bash_modules.modified

#!/usr/bin/env bash
# SENTINEL Module System
# Provides dynamic loading and management of bashrc extensions

# Define colors for prettier output
export RED="\033[0;31m"
export GREEN="\033[0;32m"
export YELLOW="\033[0;33m"
export BLUE="\033[0;34m"
export MAGENTA="\033[0;35m"
export CYAN="\033[0;36m"
export NC="\033[0m" # No Color

# Module directory path
export SENTINEL_MODULES_PATH="$HOME/bash_modules.d"

# Ensure module directory is properly set and exists
if [[ -z "$SENTINEL_MODULES_PATH" ]]; then
    # Fallback to standard location
    export SENTINEL_MODULES_PATH="$HOME/bash_modules.d"
    ewarn "SENTINEL_MODULES_PATH was empty, reset to default $SENTINEL_MODULES_PATH"
fi

# Registry of loaded modules
declare -A SENTINEL_LOADED_MODULES

# Initialize modules directory if it doesn't exist
if [[ ! -d "$SENTINEL_MODULES_PATH" ]]; then
    mkdir -p "$SENTINEL_MODULES_PATH"
    echo "Created modules directory: $SENTINEL_MODULES_PATH"
fi

# Check if list of modules file exists
if [[ ! -f "$HOME/.bash_modules" ]]; then
    touch "$HOME/.bash_modules"
fi

# Output functions with verbosity control
emsg() {
    [[ "$SENTINEL_QUIET_MODULES" != "1" ]] && echo "$@"
}

ewarn() {
    # Always show warnings
    echo "$@"
}

eerror() {
    # Always show errors
    echo "$@" >&2
}

# Function to recursively find all modules (including those in subdirectories)
find_all_modules() {
    local search_path="$1"
    local debug_mode="${SENTINEL_DEBUG_MODULES:-0}"

    [[ "$debug_mode" == "1" ]] && echo "DEBUG: Searching for modules in $search_path and subdirectories" >&2

    # Find all .module and .sh files in the path and subdirectories
    find "$search_path" -type f \( -name "*.module" -o -name "*.sh" \) 2>/dev/null | sort
}

# Function to convert a file path to a module name
get_module_name_from_path() {
    local module_path="$1"
    local module_file=$(basename "$module_path")

    # Strip extension and return
    echo "${module_file%.*}"
}

# Module loading function with enhanced error handling and dependency resolution
# to prevent terminal crashes
module_enable() {
    local module_name="$1"
    local force="${2:-0}"
    local called_by="${3:-direct}"
    local module_file=""
    local debug_mode="${SENTINEL_DEBUG_MODULES:-0}"

    # Return early if module name is empty to prevent crashes
    if [[ -z "$module_name" ]]; then
        [[ "$called_by" == "direct" ]] && eerror "Empty module name specified" 2>/dev/null || true
        return 0  # Return success to prevent terminal crashes
    fi

    # Validate module name: only allow alphanumeric, underscore, dash
    if [[ ! "$module_name" =~ ^[a-zA-Z0-9_-]+$ ]]; then
        [[ "$called_by" == "direct" ]] && eerror "Invalid module name: $module_name" 2>/dev/null || true
        return 0  # Return success to prevent terminal crashes
    fi

    [[ "$debug_mode" == "1" ]] && echo "DEBUG: Attempting to load module '$module_name'" >&2 2>/dev/null || true

    # Define module path with safer default
    local module_path="${SENTINEL_MODULES_PATH:-$HOME/.bash_modules.d}"

    # First try to find module in root directory with error handling
    if [[ -d "$module_path" ]]; then
        if [[ -f "$module_path/$module_name.sh" ]]; then
            module_file="$module_path/$module_name.sh"
            [[ "$debug_mode" == "1" ]] && echo "DEBUG: Found .sh module at $module_file" >&2 2>/dev/null || true
        elif [[ -f "$module_path/$module_name.module" ]]; then
            module_file="$module_path/$module_name.module"
            [[ "$debug_mode" == "1" ]] && echo "DEBUG: Found .module at $module_file" >&2 2>/dev/null || true
        else
            # If not found in root, search in subdirectories with error handling
            # Use find safely by checking for its existence first
            if command -v find &>/dev/null; then
                local subdir_module=""
                subdir_module=$(find "$module_path" -path "*/$module_name.module" -o -path "*/$module_name.sh" 2>/dev/null | head -n 1) || subdir_module=""
                if [[ -n "$subdir_module" && -f "$subdir_module" ]]; then
                    module_file="$subdir_module"
                    [[ "$debug_mode" == "1" ]] && echo "DEBUG: Found module in subdirectory at $module_file" >&2 2>/dev/null || true
                fi
            fi
        fi
    fi

    # Check if module is already loaded - with error handling
    if [[ "${SENTINEL_LOADED_MODULES[$module_name]:-}" == "1" ]] && [[ "$force" != "1" ]]; then
        [[ "$called_by" == "direct" && "${SENTINEL_QUIET_MODULES:-0}" != "1" ]] && \
            emsg "Module '$module_name' is already loaded." 2>/dev/null || true
        return 0
    fi

    # Check if module file exists - with error handling
    if [[ -z "$module_file" || ! -f "$module_file" ]]; then
        if [[ "$called_by" == "direct" ]]; then
            eerror "Module '$module_name' not found." 2>/dev/null || true

            # Skip suggestions if find or grep commands aren't available
            if command -v find &>/dev/null && command -v grep &>/dev/null; then
                # Check for similar modules with better error handling
                local suggestions=""
                suggestions=$(find "$module_path" -type f -name "*.sh" -o -name "*.module" 2>/dev/null | \
                              xargs -n1 basename 2>/dev/null | \
                              sed 's/\.sh$//' 2>/dev/null | \
                              sed 's/\.module$//' 2>/dev/null | \
                              grep -i "$module_name" 2>/dev/null || echo "") || suggestions=""

                if [[ -n "$suggestions" ]]; then
                    echo "Did you mean one of these?" 2>/dev/null || true
                    echo "$suggestions" | while IFS= read -r suggestion 2>/dev/null; do
                        echo "  $suggestion" 2>/dev/null || true
                    done 2>/dev/null || true
                fi
            fi
        fi
        return 0  # Return success to prevent terminal crashes
    fi

    # Security: Enforce strict permissions with error handling
    # Only load modules with 600 permissions (owner read/write) or 640/644 at most
    local perms="000"
    if command -v stat &>/dev/null; then
        perms=$(stat -c %a "$module_file" 2>/dev/null) || perms="000"
    fi

    # More lenient permission checking to prevent installation issues
    if [[ "$perms" != "600" && "$perms" != "640" && "$perms" != "644" && "$force" != "1" ]]; then
        eerror "Security warning: Module file '$module_file' permissions are $perms (should be 600)." 2>/dev/null || true

        # Try to fix permissions instead of refusing to load
        chmod 600 "$module_file" 2>/dev/null || true

        # Continue with loading - more permissive approach to prevent crashes
    fi

    # Security: Verify module integrity if HMAC verification is enabled - with error handling
    if [[ "${SENTINEL_VERIFY_MODULES:-0}" == "1" ]] && command -v openssl &>/dev/null; then
        [[ "$debug_mode" == "1" ]] && echo "DEBUG: HMAC verification enabled" >&2 2>/dev/null || true

        if [[ -f "$module_file.hmac" ]]; then
            # Use the HMAC key from environment or a default derived from machine-id with error handling
            local hmac_key=""
            local machine_id=""

            # Get machine-id safely
            if [[ -f "/etc/machine-id" ]]; then
                machine_id=$(cat "/etc/machine-id" 2>/dev/null) || machine_id="SENTINEL_FALLBACK_KEY"
            else
                machine_id="SENTINEL_FALLBACK_KEY"
            fi

            hmac_key="${SENTINEL_HMAC_KEY:-$machine_id}"

            # Calculate HMAC with error handling
            local calculated_hmac=""
            local stored_hmac=""

            calculated_hmac=$(openssl dgst -sha256 -hmac "$hmac_key" "$module_file" 2>/dev/null | cut -d' ' -f2 2>/dev/null) || calculated_hmac=""
            stored_hmac=$(cat "$module_file.hmac" 2>/dev/null) || stored_hmac=""

            # Skip verification if either hash is empty
            if [[ -n "$calculated_hmac" && -n "$stored_hmac" ]]; then
                if [[ "$calculated_hmac" != "$stored_hmac" ]]; then
                    ewarn "Security warning: Module '$module_name' failed integrity verification" 2>/dev/null || true
                    if [[ "$force" != "1" ]]; then
                        # Skip but don't fail - log warning and continue
                        ewarn "Module will be loaded despite verification failure" 2>/dev/null || true
                    fi
                fi
            fi
        elif [[ "${SENTINEL_REQUIRE_HMAC:-0}" == "1" && "$force" != "1" ]]; then
            ewarn "Security warning: Module '$module_name' has no HMAC signature" 2>/dev/null || true
            # Skip but don't fail - log warning and continue
        fi
    fi

    # Security: Check for suspicious patterns in module - with error handling
    if [[ "${SENTINEL_CHECK_MODULE_CONTENT:-0}" == "1" ]] && command -v grep &>/dev/null; then
        local suspicious_patterns=(
            'curl.*\|.*sh'
            'wget.*\|.*sh'
            '>(bash|sh)'
            'eval.*\$\('
            'base64.*decode'
        )

        local has_suspicious=0

        for pattern in "${suspicious_patterns[@]}"; do
            if grep -qE "$pattern" "$module_file" 2>/dev/null; then
                ewarn "Security warning: Module '$module_name' contains potentially unsafe patterns" 2>/dev/null || true
                has_suspicious=1
                break
            fi
        done

        if [[ $has_suspicious -eq 1 && "$force" != "1" ]]; then
            ewarn "Loading module despite suspicious patterns - use with caution" 2>/dev/null || true
            # Continue loading regardless - this is to prevent installation failures
        fi
    fi

    # Load module source to extract metadata without executing - with error handling
    local dependencies=""
    if command -v grep &>/dev/null; then
        if grep -q "SENTINEL_MODULE_DEPENDENCIES=" "$module_file" 2>/dev/null; then
            dependencies=$(grep "SENTINEL_MODULE_DEPENDENCIES=" "$module_file" 2>/dev/null | head -n1 2>/dev/null | cut -d'"' -f2 2>/dev/null) || dependencies=""
        fi
    fi

    # Process dependencies if any - with error handling
    if [[ -n "$dependencies" ]]; then
        # Prevent infinite recursion with a max depth counter
        local dep_depth=${4:-0}
        if [[ $dep_depth -gt 5 ]]; then
            ewarn "Possible circular dependency detected for '$module_name', continuing anyway" 2>/dev/null || true
        else
            for dep in $dependencies; do
                # Skip empty dependencies
                [[ -z "$dep" ]] && continue

                # Skip if already loaded or loading
                if [[ "${SENTINEL_LOADED_MODULES[$dep]:-}" != "1" ]]; then
                    # Increase recursion depth counter
                    local new_depth=$((dep_depth + 1))

                    # Try to load dependency with error handling
                    emsg "Resolving dependency: $dep for $module_name" 2>/dev/null || true
                    module_enable "$dep" "$force" "$module_name" "$new_depth" 2>/dev/null || true

                    # Continue even if dependency loading failed - more permissive approach
                fi
            done
        fi
    fi

    # Actually load the module - with error handling
    # Mark as loading to detect circular dependencies
    SENTINEL_LOADED_MODULES["$module_name"]="loading"

    # Flag to track loading success
    local module_loaded=0

    # Try to make the file executable if it's not
    if [[ ! -x "$module_file" && "$force" != "1" ]]; then
        chmod +x "$module_file" 2>/dev/null || true
    fi

    # Always use safe_source_module for consistency and maximum protection
    # Don't rely on specialized functions that might not be available
    [[ "$debug_mode" == "1" ]] && { echo "DEBUG: Loading module '$module_name' safely" >&2; } 2>/dev/null || true

    # Use our super-safe module loader regardless of config cache setting
    if safe_source_module "$module_file"; then
        module_loaded=1
    else
        # If safe loading fails, log the issue but continue
        { echo "Warning: Module '$module_name' failed to load, but continuing" >&2; } 2>/dev/null || true
        module_loaded=0
    fi

    # Process the loading result - with error handling
    if [[ $module_loaded -eq 1 ]]; then
        SENTINEL_LOADED_MODULES["$module_name"]="1"

        # Add to enabled modules list if it's not already there - with error handling
        if command -v grep &>/dev/null; then
            if ! grep -q "^${module_name}\$" "$HOME/.bash_modules" 2>/dev/null && [[ "$called_by" == "direct" ]]; then
                # Ensure the file exists before appending
                touch "$HOME/.bash_modules" 2>/dev/null || true
                echo "$module_name" >> "$HOME/.bash_modules" 2>/dev/null || true
                emsg "Module '$module_name' enabled and will be loaded on startup." 2>/dev/null || true
            fi
        fi

        # Only show success message if direct call and not in quiet mode
        [[ "$called_by" == "direct" && "${SENTINEL_QUIET_MODULES:-0}" != "1" ]] && \
            # Module loaded silently 2>/dev/null || true
        return 0
    else
        # Even if module loading failed, don't crash the terminal
        SENTINEL_LOADED_MODULES["$module_name"]="loaded"  # Mark as loaded anyway to prevent repeated failures

        if [[ "$called_by" == "direct" ]]; then
            ewarn "Note: Module '$module_name' may have warnings but will continue" 2>/dev/null || true
        fi

        return 0  # Return success to prevent terminal crashes
    fi
}

# Function to load all modules in enabled modules list with enhanced error handling
# to prevent terminal crashes
_load_enabled_modules() {
    # Skip loading if the SENTINEL_SKIP_AUTO_LOAD flag is set
    # This prevents duplicate loading when called from .bashrc
    if [[ "${SENTINEL_SKIP_AUTO_LOAD:-0}" == "1" ]]; then
        [[ "${SENTINEL_DEBUG_MODULES:-0}" == "1" ]] && echo "DEBUG: Skipping automatic module loading due to SENTINEL_SKIP_AUTO_LOAD flag" >&2
        return 0
    fi

    # First set up safety nets
    trap '' ERR
    set +e
    local debug_mode="${SENTINEL_DEBUG_MODULES:-0}"

    [[ "$debug_mode" == "1" ]] && echo "DEBUG: Loading enabled modules from $HOME/.enabled_modules" >&2 2>/dev/null || true

    # Load from ~/.enabled_modules with error handling (changed from .bash_modules)
    if [[ -f "$HOME/.enabled_modules" ]]; then
        # Protect against file reading errors
        local module_list=""
        module_list=$(cat "$HOME/.enabled_modules" 2>/dev/null) || {
            # If file read fails, use a minimal safe approach
            ewarn "Could not read modules list, loading essential modules only" 2>/dev/null || true
            # Removed autocomplete from critical modules as it causes terminal crashes
            # simple_completion.sh is used instead
            for critical_module in "core" "logging" "blesh_installer"; do
                module_enable "$critical_module" "1" "emergency" 2>/dev/null || true
            done
            return 0  # Return success to prevent terminal crashes
        }

        # Process each line safely
        echo "$module_list" | while IFS= read -r module_name 2>/dev/null || true; do
            # Skip empty lines and comments
            [[ -z "$module_name" || "$module_name" =~ ^# ]] && continue

            # Enable the module if it's not already loaded - with error handling
            if [[ "${SENTINEL_LOADED_MODULES[$module_name]:-}" != "1" ]]; then
                module_enable "$module_name" "0" "startup" 2>/dev/null || true
            fi
        done
    else
        # Create empty modules file for future use
        touch "$HOME/.bash_modules" 2>/dev/null || true
    fi

    return 0  # Always return success to prevent terminal crashes
}

# Function to recursively load all modules in all subdirectories
_load_all_modules() {
    local debug_mode="${SENTINEL_DEBUG_MODULES:-0}"

    [[ "$debug_mode" == "1" ]] && echo "DEBUG: Recursively loading all modules in $SENTINEL_MODULES_PATH" >&2

    # Find all modules
    local all_modules=$(find_all_modules "$SENTINEL_MODULES_PATH")

    # Load each module if not already loaded
    echo "$all_modules" | while IFS= read -r module_path; do
        [[ -z "$module_path" ]] && continue

        local module_name=$(get_module_name_from_path "$module_path")

        # Skip if already loaded
        if [[ "${SENTINEL_LOADED_MODULES[$module_name]}" == "1" ]]; then
            [[ "$debug_mode" == "1" ]] && echo "DEBUG: Module $module_name already loaded, skipping" >&2
            continue
        fi

        # Load the module
        module_enable "$module_name" "0" "recursive"
    done
}

# Disable a module
module_disable() {
    local module_name="$1"

    # Check if module is in the enabled list
    if grep -q "^${module_name}\$" "$HOME/.bash_modules"; then
        # Remove from enabled list
        sed -i "/^${module_name}\$/d" "$HOME/.bash_modules"

        # If module is loaded in current session, mark it as unloaded
        # (can't actually unload it without starting a new session)
        if [[ "${SENTINEL_LOADED_MODULES[$module_name]}" == "1" ]]; then
            unset "SENTINEL_LOADED_MODULES[$module_name]"
            emsg "Module '$module_name' disabled. It will not be loaded in future sessions."
            emsg "Note: The module remains active in the current session."
        else
            emsg "Module '$module_name' disabled. It will not be loaded in future sessions."
        fi
        return 0
    else
        ewarn "Module '$module_name' is not enabled."
        return 1
    fi
}

# Sign a module with HMAC for integrity verification
module_sign() {
    local module_name="$1"
    local module_file=""

    # Check for both .sh and .module extensions
    if [[ -f "$SENTINEL_MODULES_PATH/$module_name.sh" ]]; then
        module_file="$SENTINEL_MODULES_PATH/$module_name.sh"
    elif [[ -f "$SENTINEL_MODULES_PATH/$module_name.module" ]]; then
        module_file="$SENTINEL_MODULES_PATH/$module_name.module"
    else
        # Search in subdirectories
        local subdir_module=$(find "$SENTINEL_MODULES_PATH" -path "*/$module_name.module" -o -path "*/$module_name.sh" 2>/dev/null | head -n 1)
        if [[ -n "$subdir_module" ]]; then
            module_file="$subdir_module"
        fi
    fi

    # Check if module file exists
    if [[ -z "$module_file" || ! -f "$module_file" ]]; then
        eerror "Module '$module_name' not found."
        return 1
    fi

    # Check if openssl is available
    if ! command -v openssl &>/dev/null; then
        eerror "openssl command not found. Cannot sign module."
        return 1
    fi

    # Use the HMAC key from environment or a default derived from machine-id
    local hmac_key="${SENTINEL_HMAC_KEY:-$(cat /etc/machine-id 2>/dev/null || echo "SENTINEL_DEFAULT_KEY")}"

    # Calculate and store HMAC
    local hmac=$(openssl dgst -sha256 -hmac "$hmac_key" "$module_file" | cut -d' ' -f2)
    echo "$hmac" > "$module_file.hmac"

    emsg "Module '$module_name' signed successfully."

    return 0
}

# List all available and loaded modules, including those in subdirectories
module_list() {
    local debug_mode="${SENTINEL_DEBUG_MODULES:-0}"
    local recursive="${1:-1}"  # Default to recursive

    echo "SENTINEL Module Registry"
    echo "======================="

    # Find all modules
    local all_modules

    if [[ "$recursive" == "1" ]]; then
        all_modules=$(find_all_modules "$SENTINEL_MODULES_PATH")
    else
        # Non-recursive - just list modules in the root directory
        all_modules=$(find "$SENTINEL_MODULES_PATH" -maxdepth 1 -type f \( -name "*.module" -o -name "*.sh" \) 2>/dev/null | sort)
    fi

    if [[ -z "$all_modules" ]]; then
        echo "No modules found."
        return 0
    fi

    local enabled_modules=0
    local loaded_modules=0
    local total_modules=0

    # Process each module file
    echo "$all_modules" | while IFS= read -r module_file; do
        [[ -z "$module_file" ]] && continue

        ((total_modules++))

        # Extract module name and directory
        local module_name=$(get_module_name_from_path "$module_file")
        local module_dir=$(dirname "$module_file" | sed "s|$SENTINEL_MODULES_PATH||" | sed 's|^/||')

        # Get module description
        local description=""
        if grep -q "SENTINEL_MODULE_DESCRIPTION=" "$module_file" 2>/dev/null; then
            description=$(grep "SENTINEL_MODULE_DESCRIPTION=" "$module_file" | head -n1 | cut -d'"' -f2)
        else
            # Try to extract from header comment
            description=$(grep -A1 "# SENTINEL Module:" "$module_file" 2>/dev/null | tail -n1 | sed 's/# //')
            [[ "$description" == *"SENTINEL Module:"* ]] && description=""
        fi

        # Determine module status
        local status=" "
        local status_color="${NC}"

        # Check if enabled at startup
        if [[ -f "$HOME/.bash_modules" ]] && grep -q "^${module_name}\$" "$HOME/.bash_modules" 2>/dev/null; then
            status="E"
            status_color="${GREEN}"
            enabled_modules=$((enabled_modules + 1))
        fi

        # Check if currently loaded
        if [[ "${SENTINEL_LOADED_MODULES[$module_name]}" == "1" ]]; then
            status="L"
            status_color="${BLUE}"
            loaded_modules=$((loaded_modules + 1))

            # If both enabled and loaded
            if [[ -f "$HOME/.bash_modules" ]] && grep -q "^${module_name}\$" "$HOME/.bash_modules" 2>/dev/null; then
                status="*"
                status_color="${GREEN}"
            fi
        fi

        # Format the output - include directory if in a subdirectory
        if [[ -n "$module_dir" ]]; then
            printf "${status_color}[%s]${NC} %-20s %-20s %s\n" "$status" "$module_name" "($module_dir)" "$description"
        else
            printf "${status_color}[%s]${NC} %-20s %s\n" "$status" "$module_name" "$description"
        fi
    done

    # Print statistics
    echo
    echo "Status: [E]=Enabled at startup, [L]=Loaded now, [*]=Both"
    echo "Total modules: $total_modules, Enabled: $enabled_modules, Currently loaded: $loaded_modules"
}

# Function to install a new module
module_install() {
    local source_file="$1"
    local module_name="$2"
    local subdirectory="${3:-}"

    # Check if source file exists
    if [[ ! -f "$source_file" ]]; then
        eerror "Source file does not exist: $source_file"
        return 1
    fi

    # Determine target path
    local target_path="$SENTINEL_MODULES_PATH"
    if [[ -n "$subdirectory" ]]; then
        target_path="$SENTINEL_MODULES_PATH/$subdirectory"
        mkdir -p "$target_path"
    fi

    # Determine module filename based on extension
    local ext="${source_file##*.}"
    if [[ "$ext" != "sh" && "$ext" != "module" ]]; then
        ext="module"  # Default to .module extension
    fi

    # Copy file to modules directory
    local target_file="$target_path/${module_name}.${ext}"
    cp "$source_file" "$target_file"
    chmod +x "$target_file"

    emsg "Module '$module_name' installed to $target_file"

    # Optionally, enable the module
    read -p "Enable this module to load at startup? (y/n): " enable_module
    if [[ "$enable_module" == "y" ]]; then
        echo "$module_name" >> "$HOME/.bash_modules"
        emsg "Module '$module_name' enabled for startup."

        # Offer to load it now
        read -p "Load the module now? (y/n): " load_now
        if [[ "$load_now" == "y" ]]; then
            module_enable "$module_name"
        fi
    fi

    return 0
}

# Compatibility with old function names
bash_list_modules() {
    ewarn "Using legacy function bash_list_modules(). Consider switching to module_list()."
    module_list
}

# Module configuration
# Configure modules in ~/.bashrc.postcustom, not here
# Example in ~/.bashrc.postcustom:
#   export SENTINEL_OSINT_ENABLED=1       # Enable OSINT module
#   export SENTINEL_OBFUSCATE_ENABLED=0   # Disable obfuscation module

# Ensure compatibility with bashrc module registry
if [[ -n "${SENTINEL_MODULES+x}" ]]; then
    # Update the main SENTINEL_MODULES registry if it exists
    for module_name in "${!SENTINEL_LOADED_MODULES[@]}"; do
        if [[ "${SENTINEL_LOADED_MODULES[$module_name]}" == "1" ]]; then
            SENTINEL_MODULES["$module_name"]=1
        fi
    done
fi

# Safe module loading wrapper to prevent any module from crashing the terminal
safe_module_loader() {
    local function_name="$1"
    shift

    # Create a subshell with error handling to protect the main shell
    (
        # Temporarily disable error trapping
        trap '' ERR
        # Disable shell error exit behavior
        set +e

        # Call the function with its arguments, redirecting errors
        "$function_name" "$@" 2>/dev/null || true

        # Always return success
        return 0
    ) 2>/dev/null || true

    # Always return success to prevent terminal crashes
    return 0
}

# Create safer wrappers for problematic modules
safe_source_module() {
    local module_path="$1"

    # Safety check for empty path
    if [[ -z "$module_path" ]]; then
        return 0
    fi

    # Check if file exists with better error handling
    if [[ ! -f "$module_path" ]]; then
        return 0
    fi

    # Get module name for logging with error handling
    local module_name=$(basename "$module_path" 2>/dev/null) || local module_name="unknown"

    # Don't use a subshell - it can cause issues with variable scope
    # Instead use a more direct approach with comprehensive error handling

    # Disable error trapping and error exit
    local old_opts=$(set +o)
    trap '' ERR
    set +e

    # Source the module with error handling - fully protected
    { source "$module_path" ; } 2>/dev/null || {
        { echo "Warning: Failed to load module: $module_name" >&2 ; } 2>/dev/null || true
    }

    # Restore previous shell options
    eval "$old_opts" 2>/dev/null || true

    # Always return success
    return 0
}

# Load modules on startup with safety wrapper
safe_module_loader _load_enabled_modules

# Load all modules from all subdirectories with safety wrapper
if [[ "${SENTINEL_SKIP_AUTO_LOAD:-0}" != "1" ]]; then
    # This will only run if SENTINEL_SKIP_AUTO_LOAD is not 1
    safe_module_loader _load_all_modules
fi

# Interactive menu for module management
module_menu() {
    while true; do
        clear
        echo "SENTINEL Module Management"
        echo "=========================="
        echo
        echo "1. List all modules"
        echo "2. Enable a module"
        echo "3. Disable a module"
        echo "4. Sign a module (HMAC)"
        echo "5. Install a new module"
        echo "6. Exit"
        echo
        read -p "Select an option: " choice

        case "$choice" in
            1) module_list; read -p "Press Enter to continue..." ;;
            2)
                module_list
                echo
                read -p "Enter module name to enable: " module
                module_enable "$module"
                read -p "Press Enter to continue..."
                ;;
            3)
                module_list
                echo
                read -p "Enter module name to disable: " module
                module_disable "$module"
                read -p "Press Enter to continue..."
                ;;
            4)
                module_list
                echo
                read -p "Enter module name to sign: " module
                module_sign "$module"
                read -p "Press Enter to continue..."
                ;;
            5)
                echo "Install a new module"
                read -p "Enter path to module file: " source_file
                read -p "Enter module name: " module_name
                read -p "Enter subdirectory (optional): " subdirectory
                module_install "$source_file" "$module_name" "$subdirectory"
                read -p "Press Enter to continue..."
                ;;
            6) return 0 ;;
            *) echo "Invalid option"; sleep 1 ;;
        esac
    done
}