main.go

package main

import (
	"context"
	"encoding/json"
	"flag"
	"fmt"
	"net"
	"os"
	"os/signal"
	"strings"
	"sync"
	"syscall"
	"time"

	"github.com/charmbracelet/bubbles/progress"
	"github.com/charmbracelet/bubbles/timer"
	tea "github.com/charmbracelet/bubbletea"

	"github.com/ResistanceIsUseless/ProxyHawk/internal/config"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/discovery"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/errors"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/help"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/loader"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/logging"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/metrics"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/output"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/pool"
	progresspkg "github.com/ResistanceIsUseless/ProxyHawk/internal/progress"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/proxy"
	"github.com/ResistanceIsUseless/ProxyHawk/internal/ui"
)

// AppState represents the application state
type AppState struct {
	view        *ui.View
	checker     *proxy.Checker
	proxies     []string
	results     []*proxy.ProxyResult
	concurrency int
	verbose     bool
	debug       bool
	logger      *logging.Logger
	mutex       sync.RWMutex // RWMutex to protect shared state (allows concurrent reads)
	updateChan  chan tea.Msg // Channel for sending updates to the UI

	// Terminal dimensions
	width  int
	height int

	// Timer for UI updates
	ticker timer.Model

	// Graceful shutdown support
	ctx          context.Context
	cancel       context.CancelFunc
	shutdownChan chan os.Signal

	// Output options
	outputFile    string
	jsonFile      string
	workingFile   string
	anonymousFile string
	noUI          bool

	// Progress indicator for non-TUI mode
	progressIndicator progresspkg.ProgressIndicator

	// Metrics collection
	metricsCollector *metrics.Collector

	// Config watcher for hot-reloading
	configWatcher *config.ConfigWatcher
}

// Define custom message types
type progressUpdateMsg struct{}

// Worker message types
type checkingStartedMsg struct{}

type proxyCheckStartedMsg struct {
	proxy string
}

type proxyCheckCompleteMsg struct {
	proxy  string
	result *proxy.ProxyResult
}

type allChecksCompleteMsg struct {
	totalChecked int
}

func main() {
	// Parse command line flags
	proxyList := flag.String("l", "", "File containing list of proxies")
	proxyHost := flag.String("host", "", "Single proxy host (IP, hostname, or IP:PORT) to test")
	proxyCIDR := flag.String("cidr", "", "CIDR range to test (e.g., 192.168.1.0/24, or 192.168.1.0/24:8080 to specify port)")
	configFile := flag.String("config", "config/default.yaml", "Path to config file")
	verbose := flag.Bool("v", false, "Enable verbose output")
	debug := flag.Bool("d", false, "Enable debug mode")
	concurrency := flag.Int("c", 0, "Number of concurrent checks (overrides config)")
	useRDNS := flag.Bool("r", false, "Use rDNS lookup for host headers")
	timeout := flag.Int("t", 0, "Timeout in seconds (overrides config)")
	hotReload := flag.Bool("hot-reload", false, "Enable configuration hot-reloading")

	// Rate limiting flags
	rateLimitEnabled := flag.Bool("rate-limit", false, "Enable rate limiting")
	rateLimitDelay := flag.Duration("rate-delay", 1*time.Second, "Delay between requests (e.g. 500ms, 1s, 2s)")
	rateLimitPerHost := flag.Bool("rate-per-host", true, "Apply rate limiting per host instead of globally")
	rateLimitPerProxy := flag.Bool("rate-per-proxy", false, "Apply rate limiting per individual proxy (takes precedence over per-host)")

	// Output flags
	outputFile := flag.String("o", "", "Output results to text file")
	jsonFile := flag.String("j", "", "Output results to JSON file")
	workingFile := flag.String("wp", "", "Output working proxies to file")
	anonymousFile := flag.String("wpa", "", "Output working anonymous proxies to file")
	noUI := flag.Bool("no-ui", false, "Disable terminal UI (for automation/scripting)")

	// Progress indicator flags
	progressType := flag.String("progress", "bar", "Progress indicator type for non-TUI mode (none, basic, bar, spinner, dots, percent)")
	progressWidth := flag.Int("progress-width", 50, "Width of progress bar")
	progressNoColor := flag.Bool("progress-no-color", false, "Disable colored progress output")

	// Metrics flags
	enableMetrics := flag.Bool("metrics", false, "Enable Prometheus metrics endpoint")
	metricsAddr := flag.String("metrics-addr", ":9090", "Address to serve metrics on")
	metricsPath := flag.String("metrics-path", "/metrics", "Path for metrics endpoint")

	// Protocol flags
	enableHTTP2 := flag.Bool("http2", false, "Enable HTTP/2 protocol detection and support")
	enableHTTP3 := flag.Bool("http3", false, "Enable HTTP/3 protocol detection and support")

	// Check mode flags
	checkMode := flag.String("mode", "basic", "Check mode: basic (connectivity only), intense (advanced security checks), vulns (vulnerability scanning)")
	enableAdvancedChecks := flag.Bool("advanced", false, "Enable advanced security checks (overrides mode)")
	enableInteractsh := flag.Bool("interactsh", false, "Enable Interactsh for out-of-band detection (enhances security checks)")
	enableFingerprint := flag.Bool("fingerprint", false, "Enable proxy fingerprinting to identify proxy software/vendor")
	enablePathFingerprint := flag.Bool("path-fingerprint", false, "Enable path-based fingerprinting to test multiple endpoints and detect backend routing")
	pathFingerprintPaths := flag.String("paths", "", "Comma-separated list of custom paths to test (default: /, /admin, /api, /v1, etc.)")

	// Discovery flags
	discoverMode := flag.Bool("discover", false, "Enable discovery mode to find proxy candidates")
	discoverSource := flag.String("discover-source", "all", "Discovery source to use (shodan, censys, freelists, webscraper, all)")
	discoverQuery := flag.String("discover-query", "", "Custom discovery query (uses preset if empty)")
	discoverLimit := flag.Int("discover-limit", 100, "Maximum number of candidates to discover")
	discoverValidate := flag.Bool("discover-validate", false, "Validate discovered candidates immediately")
	discoverCountries := flag.String("discover-countries", "", "Comma-separated list of country codes to target")
	discoverMinConfidence := flag.Float64("discover-min-confidence", 0.0, "Minimum confidence score for candidates")
	discoverNoHoneypotFilter := flag.Bool("discover-no-honeypot-filter", false, "Disable honeypot detection and filtering")

	// Help and version flags
	showHelp := flag.Bool("help", false, "Show help message")
	showHelpShort := flag.Bool("h", false, "Show help message (short)")
	showVersion := flag.Bool("version", false, "Show version information")
	showQuickStart := flag.Bool("quickstart", false, "Show quick start guide")

	// Custom usage function
	flag.Usage = func() {
		noColor := help.DetectNoColor()
		help.PrintHelp(os.Stderr, noColor)
	}

	flag.Parse()

	// Handle help and version flags before anything else
	noColor := help.DetectNoColor()

	if *showHelp || *showHelpShort {
		help.PrintHelp(os.Stdout, noColor)
		os.Exit(0)
	}

	if *showVersion {
		help.PrintVersion(os.Stdout, noColor)
		os.Exit(0)
	}

	if *showQuickStart {
		help.PrintQuickStart(os.Stdout, noColor)
		os.Exit(0)
	}

	// Validate required flags - proxy list, host, or CIDR is required unless in discovery mode
	if *proxyList == "" && *proxyHost == "" && *proxyCIDR == "" && !*discoverMode {
		help.PrintUsageError(os.Stderr, fmt.Errorf("one of -l (file), -host (single host), -cidr (CIDR range), or -discover mode is required"), noColor)
		os.Exit(1)
	}

	// Ensure only one input method is used
	inputCount := 0
	if *proxyList != "" {
		inputCount++
	}
	if *proxyHost != "" {
		inputCount++
	}
	if *proxyCIDR != "" {
		inputCount++
	}
	if *discoverMode {
		inputCount++
	}
	if inputCount > 1 {
		help.PrintUsageError(os.Stderr, fmt.Errorf("only one of -l, -host, -cidr, or -discover can be used at a time"), noColor)
		os.Exit(1)
	}

	// Initialize logger based on debug/verbose flags
	logLevel := logging.LevelInfo
	if *debug {
		logLevel = logging.LevelDebug
	}
	logger := logging.NewLogger(logging.Config{
		Level:  logLevel,
		Format: "text",
	})

	// Initialize user config if using default and it doesn't exist
	finalConfigPath := *configFile
	if *configFile == "config/default.yaml" || *configFile == "config/client/default.yaml" {
		userConfigPath, needsInit, err := config.GetConfigPath(*configFile)
		if err != nil {
			logger.Error("Failed to determine config path", "error", err)
			os.Exit(1)
		}

		// If user config doesn't exist and we're using defaults, create it
		if needsInit {
			createdPath, created, err := config.EnsureUserConfig()
			if err != nil {
				logger.Warn("Could not create user config, using default",
					"error", err,
					"path", userConfigPath)
				finalConfigPath = "config/client/default.yaml"
			} else if created {
				logger.Info("Created user configuration",
					"path", createdPath,
					"customize", "Edit this file to customize your settings")
				finalConfigPath = createdPath
			} else {
				finalConfigPath = createdPath
			}
		} else {
			finalConfigPath = userConfigPath
		}
	}

	// Load configuration (without validation yet - we'll validate after mode overrides)
	cfg, err := config.LoadConfig(finalConfigPath)
	if err != nil {
		// Enhanced error logging with error categorization
		category := errors.GetErrorCategory(err)
		logger.Error("Failed to load configuration",
			"error", err,
			"file", finalConfigPath,
			"category", category,
			"critical", errors.IsCritical(err))
		os.Exit(1)
	}

	logger.ConfigLoaded(finalConfigPath)

	// Override config with command line flags if specified
	if *concurrency > 0 {
		cfg.Concurrency = *concurrency
	}
	if *timeout > 0 {
		cfg.Timeout = *timeout
	}

	// Override metrics config with CLI flags
	if *enableMetrics {
		cfg.Metrics.Enabled = true
		cfg.Metrics.ListenAddr = *metricsAddr
		cfg.Metrics.Path = *metricsPath
	}

	// Override protocol settings with CLI flags
	if *enableHTTP2 {
		cfg.EnableHTTP2 = true
	}
	if *enableHTTP3 {
		cfg.EnableHTTP3 = true
	}

	// Override fingerprinting setting with CLI flag
	if *enableFingerprint {
		cfg.EnableFingerprint = true
	}

	// Apply check mode settings (BEFORE validation so warnings are accurate)
	if *enableAdvancedChecks {
		// Explicit --advanced flag enables all checks
		cfg.AdvancedChecks.TestSSRF = true
		cfg.AdvancedChecks.TestHostHeaderInjection = true
		cfg.AdvancedChecks.TestProtocolSmuggling = true
		cfg.AdvancedChecks.TestDNSRebinding = true
		cfg.AdvancedChecks.TestCachePoisoning = true
		cfg.AdvancedChecks.TestIPv6 = true
	} else {
		// Apply mode-based settings
		switch strings.ToLower(*checkMode) {
		case "basic":
			// Basic mode: connectivity checks only (all tests disabled)
			cfg.AdvancedChecks.TestSSRF = false
			cfg.AdvancedChecks.TestHostHeaderInjection = false
			cfg.AdvancedChecks.TestProtocolSmuggling = false
			cfg.AdvancedChecks.TestDNSRebinding = false
			cfg.AdvancedChecks.TestCachePoisoning = false
			cfg.AdvancedChecks.TestIPv6 = false
		case "intense":
			// Intense mode: core security checks (fast tests only)
			cfg.AdvancedChecks.TestSSRF = true
			cfg.AdvancedChecks.TestHostHeaderInjection = true
			cfg.AdvancedChecks.TestProtocolSmuggling = true
			cfg.AdvancedChecks.TestDNSRebinding = false // Too slow for default intense
			cfg.AdvancedChecks.TestCachePoisoning = false // Too slow for default intense
			cfg.AdvancedChecks.TestIPv6 = true
		case "vulns":
			// Vulns mode: all vulnerability checks enabled (includes slow tests)
			cfg.AdvancedChecks.TestSSRF = true
			cfg.AdvancedChecks.TestHostHeaderInjection = true
			cfg.AdvancedChecks.TestProtocolSmuggling = true
			cfg.AdvancedChecks.TestDNSRebinding = true
			cfg.AdvancedChecks.TestCachePoisoning = true
			cfg.AdvancedChecks.TestIPv6 = true
			cfg.AdvancedChecks.TestNginxVulnerabilities = true
			cfg.AdvancedChecks.TestApacheVulnerabilities = true
			cfg.AdvancedChecks.TestKongVulnerabilities = true
			cfg.AdvancedChecks.TestGenericVulnerabilities = true
			cfg.AdvancedChecks.TestExtendedVulnerabilities = true
			cfg.AdvancedChecks.TestVendorVulnerabilities = true
		default:
			logger.Warn("Invalid check mode specified, using basic", "mode", *checkMode)
			cfg.AdvancedChecks.TestSSRF = false
			cfg.AdvancedChecks.TestHostHeaderInjection = false
			cfg.AdvancedChecks.TestProtocolSmuggling = false
			cfg.AdvancedChecks.TestDNSRebinding = false
			cfg.AdvancedChecks.TestCachePoisoning = false
			cfg.AdvancedChecks.TestIPv6 = false
		}
	}

	// NOW validate configuration (after mode overrides have been applied)
	validationResult := config.ValidateConfig(cfg)

	// Log validation warnings if any
	if len(validationResult.Warnings) > 0 {
		for _, warning := range validationResult.Warnings {
			logger.Warn("Configuration validation warning", "warning", warning)
		}
	}

	// Check for validation errors
	if !validationResult.Valid {
		logger.Error("Configuration validation failed", "errors", len(validationResult.Errors))
		for _, validationErr := range validationResult.Errors {
			logger.Error("Configuration error", "error", validationErr.Error())
		}
		os.Exit(1)
	}

	// Set up config hot-reloading if enabled
	var configWatcher *config.ConfigWatcher
	if *hotReload {
		watcherConfig := config.WatcherConfig{
			DebounceDelay:        1 * time.Second,
			ValidateBeforeReload: true,
			OnReload: func(newConfig *config.Config, result *config.ValidationResult) {
				logger.Info("Configuration reloaded successfully", "file", *configFile)

				// Log any warnings
				for _, warning := range result.Warnings {
					logger.Warn("Configuration warning after reload", "warning", warning)
				}

				// Note: We don't update the running configuration here because
				// that would require stopping and restarting workers, which is complex.
				// For now, hot-reload will take effect on the next run.
				logger.Info("Configuration changes will take effect on next proxy check run")
			},
			OnError: func(err error) {
				logger.Error("Configuration reload failed", "error", err)
			},
		}

		var err error
		configWatcher, err = config.NewConfigWatcher(*configFile, watcherConfig)
		if err != nil {
			logger.Warn("Failed to enable configuration hot-reloading", "error", err)
			// Continue without hot-reload
		} else {
			logger.Info("Configuration hot-reloading enabled", "file", *configFile)
		}
	}

	// Apply Interactsh flag (if specified, disable the DisableInteractsh flag)
	if *enableInteractsh {
		cfg.AdvancedChecks.DisableInteractsh = false
		logger.Info("Interactsh enabled for out-of-band detection")
	}

	// Override discovery settings with CLI flags
	if *discoverCountries != "" {
		cfg.Discovery.Countries = strings.Split(*discoverCountries, ",")
	}
	if *discoverMinConfidence > 0 {
		cfg.Discovery.MinConfidence = *discoverMinConfidence
	}

	// Handle discovery mode
	if *discoverMode {
		runDiscoveryMode(cfg, logger, *discoverSource, *discoverQuery, *discoverLimit, *discoverValidate, *discoverNoHoneypotFilter, *outputFile, *jsonFile)
		return
	}

	// Handle path-based fingerprinting mode
	if *enablePathFingerprint {
		runPathFingerprintMode(logger, *proxyHost, *pathFingerprintPaths, *timeout, cfg.InsecureSkipVerify, *outputFile, *jsonFile)
		return
	}

	// Load proxies based on input method
	var proxies []string
	var warnings []string

	if *proxyList != "" {
		// Load from file
		var loadErr error
		proxies, warnings, loadErr = loader.LoadProxies(*proxyList)
		if loadErr != nil {
			category := errors.GetErrorCategory(loadErr)
			logger.Error("Failed to load proxies",
				"error", loadErr,
				"file", *proxyList,
				"category", category,
				"retryable", errors.IsRetryable(loadErr))
			os.Exit(1)
		}
		logger.ProxiesLoaded(len(proxies), *proxyList)
	} else if *proxyHost != "" {
		// Single host
		proxies = []string{*proxyHost}
		logger.Info("Testing single proxy host", "host", *proxyHost)
	} else if *proxyCIDR != "" {
		// CIDR range
		var cidrErr error
		proxies, cidrErr = expandCIDR(*proxyCIDR)
		if cidrErr != nil {
			logger.Error("Failed to expand CIDR range",
				"error", cidrErr,
				"cidr", *proxyCIDR)
			os.Exit(1)
		}
		logger.Info("Expanded CIDR range", "cidr", *proxyCIDR, "count", len(proxies))
	}

	// Check if we have any proxies to work with
	if len(proxies) == 0 {
		logger.Error("No valid proxies found to check")
		os.Exit(1)
	}

	// Log any warnings
	for _, warning := range warnings {
		logger.Warn("Proxy loading warning", "warning", warning)
	}

	// Initialize metrics collector
	var metricsCollector *metrics.Collector
	if cfg.Metrics.Enabled {
		metricsCollector = metrics.NewCollector()
		if err := metricsCollector.StartServer(cfg.Metrics.ListenAddr); err != nil {
			logger.Warn("Failed to start metrics server", "error", err, "addr", cfg.Metrics.ListenAddr)
		} else {
			logger.Info("Metrics server started", "addr", cfg.Metrics.ListenAddr, "path", cfg.Metrics.Path)
		}
	}

	// Create connection pool
	poolConfig := pool.Config{
		MaxIdleConns:          cfg.ConnectionPool.MaxIdleConns,
		MaxIdleConnsPerHost:   cfg.ConnectionPool.MaxIdleConnsPerHost,
		MaxConnsPerHost:       cfg.ConnectionPool.MaxConnsPerHost,
		IdleConnTimeout:       cfg.ConnectionPool.IdleConnTimeout,
		KeepAliveTimeout:      cfg.ConnectionPool.KeepAliveTimeout,
		TLSHandshakeTimeout:   cfg.ConnectionPool.TLSHandshakeTimeout,
		ExpectContinueTimeout: cfg.ConnectionPool.ExpectContinueTimeout,
		DisableKeepAlives:     cfg.ConnectionPool.DisableKeepAlives,
		DisableCompression:    cfg.ConnectionPool.DisableCompression,
		InsecureSkipVerify:    cfg.InsecureSkipVerify,
	}
	connectionPool := pool.NewConnectionPool(poolConfig)
	logger.Info("Connection pool initialized",
		"max_idle_conns", poolConfig.MaxIdleConns,
		"max_idle_conns_per_host", poolConfig.MaxIdleConnsPerHost,
		"max_conns_per_host", poolConfig.MaxConnsPerHost)

	// Create proxy checker
	checker := proxy.NewChecker(proxy.Config{
		Timeout:             time.Duration(cfg.Timeout) * time.Second,
		ValidationURL:       cfg.TestURLs.DefaultURL,
		DisallowedKeywords:  cfg.Validation.DisallowedKeywords,
		MinResponseBytes:    cfg.Validation.MinResponseBytes,
		DefaultHeaders:      cfg.DefaultHeaders,
		UserAgent:           cfg.UserAgent,
		EnableCloudChecks:   cfg.EnableCloudChecks,
		CloudProviders:      cfg.CloudProviders,
		RequireStatusCode:   cfg.RequireStatusCode,
		RequireContentMatch: cfg.RequireContentMatch,
		RequireHeaderFields: cfg.RequireHeaderFields,
		AdvancedChecks:      cfg.AdvancedChecks,
		UseRDNS:             *useRDNS,
		InteractshURL:       cfg.InteractshURL,
		InteractshToken:     cfg.InteractshToken,

		// Rate limiting settings
		RateLimitEnabled:  *rateLimitEnabled,
		RateLimitDelay:    *rateLimitDelay,
		RateLimitPerHost:  *rateLimitPerHost,
		RateLimitPerProxy: *rateLimitPerProxy,

		// Retry settings
		RetryEnabled:    cfg.RetryEnabled,
		MaxRetries:      cfg.MaxRetries,
		InitialDelay:    cfg.InitialRetryDelay,
		MaxDelay:        cfg.MaxRetryDelay,
		BackoffFactor:   cfg.BackoffFactor,
		RetryableErrors: cfg.RetryableErrors,

		// Authentication settings
		AuthEnabled:     cfg.AuthEnabled,
		DefaultUsername: cfg.DefaultUsername,
		DefaultPassword: cfg.DefaultPassword,
		AuthMethods:     cfg.AuthMethods,

		// Connection pool
		ConnectionPool: connectionPool,

		// HTTP/2 and HTTP/3 settings
		EnableHTTP2: cfg.EnableHTTP2,
		EnableHTTP3: cfg.EnableHTTP3,

		// Fingerprinting settings
		EnableFingerprint: cfg.EnableFingerprint,
	}, *debug || cfg.AdvancedChecks.TestProtocolSmuggling || cfg.AdvancedChecks.TestDNSRebinding, logger)

	// Initialize UI
	p := progress.New(
		progress.WithDefaultGradient(),
		progress.WithWidth(40),
		progress.WithoutPercentage(),
	)

	view := ui.NewView()
	view.Progress = p
	view.Total = len(proxies)
	view.Version = help.GetVersion()
	view.SetMode(*verbose, *debug || cfg.AdvancedChecks.TestProtocolSmuggling || cfg.AdvancedChecks.TestDNSRebinding)

	// Set up graceful shutdown
	ctx, cancel := context.WithCancel(context.Background())
	shutdownChan := make(chan os.Signal, 1)
	signal.Notify(shutdownChan, syscall.SIGINT, syscall.SIGTERM)

	// Create progress indicator for non-TUI mode
	var progressIndicator progresspkg.ProgressIndicator
	if *noUI {
		progressConfig := progresspkg.Config{
			Type:      progresspkg.ProgressType(*progressType),
			Width:     *progressWidth,
			NoColor:   *progressNoColor,
			ShowETA:   true,
			ShowStats: true,
		}
		progressIndicator = progresspkg.NewProgressIndicator(progressConfig)
	}

	// Create application state
	state := &AppState{
		view:              view,
		checker:           checker,
		proxies:           proxies,
		concurrency:       cfg.Concurrency,
		verbose:           *verbose, // Only use verbose flag
		debug:             *debug || cfg.AdvancedChecks.TestProtocolSmuggling || cfg.AdvancedChecks.TestDNSRebinding,
		logger:            logger,
		updateChan:        make(chan tea.Msg, 100), // Buffer for update messages
		ctx:               ctx,
		cancel:            cancel,
		shutdownChan:      shutdownChan,
		outputFile:        *outputFile,
		jsonFile:          *jsonFile,
		workingFile:       *workingFile,
		anonymousFile:     *anonymousFile,
		noUI:              *noUI,
		progressIndicator: progressIndicator,
		metricsCollector:  metricsCollector,
		configWatcher:     configWatcher,
		ticker:            timer.NewWithInterval(100*time.Millisecond, 100*time.Millisecond),
	}

	// Start shutdown handler goroutine
	go func() {
		<-shutdownChan
		logger.ShutdownReceived()
		cancel() // Cancel the context to signal all goroutines to stop

		// Give goroutines time to clean up
		time.Sleep(2 * time.Second)

		// Process any remaining results
		processResults(state)

		// Stop config watcher
		if state.configWatcher != nil {
			if err := state.configWatcher.Stop(); err != nil {
				logger.Warn("Error stopping config watcher", "error", err)
			} else {
				logger.Info("Config watcher stopped")
			}
		}

		// Stop metrics server
		if state.metricsCollector != nil {
			if err := state.metricsCollector.StopServer(); err != nil {
				logger.Warn("Error stopping metrics server", "error", err)
			} else {
				logger.Info("Metrics server stopped")
			}
		}

		// Clean up connection pool
		connectionPool.CloseIdleConnections()
		logger.Info("Connection pool cleaned up")

		logger.ShutdownComplete()
		os.Exit(0)
	}()

	if state.noUI {
		// Run without UI
		logger.ProxyCheckStart(len(state.proxies), state.concurrency)
		state.startCheckingNoUI()
	} else {
		// Start the UI
		program := tea.NewProgram(state, tea.WithAltScreen(), tea.WithMouseCellMotion())

		// Start a goroutine to forward messages from updateChan to the program
		go func() {
			for msg := range state.updateChan {
				program.Send(msg)
			}
		}()

		if _, err := program.Run(); err != nil {
			logger.Error("Failed to run TUI program", "error", err)
			os.Exit(1)
		}
	}

	// Process results
	processResults(state)
}

func processResults(state *AppState) {
	// Generate summary
	summary := output.GenerateSummary(state.results)
	outputResults := output.ConvertToOutputFormat(state.results)

	// Log summary statistics
	state.logger.SummaryStats(summary.TotalProxies, summary.WorkingProxies, summary.AnonymousProxies, summary.SuccessRate)

	// Write output files if specified
	if state.outputFile != "" {
		if err := output.WriteTextOutput(state.outputFile, outputResults, summary); err != nil {
			state.logger.Error("Failed to write text output", "error", err, "file", state.outputFile)
		} else {
			state.logger.ResultsSaved(state.outputFile, "text")
		}
	}

	if state.jsonFile != "" {
		if err := output.WriteJSONOutput(state.jsonFile, summary); err != nil {
			state.logger.Error("Failed to write JSON output", "error", err, "file", state.jsonFile)
		} else {
			state.logger.ResultsSaved(state.jsonFile, "json")
		}
	}

	if state.workingFile != "" {
		if err := output.WriteWorkingProxiesOutput(state.workingFile, outputResults); err != nil {
			state.logger.Error("Failed to write working proxies", "error", err, "file", state.workingFile)
		} else {
			state.logger.ResultsSaved(state.workingFile, "working_proxies")
		}
	}

	if state.anonymousFile != "" {
		if err := output.WriteAnonymousProxiesOutput(state.anonymousFile, outputResults); err != nil {
			state.logger.Error("Failed to write anonymous proxies", "error", err, "file", state.anonymousFile)
		} else {
			state.logger.ResultsSaved(state.anonymousFile, "anonymous_proxies")
		}
	}
}

// Tea model implementation

// startCheckingCmd wraps the proxy checking goroutine in a tea.Cmd
func (s *AppState) startCheckingCmd() tea.Cmd {
	return func() tea.Msg {
		// Run in goroutine so it doesn't block
		go s.startChecking()
		// Return immediately with a started message
		return checkingStartedMsg{}
	}
}

func (s *AppState) Init() tea.Cmd {
	// Start proxy checking and timer in parallel
	return tea.Batch(
		s.startCheckingCmd(),
		s.ticker.Init(),
	)
}

func (s *AppState) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
	var cmds []tea.Cmd

	// Always update the ticker
	var cmd tea.Cmd
	s.ticker, cmd = s.ticker.Update(msg)
	cmds = append(cmds, cmd)

	switch msg := msg.(type) {
	case tea.WindowSizeMsg:
		// Handle terminal resize
		s.width = msg.Width
		s.height = msg.Height

		// Update progress bar width (account for padding/borders)
		if msg.Width > 4 {
			s.view.Progress.Width = msg.Width - 4
		}

		return s, tea.Batch(cmds...)

	case tea.KeyMsg:
		switch msg.String() {
		case "q", "Q", "ctrl+c":
			// Cancel context to stop workers
			s.cancel()
			return s, tea.Quit
		}

	case checkingStartedMsg:
		// Checking has started, just continue
		if s.debug {
			s.view.AddDebugMessage("[INFO] Proxy checking started\n")
		}
		return s, tea.Batch(cmds...)

	case proxyCheckCompleteMsg:
		// Handle completed proxy check - incremental update
		s.mutex.Lock()
		s.results = append(s.results, msg.result)
		s.view.Current++

		// Incremental metrics - O(1) instead of O(n)
		if msg.result.Working {
			s.view.Working++
		} else {
			s.view.Failed++
		}

		// Running average for speed
		if msg.result.Speed > 0 {
			// Simple running average
			oldAvg := s.view.AvgSpeed
			n := len(s.results)
			s.view.AvgSpeed = oldAvg + (msg.result.Speed-oldAvg)/time.Duration(n)
		}

		// Update progress
		progress := float64(s.view.Current) / float64(s.view.Total)
		progressCmd := s.view.Progress.SetPercent(progress)

		// Debug logging
		if s.debug {
			s.view.AddDebugMessage(fmt.Sprintf("[PROGRESS] %d/%d (%.1f%%)\n", s.view.Current, s.view.Total, progress*100))
		}

		s.mutex.Unlock()

		cmds = append(cmds, progressCmd)
		return s, tea.Batch(cmds...)

	case allChecksCompleteMsg:
		// All checks complete, can quit or show completion
		if s.debug {
			s.view.AddDebugMessage(fmt.Sprintf("[COMPLETE] All %d proxies checked\n", msg.totalChecked))
		}
		return s, tea.Batch(cmds...)

	case timer.TickMsg, progressUpdateMsg:
		// Update spinner every tick
		s.view.SpinnerIdx++

		// Update metrics collector if enabled (light operation)
		if s.metricsCollector != nil {
			s.mutex.Lock()
			activeCount := s.view.CountActive()
			queueSize := len(s.proxies) - s.view.Current - activeCount
			if queueSize < 0 {
				queueSize = 0
			}
			s.metricsCollector.SetActiveChecks(activeCount)
			s.metricsCollector.SetQueueSize(queueSize)
			s.metricsCollector.SetWorkersActive(s.concurrency)
			s.mutex.Unlock()
		}

		// Just refresh the UI, metrics are updated incrementally
		return s, tea.Batch(cmds...)
	}

	return s, tea.Batch(cmds...)
}

func (s *AppState) View() string {
	// Use read lock for rendering to allow concurrent reads
	s.mutex.RLock()
	defer s.mutex.RUnlock()

	if s.view.Mode == ui.ModeDebug {
		return s.view.RenderDebug()
	}
	if s.view.Mode == ui.ModeVerbose {
		return s.view.RenderVerbose()
	}
	return s.view.RenderDefault()
}

func (s *AppState) startChecking() {
	var wg sync.WaitGroup
	proxyChan := make(chan string)

	// Send initial update
	s.updateChan <- progressUpdateMsg{}

	if s.debug {
		s.mutex.Lock()
		s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Starting proxy checks with concurrency: %d\n", s.concurrency))
		s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Total proxies to check: %d\n", len(s.proxies)))
		s.mutex.Unlock()

		// Send update
		s.updateChan <- progressUpdateMsg{}
	}

	// Start workers
	for i := 0; i < s.concurrency; i++ {
		wg.Add(1)
		go func(workerID int) {
			// Add panic recovery to prevent worker crashes from affecting the whole application
			defer func() {
				if r := recover(); r != nil {
					s.mutex.Lock()
					s.view.AddDebugMessage(fmt.Sprintf("[ERROR] Worker %d panicked: %v\n", workerID, r))
					s.mutex.Unlock()

					// Send update
					s.updateChan <- progressUpdateMsg{}
				}
				wg.Done()
			}()

			if s.debug {
				s.mutex.Lock()
				s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d started\n", workerID))
				s.mutex.Unlock()

				// Send update
				s.updateChan <- progressUpdateMsg{}
			}

			for proxy := range proxyChan {
				// Check for cancellation before processing
				select {
				case <-s.ctx.Done():
					if s.debug {
						s.mutex.Lock()
						s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d cancelled\n", workerID))
						s.mutex.Unlock()
						s.updateChan <- progressUpdateMsg{}
					}
					return
				default:
					// Continue processing
				}

				// Update active job status when starting a check
				s.mutex.Lock()
				status := &ui.CheckStatus{
					Proxy:      proxy,
					IsActive:   true,
					LastUpdate: time.Now(),
				}
				s.view.ActiveChecks[proxy] = status
				s.mutex.Unlock()

				// Update queue size when starting a check
				// Queue size tracked in metrics
				// Send update
				s.updateChan <- progressUpdateMsg{}

				if s.debug {
					s.mutex.Lock()
					s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d checking: %s\n", workerID, proxy))
					s.mutex.Unlock()

					// Send update
					s.updateChan <- progressUpdateMsg{}
				}

				result := s.checker.Check(proxy)

				// Record metrics if enabled
				if s.metricsCollector != nil {
					s.metricsCollector.RecordProxyCheck(result.Working, string(result.Type), result.Speed)
					if result.IsAnonymous {
						s.metricsCollector.RecordAnonymousProxy()
					}
					if result.CloudProvider != "" {
						s.metricsCollector.RecordCloudProvider(result.CloudProvider)
					}
					if result.Error != nil {
						s.metricsCollector.RecordError("proxy_check_failed")
					}
				}

				// Update queue size after each check is no longer needed here as it will be updated in processResult
				// or when marking a job as inactive

				// Send update
				s.updateChan <- progressUpdateMsg{}

				// Log debug info based on result
				if s.debug {
					s.mutex.Lock()
					if !result.Working {
						// Create a more concise error message
						errorMsg := "Proxy not working"
						if result.Error != nil {
							errorMsg = result.Error.Error()
							// Truncate long error messages
							if len(errorMsg) > 100 {
								errorMsg = errorMsg[:97] + "..."
							}
						}
						s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d failed: %s - %s\n", workerID, proxy, errorMsg))
					} else {
						s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d success: %s (%s)\n", workerID, proxy, result.Type))
					}
					s.mutex.Unlock()

					// Send update
					s.updateChan <- progressUpdateMsg{}
				}

				// Always process result (whether working or not) to update counters
				s.processResult(result)

				// Send update
				s.updateChan <- progressUpdateMsg{}
			}

			if s.debug {
				s.mutex.Lock()
				s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Worker %d finished\n", workerID))
				s.mutex.Unlock()

				// Send update
				s.updateChan <- progressUpdateMsg{}
			}
		}(i)
	}

	// Feed proxies to workers
	if s.debug {
		s.mutex.Lock()
		s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Starting to feed proxies to workers\n"))
		s.mutex.Unlock()

		// Send update
		s.updateChan <- progressUpdateMsg{}
	}

	for _, proxy := range s.proxies {
		// Check for cancellation before sending each proxy
		select {
		case <-s.ctx.Done():
			if s.debug {
				s.mutex.Lock()
				s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Proxy feeding cancelled\n"))
				s.mutex.Unlock()
				s.updateChan <- progressUpdateMsg{}
			}
			close(proxyChan)
			return
		default:
			if s.debug {
				s.mutex.Lock()
				s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Sending proxy to channel: %s\n", proxy))
				s.mutex.Unlock()
			}
			proxyChan <- proxy
		}
	}

	if s.debug {
		s.mutex.Lock()
		s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] All proxies sent to channel, closing\n"))
		s.mutex.Unlock()

		// Send update
		s.updateChan <- progressUpdateMsg{}
	}
	close(proxyChan)

	if s.debug {
		s.mutex.Lock()
		s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Waiting for workers to finish\n"))
		s.mutex.Unlock()

		// Send update
		s.updateChan <- progressUpdateMsg{}
	}

	// Add a timeout mechanism to prevent deadlocks
	waitCh := make(chan struct{})
	go func() {
		wg.Wait()
		close(waitCh)
	}()

	// Set a reasonable timeout (adjust as needed)
	timeout := 30 * time.Second
	if s.concurrency > 10 {
		// Add more time for higher concurrency
		timeout = time.Duration(s.concurrency*3) * time.Second
	}

	select {
	case <-waitCh:
		// All workers finished normally
		if s.debug {
			s.mutex.Lock()
			s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] All workers finished successfully\n"))
			s.mutex.Unlock()

			// Send update
			s.updateChan <- progressUpdateMsg{}
		}
	case <-time.After(timeout):
		// Timeout occurred, some workers might be stuck
		if s.debug {
			s.mutex.Lock()
			s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] WARNING: Timed out waiting for some workers after %v\n", timeout))
			s.view.AddDebugMessage(fmt.Sprintf("[DEBUG] Proceeding with available results\n"))
			s.mutex.Unlock()

			// Send update
			s.updateChan <- progressUpdateMsg{}
		}
	}

	// Send completion message before closing channel
	s.updateChan <- allChecksCompleteMsg{totalChecked: len(s.proxies)}

	// Close the update channel
	close(s.updateChan)
}

func (s *AppState) processResult(result *proxy.ProxyResult) {
	// Send message to Update() instead of modifying state directly
	s.updateChan <- proxyCheckCompleteMsg{
		proxy:  result.ProxyURL,
		result: result,
	}

	// Still need to update UI status for active checks display
	s.mutex.Lock()
	defer s.mutex.Unlock()

	// Convert check results
	uiCheckResults := make([]ui.CheckResult, len(result.CheckResults))
	for i, cr := range result.CheckResults {
		uiCheckResults[i] = ui.CheckResult{
			URL:        cr.URL,
			Success:    cr.Success,
			Speed:      cr.Speed,
			Error:      cr.Error,
			StatusCode: cr.StatusCode,
			BodySize:   cr.BodySize,
		}
	}

	// Update UI state
	status := &ui.CheckStatus{
		Proxy:          result.ProxyURL,
		TotalChecks:    len(result.CheckResults),
		DoneChecks:     len(result.CheckResults),
		LastUpdate:     time.Now(),
		Speed:          result.Speed,
		ProxyType:      string(result.Type),
		IsActive:       false, // Mark as inactive since check is complete
		CloudProvider:  result.CloudProvider,
		InternalAccess: result.InternalAccess,
		MetadataAccess: result.MetadataAccess,
		SupportsHTTP:   result.SupportsHTTP,
		SupportsHTTPS:  result.SupportsHTTPS,
		CheckResults:   uiCheckResults,
		DebugInfo:      result.DebugInfo,
	}

	s.view.ActiveChecks[result.ProxyURL] = status

	// Queue size is tracked in metrics collector

	// Add debug info to the main debug output if in debug mode
	if s.debug && result.DebugInfo != "" {
		s.view.AddDebugMessage(result.DebugInfo)
	}
}

// startCheckingNoUI runs proxy checking without UI (for automation)
func (s *AppState) startCheckingNoUI() {
	var wg sync.WaitGroup
	proxyChan := make(chan string)

	s.logger.Info("Starting proxy tests", "total", len(s.proxies), "concurrency", s.concurrency)

	// Start progress indicator if available
	if s.progressIndicator != nil {
		s.progressIndicator.Start(len(s.proxies))
	}

	// Start workers
	for i := 0; i < s.concurrency; i++ {
		wg.Add(1)
		go func(workerID int) {
			defer wg.Done()

			for proxy := range proxyChan {
				// Check for cancellation before processing
				select {
				case <-s.ctx.Done():
					if s.verbose {
						s.logger.WithWorker(workerID).Debug("Worker cancelled")
					}
					return
				default:
					// Continue processing
				}

				if s.verbose {
					s.logger.WithWorker(workerID).WithProxy(proxy).Debug("Testing proxy")
				}

				result := s.checker.Check(proxy)

				// Record metrics if enabled
				if s.metricsCollector != nil {
					s.metricsCollector.RecordProxyCheck(result.Working, string(result.Type), result.Speed)
					if result.IsAnonymous {
						s.metricsCollector.RecordAnonymousProxy()
					}
					if result.CloudProvider != "" {
						s.metricsCollector.RecordCloudProvider(result.CloudProvider)
					}
					if result.Error != nil {
						s.metricsCollector.RecordError("proxy_check_failed")
					}
				}

				s.mutex.Lock()
				s.results = append(s.results, result)
				current := len(s.results)
				s.mutex.Unlock()

				// Update progress indicator
				if s.progressIndicator != nil {
					var message string
					if result.Working {
						if result.IsAnonymous {
							message = "working anonymous proxy"
						} else {
							message = "working proxy"
						}
					} else {
						message = "failed proxy check"
					}
					s.progressIndicator.Update(current, message)
				}

				if result.Working {
					s.logger.WithContext("progress", fmt.Sprintf("%d/%d", current, len(s.proxies))).ProxySuccess(proxy, result.Speed.Seconds(), result.IsAnonymous, result.CloudProvider)
				} else {
					if s.verbose {
						s.logger.WithContext("progress", fmt.Sprintf("%d/%d", current, len(s.proxies))).ProxyFailure(proxy, result.Error)
					}
				}
			}
		}(i)
	}

	// Feed proxies to workers
	for _, proxy := range s.proxies {
		select {
		case <-s.ctx.Done():
			s.logger.Info("Shutdown requested, stopping proxy feeding")
			close(proxyChan)
			return
		case proxyChan <- proxy:
			// Proxy sent successfully, continue
		}
	}
	close(proxyChan)

	// Wait for all workers to finish
	wg.Wait()

	// Finish progress indicator
	if s.progressIndicator != nil {
		s.progressIndicator.Finish("Proxy checking completed")
	}

	s.logger.ProxyCheckComplete()
}

// runDiscoveryMode handles the proxy discovery workflow
func runDiscoveryMode(cfg *config.Config, logger *logging.Logger, source, query string, limit int, validate bool, noHoneypotFilter bool, outputFile, jsonFile string) {
	logger.Info("Starting proxy discovery mode",
		"source", source,
		"query", query,
		"limit", limit,
		"validate", validate)

	// Create discovery manager
	manager := discovery.NewManager(cfg.Discovery, logger)
	
	// Configure honeypot filtering
	if noHoneypotFilter {
		manager.SetHoneypotFilterEnabled(false)
		logger.Info("Honeypot filtering disabled by user request")
	}

	// Check available sources
	availableSources := manager.GetAvailableSources()
	if len(availableSources) == 0 {
		logger.Error("No discovery sources configured",
			"required", "API keys in config file or environment variables")
		fmt.Fprintf(os.Stderr, "Error: No discovery sources configured.\n")
		fmt.Fprintf(os.Stderr, "Available sources:\n")
		fmt.Fprintf(os.Stderr, "  - Shodan: Add shodan_api_key to config or set SHODAN_API_KEY env var\n")
		fmt.Fprintf(os.Stderr, "  - Censys: Add censys_api_key and censys_secret to config\n")
		fmt.Fprintf(os.Stderr, "  - Free Lists: Always available (no API key required)\n")
		fmt.Fprintf(os.Stderr, "  - Web Scraper: Always available (no API key required)\n")
		os.Exit(1)
	}

	logger.Info("Available discovery sources", "sources", availableSources)

	// Use default query if none provided
	if query == "" {
		presets := manager.GetPresetQueries()
		if sourceQueries, exists := presets[source]; exists && len(sourceQueries) > 0 {
			query = sourceQueries[0] // Use first preset query
			logger.Info("Using preset query", "query", query)
		} else {
			query = "proxy server" // Fallback
			logger.Info("Using fallback query", "query", query)
		}
	}

	// Execute discovery
	var result *discovery.DiscoveryResult
	var err error

	if source == "all" {
		result, err = manager.SearchAll(query, limit)
	} else {
		result, err = manager.SearchSource(source, query, limit)
	}

	if err != nil {
		logger.Error("Discovery failed", "error", err)
		fmt.Fprintf(os.Stderr, "Discovery failed: %v\n", err)
		os.Exit(1)
	}

	// Display discovery results
	logger.Info("Discovery completed",
		"candidates_found", len(result.Candidates),
		"duration", result.Duration,
		"source", result.Source)

	fmt.Printf("\n🔍 Discovery Results\n")
	fmt.Printf("====================\n")
	fmt.Printf("Query: %s\n", result.Query)
	fmt.Printf("Source: %s\n", result.Source)
	fmt.Printf("Duration: %v\n", result.Duration)
	fmt.Printf("Candidates found: %d\n", len(result.Candidates))
	
	if len(result.Errors) > 0 {
		fmt.Printf("Errors: %d\n", len(result.Errors))
		for _, errMsg := range result.Errors {
			fmt.Printf("  - %s\n", errMsg)
		}
	}
	fmt.Printf("\n")

	if len(result.Candidates) == 0 {
		fmt.Printf("No proxy candidates found. Try adjusting your search query or filters.\n")
		return
	}

	// Show top candidates
	fmt.Printf("🎯 Top Candidates (by confidence):\n")
	fmt.Printf("===================================\n")
	showLimit := 10
	if len(result.Candidates) < showLimit {
		showLimit = len(result.Candidates)
	}

	for i, candidate := range result.Candidates[:showLimit] {
		fmt.Printf("%d. %s:%d (%s) - Confidence: %.2f\n",
			i+1, candidate.IP, candidate.Port, candidate.Protocol, candidate.Confidence)
		if candidate.Country != "" {
			fmt.Printf("   Location: %s", candidate.Country)
			if candidate.City != "" {
				fmt.Printf(", %s", candidate.City)
			}
			fmt.Printf("\n")
		}
		if candidate.ProxyType != "" && candidate.ProxyType != "unknown" {
			fmt.Printf("   Type: %s\n", candidate.ProxyType)
		}
		if candidate.ServerHeader != "" {
			fmt.Printf("   Server: %s\n", candidate.ServerHeader)
		}
		fmt.Printf("\n")
	}

	// Validate candidates if requested
	if validate {
		fmt.Printf("🧪 Validating discovered candidates...\n")
		fmt.Printf("=====================================\n")
		
		// Convert candidates to proxy URLs for validation
		proxyURLs := make([]string, len(result.Candidates))
		for i, candidate := range result.Candidates {
			proxyURLs[i] = fmt.Sprintf("%s://%s:%d", candidate.Protocol, candidate.IP, candidate.Port)
		}

		// Create proxy checker
		poolConfig := pool.Config{
			MaxIdleConns:          cfg.ConnectionPool.MaxIdleConns,
			MaxIdleConnsPerHost:   cfg.ConnectionPool.MaxIdleConnsPerHost,
			MaxConnsPerHost:       cfg.ConnectionPool.MaxConnsPerHost,
			IdleConnTimeout:       cfg.ConnectionPool.IdleConnTimeout,
			KeepAliveTimeout:      cfg.ConnectionPool.KeepAliveTimeout,
			TLSHandshakeTimeout:   cfg.ConnectionPool.TLSHandshakeTimeout,
			ExpectContinueTimeout: cfg.ConnectionPool.ExpectContinueTimeout,
			DisableKeepAlives:     cfg.ConnectionPool.DisableKeepAlives,
			DisableCompression:    cfg.ConnectionPool.DisableCompression,
			InsecureSkipVerify:    cfg.InsecureSkipVerify,
		}
		connectionPool := pool.NewConnectionPool(poolConfig)

		checker := proxy.NewChecker(proxy.Config{
			Timeout:             time.Duration(cfg.Timeout) * time.Second,
			ValidationURL:       cfg.TestURLs.DefaultURL,
			DisallowedKeywords:  cfg.Validation.DisallowedKeywords,
			MinResponseBytes:    cfg.Validation.MinResponseBytes,
			DefaultHeaders:      cfg.DefaultHeaders,
			UserAgent:           cfg.UserAgent,
			ConnectionPool:      connectionPool,
		}, false, logger) // Don't use debug mode for validation

		// Validate proxies concurrently
		workingCandidates := make([]*discovery.ProxyCandidate, 0)
		
		// Simple validation - test a few candidates
		testLimit := 20
		if len(result.Candidates) < testLimit {
			testLimit = len(result.Candidates)
		}

		fmt.Printf("Testing top %d candidates...\n\n", testLimit)
		
		for i, candidate := range result.Candidates[:testLimit] {
			proxyURL := fmt.Sprintf("%s://%s:%d", candidate.Protocol, candidate.IP, candidate.Port)
			
			fmt.Printf("Testing %d/%d: %s... ", i+1, testLimit, proxyURL)
			
			proxyResult := checker.Check(proxyURL)
			if proxyResult.Working {
				fmt.Printf("✅ Working (%.2fs)\n", proxyResult.Speed.Seconds())
				workingCandidates = append(workingCandidates, &candidate)
			} else {
				fmt.Printf("❌ Failed\n")
			}
		}

		fmt.Printf("\n✅ Validation Summary:\n")
		fmt.Printf("Tested: %d\n", testLimit)
		fmt.Printf("Working: %d\n", len(workingCandidates))
		fmt.Printf("Success Rate: %.1f%%\n", float64(len(workingCandidates))/float64(testLimit)*100)
	}

	// Save results to files if requested
	if outputFile != "" {
		err := saveCandidatesToText(result.Candidates, outputFile)
		if err != nil {
			logger.Error("Failed to save text output", "error", err, "file", outputFile)
		} else {
			logger.Info("Candidates saved to text file", "file", outputFile, "count", len(result.Candidates))
			fmt.Printf("📝 Candidates saved to: %s\n", outputFile)
		}
	}

	if jsonFile != "" {
		err := saveCandidatesToJSON(result, jsonFile)
		if err != nil {
			logger.Error("Failed to save JSON output", "error", err, "file", jsonFile)
		} else {
			logger.Info("Discovery result saved to JSON file", "file", jsonFile)
			fmt.Printf("💾 Full results saved to: %s\n", jsonFile)
		}
	}

	fmt.Printf("\n🎉 Discovery completed successfully!\n")
}

// runPathFingerprintMode performs path-based fingerprinting on a target
func runPathFingerprintMode(logger *logging.Logger, host, pathsStr string, timeout int, insecureSSL bool, outputFile, jsonFile string) {
	if host == "" {
		logger.Error("Path fingerprinting requires a host (-host flag)")
		fmt.Fprintf(os.Stderr, "Error: -host flag is required for path-based fingerprinting\n")
		fmt.Fprintf(os.Stderr, "Example: proxyhawk -path-fingerprint -host http://10.176.17.250\n")
		os.Exit(1)
	}

	// Ensure host has a protocol
	targetURL := host
	if !strings.HasPrefix(host, "http://") && !strings.HasPrefix(host, "https://") {
		targetURL = "http://" + host
	}

	// Parse custom paths if provided
	var customPaths []string
	if pathsStr != "" {
		customPaths = strings.Split(pathsStr, ",")
		for i, path := range customPaths {
			customPaths[i] = strings.TrimSpace(path)
		}
	}

	// Set timeout
	timeoutDuration := 15 * time.Second
	if timeout > 0 {
		timeoutDuration = time.Duration(timeout) * time.Second
	}

	logger.Info("Starting path-based fingerprinting",
		"target", targetURL,
		"timeout", timeoutDuration,
		"custom_paths", len(customPaths))

	fmt.Printf("\n🔍 Path-Based Fingerprinting\n")
	fmt.Printf("===========================\n")
	fmt.Printf("Target: %s\n", targetURL)
	fmt.Printf("Timeout: %v\n", timeoutDuration)
	if len(customPaths) > 0 {
		fmt.Printf("Custom Paths: %v\n", customPaths)
	}
	fmt.Printf("\n")

	// Perform path fingerprinting
	result, err := proxy.PathFingerprint(targetURL, timeoutDuration, insecureSSL, customPaths)
	if err != nil {
		logger.Error("Path fingerprinting failed", "error", err)
		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
		os.Exit(1)
	}

	logger.Info("Path fingerprinting completed",
		"paths_tested", len(result.PathResults),
		"header_differences", len(result.HeaderDifferences),
		"detected_backends", len(result.DetectedBackends),
		"routing_patterns", len(result.RoutingPatterns))

	// Display proxy software detection
	fmt.Printf("📋 Proxy Software Detection:\n")
	fmt.Printf("=============================\n")
	if result.ProxySoftware != proxy.ProxySoftwareUnknown {
		fmt.Printf("Detected: %s (confidence: %.2f)\n", result.ProxySoftware, result.Confidence)
	} else {
		fmt.Printf("Unable to determine proxy software with confidence\n")
	}
	fmt.Printf("\n")

	// Display path results
	fmt.Printf("🌐 Path Test Results:\n")
	fmt.Printf("=====================\n")
	for path, pathResp := range result.PathResults {
		if pathResp.Error != "" {
			fmt.Printf("%-20s ❌ Error: %s\n", path, pathResp.Error)
		} else {
			statusIcon := "✅"
			if pathResp.StatusCode >= 400 {
				statusIcon = "⚠️"
			} else if pathResp.StatusCode >= 500 {
				statusIcon = "❌"
			}
			fmt.Printf("%-20s %s %d (%v)\n", path, statusIcon, pathResp.StatusCode, pathResp.ResponseTime)
			if pathResp.ServerHeader != "" {
				fmt.Printf("                     Server: %s\n", pathResp.ServerHeader)
			}
		}
	}
	fmt.Printf("\n")

	// Display header differences
	if len(result.HeaderDifferences) > 0 {
		fmt.Printf("🔄 Header Differences Detected:\n")
		fmt.Printf("===============================\n")
		for _, diff := range result.HeaderDifferences {
			suspiciousMarker := ""
			if diff.Suspicious {
				suspiciousMarker = " ⚠️  [SUSPICIOUS - May indicate backend routing]"
			}
			fmt.Printf("Header: %s%s\n", diff.HeaderName, suspiciousMarker)
			for i, value := range diff.Values {
				if i < len(diff.Paths) {
					fmt.Printf("  - '%s' (paths: %v)\n", value, diff.Paths)
				}
			}
			fmt.Printf("\n")
		}
	}

	// Display detected backends
	if len(result.DetectedBackends) > 0 {
		fmt.Printf("🎯 Detected Backend Services:\n")
		fmt.Printf("=============================\n")
		for _, backend := range result.DetectedBackends {
			fmt.Printf("Path: %s\n", backend.Path)
			fmt.Printf("  Backend: %s (confidence: %.2f)\n", backend.Backend, backend.Confidence)
			fmt.Printf("  Indicators:\n")
			for _, indicator := range backend.Indicators {
				fmt.Printf("    - %s\n", indicator)
			}
			fmt.Printf("\n")
		}
	}

	// Display routing patterns
	if len(result.RoutingPatterns) > 0 {
		fmt.Printf("🔀 Routing Patterns Detected:\n")
		fmt.Printf("=============================\n")
		for _, pattern := range result.RoutingPatterns {
			fmt.Printf("Pattern: %s\n", pattern.Pattern)
			fmt.Printf("  Description: %s\n", pattern.Description)
			if len(pattern.Paths) > 0 {
				fmt.Printf("  Affected Paths: %v\n", pattern.Paths)
			}
			if len(pattern.Evidence) > 0 {
				fmt.Printf("  Evidence:\n")
				for _, evidence := range pattern.Evidence {
					fmt.Printf("    - %s\n", evidence)
				}
			}
			fmt.Printf("\n")
		}
	}

	// Save results to files if requested
	if outputFile != "" {
		err := savePathFingerprintToText(result, outputFile)
		if err != nil {
			logger.Error("Failed to save text output", "error", err, "file", outputFile)
		} else {
			logger.Info("Results saved to text file", "file", outputFile)
			fmt.Printf("📝 Results saved to: %s\n", outputFile)
		}
	}

	if jsonFile != "" {
		err := savePathFingerprintToJSON(result, jsonFile)
		if err != nil {
			logger.Error("Failed to save JSON output", "error", err, "file", jsonFile)
		} else {
			logger.Info("Results saved to JSON file", "file", jsonFile)
			fmt.Printf("💾 Full results saved to: %s\n", jsonFile)
		}
	}

	fmt.Printf("\n🎉 Path fingerprinting completed successfully!\n")
}

// savePathFingerprintToText saves path fingerprint results to a text file
func savePathFingerprintToText(result *proxy.PathFingerprintResult, filename string) error {
	file, err := os.Create(filename)
	if err != nil {
		return fmt.Errorf("failed to create file: %w", err)
	}
	defer file.Close()

	fmt.Fprintf(file, "# ProxyHawk Path-Based Fingerprint Results\n")
	fmt.Fprintf(file, "# Generated: %s\n", result.Timestamp.Format(time.RFC3339))
	fmt.Fprintf(file, "# Target: %s\n\n", result.TargetURL)

	fmt.Fprintf(file, "## Proxy Software Detection\n")
	if result.ProxySoftware != proxy.ProxySoftwareUnknown {
		fmt.Fprintf(file, "Detected: %s (confidence: %.2f)\n\n", result.ProxySoftware, result.Confidence)
	} else {
		fmt.Fprintf(file, "Unable to determine proxy software\n\n")
	}

	fmt.Fprintf(file, "## Path Test Results\n")
	for path, pathResp := range result.PathResults {
		if pathResp.Error != "" {
			fmt.Fprintf(file, "%s: Error - %s\n", path, pathResp.Error)
		} else {
			fmt.Fprintf(file, "%s: HTTP %d (%v)\n", path, pathResp.StatusCode, pathResp.ResponseTime)
			if pathResp.ServerHeader != "" {
				fmt.Fprintf(file, "  Server: %s\n", pathResp.ServerHeader)
			}
		}
	}
	fmt.Fprintf(file, "\n")

	if len(result.HeaderDifferences) > 0 {
		fmt.Fprintf(file, "## Header Differences\n")
		for _, diff := range result.HeaderDifferences {
			suspicious := ""
			if diff.Suspicious {
				suspicious = " [SUSPICIOUS]"
			}
			fmt.Fprintf(file, "%s%s:\n", diff.HeaderName, suspicious)
			for _, value := range diff.Values {
				fmt.Fprintf(file, "  - %s\n", value)
			}
		}
		fmt.Fprintf(file, "\n")
	}

	if len(result.DetectedBackends) > 0 {
		fmt.Fprintf(file, "## Detected Backends\n")
		for _, backend := range result.DetectedBackends {
			fmt.Fprintf(file, "%s: %s (%.2f confidence)\n", backend.Path, backend.Backend, backend.Confidence)
		}
		fmt.Fprintf(file, "\n")
	}

	if len(result.RoutingPatterns) > 0 {
		fmt.Fprintf(file, "## Routing Patterns\n")
		for _, pattern := range result.RoutingPatterns {
			fmt.Fprintf(file, "%s: %s\n", pattern.Pattern, pattern.Description)
		}
		fmt.Fprintf(file, "\n")
	}

	return nil
}

// savePathFingerprintToJSON saves path fingerprint results to a JSON file
func savePathFingerprintToJSON(result *proxy.PathFingerprintResult, filename string) error {
	file, err := os.Create(filename)
	if err != nil {
		return fmt.Errorf("failed to create file: %w", err)
	}
	defer file.Close()

	encoder := json.NewEncoder(file)
	encoder.SetIndent("", "  ")

	if err := encoder.Encode(result); err != nil {
		return fmt.Errorf("failed to encode JSON: %w", err)
	}

	return nil
}

// saveCandidatesToText saves discovery candidates to a text file
func saveCandidatesToText(candidates []discovery.ProxyCandidate, filename string) error {
	file, err := os.Create(filename)
	if err != nil {
		return fmt.Errorf("failed to create file: %w", err)
	}
	defer file.Close()

	fmt.Fprintf(file, "# ProxyHawk Discovery Results\n")
	fmt.Fprintf(file, "# Generated: %s\n", time.Now().Format(time.RFC3339))
	fmt.Fprintf(file, "# Total candidates: %d\n\n", len(candidates))

	for _, candidate := range candidates {
		// Write in format: protocol://ip:port
		fmt.Fprintf(file, "%s://%s:%d\n", candidate.Protocol, candidate.IP, candidate.Port)
	}

	return nil
}

// saveCandidatesToJSON saves the full discovery result to a JSON file
func saveCandidatesToJSON(result *discovery.DiscoveryResult, filename string) error {
	file, err := os.Create(filename)
	if err != nil {
		return fmt.Errorf("failed to create file: %w", err)
	}
	defer file.Close()

	encoder := json.NewEncoder(file)
	encoder.SetIndent("", "  ")

	if err := encoder.Encode(result); err != nil {
		return fmt.Errorf("failed to encode JSON: %w", err)
	}

	return nil
}

// expandCIDR expands a CIDR notation into individual IP addresses
// Supports optional port specification (e.g., "192.168.1.0/24:8080")
func expandCIDR(cidr string) ([]string, error) {
	// Check if port is specified
	var port string
	cidrParts := strings.Split(cidr, ":")
	if len(cidrParts) == 2 {
		cidr = cidrParts[0]
		port = ":" + cidrParts[1]
	} else if len(cidrParts) > 2 {
		return nil, fmt.Errorf("invalid CIDR format: %s", cidr)
	}

	// Parse CIDR
	ip, ipNet, err := net.ParseCIDR(cidr)
	if err != nil {
		return nil, fmt.Errorf("invalid CIDR notation: %w", err)
	}

	var ips []string
	for ip := ip.Mask(ipNet.Mask); ipNet.Contains(ip); inc(ip) {
		ips = append(ips, ip.String()+port)
	}

	// Remove network and broadcast addresses for IPv4
	if len(ips) > 2 {
		ips = ips[1 : len(ips)-1]
	}

	return ips, nil
}

// inc increments an IP address
func inc(ip net.IP) {
	for j := len(ip) - 1; j >= 0; j-- {
		ip[j]++
		if ip[j] > 0 {
			break
		}
	}
}