fix(harden): fix 6 bugs in harden command and gum_confirm

- SSH port change now updates local shipnode.conf, not the remote file
- Remove `local` keyword inside remote heredoc (not valid outside a function)
- Fix UFW port-check regex to correctly match existing rules
- Fix SSH uncomment sed to handle `# Key` with space after hash
- Remove --no-limit from gum_confirm to prevent multi-select on yes/no
- Remove redundant 2>&1 after &>/dev/null in fail2ban status check

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: devalade

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to ShipNode will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.11] - 2026-05-11
+
+### Fixed
+- **harden**: SSH port change now updates local `shipnode.conf` instead of the remote file, so subsequent commands use the correct port
+- **harden**: Removed `local` keyword inside remote heredoc in `install_configure_fail2ban` (caused `bash: local: can only be used in a function` error)
+- **harden**: Fixed UFW duplicate-rule check regex to correctly match existing port rules
+- **harden**: SSH uncomment `sed` now handles commented keys with a space after `#` (e.g. `# PasswordAuthentication`)
+- **prompts**: Removed `--no-limit` from `gum_confirm` to prevent multi-select on yes/no prompts
+- **prompts**: Removed redundant `2>&1` after `&>/dev/null` in fail2ban status check
+
 ## [1.4.0] - 2026-05-10
 
 ### Added

lib/commands/harden.sh

@@ -51,7 +51,7 @@ apply_ssh_config() {
     local value="$2"
     remote_exec bash << EOF
         # Uncomment if the key is commented out
-        sudo sed -i "s/^#\(${key}[[:space:]]\)/\1/" /etc/ssh/sshd_config
+        sudo sed -i "s/^#[[:space:]]*\(${key}[[:space:]]\)/\1/" /etc/ssh/sshd_config
         # Check if the configuration already exists
         if grep -qE "^${key}[[:space:]]" /etc/ssh/sshd_config; then
             # Update existing line
@@ -140,7 +140,7 @@ apply_firewall_rules() {
         \$SUDO ufw default allow outgoing 2>/dev/null || true
 
         # Allow SSH (only if not already allowed)
-        if ! \$SUDO ufw status | grep -qE "^\[?${ssh_port}\]"; then
+        if ! \$SUDO ufw status | grep -qE "${ssh_port}/tcp"; then
             \$SUDO ufw allow ${ssh_port}/tcp
         fi
 
@@ -161,7 +161,7 @@ EOF
 check_fail2ban() {
     remote_exec bash << 'EOF'
         if command -v fail2ban-server &> /dev/null; then
-            if systemctl is-active fail2ban &> /dev/null 2>&1; then
+            if systemctl is-active fail2ban &>/dev/null; then
                 echo "ACTIVE"
             else
                 echo "INSTALLED_INACTIVE"
@@ -199,7 +199,7 @@ install_configure_fail2ban() {
         fi
 
         # Determine log path based on distro
-        local log_path="/var/log/auth.log"
+        log_path="/var/log/auth.log"
         if [ -f "/var/log/secure" ]; then
             log_path="/var/log/secure"
         fi
@@ -333,7 +333,7 @@ cmd_harden() {
                     apply_ssh_config "Port" "$new_port"
                     SSH_PORT="$new_port"
                     # Persist SSH_PORT to shipnode.conf on the server
-                    remote_exec "sed -i 's/^SSH_PORT=.*/SSH_PORT=${new_port}/' ${REMOTE_PATH}/shipnode.conf" 2>/dev/null || true
+                    sed -i "s/^SSH_PORT=.*/SSH_PORT=${new_port}/" shipnode.conf 2>/dev/null || true
                     ((changes_made++))
                     success "SSH port configured: $new_port"
                     echo ""

lib/core.sh

@@ -10,7 +10,7 @@ BLUE='\033[0;34m'
 NC='\033[0m' # No Color
 
 # ShipNode version
-VERSION="1.4.10"
+VERSION="1.4.11"
 
 # SSH multiplexing for connection reuse
 SSH_CONTROL_PATH="/tmp/shipnode-ssh-%r@%h:%p"

lib/prompts.sh

@@ -143,11 +143,11 @@ gum_confirm() {
     if [ "$USE_GUM" = true ] && [ -t 0 ]; then
         if [ "$default" = "y" ]; then
             local choice
-            choice=$(printf 'Yes\nNo' | gum choose --header "$message" --default "Yes" --no-limit 2>/dev/null || echo "No")
+            choice=$(printf 'Yes\nNo' | gum choose --header "$message" --default "Yes" 2>/dev/null || echo "No")
             [ "$choice" = "Yes" ] && return 0 || return 1
         else
             local choice
-            choice=$(printf 'Yes\nNo' | gum choose --header "$message" --default "No" --no-limit 2>/dev/null || echo "No")
+            choice=$(printf 'Yes\nNo' | gum choose --header "$message" --default "No" 2>/dev/null || echo "No")
             [ "$choice" = "Yes" ] && return 0 || return 1
         fi
     else