE-2022-24765)?"; then
            git config --global --unset 'safe.directory' '\*' 2>/dev/null || \
                git config --global --unset-all 'safe.directory' '\*' 2>/dev/null || true
            print_info "Removed safe.directory = *"
        fi
    fi

    mkdir -p "$HOOKS_DIR"

    # --- Group 4: Pull/Merge & Transport ---
    # url.https.insteadOf needs special handling — check first
    local instead_of
    instead_of="$(git config --global --get 'url.https://.insteadOf' 2>/dev/null || true)"

    apply_setting_group "Pull/Merge & Transport Security" \
        "Refuse non-fast-forward merges and force HTTPS." \
        "pull.ff"               "only"       "Reject non-fast-forward pulls" \
        "merge.ff"              "only"       "Reject non-fast-forward merges" \
        "http.sslVerify"        "true"       "Enforce TLS certificate validation"

    # url rewrite is separate (not a simple key=value)
    if [ "$instead_of" != "http://" ]; then
        if prompt_yn "Rewrite http:// URLs to https:// automatically?"; then
            git config --global 'url.https://.insteadOf' 'http://'
            print_info "Set url.\"https://\".insteadOf = http://"
        fi
    fi

    # --- Group 5: Credential, Identity & Defaults ---
    local cred_current
    cred_current="$(git config --global --get credential.helper 2>/dev/null || true)"

    apply_setting_group "Identity, Credentials & Defaults" \
        "Prevent accidental identity, enforce secure credential storage." \
        "user.useConfigOnly"    "true"       "Block commits without explicit user.name/email" \
        "init.defaultBranch"    "main"       "Default branch name for new repos" \
        "log.showSignature"     "true"       "Show signature status in git log"

    # Credential helper needs special logic (warn about 'store')
    if [ "$cred_current" != "$DETECTED_CRED_HELPER" ]; then
        local cred_prompt="Set credential.helper = $DETECTED_CRED_HELPER?"
        if [ "$cred_current" = "store" ]; then
            cred_prompt="Replace INSECURE credential.helper=store with $DETECTED_CRED_HELPER?"
        fi
        if prompt_yn "$cred_prompt"; then
            git config --global credential.helper "$DETECTED_CRED_HELPER"
            print_info "Set credential.helper = $DETECTED_CRED_HELPER"
        fi
    fi

    # --- Group 6: Forensic Readiness ---
    apply_setting_group "Forensic Readiness" \
        "Extend reflog retention for post-incident investigation." \
        "gc.reflogExpire"              "180.days"  "Keep reachable reflog 180 days (default: 90)" \
        "gc.reflogExpireUnreachable"   "90.days"   "Keep unreachable reflog 90 days (default: 30)"
}

apply_precommit_hook() {
    print_header "Pre-commit Hook (gitleaks)"

    local hook_path="${HOOKS_DIR}/pre-commit"

    # Never overwrite existing hooks
    if [ -f "$hook_path" ]; then
        if grep -q 'gitleaks' "$hook_path" 2>/dev/null; then
            return
        fi
        print_info "Existing pre-commit hook found — not overwriting"
        return
    fi

    # Check for gitleaks
    local has_gitleaks=false
    if command -v gitleaks >/dev/null 2>&1; then
        has_gitleaks=true
    fi

    if [ "$has_gitleaks" = false ]; then
        print_warn "gitleaks not found — install it for pre-commit secret scanning:"
        printf '    macOS:  brew install gitleaks\n' >&2
        printf '    Linux:  apt install gitleaks / dnf install gitleaks (or download from GitHub releases)\n' >&2
    fi

    if prompt_yn "Install gitleaks pre-commit hook at $hook_path?"; then
        mkdir -p "$HOOKS_DIR"
        cat > "$hook_path" << 'HOOK_EOF'
#!/usr/bin/env bash
# Installed by git-harden.sh — global pre-commit secret scanning
# To bypass for a single commit: SKIP_GITLEAKS=1 git commit
set -o errexit
set -o nounset
set -o pipefail

if [ "${SKIP_GITLEAKS:-0}" = "1" ]; then
    exit 0
fi

if command -v gitleaks >/dev/null 2>&1; then
    gitleaks protect --staged --redact --verbose
fi
HOOK_EOF
        chmod +x "$hook_path"
        print_info "Installed gitleaks pre-commit hook at $hook_path"
    fi
}

apply_global_gitignore() {
    print_header "Global Gitignore"

    local excludes_file
    excludes_file="$(git config --global --get core.excludesFile 2>/dev/null || true)"

    if [ -n "$excludes_file" ]; then
        local expanded_path
        expanded_path="${excludes_file/#\~/$HOME}"
        print_info "core.excludesFile already set to $excludes_file"
        if [ -f "$expanded_path" ]; then
            local has_security_patterns=false
            if grep -q '\.env' "$expanded_path" 2>/dev/null && \
               grep -q '\*\.pem' "$expanded_path" 2>/dev/null; then
                has_security_patterns=true
            fi
            if [ "$has_security_patterns" = false ]; then
                print_warn "Your global gitignore lacks secret patterns (.env, *.pem, *.key) — consider adding them"
            fi
        fi
        return
    fi

    if prompt_yn "Create global gitignore with security patterns at $GLOBAL_GITIGNORE?"; then
        mkdir -p "$(dirname "$GLOBAL_GITIGNORE")"
        cat > "$GLOBAL_GITIGNORE" << 'GITIGNORE_EOF'
# === Security: secrets & credentials ===
.env
.env.*
!.env.example
*.pem
*.key
*.p12
*.pfx
*.jks
credentials.json
service-account*.json
.git-credentials
.netrc
.npmrc
.pypirc

# === Security: Terraform state (contains secrets) ===
*.tfstate
*.tfstate.backup

# === OS artifacts ===
.DS_Store
Thumbs.db
Desktop.ini

# === IDE artifacts ===
.idea/
.vscode/
*.swp
*.swo
*~
GITIGNORE_EOF
        print_info "Created $GLOBAL_GITIGNORE"

        # shellcheck disable=SC2088 # Intentional: git config stores literal ~
        git config --global core.excludesFile "~/.config/git/ignore"
        print_info "Set core.excludesFile = ~/.config/git/ignore"
    fi
}

apply_signing_config() {
    print_header "Signing Configuration"

    # Always safe to set format and allowed signers
    if setting_needs_change "gpg.format" "ssh"; then
        git config --global gpg.format ssh
        print_info "Set gpg.format = ssh"
    fi
    # shellcheck disable=SC2088 # Intentional: git config stores literal ~
    local signers_path="~/.config/git/allowed_signers"
    if setting_needs_change "gpg.ssh.allowedSignersFile" "$signers_path"; then
        git config --global gpg.ssh.allowedSignersFile "$signers_path"
        print_info "Set gpg.ssh.allowedSignersFile = $signers_path"
    fi

    # Detect existing signing key
    detect_existing_keys

    if [ "$AUTO_YES" = true ]; then
        # In -y mode: only enable signing if key exists
        if [ "$SIGNING_KEY_FOUND" = true ] && [ -n "$SIGNING_PUB_PATH" ] && [ -f "$SIGNING_PUB_PATH" ]; then
            enable_signing "$SIGNING_PUB_PATH"
        else
            print_info "No SSH signing key found. Skipping commit.gpgsign and tag.gpgsign."
            print_info "Run git-harden.sh interactively (without -y) to set up signing."
        fi
    else
        # Interactive mode: run the wizard
        signing_wizard
    fi
}

detect_existing_keys() {
    SIGNING_KEY_FOUND=false
    
    SIGNING_PUB_PATH=""

    # Check if a signing key is already configured
    local configured_key
    configured_key="$(git config --global --get user.signingkey 2>/dev/null || true)"
    if [ -n "$configured_key" ]; then
        local expanded_key
        expanded_key="${configured_key/#\~/$HOME}"
        if [ -f "$expanded_key" ]; then
            SIGNING_KEY_FOUND=true
            SIGNING_PUB_PATH="$expanded_key"
            # Derive private key path (remove .pub suffix if present)

            return
        fi
    fi

    # Check common ed25519 key locations (sk first, then software)
    local priv_path pub_path
    for key_type in id_ed25519_sk id_ed25519; do
        priv_path="${SSH_DIR}/${key_type}"
        pub_path="${priv_path}.pub"
        if [ -f "$pub_path" ]; then
            SIGNING_KEY_FOUND=true

            SIGNING_PUB_PATH="$pub_path"
            return
        fi
    done

    # Check IdentityFile directives in ~/.ssh/config for custom-named keys
    if [ -f "$SSH_CONFIG" ]; then
        local identity_path
        while IFS= read -r identity_path; do
            # Strip inline comments and quotes
            identity_path="$(strip_ssh_value "$identity_path")"
            [ -z "$identity_path" ] && continue
            # Expand tilde safely
            identity_path="${identity_path/#\~/$HOME}"

            pub_path="${identity_path}.pub"
            if [ -f "$pub_path" ]; then
                # Only use ed25519 or ed25519-sk keys for signing
                local key_type_str
                key_type_str="$(head -1 "$pub_path" 2>/dev/null || true)"
                case "$key_type_str" in
                    ssh-ed25519*|sk-ssh-ed25519*)
                        SIGNING_KEY_FOUND=true

                        SIGNING_PUB_PATH="$pub_path"
                        return
                        ;;
                esac
            fi
        done <<EOF
$(grep -i '^[[:space:]]*IdentityFile[[:space:]=]' "$SSH_CONFIG" 2>/dev/null | sed 's/^[[:space:]]*[Ii][Dd][Ee][Nn][Tt][Ii][Tt][Yy][Ff][Ii][Ll][Ee][[:space:]=]*//')
EOF
    fi
}

detect_fido2_hardware() {
    # Check via ykman (cross-platform)
    if [ "$HAS_YKMAN" = true ]; then
        if ykman info >/dev/null 2>&1; then
            return 0
        fi
    fi
    # Check via fido2-token (Linux)
    if [ "$HAS_FIDO2_TOKEN" = true ]; then
        if fido2-token -L 2>/dev/null | grep -q .; then
            return 0
        fi
    fi
    # macOS: check IOKit USB registry for FIDO devices (works without ykman)
    if [ "$PLATFORM" = "macos" ]; then
        if ioreg -p IOUSB -l 2>/dev/null | grep -qi "fido\|yubikey\|security key\|titan"; then
            return 0
        fi
    fi
    # Linux: check /sys for FIDO HID devices (Yubico vendor 1050)
    if [ "$PLATFORM" = "linux" ]; then
        if [ -d /sys/bus/hid/devices ]; then
            for dev_dir in /sys/bus/hid/devices/*; do
                [ -d "$dev_dir" ] || continue
                case "$(basename "$dev_dir")" in
                    *1050:*) return 0 ;;
                esac
            done
        fi
    fi
    return 1
}

signing_wizard() {
    print_header "SSH Signing Setup Wizard"

    printf '\n  %bPrivacy note:%b Your signing key is public — it appears in every signed\n' "$YELLOW" "$RESET" >&2
    printf '  commit and on your GitHub/GitLab profile. Using the same key across\n' >&2
    printf '  personal and work accounts links those identities (OSINT risk). If\n' >&2
    printf '  identity separation matters, generate a dedicated key per context and\n' >&2
    printf '  use git'\''s includeIf to configure per-org signing keys.\n' >&2

    if [ "$SIGNING_KEY_FOUND" = true ]; then
        printf '\n  Found existing key: %s\n' "$SIGNING_PUB_PATH" >&2
        if prompt_yn "Use this key for git signing? (enables commit + tag signing)"; then
            enable_signing "$SIGNING_PUB_PATH"
            return
        fi
    fi

    # Offer key generation options
    printf '\n  Signing key options:\n' >&2
    printf '    1) Generate a new ed25519 SSH key (software)\n' >&2
    printf '    2) Generate a new ed25519-sk SSH key (FIDO2 hardware key)\n' >&2
    printf '    s) Skip signing setup\n' >&2

    local choice
    printf '\n  Choose [1/2/s]: ' >&2
    read -r choice </dev/tty || choice="s"

    case "$choice" in
        1)
            generate_ssh_key
            ;;
        2)
            generate_fido2_key
            ;;
        *)
            print_info "Skipping signing setup."
            return
            ;;
    esac

    if [ "$SIGNING_KEY_FOUND" = true ]; then
        if prompt_yn "Enable commit and tag signing with this key?"; then
            enable_signing "$SIGNING_PUB_PATH"
        fi
    fi
}

# Enable signing with a given public key path. Sets signingkey, gpgsign,
# and forceSignAnnotated in one step (no individual prompts).
enable_signing() {
    local pub_path="$1"
    git config --global user.signingkey "$pub_path"
    git config --global commit.gpgsign true
    git config --global tag.gpgsign true
    git config --global tag.forceSignAnnotated true
    print_info "Signing enabled: commits and tags will be signed with $pub_path"
    setup_allowed_signers
}

generate_ssh_key() {
    local key_path="${SSH_DIR}/id_ed25519"

    if [ -f "$key_path" ]; then
        print_warn "$key_path already exists. Not overwriting."
        SIGNING_KEY_FOUND=true

        SIGNING_PUB_PATH="${key_path}.pub"
        return
    fi

    printf '  Generating ed25519 SSH key...\n' >&2

    local email
    email="$(git config --global --get user.email 2>/dev/null || true)"
    if [ -z "$email" ]; then
        printf '  Enter email for key comment: ' >&2
        read -r email </dev/tty || email="git-signing"
    fi

    mkdir -p "$SSH_DIR"
    chmod 700 "$SSH_DIR"

    ssh-keygen -t ed25519 -C "$email" -f "$key_path" </dev/tty

    if [ -f "${key_path}.pub" ]; then
        SIGNING_KEY_FOUND=true

        SIGNING_PUB_PATH="${key_path}.pub"
        print_info "Key generated: ${key_path}.pub"
    else
        print_warn "Key generation may have failed — ${key_path}.pub not found"
    fi
}

generate_fido2_key() {
    local key_path="${SSH_DIR}/id_ed25519_sk"

    if [ -f "$key_path" ]; then
        print_warn "$key_path already exists. Not overwriting."
        SIGNING_KEY_FOUND=true

        SIGNING_PUB_PATH="${key_path}.pub"
        return
    fi

    if ! detect_fido2_hardware; then
        printf '\n  No FIDO2 security key detected.\n' >&2
        printf '  Please insert your security key and press Enter to continue (or q to go back): ' >&2
        local reply
        read -r reply </dev/tty || reply="q"
        if [ "$reply" = "q" ]; then
            return
        fi
        if ! detect_fido2_hardware; then
            print_warn "Still no FIDO2 hardware detected. Skipping."
            return
        fi
    fi

    # On macOS, the system ssh-keygen lacks FIDO2 support. Homebrew's openssh
    # bundles ssh-sk-helper and builds FIDO2 into its own ssh-keygen binary.
    # Detect by checking for ssh-sk-helper (NOT by running ssh-keygen, which
    # would block waiting for a FIDO touch).
    local keygen_cmd="ssh-keygen"
    if [ "$PLATFORM" = "macos" ]; then
        local brew_keygen=""
        local brew_path brew_dir
        for brew_path in /opt/homebrew/bin/ssh-keygen /usr/local/bin/ssh-keygen; do
            [ -x "$brew_path" ] || continue
            # Resolve symlink to find the cellar libexec with ssh-sk-helper
            local real_path
            real_path="$(readlink "$brew_path" 2>/dev/null || true)"
            if [ -n "$real_path" ]; then
                # Relative symlink: resolve against parent dir
                brew_dir="$(cd "$(dirname "$brew_path")" && cd "$(dirname "$real_path")" && pwd)"
                if [ -x "${brew_dir}/../libexec/ssh-sk-helper" ]; then
                    brew_keygen="$brew_path"
                    break
                fi
            fi
        done
        if [ -z "$brew_keygen" ]; then
            print_warn "macOS system ssh-keygen lacks FIDO2 support."
            printf '  Install Homebrew OpenSSH (includes built-in FIDO2):\n' >&2
            printf '    brew install openssh\n' >&2
            printf '  Then re-run this script.\n' >&2
            return
        fi
        keygen_cmd="$brew_keygen"
    fi

    printf '  Generating ed25519-sk SSH key (touch your security key when prompted)...\n' >&2

    local email
    email="$(git config --global --get user.email 2>/dev/null || true)"
    if [ -z "$email" ]; then
        printf '  Enter email for key comment: ' >&2
        read -r email </dev/tty || email="git-signing"
    fi

    mkdir -p "$SSH_DIR"
    chmod 700 "$SSH_DIR"

    # Do NOT suppress stderr — per AC-7
    "$keygen_cmd" -t ed25519-sk -C "$email" -f "$key_path" </dev/tty

    if [ -f "${key_path}.pub" ]; then
        SIGNING_KEY_FOUND=true

        SIGNING_PUB_PATH="${key_path}.pub"
        print_info "Key generated: ${key_path}.pub"
    else
        print_warn "Key generation may have failed — ${key_path}.pub not found"
    fi
}

setup_allowed_signers() {
    if [ -z "$SIGNING_PUB_PATH" ] || [ ! -f "$SIGNING_PUB_PATH" ]; then
        return
    fi

    local email
    email="$(git config --global --get user.email 2>/dev/null || true)"
    if [ -z "$email" ]; then
        print_warn "user.email not set — cannot create allowed_signers entry"
        return
    fi

    mkdir -p "$(dirname "$ALLOWED_SIGNERS_FILE")"

    local pub_key
    pub_key="$(cat "$SIGNING_PUB_PATH")"

    # Check if this entry already exists
    if [ -f "$ALLOWED_SIGNERS_FILE" ]; then
        if grep -qF "$pub_key" "$ALLOWED_SIGNERS_FILE" 2>/dev/null; then
            print_info "Signing key already in allowed_signers"
            return
        fi
    fi

    printf '%s %s\n' "$email" "$pub_key" >> "$ALLOWED_SIGNERS_FILE"
    print_info "Added signing key to $ALLOWED_SIGNERS_FILE"
}

# ------------------------------------------------------------------------------
# SSH config hardening
# ------------------------------------------------------------------------------

apply_ssh_directive() {
    local directive="$1"
    local value="$2"

    # Check if directive already exists with correct value (case-insensitive directive match)
    local current
    current="$(grep -i "^[[:space:]]*${directive}[[:space:]=]" "$SSH_CONFIG" 2>/dev/null | head -1 | sed 's/^[[:space:]]*[^[:space:]=]*[[:space:]=]*//' || true)"
    current="$(strip_ssh_value "$current")"

    if [ "$current" = "$value" ]; then
        return
    fi

    if [ -n "$current" ]; then
        # Directive exists but with wrong value
        if prompt_yn "Update SSH directive: $directive $current -> $value?"; then
            # Use temp file to avoid sed -i portability issues
            local tmpfile
            tmpfile="$(mktemp "${SSH_CONFIG}.XXXXXX")"
            trap 'rm -f "$tmpfile"' EXIT
            # Replace first occurrence of the directive (case-insensitive)
            local replaced=false
            while IFS= read -r line || [ -n "$line" ]; do
                if [ "$replaced" = false ] && printf '%s' "$line" | grep -qi "^[[:space:]]*${directive}[[:space:]=]"; then
                    printf '%s %s\n' "$directive" "$value"
                    replaced=true
                else
                    printf '%s\n' "$line"
                fi
            done < "$SSH_CONFIG" > "$tmpfile"
            mv "$tmpfile" "$SSH_CONFIG"
            chmod 600 "$SSH_CONFIG"
            print_info "Updated $directive = $value in $SSH_CONFIG"
        fi
    else
        # Directive missing entirely
        if prompt_yn "Add SSH directive: $directive $value?"; then
            printf '%s %s\n' "$directive" "$value" >> "$SSH_CONFIG"
            print_info "Added $directive $value to $SSH_CONFIG"
        fi
    fi
}

apply_ssh_config() {
    print_header "SSH Config Hardening"

    # Ensure ~/.ssh/ exists with correct permissions
    if [ ! -d "$SSH_DIR" ]; then
        mkdir -p "$SSH_DIR"
        chmod 700 "$SSH_DIR"
        print_info "Created $SSH_DIR with mode 700"
    fi

    # Ensure ~/.ssh/config exists with correct permissions
    if [ ! -f "$SSH_CONFIG" ]; then
        touch "$SSH_CONFIG"
        chmod 600 "$SSH_CONFIG"
        print_info "Created $SSH_CONFIG with mode 600"
    fi

    apply_ssh_directive "StrictHostKeyChecking" "accept-new"
    apply_ssh_directive "HashKnownHosts" "yes"
    apply_ssh_directive "IdentitiesOnly" "yes"
    apply_ssh_directive "AddKeysToAgent" "yes"
    apply_ssh_directive "PubkeyAcceptedAlgorithms" "ssh-ed25519,sk-ssh-ed25519@openssh.com,ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com"
}

# ------------------------------------------------------------------------------
# Admin recommendations
# ------------------------------------------------------------------------------

print_admin_recommendations() {
    print_header "Admin / Org-Level Recommendations"
    printf '  These are informational and cannot be applied by this script:\n\n' >&2
    printf '  • Enable branch protection rules on main branches\n' >&2
    printf '  • Enable GitHub vigilant mode (Settings → SSH and GPG keys → Flag unsigned commits)\n' >&2
    printf '  • Restrict force-pushes (disable or limit to admins)\n' >&2
    printf '  • Rotate personal access tokens regularly; prefer fine-grained tokens\n' >&2
    printf '  • Use short-lived credentials (GitHub App tokens, OIDC) in CI/CD\n' >&2
    printf '  • Require signed commits via branch protection (Require signed commits)\n' >&2
    printf '  • Audit deploy keys and service account access quarterly\n' >&2
    printf '  • If using hook frameworks (husky, lefthook, pre-commit), pin versions and review changes\n' >&2
    printf '  • Use separate signing keys per org to prevent cross-platform identity correlation (OSINT)\n' >&2
    printf '    Use git includeIf with gitdir: or hasconfig:remote.*.url: for per-org signing keys\n' >&2
    printf '\n' >&2
}

# ------------------------------------------------------------------------------
# Safety review gate
# ------------------------------------------------------------------------------

safety_review_gate() {
    # Skip in -y mode (user takes responsibility) or --audit (read-only)
    if [ "$AUTO_YES" = true ] || [ "$AUDIT_ONLY" = true ]; then
        return
    fi

    local script_path
    script_path="$(cd "$(dirname "$0")" && pwd)/$(basename "$0")"

    printf '\n%b── Safety Review ──%b\n' "$BOLD" "$RESET" >&2
    printf '  Before running scripts that modify your system configuration,\n' >&2
    printf '  you should review them with a tool you trust.\n\n' >&2

    if ! prompt_yn "Have you reviewed this script (or had an AI assistant review it) for safety?" "n"; then
        local review_prompt="Review this shell script for security issues. Check that it only modifies git and SSH config, makes no network calls, and does not exfiltrate data. List every file it writes to."
        printf '\n  You can review this script by piping it to an AI coding assistant:\n\n' >&2
        printf '  %bClaude Code:%b\n' "$BOLD" "$RESET" >&2
        printf '    cat "%s" | claude "%s"\n\n' "$script_path" "$review_prompt" >&2
        printf '  %bGemini CLI:%b\n' "$BOLD" "$RESET" >&2
        printf '    cat "%s" | gemini -p "%s"\n\n' "$script_path" "$review_prompt" >&2
        printf '  %bManual review:%b\n' "$BOLD" "$RESET" >&2
        printf '    less "%s"\n\n' "$script_path" >&2
        exit 0
    fi
}

# ------------------------------------------------------------------------------
# Main
# ------------------------------------------------------------------------------

main() {
    parse_args "$@"
    safety_review_gate
    detect_platform
    check_dependencies

    # --- Audit phase ---
    AUDIT_OK=0
    AUDIT_WARN=0
    AUDIT_MISS=0

    audit_git_config
    audit_precommit_hook
    audit_global_gitignore
    audit_credential_hygiene
    audit_signing
    audit_ssh_config
    audit_ssh_key_hygiene

    local audit_exit=0
    print_audit_report || audit_exit=$?

    if [ "$AUDIT_ONLY" = true ]; then
        exit "$audit_exit"
    fi

    # If everything is already OK, nothing to do
    if [ "$audit_exit" -eq 0 ]; then
        print_info "All settings already match recommendations. Nothing to do."
        print_admin_recommendations
        exit 0
    fi

    # --- Apply phase ---
    if [ "$AUTO_YES" = false ]; then
        printf '\n' >&2
        if ! prompt_yn "Proceed with hardening?"; then
            print_info "Aborted."
            exit 0
        fi
    fi

    backup_git_config
    apply_git_config
    apply_precommit_hook
    apply_global_gitignore
    apply_signing_config
    apply_ssh_config
    print_admin_recommendations

    print_info "Hardening complete. Re-run with --audit to verify."
}

main "$@"