Feature

closes #37

.gitea/workflows/loxide_lib.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Install Prerequisites
         run: |
           apt update
-          apt install curl git python3 pip pkg-config openssl libssl-dev patchelf binutils-mingw-w64-x86-64 mingw-w64 -y
+          apt install curl git python3 pip pkg-config openssl libssl-dev patchelf binutils-mingw-w64-x86-64 mingw-w64 protobuf-compiler -y
           curl https://sh.rustup.rs -sSf | sh -s -- -y
           pip install maturin twine --break-system-packages
 

Loxide.py

@@ -23,39 +23,28 @@
 
 import logging
 import os
-import tempfile
 
-import dotenv
 import urllib3
 
 from services.API import AirlockAPIWrapper
 from services.security import getAPI
+from TUI.TUI import run_Loxide
+from utils.configmanager import get_system_value
 from utils.setup import get_base_directory, setup
-from utils.TUI import run_Loxide
 from utils.utils import irtang
 
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 
 def main():
-
-    if "NUITKA_ONEFILE_PARENT" in os.environ:
-        splash_filename = os.path.join(
-            tempfile.gettempdir(),
-            f"onefile_{int(os.environ['NUITKA_ONEFILE_PARENT'])}_splash_feedback.tmp",
-        )
-        if os.path.exists(splash_filename):
-            os.unlink(splash_filename)
-
     irtang()
     # Determine  working directory, setup directory, configure logging, sent env, get API and URL if not already stored
     setup()
     base_dir = get_base_directory()
     logger = logging.getLogger(__name__)
-    dotenv.load_dotenv(dotenv_path=base_dir / ".env")
 
     try:
-        url = os.getenv("URL")
+        url = get_system_value("URL")
         username = os.getenv("USERNAME")
 
         if not url:
@@ -75,7 +64,7 @@ def main():
         raise ValueError("API key for Loxide is missing.")
 
     api = AirlockAPIWrapper(
-        base_url=str(os.getenv("URL")),
+        base_url=str(url),
         api_key=api_key,
     )
     run_Loxide(api)

TUI/OTP_generate.py

@@ -1,5 +1,5 @@
 import logging
-from typing import List
+from typing import List, Optional
 
 from textual.containers import Horizontal, Vertical
 from textual.css.query import NoMatches
@@ -31,7 +31,11 @@ class OTPGenerator(Widget):
 
     class OTPInfo(Message):
         def __init__(
-            self, devices: List[Agent], requestor: str, reasoning: str, duration: int
+            self,
+            devices: Optional[List[Agent]],
+            requestor: str,
+            reasoning: str,
+            duration: int,
         ):
             super().__init__()
             self.devices = devices
@@ -243,7 +247,7 @@ class OTPGenerator(Widget):
                 self.otp_generated = True
 
                 # Access API from the app - this is the key change!
-                api = self.app.api
+                api = self.app.api  # type: ignore
 
                 output_lines = [
                     "Requested OTP Codes:",

TUI/TUI.py

@@ -1,11 +1,12 @@
 import logging
 import os
 import sys
+from typing import Optional
 
 import dotenv
-from dotenv import set_key
 from textual.app import App, ComposeResult
 from textual.containers import Vertical
+from textual.message import Message
 from textual.reactive import reactive
 from textual.screen import Screen
 from textual.widgets import (
@@ -18,26 +19,27 @@ from textual.widgets import (
     Tabs,
 )
 
-from flows.otp import otp_activities_by_agent, otp_revoke
+from flows.otp import otp_revoke
 from flows.prepPolicy import menu_policy_enforce
-from flows.quietAgent import findQuietAgents
 from models.agent import Agent
 from models.policy import Policy
-from screens.moveagentworkflowscreen import MoveAgentWorkflowScreen
-from screens.otpworkflowscreen import OTPWorkflowScreen
 from services.API import AirlockAPIWrapper
 from services.policyhandler import confirmUpdateAfromE
-from utils.configmanager import load_env
+from TUI.agentmoveoperations import AgentMoveOperations
-from utils.setup import get_base_directory, load_user_config
+from TUI.moveagentworkflowscreen import MoveAgentWorkflowScreen
+from TUI.multiagentselector import MultiAgentSelector
+from TUI.OTP_generate import OTPGenerator
+from TUI.otpactivityscreen import OTPActivitiesScreen
+from TUI.otpworkflowscreen import OTPWorkflowScreen
+from TUI.policytreewidget import PolicyTreeWidget
+from TUI.quietagentworkflowscreen import QuietAgentWorkflowScreen
+from TUI.resultsdisplay import ResultsDisplay
+from TUI.theme_amber_terminal import get_amber_terminal_theme
+from TUI.theme_retro_terminal import get_retro_terminal_theme
+from TUI.themeselector import ThemeSelector
+from utils.configmanager import get_user_value, load_env, save_user_config
+from utils.setup import get_base_directory
 from utils.utils import open_directory
-from widgets.agentmoveoperations import AgentMoveOperations
-from widgets.amber_terminal_theme import get_amber_terminal_theme
-from widgets.multiagentselector import MultiAgentSelector
-from widgets.OTP_generate import OTPGenerator
-from widgets.policytreewidget import PolicyTreeWidget
-from widgets.resultsdisplay import ResultsDisplay
-from widgets.retro_terminal_theme import get_retro_terminal_theme
-from widgets.themeselector import ThemeSelector
 
 dotenv.load_dotenv()
 
@@ -55,53 +57,24 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 def _persist_user_theme(theme_name: str) -> None:
     """
-    Store the chosen Textual theme in the user's config:
+    Store the chosen Textual theme in the user's config using the config manager.
-      <base>/config/user_config.json
+    No need to touch .env - config manager handles everything.
-    and also mirror to <base>/.env so load_env(...) sees it.
     """
     base_dir = get_base_directory()
     config_dir = base_dir / "config"
-    user_config_path = config_dir / "user_config.json"
-    env_path = base_dir / ".env"
 
-    # ensure dirs / files exist similarly to setup()
-    config_dir.mkdir(parents=True, exist_ok=True)
-    if not user_config_path.exists():
-        # minimal default like your load_user_config does
-        user_config_path.write_text(
-            '{"URL": "", "LOG_LEVEL": "INFO"}\n', encoding="utf-8"
-        )
-
-    # load existing user config
-    user_conf = load_user_config(config_dir)
-    user_conf["TEXTUAL_THEME"] = theme_name
-
-    # write it back
-    user_config_path.write_text(
-        # pretty print so it stays human-readable
-        __import__("json").dumps(user_conf, indent=4),
-        encoding="utf-8",
-    )
-    logger.debug("Updated user_config.json with TEXTUAL_THEME=%s", theme_name)
-
-    # mirror to .env (like setup.write_config_to_env does)
-    env_path.parent.mkdir(parents=True, exist_ok=True)
-    if not env_path.exists():
-        env_path.touch()
     try:
-        set_key(str(env_path), "TEXTUAL_THEME", theme_name)
+        save_user_config(config_dir, {"TEXTUAL_THEME": theme_name})
-    except Exception as exc:  # keep going even if .env write fails
+        logger.debug("Updated user config with TEXTUAL_THEME=%s", theme_name)
-        logger.warning("Failed to mirror TEXTUAL_THEME to .env: %s", exc)
+    except Exception as exc:
-
+        logger.error("Failed to save TEXTUAL_THEME: %s", exc)
-    # reload so load_env(...) sees the new value right now
-    dotenv.load_dotenv(dotenv_path=env_path, override=True)
-    logger.debug("Reloaded .env from %s", env_path)
 
 
 # ---------------------------------------------------------------------------
 # 1) SCREEN
 # ---------------------------------------------------------------------------
 class MainMenuScreen(Screen):
+    api: AirlockAPIWrapper
     current_tab = reactive("")
 
     BUTTON_DEFS = {
@@ -110,20 +83,19 @@ class MainMenuScreen(Screen):
                 "🖥️ - Find, Move, or Generate OTP for Agents",
                 "move_agent_workflow_button",
             ),
-            ("🔇 - Find Quiet Hosts", "find_quiet_button"),
+            ("📊 - Review and appove OTP Activities", "otp_activities_button"),
+            ("📇 - Find and Move Quiet Hosts to Enforcement", "find_quiet_button"),
         ],
         "policy": [
             ("🔒 - Prepare Policy For Enforcement", "policy_prep_button"),
             ("🔄 - Update Audit Policies", "policy_audit_update_button"),
-            ("📊 - OTP Activities By Agent", "otp_activities_button"),
             ("❌ - Revoke OTPs", "otp_revoke_button"),
         ],
     }
 
-    def __init__(self, api: AirlockAPIWrapper) -> None:
+    def __init__(self) -> None:
         super().__init__()
-        self.api = api
+        self.extras = get_user_value("EXTRAS", str, "NOTTODAY")
-        self.extras = load_env("EXTRAS")
         wd = load_env("WORKING_DIR") or os.getcwd()
         if not os.path.isdir(wd):
             wd = os.getcwd()
@@ -156,6 +128,7 @@ class MainMenuScreen(Screen):
         yield Footer()
 
     def on_mount(self) -> None:
+        api = self.app.api
         self.switch_tab("agent_actions")
 
     # focus helpers
@@ -238,7 +211,6 @@ class MainMenuScreen(Screen):
         """Handle OTP generation request from the workflow."""
         global _PENDING_JOB
 
-        # Log what we received
         logger.info(
             "OTP Generation requested: %d devices, requestor=%s, reason=%s, duration=%d",
             len(message.devices),
@@ -247,7 +219,6 @@ class MainMenuScreen(Screen):
             message.duration,
         )
 
-        # Set up the job to run the OTP generation
         _PENDING_JOB = (
             "otp_workflow",
             message.devices,
@@ -317,38 +288,57 @@ class MainMenuScreen(Screen):
 
         match button_id:
             case "move_agent_workflow_button":
-                # Push Move Agent workflow screen
                 self.app.push_screen(MoveAgentWorkflowScreen(self.app.devices))
                 event.stop()
-                return  # Don't exit the app
+
             case "otp_generate_button":
-                # NEW: Push OTP workflow screen instead of legacy function
                 self.app.push_screen(OTPWorkflowScreen(self.app.devices))
                 event.stop()
-                return  # Don't exit the app
+
             case "find_quiet_button":
-                _PENDING_JOB = ("legacy", findQuietAgents, (self.app.api,), {})
+                self.app.push_screen(
+                    QuietAgentWorkflowScreen(self.app.api, self.app.policies)
+                )
+                event.stop()
+                return
+
             case "otp_activities_button":
-                _PENDING_JOB = ("legacy", otp_activities_by_agent, (self.app.api,), {})
+                self.app.push_screen(OTPActivitiesScreen())
+                event.stop()
+                return
+
             case "otp_revoke_button":
                 _PENDING_JOB = ("legacy", otp_revoke, (self.app.api,), {})
+
             case "policy_prep_button":
                 _PENDING_JOB = ("legacy", menu_policy_enforce, (self.app.api,), {})
+
             case "policy_audit_update_button":
                 _PENDING_JOB = ("legacy", confirmUpdateAfromE, (self.app.api,), {})
+
             case _:
                 self.app.bell()
                 logger.warning("Unknown button pressed: %s", button_id)
                 return
 
+        # Only exit the UI loop when we explicitly queued a legacy job.
+        # The original flow used `self.app.exit()` after setting _PENDING_JOB so
+        # the outer loop could run legacy code. Keep that behavior only for legacy jobs.
         logger.debug("Set _PENDING_JOB = %r", _PENDING_JOB)
+        if _PENDING_JOB and _PENDING_JOB[0] == "legacy":
+            # let the main loop pick up the legacy job
             self.app.exit()
 
 
 # ---------------------------------------------------------------------------
 # 2) APP
 # ---------------------------------------------------------------------------
-class Loxide(App):
+class Loxide(App[Message]):
+    api: AirlockAPIWrapper
+    working_dir: str
+    policies: Optional[list[Policy]]
+    devices: Optional[list[Agent]]
+
     CSS = """
     #logo {
         width: 100%;
@@ -358,11 +348,12 @@ class Loxide(App):
     """
     BINDINGS = [
         ("q", "quit", "Quit"),
-        ("d", "open_dir", "Open Directory"),
+        ("f", "open_fe", "Launch Explorer"),
+        ("r", "refresh", "Refresh"),
     ]
 
     def __init__(self, api: AirlockAPIWrapper):
-        self._textual_theme = load_env("TEXTUAL_THEME") or "nord"
+        self._textual_theme = get_user_value("TEXTUAL_THEME", str, "nord")
         super().__init__()
         self.api = api
         wd = load_env("WORKING_DIR") or os.getcwd()
@@ -398,20 +389,24 @@ class Loxide(App):
         self.register_theme(get_retro_terminal_theme())
         self.register_theme(get_amber_terminal_theme())
         self.theme = self._textual_theme
-        self.push_screen(MainMenuScreen(api))
+        self.push_screen(MainMenuScreen())
+
+    def action_refresh(self) -> None:
+        self.refresh_data()
 
     def action_quit(self) -> None:
         global _PENDING_JOB
         _PENDING_JOB = None
         self.exit()
 
-    def action_open_dir(self) -> None:
+    def action_open_fe(self) -> None:
-        # Refresh data before proceeding
+        """Open the working directory in the OS file manager (footer binding)."""
-        self.refresh_data()
+        path_to_open = self.working_dir or os.getcwd()
-        screen = self.screen_stack[-1]
+        try:
-        if isinstance(screen, MainMenuScreen):
+            open_directory(path_to_open)
-            if screen.current_tab != "dir":
+        except Exception as exc:
-                screen.switch_tab("dir")
+            logger.error("Failed to open directory %s: %s", path_to_open, exc)
+            self.bell()  # optional feedback
 
 
 # ---------------------------------------------------------------------------

TUI/agentmoveoperations.py

@@ -1,23 +1,3 @@
-"""
-Agent Move Operations Widget Module
-
-This module provides a Textual-based UI widget for performing bulk operations on
-agent devices in the Airlock system. It allows users to:
-- View selected agents and their current policy assignments
-- Move agents to local approval mode with OTP enforcement
-- Toggle agents between audit and enforcement policy modes
-- Select and move agents to alternate policies (future implementation)
-
-The widget tracks operation state, manages button availability, and displays
-results with success/failure summaries that can be copied to clipboard.
-
-Dependencies:
-    - textual: TUI framework for building the widget and UI components
-    - models.agent: Agent model class
-    - services.agenthandler: Core agent operation functions
-    - flows.localApproval: Local approval workflow handling
-"""
-
 from dataclasses import asdict
 from datetime import datetime
 import logging
@@ -33,9 +13,9 @@ from textual.widget import Widget
 from textual.widgets import Button, DataTable, Header, Static, TextArea
 
 from models.agent import Agent
-from screens.otpworkflowscreen import OTPWorkflowScreen
+from TUI.OTP_generate import OTPGenerator
-from screens.policyselectorscreen import PolicySelectorScreen
+from TUI.otpworkflowscreen import OTPWorkflowScreen
-from widgets.OTP_generate import OTPGenerator
+from TUI.policyselectorscreen import PolicySelectorScreen
 
 logger = logging.getLogger(__name__)
 
@@ -203,21 +183,21 @@ class AgentMoveOperations(Widget):
                 f"Operation: {operation_name}",
                 f"{'=' * 50}",
                 "",
-                f"✅ Successful ({len(successful)}):",
+                f"✅ Successful ({len(successful)}):",
             ]
 
             if successful:
                 for agent, result in successful:
-                    results_lines.append(f"  ✅ {agent.hostname}")
+                    results_lines.append(f"  ✅ {agent.hostname}")
             else:
                 results_lines.append("  (none)")
 
             results_lines.append("")
-            results_lines.append(f"❌ Failed ({len(unsuccessful)}):")
+            results_lines.append(f"❌ Failed ({len(unsuccessful)}):")
 
             if unsuccessful:
                 for agent, error in unsuccessful:
-                    results_lines.append(f"  ❌ {agent.hostname}: {error}")
+                    results_lines.append(f"  ❌ {agent.hostname}: {error}")
             else:
                 results_lines.append("  (none)")
 
@@ -252,9 +232,9 @@ class AgentMoveOperations(Widget):
         - Operations panel: 1/3 width
         - Results area: Initially hidden, shown after operation completion
         """
-        yield Header(show_clock=True, icon="⚙")
+        yield Header(show_clock=True, icon="âš™")
         title_text = Static(
-            f"🖥️ Agent Operations - {len(self.agents)} device(s) selected",
+            f"🖥️ Agent Operations - {len(self.agents)} device(s) selected",
             id="move_ops_title",
         )
         title_text.styles.margin = (0, 0, 1, 0)
@@ -289,32 +269,32 @@ class AgentMoveOperations(Widget):
                 yield operations_label
 
                 # Operation buttons
-                export_csv_btn = Button("📈 Export CSV", id="export_csv_btn")
+                export_csv_btn = Button("📈 Export CSV", id="export_csv_btn")
                 export_csv_btn.styles.width = "100%"
                 export_csv_btn.styles.margin = (0, 0, 1, 0)
                 yield export_csv_btn
 
                 local_approval_btn = Button(
-                    "✔️ Local Approval Mode", id="local_approval_btn"
+                    "✔️ Local Approval Mode", id="local_approval_btn"
                 )
                 local_approval_btn.styles.width = "100%"
                 local_approval_btn.styles.margin = (0, 0, 1, 0)
                 yield local_approval_btn
 
-                otp_gen_btn = Button("🎫 Generate One Time Passes", id="otp_gen_btn")
+                otp_gen_btn = Button("🎫 Generate One Time Passes", id="otp_gen_btn")
                 otp_gen_btn.styles.width = "100%"
                 otp_gen_btn.styles.margin = (0, 0, 1, 0)
                 yield otp_gen_btn
 
                 toggle_enforcement_btn = Button(
-                    "🔄 Toggle Audit/Enforcement", id="toggle_enforcement_btn"
+                    "🔄 Toggle Audit/Enforcement", id="toggle_enforcement_btn"
                 )
                 toggle_enforcement_btn.styles.width = "100%"
                 toggle_enforcement_btn.styles.margin = (0, 0, 1, 0)
                 yield toggle_enforcement_btn
 
                 other_policy_btn = Button(
-                    "🔀 Move to Other Policy", id="other_policy_btn"
+                    "🔀 Move to Other Policy", id="other_policy_btn"
                 )
                 other_policy_btn.styles.width = "100%"
                 other_policy_btn.styles.margin = (0, 0, 1, 0)
@@ -325,7 +305,7 @@ class AgentMoveOperations(Widget):
                 status_label.styles.margin = (2, 0, 0, 0)
                 yield status_label
 
-                back_button = Button("← Back", id="back_button")
+                back_button = Button("← Back", id="back_button")
                 back_button.styles.width = "50%"
                 back_button.styles.margin = (0, 1, 1, 0)
                 yield back_button
@@ -389,17 +369,17 @@ class AgentMoveOperations(Widget):
 
                 pyperclip.copy(results_text.text)
                 self.app.notify(
-                    "📋✅ Results copied to clipboard!",
+                    "📋✅ Results copied to clipboard!",
                     severity="information",
                     timeout=2,
                 )
             except ImportError:
                 self.app.notify(
-                    "❌ pyperclip not installed. Run: pip install pyperclip",
+                    "❌ pyperclip not installed. Run: pip install pyperclip",
                     severity="warning",
                 )
             except Exception as e:
-                self.app.notify(f"❌ Failed to copy: {str(e)}", severity="error")
+                self.app.notify(f"❌ Failed to copy: {str(e)}", severity="error")
             event.stop()
         elif btn_id == "export_csv_btn":
             self._start_export_csv_operation()
@@ -447,7 +427,7 @@ class AgentMoveOperations(Widget):
         self.operation_in_progress = True
 
         status_label = self.query_one("#status_label", Static)
-        status_label.update("✔️ Moving agents to local approval...")
+        status_label.update("✔️ Moving agents to local approval...")
 
         # Get API from app
         api = self.app.api
@@ -482,12 +462,12 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error during local approval operation: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             return
 
         self.operation_in_progress = False
-        status_label.update("✅ Operation complete!")
+        status_label.update("✅ Operation complete!")
 
         # Display results in the widget
         self._display_results("Local Approval Mode", successful, unsuccessful)
@@ -531,9 +511,9 @@ class AgentMoveOperations(Widget):
             file_path = os.path.join(str(path), filename)
             df.to_csv(file_path, index=False)
             successful.append(file_path)
-            status_label.update(f"✅ Exported to {file_path}")
+            status_label.update(f"✅ Exported to {file_path}")
         except Exception:
-            status_label.update("❌ Failed")
+            status_label.update("❌ Failed")
 
         self.operation_in_progress = False
 
@@ -577,7 +557,7 @@ class AgentMoveOperations(Widget):
         self.operation_in_progress = True
 
         status_label = self.query_one("#status_label", Static)
-        status_label.update("⏳ Toggling enforcement mode...")
+        status_label.update("⏳ Toggling enforcement mode...")
 
         # Get API from app
         api = self.app.api
@@ -587,9 +567,9 @@ class AgentMoveOperations(Widget):
 
         try:
             from services.agenthandler import moveAgentToRelatedPolicy
-            from utils.configmanager import get_protected_json
+            from utils.configmanager import get_system_json
 
-            policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+            policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
 
             for agent in self.agents:
                 try:
@@ -613,12 +593,12 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error during toggle enforcement operation: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             return
 
         self.operation_in_progress = False
-        status_label.update("✅ Operation complete!")
+        status_label.update("✅ Operation complete!")
 
         # Display results in the widget
         self._display_results("Toggle Audit/Enforcement", successful, unsuccessful)
@@ -683,7 +663,7 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error loading policies: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             self.selected_operation = ""
             self.app.notify(f"Failed to load policies: {str(e)}", severity="error")

TUI/allowlistselectionscreen.py

@@ -0,0 +1,657 @@
+from __future__ import annotations
+
+import logging
+from typing import Optional
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import Screen
+from textual.widgets import (
+    Button,
+    DataTable,
+    Footer,
+    Header,
+    Static,
+    TextArea,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class AllowlistSelectionWidget(Static):
+    """
+    Widget for selecting an allowlist and adding hashes to it.
+    Can be reused in different workflows.
+    """
+
+    DEFAULT_CSS = """
+    AllowlistSelectionWidget {
+        height: 1fr;
+        layout: vertical;
+    }
+    #allowlist_main {
+        height: 1fr;
+        width: 100%;
+    }
+    #left_panel {
+        width: 50%;
+        padding: 1;
+        border: solid $primary;
+    }
+    #right_panel {
+        width: 50%;
+        padding: 1;
+        border: solid $primary;
+    }
+    #allowlist_table {
+        height: 70%;
+        margin: 1 0;
+    }
+    #allowlist_table > .datatable--header {
+        text-style: bold;
+        background: $boost;
+    }
+    #allowlist_table Row {
+        height: 1;
+    }
+    #preview_area {
+        height: 60%;
+        margin: 1 0;
+    }
+    #action_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1;
+        content-align: center middle;
+    }
+    .panel-title {
+        text-style: bold;
+        margin: 0 0 1 0;
+    }
+    .info-text {
+        margin: 1 0;
+    }
+    """
+
+    def __init__(
+        self,
+        selected_data: pd.DataFrame,
+        api=None,
+        hostname: Optional[str] = None,
+        otpid: Optional[str] = None,
+        hash_column: str = "sha256",  # Default hash column name
+    ):
+        """
+        Initialize the allowlist selection widget.
+
+        Args:
+            selected_data: DataFrame containing the selected activities
+            api: API instance for making allowlist calls
+            hostname: Optional hostname for context
+            otpid: Optional OTP ID for context
+            hash_column: Name of the column containing hashes (default: "sha256")
+        """
+        super().__init__()
+        self.selected_data = selected_data
+        self.api = api
+        self.hostname = hostname
+        self.otpid = otpid
+        self.hash_column = hash_column
+        self.allowlists = []
+        self.selected_allowlist = None
+        self.hashes_to_add = []
+
+    def compose(self) -> ComposeResult:
+        with Horizontal(id="allowlist_main"):
+            # Left panel - Allowlist selection
+            with Vertical(id="left_panel"):
+                yield Static("Select Allowlist", classes="panel-title")
+                yield Static(
+                    f"Choose an allowlist to add {len(self.selected_data)} selected items",
+                    classes="info-text",
+                )
+
+                # Allowlist table
+                self.allowlist_table = DataTable(id="allowlist_table")
+                self.allowlist_table.cursor_type = "row"
+                yield self.allowlist_table
+
+                # Refresh button
+                self.refresh_btn = Button(
+                    "🔄 Refresh Allowlists", id="refresh_allowlists_btn"
+                )
+                yield self.refresh_btn
+
+            # Right panel - Preview and actions
+            with Vertical(id="right_panel"):
+                yield Static("Preview", classes="panel-title")
+
+                # Context information
+                context_text = []
+                if self.hostname:
+                    context_text.append(f"Host: {self.hostname}")
+                if self.otpid:
+                    context_text.append(f"OTP: {self.otpid}")
+                context_text.append(f"Selected Activities: {len(self.selected_data)}")
+
+                yield Static(" | ".join(context_text), classes="info-text")
+
+                # Preview text area
+                self.preview_area = TextArea(
+                    id="preview_area", read_only=True, language="markdown"
+                )
+                yield self.preview_area
+
+                # Hash statistics
+                self.stats_label = Static("", id="stats_label", classes="info-text")
+                yield self.stats_label
+
+        # Action buttons at bottom
+        with Horizontal(id="action_buttons"):
+            self.back_btn = Button("⬅ Back", id="back_btn")
+            self.add_btn = Button("➕ Add to Allowlist", id="add_to_allowlist_btn")
+
+            self.back_btn.styles.width = "50%"
+            self.add_btn.styles.width = "50%"
+            self.add_btn.disabled = True  # Disabled until allowlist selected
+
+            yield self.back_btn
+            yield self.add_btn
+
+    async def on_mount(self) -> None:
+        """Load allowlists when widget mounts."""
+        await self.load_allowlists()
+        await self.extract_and_preview_hashes()
+
+    async def load_allowlists(self) -> None:
+        """Load available allowlists from API, grouped by policy association."""
+        if not self.api:
+            logger.error("No API available")
+            self.allowlist_table.add_column("Error")
+            self.allowlist_table.add_row("No API available")
+            return
+
+        try:
+            # First, try to get the host's policy if hostname is provided
+            host_policy_allowlists = []
+            host_policy_ids = set()
+            policy_name = "Unknown Policy"  # Default value
+            group_id = None
+
+            if self.hostname:
+                try:
+                    # Get agent info to find its policy
+                    agents_df = self.api.agent_find_by_hostname(self.hostname)
+                    if not agents_df.empty:
+                        # Get the policy group ID for this host
+                        group_id = agents_df.iloc[0].get("groupid")
+
+                        # Look up the policy name from app's cached policies
+                        if (
+                            group_id
+                            and hasattr(self.app, "policies")
+                            and self.app.policies
+                        ):
+                            for policy in self.app.policies:
+                                if policy.groupid == group_id:
+                                    policy_name = policy.name
+                                    logger.info(
+                                        f"Found policy name: '{policy_name}' for group_id: {group_id}"
+                                    )
+                                    break
+
+                        logger.info(
+                            f"Found host '{self.hostname}' in policy '{policy_name}' (group_id: {group_id})"
+                        )
+
+                        if group_id:
+                            # Get allowlists for this policy
+                            policy_allowlists_df = self.api.policy_list_allowlists(
+                                group_id
+                            )
+                            if not policy_allowlists_df.empty:
+                                host_policy_allowlists = policy_allowlists_df.to_dict(
+                                    orient="records"
+                                )
+                                host_policy_ids = {
+                                    al.get("applicationid")
+                                    for al in host_policy_allowlists
+                                }
+                                logger.info(
+                                    f"Found {len(host_policy_allowlists)} allowlists for host's policy"
+                                )
+                except Exception as e:
+                    logger.warning(f"Could not get host's policy allowlists: {e}")
+
+            # If we still don't have a policy name, try to get it from the first allowlist or use a default
+            if not policy_name:
+                # Get all policies and try to find which one has allowlists
+                try:
+                    all_policies_df = self.api.policy_find_all()
+                    if not all_policies_df.empty:
+                        # If we have a group_id from somewhere, use it
+                        if group_id:
+                            policy_row = all_policies_df[
+                                all_policies_df["groupid"] == group_id
+                            ]
+                            if not policy_row.empty:
+                                policy_name = policy_row.iloc[0].get(
+                                    "groupname", "Unknown Policy"
+                                )
+                        else:
+                            # Use the first policy as fallback
+                            policy_name = all_policies_df.iloc[0].get(
+                                "groupname", "Default Policy"
+                            )
+                            logger.info(f"Using first available policy: {policy_name}")
+                    else:
+                        policy_name = "Unknown Policy"
+                except Exception as e:
+                    logger.warning(f"Could not fetch policies: {e}")
+                    policy_name = "Unknown Policy"
+
+            # Get all allowlists
+            all_allowlists_df = self.api.allowlist_find_all()
+
+            if all_allowlists_df.empty:
+                self.allowlist_table.add_column("No Allowlists")
+                self.allowlist_table.add_row("No allowlists found")
+                return
+
+            all_allowlists = all_allowlists_df.to_dict(orient="records")
+
+            # Separate into two groups: policy-associated and others
+            other_allowlists = [
+                al
+                for al in all_allowlists
+                if al.get("applicationid") not in host_policy_ids
+            ]
+
+            # Sort each group alphabetically by name
+            host_policy_allowlists.sort(key=lambda x: x.get("name", "").lower())
+            other_allowlists.sort(key=lambda x: x.get("name", "").lower())
+
+            # Combine lists with policy-associated first
+            self.allowlists = host_policy_allowlists + other_allowlists
+
+            # Setup table columns
+            self.allowlist_table.clear()
+            self.allowlist_table.add_columns("Name", "Application ID", "Type")
+
+            # Track which rows are headers vs actual allowlists
+            self._row_to_allowlist_map = {}
+            current_row = 0
+
+            # Add policy-associated allowlists if any
+            if host_policy_allowlists:
+                # Add section header
+                header_text = f"=== Policy: {policy_name or 'Host Policy'} ==="
+                self.allowlist_table.add_row(header_text, "", "", key="header_policy")
+                current_row += 1
+
+                # Add policy allowlists
+                for idx, allowlist in enumerate(host_policy_allowlists):
+                    name = allowlist.get("name", "Unknown")
+                    app_id = allowlist.get("applicationid", "Unknown")
+
+                    self.allowlist_table.add_row(
+                        f"  {name}",  # Indent to show grouping
+                        app_id,
+                        "Policy",
+                        key=f"policy_{idx}",
+                    )
+                    self._row_to_allowlist_map[current_row] = idx
+                    current_row += 1
+
+            # Add other allowlists
+            if other_allowlists:
+                # Add section header
+                if host_policy_allowlists:
+                    # Add spacer if we have policy allowlists above
+                    self.allowlist_table.add_row("", "", "", key="spacer")
+                    current_row += 1
+
+                self.allowlist_table.add_row(
+                    "=== Other Available Allowlists ===", "", "", key="header_other"
+                )
+                current_row += 1
+
+                # Add other allowlists
+                for idx, allowlist in enumerate(other_allowlists):
+                    name = allowlist.get("name", "Unknown")
+                    app_id = allowlist.get("applicationid", "Unknown")
+
+                    self.allowlist_table.add_row(
+                        f"  {name}",  # Indent to show grouping
+                        app_id,
+                        "General",
+                        key=f"other_{idx}",
+                    )
+                    # Map to the correct index in the combined list
+                    actual_idx = len(host_policy_allowlists) + idx
+                    self._row_to_allowlist_map[current_row] = actual_idx
+                    current_row += 1
+
+            # Log summary
+            logger.info(
+                f"Loaded {len(self.allowlists)} total allowlists: "
+                f"{len(host_policy_allowlists)} policy-associated, "
+                f"{len(other_allowlists)} others"
+            )
+
+            # Update stats label if no allowlists in policy
+            if self.hostname and not host_policy_allowlists:
+                self.stats_label.update(
+                    f"Note: No allowlists found for {self.hostname}'s policy | "
+                    + self.stats_label.content.plain
+                )
+
+        except Exception as exc:
+            logger.exception(f"Failed to load allowlists: {exc}")
+            self.allowlist_table.add_column("Error")
+            self.allowlist_table.add_row(f"Failed to load: {str(exc)}")
+
+    async def extract_and_preview_hashes(self) -> None:
+        """Extract hashes from selected data and show preview."""
+        preview_lines = ["## Hash Extraction Summary\n"]
+
+        # Check for hash column
+        if self.hash_column not in self.selected_data.columns:
+            # Try to find a hash column
+            possible_hash_cols = [
+                "sha256",
+                "SHA256",
+                "hash",
+                "Hash",
+                "sha1",
+                "SHA1",
+                "md5",
+                "MD5",
+                "filehash",
+                "file_hash",
+            ]
+            found_col = None
+            for col in possible_hash_cols:
+                if col in self.selected_data.columns:
+                    found_col = col
+                    break
+
+            if found_col:
+                self.hash_column = found_col
+                preview_lines.append(f"✓ Found hash column: **{found_col}**\n")
+            else:
+                preview_lines.append("⚠️ **No hash column found**\n")
+                preview_lines.append("Available columns:\n")
+                for col in self.selected_data.columns:
+                    if col != "_row_id":
+                        preview_lines.append(f"  - {col}\n")
+
+                self.preview_area.text = "".join(preview_lines)
+                self.stats_label.update("No hashes to add")
+                return
+
+        # Extract unique hashes
+        hashes = self.selected_data[self.hash_column].dropna().unique()
+        self.hashes_to_add = [h for h in hashes if h and str(h).strip()]
+
+        # Build preview
+        preview_lines.append(f"### Found {len(self.hashes_to_add)} unique hashes\n\n")
+
+        # Show sample of hashes (first 10)
+        preview_lines.append("**Sample hashes to be added:**\n```\n")
+        for i, hash_val in enumerate(self.hashes_to_add[:10]):
+            preview_lines.append(f"{i+1}. {hash_val}\n")
+        if len(self.hashes_to_add) > 10:
+            preview_lines.append(f"... and {len(self.hashes_to_add) - 10} more\n")
+        preview_lines.append("```\n\n")
+
+        # Show sample of source data
+        preview_lines.append("**Sample source activities:**\n")
+        sample_cols = [
+            col
+            for col in self.selected_data.columns
+            if col not in ["_row_id"] and col in ["filename", "path", "action", "user"]
+        ]
+        if not sample_cols:
+            sample_cols = [
+                col for col in self.selected_data.columns if col != "_row_id"
+            ][:3]
+
+        if sample_cols:
+            preview_lines.append("```\n")
+            for i, row in self.selected_data[sample_cols].head(5).iterrows():
+                row_text = " | ".join([f"{col}: {row[col]}" for col in sample_cols])
+                preview_lines.append(f"{row_text}\n")
+            preview_lines.append("```\n")
+
+        self.preview_area.text = "".join(preview_lines)
+
+        # Update statistics
+        self.stats_label.update(
+            f"Ready to add {len(self.hashes_to_add)} unique hashes | "
+            f"From {len(self.selected_data)} selected activities"
+        )
+
+    async def on_data_table_row_selected(self, event) -> None:
+        """Handle allowlist selection."""
+        try:
+            # Extract row index from event - handle different event structures
+            row_index = None
+
+            # Try to get row index from coordinate
+            if hasattr(event, "coordinate") and hasattr(event.coordinate, "row"):
+                row_index = event.coordinate.row
+            # Try cursor_row as fallback
+            elif hasattr(event, "cursor_row"):
+                row_index = event.cursor_row
+            # Try getting from the table itself
+            else:
+                table = self.allowlist_table
+                if hasattr(table, "cursor_row"):
+                    row_index = table.cursor_row
+
+            # Validate row index
+            if row_index is not None and isinstance(row_index, int):
+                # Account for group headers in the row count
+                actual_allowlist_index = self._get_allowlist_index_from_row(row_index)
+
+                if (
+                    actual_allowlist_index is not None
+                    and 0 <= actual_allowlist_index < len(self.allowlists)
+                ):
+                    self.selected_allowlist = self.allowlists[actual_allowlist_index]
+                    self.add_btn.disabled = False
+                    self.add_btn.label = (
+                        f"➕ Add to '{self.selected_allowlist.get('name', 'Unknown')}'"
+                    )
+
+                    # Update preview with selection
+                    await self._update_preview_with_selection()
+
+                    logger.info(
+                        f"Selected allowlist: {self.selected_allowlist.get('name')}"
+                    )
+                else:
+                    logger.debug(f"Row {row_index} is a header or invalid")
+            else:
+                logger.warning(f"Could not extract valid row index from event: {event}")
+
+        except Exception as exc:
+            logger.exception(f"Failed to select allowlist: {exc}")
+
+    def _get_allowlist_index_from_row(self, row_index: int) -> Optional[int]:
+        """Convert table row index to allowlist list index, accounting for group headers."""
+        # This will be updated when we have group headers
+        if hasattr(self, "_row_to_allowlist_map"):
+            return self._row_to_allowlist_map.get(row_index)
+        return row_index
+
+    async def _update_preview_with_selection(self) -> None:
+        """Update preview when an allowlist is selected."""
+        if not self.selected_allowlist:
+            return
+
+        current_text = self.preview_area.text
+        # Remove any existing selection header
+        if "### Selected Allowlist:" in current_text:
+            lines = current_text.split("\n")
+            # Find and remove the selection lines
+            new_lines = []
+            skip_next = False
+            for line in lines:
+                if line.startswith("### Selected Allowlist:"):
+                    skip_next = True
+                    continue
+                if skip_next and line.startswith("Application ID:"):
+                    skip_next = False
+                    continue
+                if not skip_next:
+                    new_lines.append(line)
+            current_text = "\n".join(new_lines)
+
+        # Add new selection at the top
+        selection_text = (
+            f"### Selected Allowlist: **{self.selected_allowlist.get('name')}**\n"
+            f"Application ID: {self.selected_allowlist.get('applicationid')}\n\n"
+        )
+        self.preview_area.text = selection_text + current_text
+
+    async def on_button_pressed(self, event) -> None:
+        """Handle button presses."""
+        btn = getattr(event, "button", None) or getattr(event, "sender", None)
+        btn_id = getattr(btn, "id", None) or getattr(event, "button_id", None)
+
+        if btn is self.back_btn or btn_id == "back_btn":
+            await self.app.pop_screen()
+            event.stop()
+            return
+
+        if btn is self.refresh_btn or btn_id == "refresh_allowlists_btn":
+            await self.load_allowlists()
+            event.stop()
+            return
+
+        if btn is self.add_btn or btn_id == "add_to_allowlist_btn":
+            await self.add_hashes_to_allowlist()
+            event.stop()
+            return
+
+    async def add_hashes_to_allowlist(self) -> None:
+        """Add the extracted hashes to the selected allowlist."""
+        if not self.selected_allowlist or not self.hashes_to_add:
+            self.app.notify(
+                "No allowlist selected or no hashes to add", severity="warning"
+            )
+            return
+
+        if not self.api:
+            self.app.notify("API not available", severity="error")
+            return
+
+        try:
+            # Disable button during operation
+            self.add_btn.disabled = True
+            self.add_btn.label = "⏳ Adding hashes..."
+
+            # Call API to add hashes
+            app_id = self.selected_allowlist.get("applicationid")
+            allowlist_name = self.selected_allowlist.get("name", "Unknown")
+
+            logger.info(
+                f"Adding {len(self.hashes_to_add)} hashes to allowlist {allowlist_name} (ID: {app_id})"
+            )
+
+            result = self.api.hash_add_to_allowlist(app_id, self.hashes_to_add)
+
+            # Success notification
+            self.app.notify(
+                f"✅ Successfully added {len(self.hashes_to_add)} hashes to '{allowlist_name}'",
+                title="Success",
+                severity="information",
+                timeout=5,
+            )
+
+            # Update preview to show success
+            self.preview_area.text = (
+                f"## ✅ SUCCESS\n\n"
+                f"Added **{len(self.hashes_to_add)} hashes** to allowlist:\n"
+                f"**{allowlist_name}** (ID: {app_id})\n\n"
+                f"### Operation Details:\n"
+                f"- Source: {self.hostname or 'Multiple hosts'}\n"
+                f"- OTP ID: {self.otpid or 'N/A'}\n"
+                f"- Activities processed: {len(self.selected_data)}\n"
+                f"- Unique hashes added: {len(self.hashes_to_add)}\n"
+            )
+
+            # Change button to "Done"
+            self.add_btn.label = "✅ Done"
+            self.add_btn.disabled = True
+
+        except Exception as exc:
+            logger.exception(f"Failed to add hashes to allowlist: {exc}")
+            self.app.notify(
+                f"❌ Failed to add hashes: {str(exc)}",
+                title="Error",
+                severity="error",
+                timeout=10,
+            )
+
+            # Re-enable button
+            self.add_btn.disabled = False
+            self.add_btn.label = "⟳ Retry Add to Allowlist"
+
+
+class AllowlistSelectionScreen(Screen):
+    """
+    Screen wrapper for the AllowlistSelectionWidget.
+    """
+
+    BINDINGS = [
+        Binding("b", "back", "Back"),
+        Binding("r", "refresh", "Refresh Allowlists"),
+        Binding("enter", "confirm", "Add to Allowlist"),
+    ]
+
+    def __init__(
+        self,
+        selected_data: pd.DataFrame,
+        api=None,
+        hostname: Optional[str] = None,
+        otpid: Optional[str] = None,
+        hash_column: str = "sha256",
+    ):
+        super().__init__()
+        self.selected_data = selected_data
+        self.api = api
+        self.hostname = hostname
+        self.otpid = otpid
+        self.hash_column = hash_column
+
+    def compose(self) -> ComposeResult:
+        yield Header(show_clock=True)
+        self.widget = AllowlistSelectionWidget(
+            self.selected_data,
+            api=self.api,
+            hostname=self.hostname,
+            otpid=self.otpid,
+            hash_column=self.hash_column,
+        )
+        yield self.widget
+        yield Footer()
+
+    async def action_back(self) -> None:
+        """Go back to previous screen."""
+        await self.app.pop_screen()
+
+    async def action_refresh(self) -> None:
+        """Refresh the allowlists."""
+        if hasattr(self, "widget") and self.widget:
+            await self.widget.load_allowlists()
+
+    async def action_confirm(self) -> None:
+        """Confirm and add to allowlist."""
+        if hasattr(self, "widget") and self.widget:
+            if self.widget.selected_allowlist and self.widget.hashes_to_add:
+                await self.widget.add_hashes_to_allowlist()

TUI/moveagentworkflowscreen.py

@@ -1,18 +1,18 @@
-from typing import List
+from typing import List, Optional
 
 from textual.app import ComposeResult
 from textual.screen import Screen
 
 from models.agent import Agent
-from widgets.agentmoveoperations import AgentMoveOperations
+from TUI.agentmoveoperations import AgentMoveOperations
-from widgets.multiagentselector import MultiAgentSelector
+from TUI.multiagentselector import MultiAgentSelector
-from widgets.resultsdisplay import ResultsDisplay
+from TUI.resultsdisplay import ResultsDisplay
 
 
 class MoveAgentWorkflowScreen(Screen):
     """Screen that handles the agent movement workflow."""
 
-    def __init__(self, all_agents: List[Agent]):
+    def __init__(self, all_agents: Optional[List[Agent]]):
         super().__init__()
         self.all_agents = all_agents
         self.selected_agents = None

TUI/multiagentselector.py

@@ -1,6 +1,6 @@
 import difflib
 import re
-from typing import List
+from typing import List, Optional
 
 from textual.containers import Horizontal, Vertical
 from textual.css.query import NoMatches
@@ -25,7 +25,7 @@ class MultiAgentSelector(Widget):
             super().__init__()
             self.selected_agents = selected_agents
 
-    def __init__(self, all_agents: List[Agent]):
+    def __init__(self, all_agents: Optional[List[Agent]]):
         super().__init__()
         self.all_agents = all_agents
         self._match_type = "exact"

TUI/otpactivityscreen.py

@@ -0,0 +1,897 @@
+from __future__ import annotations
+
+from datetime import datetime
+import logging
+import os
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import Screen
+from textual.widgets import Button, DataTable, Footer, Header, Static
+
+from TUI.allowlistselectionscreen import AllowlistSelectionScreen
+from utils.configmanager import load_env
+
+logger = logging.getLogger(__name__)
+
+
+def _load_working_dir() -> str:
+    """
+    Load the working directory from environment variables or use the current working directory.
+    """
+    wd = os.environ.get("WORKING_DIR")
+    if wd:
+        return wd
+    return os.getcwd()
+
+
+class OTPActivitiesWidget(Static):
+    """
+    Reusable widget that contains the sessions table (left) and an Activity Preview (right).
+    The right side shows an Activity Preview that takes ~75% vertical space, and a lower area
+    with Back and Continue buttons. The Continue button pushes ActivityDetailScreen with the
+    currently-loaded activities.
+    """
+
+    DEFAULT_CSS = """
+    OTPActivitiesWidget {
+        height: 1fr;
+    }
+    #main_row {
+        width: 100%;
+        height: 100%;
+        layout: horizontal;
+    }
+    #left_panel {
+        width: 60%;
+        min-width: 60;
+        border: none;
+    }
+    #right_panel {
+        width: 40%;
+        min-width: 40;
+        border: none;
+        layout: vertical;
+    }
+    #activity_preview_container {
+        height: 1fr;
+        border: none;
+        padding: 1 1;
+    }
+    #activity_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    """
+
+    def compose(self) -> ComposeResult:
+        # Layout: horizontal main row with left & right panels
+        with Horizontal(id="main_row"):
+            # Left: sessions area
+            with Vertical(id="left_panel"):
+                yield Static("OTP Sessions", classes="panel-title")
+                with Vertical(id="sessions_table_container"):
+                    self.sessions_table = DataTable(id="sessions_table")
+                    self.sessions_table.styles.width = "100%"
+                    yield self.sessions_table
+            # Right: Activity Preview (top 3/4) + buttons (bottom 1/4)
+            with Vertical(id="right_panel"):
+                # Activity preview area (takes ~75% of right panel)
+                yield Static("Activity Preview", classes="panel-title")
+                with Vertical(id="activity_preview_container"):
+                    self.activities_table = DataTable(id="activity_preview_table")
+                    yield self.activities_table
+                # Buttons area at the bottom (Back, Continue)
+                with Horizontal(id="activity_buttons"):
+                    # Back takes left side, Continue right side
+                    self.back_btn = Button("Back", id="activity_back_btn")
+                    self.continue_btn = Button("Continue", id="activity_continue_btn")
+                    # Stretch buttons nicely
+                    self.back_btn.styles.width = "50%"
+                    self.continue_btn.styles.width = "50%"
+                    yield self.back_btn
+                    yield self.continue_btn
+
+    async def on_mount(self) -> None:
+        # Configure sessions table and activities preview
+        self.sessions_table.clear()
+        self.sessions_table.add_columns(
+            "otpid", "hostname", "status", "purpose", "granted"
+        )
+        self.activities_table.clear()
+        # activities_table columns are dynamically added when activities are loaded.
+        # Selection behavior
+        self.sessions_table.cursor_type = "row"
+        try:
+            self.sessions_table.zebra_stripes = True
+        except Exception:
+            pass
+        self.activities_table.cursor_type = "row"
+        try:
+            self.activities_table.zebra_stripes = True
+        except Exception:
+            pass
+        # Store state
+        self._sessions_df: pd.DataFrame | None = None
+        self._activities_df: pd.DataFrame | None = None
+        self._selected_session_otpid: str | int | None = None
+
+    async def on_button_pressed(self, event) -> None:  # type: ignore[override]
+        """
+        Handle Back / Continue buttons for the Activity Preview area.
+        """
+        # Try to resolve the button object from the event
+        btn = (
+            getattr(event, "button", None)
+            or getattr(event, "sender", None)
+            or getattr(event, "control", None)
+            or getattr(event, "widget", None)
+        )
+        btn_id = (
+            getattr(btn, "id", None)
+            or getattr(event, "button_id", None)
+            or getattr(event, "id", None)
+        )
+        # ---- Back ----
+        if btn is self.back_btn or btn_id == getattr(self.back_btn, "id", None):
+            while len(self.app.screen_stack) > 2:
+                self.app.pop_screen()
+            event.stop()
+            return
+        # ---- Continue ----
+        if btn is self.continue_btn or btn_id == getattr(self.continue_btn, "id", None):
+            if self._activities_df is None or self._activities_df.empty:
+                logger.info("Continue pressed but no activities loaded.")
+                await self.post_message(
+                    Static("No activities loaded to continue with.")
+                )
+                return
+            # Copy activities DataFrame to pass to new screen
+            activities_copy = self._activities_df.copy()
+            otpid = self._selected_session_otpid
+            # Optionally include hostname if available
+            hostname = None
+            try:
+                if self._sessions_df is not None:
+                    df = self._sessions_df.reset_index(drop=True)
+                    match = df[df["otpid"] == otpid]
+                    if not match.empty:
+                        hostname = match.iloc[0].get("hostname")
+            except Exception:
+                hostname = None
+            # Create and push ActivityDetailScreen, handing the data
+            try:
+                detail_screen = ActivityDetailScreen(
+                    activities_copy, otpid=otpid, hostname=hostname
+                )
+                await self.app.push_screen(detail_screen)
+            except Exception as exc:
+                logger.exception("Failed to push ActivityDetailScreen: %s", exc)
+            return
+        # Unknown button on widget
+        logger.debug(
+            "Unhandled OTPActivitiesWidget button pressed (resolved btn=%r, id=%r)",
+            btn,
+            btn_id,
+        )
+
+    async def on_data_table_row_selected(self, event) -> None:  # type: ignore[override]
+        """
+        Robust handler for DataTable row-selection across Textual micro-versions.
+        Tries many attribute names and shapes:
+         - numeric index (row_key, row_index, index)
+         - coordinate object or tuple (coordinate.row or (row, col))
+         - direct row values (row, values, cells) -> we try to map those back to the sessions DF
+         - table.cursor_row fallback
+        """
+        # 1) Determine the sending table (best-effort)
+        sender = None
+        for attr in ("sender", "table", "data_table", "control"):
+            sender = getattr(event, attr, None)
+            if sender is not None:
+                break
+        if sender is None:
+            sender = self.sessions_table  # Assume sessions_table if unknown
+        # Only respond to selections in the sessions table
+        if sender is not self.sessions_table:
+            return
+
+        # Helper to log and return
+        def _bad(msg: str, *args):
+            logger.warning(msg, *args)
+            return None
+
+        # 2) Try to extract a numeric index
+        row_key = None
+        for attr in ("row_key", "row", "row_index", "index"):
+            row_key = getattr(event, attr, None)
+            if row_key is not None:
+                break
+        # If coordinate: try to extract .row or tuple[0]
+        if row_key is None:
+            coord = getattr(event, "coordinate", None) or getattr(
+                event, "cursor_coordinate", None
+            )
+            if coord is not None:
+                if hasattr(coord, "row"):
+                    row_key = coord.row
+                elif isinstance(coord, (tuple, list)) and len(coord) >= 1:
+                    row_key = coord[0]
+        # If still nothing, maybe the event provides the row's cell values directly
+        row_values = None
+        for attr in ("values", "cells", "row", "row_values", "selected_row_values"):
+            val = getattr(event, attr, None)
+            if val:
+                # Prefer actual sequence of cell values
+                row_values = val
+                break
+        # If we have row_values, try to map them back to the sessions DataFrame
+        if row_values is not None:
+            # Normalize into list of strings for comparison
+            try:
+                vals = [
+                    "" if pd.isna(v) else str(v)
+                    for v in (
+                        list(row_values)
+                        if not isinstance(row_values, str)
+                        else [row_values]
+                    )
+                ]
+            except Exception:
+                vals = [str(row_values)]
+            # Try to match against the expected columns order we render
+            if self._sessions_df is None or self._sessions_df.empty:
+                logger.warning(
+                    "Sessions DataFrame is empty; cannot map selected row values."
+                )
+                return
+            df_ordered = self._sessions_df.reset_index(drop=True)
+            expected_cols = ["otpid", "hostname", "status", "purpose", "granted"]
+
+            # Build stringified candidates for each row in df using the same columns we show
+            def _row_to_vals(sr):
+                out = []
+                for c in expected_cols:
+                    if c in sr:
+                        v = sr[c]
+                        out.append("" if pd.isna(v) else str(v))
+                    else:
+                        out.append("")
+                return out
+
+            match_idx = None
+            for i, sr in df_ordered.iterrows():
+                cand = _row_to_vals(sr)
+                # Compare prefix: row values might be a subset (e.g. only first 3 cols), so compare prefix only
+                if len(vals) <= len(cand) and all(
+                    vals[j] == cand[j] for j in range(len(vals))
+                ):
+                    match_idx = i
+                    break
+            if match_idx is None:
+                # Try looser match: compare first cell only (otpid)
+                first = vals[0] if vals else None
+                if first is not None:
+                    for i, sr in df_ordered.iterrows():
+                        cand0 = "" if pd.isna(sr.get("otpid")) else str(sr.get("otpid"))
+                        if cand0 == first:
+                            match_idx = i
+                            break
+            if match_idx is None:
+                logger.warning(
+                    "Unable to locate DataFrame row matching selected row values: %r",
+                    vals,
+                )
+                return
+            idx = int(match_idx)
+        else:
+            # 3) If we have a row_key, try to normalize to an int index
+            if row_key is not None:
+                try:
+                    idx = int(row_key)
+                except Exception:
+                    # Try converting via string
+                    try:
+                        idx = int(str(row_key))
+                    except Exception:
+                        idx = None
+                if idx is None:
+                    # Final numeric fallback: use sessions_table.cursor_row if present
+                    try:
+                        idx = getattr(self.sessions_table, "cursor_row")
+                    except Exception:
+                        idx = None
+                if idx is None:
+                    _bad("Failed to normalize row/key from event: %r", row_key)
+                    return
+            else:
+                # 4) Try table cursor_row as last resort
+                try:
+                    idx = getattr(self.sessions_table, "cursor_row")
+                except Exception:
+                    logger.warning(
+                        "Could not determine selected row from event: %r", event
+                    )
+                    # Helpful debug hint for you to paste back if still failing:
+                    logger.debug("Event repr for debugging: %r", event)
+                    return
+        # At this point we should have an integer idx
+        try:
+            idx = int(idx)
+        except Exception:
+            logger.exception(
+                "Final normalization of selected row index failed: %r", idx
+            )
+            return
+        # Validate sessions df
+        if self._sessions_df is None or self._sessions_df.empty:
+            logger.warning("Sessions DataFrame empty; nothing to select.")
+            return
+        df_ordered = self._sessions_df.reset_index(drop=True)
+        if idx < 0 or idx >= len(df_ordered):
+            logger.warning(
+                "Selected row index %s out of range (0..%d)", idx, len(df_ordered) - 1
+            )
+            return
+        row_series = df_ordered.iloc[idx]
+        otpid = row_series.get("otpid")
+        hostname = row_series.get("hostname")
+        # Store selected session and fetch activities
+        self._selected_session_otpid = otpid
+        # Obtain api from app (try multiple places)
+        api = (
+            getattr(self.app, "api", None)
+            or getattr(self, "api", None)
+            or getattr(self.app, "airlock_api", None)
+        )
+        if api is None:
+            logger.error("No API available on self.app.api - cannot fetch activities")
+            return
+        logger.info(
+            "Fetching activities for otpid=%s host=%s (selected row=%s)",
+            otpid,
+            hostname,
+            idx,
+        )
+        await self._fetch_activities_for_otpid(api, otpid, hostname=hostname)
+
+    async def load_sessions_from_api(self, api) -> None:
+        """
+        Pulls OTP session lists, adds status column, concatenates and populates the sessions table.
+        """
+        try:
+            active = api.otp_find_active()
+            awaiting = api.otp_find_awaiting()
+            enforced = api.otp_find_enforced()
+            revoked = api.otp_find_revoked()
+        except Exception as exc:
+            logger.exception("Failed to fetch OTP session lists: %s", exc)
+            # Present empty
+            active = awaiting = enforced = revoked = pd.DataFrame()
+
+        # Ensure DataFrame objects
+        def _ensure_df(df):
+            return df if isinstance(df, pd.DataFrame) else pd.DataFrame(df)
+
+        active = _ensure_df(active)
+        awaiting = _ensure_df(awaiting)
+        enforced = _ensure_df(enforced)
+        revoked = _ensure_df(revoked)
+        for df, status in [
+            (active, "active"),
+            (awaiting, "awaiting"),
+            (enforced, "enforced"),
+            (revoked, "revoked"),
+        ]:
+            if "status" not in df.columns:
+                df["status"] = status
+        combined = pd.concat([active, awaiting, enforced, revoked], ignore_index=True)
+        if "otpid" in combined.columns:
+            combined = combined.sort_values(by="otpid", ascending=False)
+        self._sessions_df = combined
+        # Populate DataTable
+        self.sessions_table.clear()
+        # Ensure columns exist in DF and when missing add empty column
+        expected_cols = ["otpid", "hostname", "status", "purpose", "granted"]
+        for col in expected_cols:
+            if col not in combined.columns:
+                combined[col] = ""
+        self.sessions_table.add_columns(*expected_cols)
+        # Add rows
+        for _, row in combined[expected_cols].iterrows():
+            # Convert values to str for safe insertion
+            vals = ["" if pd.isna(v) else v for v in row.to_list()]
+            self.sessions_table.add_row(*[str(v) for v in vals])
+        logger.info("Loaded %d OTP sessions.", len(combined))
+
+    async def _fetch_activities_for_otpid(self, api, otpid, hostname=None) -> None:
+        """
+        Fetch activities DataFrame for a given otpid and populate activities_table.
+        """
+        try:
+            result = api.otp_get_activities(otpid)
+            result_df = (
+                result if isinstance(result, pd.DataFrame) else pd.DataFrame(result)
+            )
+        except Exception as exc:
+            logger.exception("Failed to fetch activities for otpid %s: %s", otpid, exc)
+            result_df = pd.DataFrame()
+        # Attach hostname if provided
+        if hostname is not None:
+            result_df["hostname"] = hostname
+        if result_df.empty:
+            logger.info("No activities found for otpid %s (host: %s)", otpid, hostname)
+            self._activities_df = pd.DataFrame()
+            self.activities_table.clear()
+            return
+        # Store and render
+        self._activities_df = result_df.copy()
+        # Rebuild activities_table columns from result_df
+        self.activities_table.clear()
+        # Ensure stable column order
+        for col in result_df.columns:
+            self.activities_table.add_column(col)
+        # Add rows
+        for _, arow in result_df.iterrows():
+            values = ["" if pd.isna(v) else v for v in arow.to_list()]
+            self.activities_table.add_row(*[str(v) for v in values])
+        logger.info(
+            "Loaded %d activity rows for otpid %s (host: %s)",
+            len(result_df),
+            otpid,
+            hostname,
+        )
+
+    async def export_activities(self) -> None:
+        """
+        Export currently-loaded activities DataFrame to CSV.
+        Can be called directly (programmatically) or from the button handler.
+        """
+        if self._activities_df is None or self._activities_df.empty:
+            logger.info("No activities loaded to export.")
+            # On-screen short message
+            await self.post_message(Static("No activities to export."))
+            return
+        working_dir = _load_working_dir()
+        timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
+        filename = f"otp_activities_{self._selected_session_otpid}_{timestamp}.csv"
+        file_path = os.path.join(working_dir, filename)
+        try:
+            self._activities_df.to_csv(file_path, index=False)
+            logger.info("Exported activities to %s", file_path)
+            await self.post_message(Static(f"✅ Exported activities to: {file_path}"))
+        except Exception as exc:
+            logger.exception("Failed to export activities to %s: %s", file_path, exc)
+            await self.post_message(Static("Failed to export activities; check logs."))
+
+
+class ActivityDetailWidget(Static):
+    """
+    Interactive widget for Activity Detail screen.
+    Shows the provided DataFrame in a DataTable and offers Export + Back buttons.
+    Now includes Select All/None and Add to Allowlist functionality.
+    """
+
+    DEFAULT_CSS = """
+    ActivityDetailWidget {
+        height: 1fr;
+        layout: vertical;
+    }
+    #detail_table_container {
+        height: 1fr;
+        padding: 1 1;
+    }
+    #selection_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    #detail_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    """
+
+    def __init__(self, activities_df: pd.DataFrame, otpid=None, hostname=None) -> None:
+        super().__init__()
+        self.activities_df = (
+            activities_df.copy()
+            if isinstance(activities_df, pd.DataFrame)
+            else pd.DataFrame(activities_df)
+        )
+        # Add a unique identifier column if not present
+        if "_row_id" not in self.activities_df.columns:
+            self.activities_df["_row_id"] = range(len(self.activities_df))
+
+        self.otpid = otpid
+        self.hostname = hostname
+        self.selected_row_ids = set()  # Track selected rows by unique ID
+        self.row_key_to_id = {}  # Map DataTable row keys to unique row IDs
+        self.table_row_to_id = {}  # Map table row indices to unique row IDs
+        self._last_sort = None  # Track last sort column and order
+
+    def compose(self) -> ComposeResult:
+        yield Static(
+            f"Activity Detail (otpid={self.otpid} host={self.hostname})",
+            classes="panel-title",
+        )
+        # Table container
+        with Vertical(id="detail_table_container"):
+            self.detail_table = DataTable(id="detail_table")
+            yield self.detail_table
+
+        # Original buttons at bottom
+        with Horizontal(id="detail_buttons"):
+            self.detail_back_btn = Button("Back", id="detail_back_btn")
+            self.add_allowlist_btn = Button(
+                "📋 Add Selected to Allowlist", id="add_allowlist_btn"
+            )
+            yield self.add_allowlist_btn
+            yield self.detail_back_btn
+
+    async def on_mount(self) -> None:
+        await self._build_table(rebuild=True)
+        self._update_button_states()
+
+    def _update_button_states(self) -> None:
+        """Update button states based on selection."""
+        has_selection = len(self.selected_row_ids) > 0
+        self.add_allowlist_btn.disabled = not has_selection
+
+        # Update button labels with count
+        count = len(self.selected_row_ids)
+        total = len(self.activities_df)
+
+        if has_selection:
+            self.add_allowlist_btn.label = f"📋 Add {count} Selected to Allowlist"
+        else:
+            self.add_allowlist_btn.label = "📋 Add Selected to Allowlist"
+
+    async def _build_table(self, rebuild: bool = True) -> None:
+        """Rebuild the DataTable. If rebuild=False, only refresh rows."""
+        if rebuild:
+            # Full rebuild: clear columns and rows
+            self.detail_table.clear()
+            self.detail_table.columns.clear()
+            self.row_key_to_id.clear()
+            self.table_row_to_id.clear()
+
+            if self.activities_df is None or self.activities_df.empty:
+                logger.info("ActivityDetailWidget mounted with empty dataframe.")
+                return
+
+            # Add columns (checkbox + data columns, excluding internal _row_id)
+            self.detail_table.add_column("Select", key="select")
+            for col in self.activities_df.columns:
+                if col != "_row_id":  # Don't display the internal ID column
+                    self.detail_table.add_column(col)
+        else:
+            # Partial rebuild: clear rows only
+            self.detail_table.clear()
+            self.row_key_to_id.clear()
+            self.table_row_to_id.clear()
+
+        # Add rows
+        for table_idx, (df_idx, row) in enumerate(self.activities_df.iterrows()):
+            # Get the unique row ID
+            row_id = row["_row_id"]
+
+            # Build values list (excluding _row_id column)
+            vals = []
+            for col in self.activities_df.columns:
+                if col != "_row_id":
+                    v = row[col]
+                    vals.append("" if pd.isna(v) else str(v))
+
+            # Check if this row is selected
+            checkbox = "☑" if row_id in self.selected_row_ids else "☐"
+
+            # Add row to table
+            row_key = self.detail_table.add_row(checkbox, *vals)
+
+            # Map the row key and table index to the unique row ID
+            self.row_key_to_id[row_key] = row_id
+            self.table_row_to_id[table_idx] = row_id
+
+    async def on_data_table_cell_selected(self, event: DataTable.CellSelected) -> None:
+        # Toggle selection when the "Select" column is clicked
+        if event.cell_key.column_key.value == "select":
+            table_row_index = event.coordinate.row
+
+            # Get the unique row ID for this table row
+            row_id = self.table_row_to_id.get(table_row_index)
+            if row_id is not None:
+                # Get the row key for updating the cell
+                row_key = event.cell_key.row_key
+
+                if row_id in self.selected_row_ids:
+                    self.selected_row_ids.remove(row_id)
+                    self.detail_table.update_cell(row_key, "select", "☐")  # Unchecked
+                else:
+                    self.selected_row_ids.add(row_id)
+                    self.detail_table.update_cell(row_key, "select", "☑")  # Checked
+
+                self._update_button_states()
+
+    async def on_data_table_header_selected(
+        self, event: DataTable.HeaderSelected
+    ) -> None:
+        column_key = event.column_key.value if event.column_key else None
+        if not column_key:
+            col_index = event.column_index
+            if col_index == 0:  # First column is "Select"
+                return
+            # Adjust for hidden _row_id column
+            visible_cols = [
+                col for col in self.activities_df.columns if col != "_row_id"
+            ]
+            if col_index - 1 < len(visible_cols):
+                column_key = visible_cols[col_index - 1]
+            else:
+                return
+        if column_key == "select" or column_key == "_row_id":
+            return
+
+        ascending = True
+        if self._last_sort == (column_key, True):
+            ascending = False
+        self._last_sort = (column_key, ascending)
+
+        try:
+            self.activities_df.sort_values(
+                by=column_key, ascending=ascending, inplace=True
+            )
+        except Exception as exc:
+            logger.exception("Failed to sort by column %s: %s", column_key, exc)
+            return
+
+        # ✅ Only refresh rows, not columns
+        await self._build_table(rebuild=False)
+
+    async def on_button_pressed(self, event) -> None:
+        btn = getattr(event, "button", None) or getattr(event, "sender", None)
+        btn_id = getattr(btn, "id", None) or getattr(event, "button_id", None)
+
+        if btn is self.detail_back_btn or btn_id == "detail_back_btn":
+            while len(self.app.screen_stack) > 2:
+                self.app.pop_screen()
+            event.stop()
+            return
+
+        if btn is self.add_allowlist_btn or btn_id == "add_allowlist_btn":
+            await self._open_allowlist_screen()
+            return
+
+    async def _select_all(self) -> None:
+        """Select all rows in the table."""
+        # Add all row IDs to selected set
+        self.selected_row_ids = set(self.activities_df["_row_id"].tolist())
+
+        # Update all checkboxes in the table
+        for row_key, row_id in self.row_key_to_id.items():
+            self.detail_table.update_cell(row_key, "select", "☑")
+
+        self._update_button_states()
+        logger.info(f"Selected all {len(self.selected_row_ids)} rows")
+
+    async def _select_none(self) -> None:
+        """Deselect all rows in the table."""
+        # Clear selected set
+        self.selected_row_ids.clear()
+
+        # Update all checkboxes in the table
+        for row_key, row_id in self.row_key_to_id.items():
+            self.detail_table.update_cell(row_key, "select", "☐")
+
+        self._update_button_states()
+        logger.info("Cleared all selections")
+
+    async def _open_allowlist_screen(self) -> None:
+        """Open the allowlist selection screen with selected activities."""
+        if not self.selected_row_ids:
+            self.app.notify("No rows selected", severity="warning")
+            return
+
+        # Get selected data
+        selected_df = self.get_selected_data()
+
+        # Get API from app
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API available on self.app.api")
+            self.app.notify("API not available", severity="error")
+            return
+
+        # Create and push AllowlistSelectionScreen
+        try:
+            allowlist_screen = AllowlistSelectionScreen(
+                selected_df, api=api, hostname=self.hostname, otpid=self.otpid
+            )
+            await self.app.push_screen(allowlist_screen)
+            logger.info(
+                f"Opened allowlist screen with {len(selected_df)} selected activities"
+            )
+        except ImportError as e:
+            logger.error(f"Failed to import AllowlistSelectionScreen: {e}")
+            self.app.notify("Allowlist screen module not found", severity="error")
+        except Exception as e:
+            logger.exception(f"Failed to open allowlist screen: {e}")
+            self.app.notify(
+                f"Error opening allowlist screen: {str(e)}", severity="error"
+            )
+
+    async def _export_detail_activities(self) -> None:
+        if self.activities_df is None or self.activities_df.empty:
+            logger.info("No activities to export.")
+            await self.mount(
+                Static("❌ No activities to export.", classes="notification")
+            )
+            return
+        if not self.selected_row_ids:
+            logger.info("No rows selected for export.")
+            await self.mount(
+                Static("❌ No rows selected for export.", classes="notification")
+            )
+            return
+        try:
+            working_dir = load_env("WORKING_DIR") or os.getcwd()
+            timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
+            filename = f"otp_activities_detail_{timestamp}.csv"
+            file_path = os.path.join(working_dir, filename)
+            selected_df = self.get_selected_data()
+            selected_df.to_csv(file_path, index=False)
+            logger.info("Exported selected activities to %s", file_path)
+            await self.mount(
+                Static(
+                    f"✅ Exported selected activities to: {filename}",
+                    classes="notification",
+                )
+            )
+        except Exception as exc:
+            logger.exception("Failed to export detail activities: %s", exc)
+            await self.mount(
+                Static(
+                    "❌ Failed to export activities; check logs.",
+                    classes="notification",
+                )
+            )
+
+    # ✅ Helper methods
+    def get_selected_data(self) -> pd.DataFrame:
+        """Return a DataFrame of the selected rows."""
+        if not self.selected_row_ids:
+            return pd.DataFrame()
+        # Filter by selected row IDs and drop the internal _row_id column
+        selected_df = self.activities_df[
+            self.activities_df["_row_id"].isin(self.selected_row_ids)
+        ].copy()
+        if "_row_id" in selected_df.columns:
+            selected_df = selected_df.drop(columns=["_row_id"])
+        return selected_df
+
+    def get_selected_records(self) -> list[dict]:
+        """Return selected rows as a list of dicts."""
+        if not self.selected_row_ids:
+            return []
+        # Filter by selected row IDs and drop the internal _row_id column
+        selected_df = self.activities_df[
+            self.activities_df["_row_id"].isin(self.selected_row_ids)
+        ].copy()
+        if "_row_id" in selected_df.columns:
+            selected_df = selected_df.drop(columns=["_row_id"])
+        return selected_df.to_dict(orient="records")
+
+
+class ActivityDetailScreen(Screen):
+    """
+    Screen that wraps ActivityDetailWidget. Expects a DataFrame passed on init.
+    """
+
+    BINDINGS = [
+        Binding("b", "back", "Back"),
+        Binding("e", "export", "Export"),
+        Binding("a", "select_all", "Select All"),
+        Binding("n", "select_none", "Select None"),
+    ]
+
+    def __init__(self, activities_df: pd.DataFrame, otpid=None, hostname=None) -> None:
+        super().__init__()
+        self._activities_df = (
+            activities_df.copy()
+            if isinstance(activities_df, pd.DataFrame)
+            else pd.DataFrame(activities_df)
+        )
+        self._otpid = otpid
+        self._hostname = hostname
+
+    def compose(self) -> ComposeResult:
+        self.widget = ActivityDetailWidget(
+            self._activities_df, otpid=self._otpid, hostname=self._hostname
+        )
+        yield Header(show_clock=True)
+        yield self.widget
+        yield Footer()
+
+    async def action_back(self) -> None:
+        try:
+            await self.app.pop_screen()
+        except Exception:
+            logger.debug("ActivityDetailScreen.action_back pop_screen failed.")
+
+    async def action_export(self) -> None:
+        # Delegate to widget export helper
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._export_detail_activities()
+
+    async def action_select_all(self) -> None:
+        """Handle 'a' key for select all."""
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._select_all()
+
+    async def action_select_none(self) -> None:
+        """Handle 'n' key for select none."""
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._select_none()
+
+
+class OTPActivitiesScreen(Screen):
+    """
+    A Screen intended to be pushed into an existing Textual App.
+    Usage:
+        app.push_screen(OTPActivitiesScreen())
+    or create this screen and call `await screen.load()` inside your app lifecycle.
+    The screen expects `self.app.api` to exist and be an AirlockAPIWrapper instance.
+    """
+
+    BINDINGS = [
+        Binding("r", "refresh_sessions", "Refresh Sessions"),
+        Binding("e", "export_activities", "Export activities"),
+        Binding("q", "quit", "Quit"),
+    ]
+
+    def compose(self) -> ComposeResult:
+        yield Header()
+        self.widget = OTPActivitiesWidget()
+        yield self.widget
+        yield Footer()
+
+    async def on_show(self) -> None:
+        """Restore focus to the left sessions table when the screen becomes visible."""
+        if hasattr(self, "widget") and hasattr(self.widget, "sessions_table"):
+            self.widget.sessions_table.focus()
+
+    async def on_mount(self) -> None:
+        # Try to load sessions immediately
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.warning("OTPActivitiesScreen mounted but no self.app.api found.")
+        else:
+            await self.widget.load_sessions_from_api(api)
+
+    # Simple actions bound to keys
+    async def action_refresh_sessions(self) -> None:
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API on app; cannot refresh sessions.")
+            return
+        logger.info("Refreshing OTP sessions via API.")
+        await self.widget.load_sessions_from_api(api)
+
+    async def action_quit(self) -> None:
+        # Pop the screen or exit app
+        await self.app.pop_screen()
+
+    # If you want an explicit method to fetch activities for a particular otpid from outside:
+    async def fetch_activities_for_otpid(self, otpid, hostname=None) -> None:
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API on app; cannot fetch activities.")
+            return
+        await self.widget._fetch_activities_for_otpid(api, otpid, hostname=hostname)

TUI/otpworkflowscreen.py

@@ -1,18 +1,18 @@
 # otp_workflow_screen.py
 
-from typing import List
+from typing import List, Optional
 
 from textual.app import ComposeResult
 from textual.screen import Screen
 
 from models.agent import Agent
-from widgets.OTP_generate import OTPGenerator
+from TUI.OTP_generate import OTPGenerator
 
 
 class OTPWorkflowScreen(Screen):
     """Screen that handles the OTP generation workflow without agent selection."""
 
-    def __init__(self, selected_agents: List[Agent]):
+    def __init__(self, selected_agents: Optional[List[Agent]]):
         super().__init__()
         self.selected_agents = selected_agents
 

TUI/policyselector.py

@@ -14,7 +14,7 @@ import pandas as pd
 from textual.containers import Horizontal, Vertical
 from textual.message import Message
 from textual.widget import Widget
-from textual.widgets import Button, DataTable, Footer, Header, Static, TextArea
+from textual.widgets import Button, DataTable, Static, TextArea
 
 from models.policy import Policy
 
@@ -93,7 +93,6 @@ class PolicySelector(Widget):
         - Policy table displaying available policies
         - Back buttons for navigation
         """
-        yield Header(show_clock=True, icon="⚙")
         title_text = Static(
             "🎯 Select Target Policy",
             id="policy_selector_title",
@@ -164,8 +163,6 @@ class PolicySelector(Widget):
                 policy_table.styles.margin = (1, 0, 1, 0)
                 yield policy_table
 
-        yield Footer()
-
     def on_mount(self) -> None:
         """
         Initialize the policy table when the widget is mounted.

TUI/policyselectorscreen.py

@@ -25,7 +25,7 @@ import logging
 from textual.app import ComposeResult
 from textual.screen import Screen
 
-from widgets.policyselector import PolicySelector
+from TUI.policyselector import PolicySelector
 
 logger = logging.getLogger(__name__)
 

TUI/policytreewidget.py

@@ -4,7 +4,7 @@ import logging
 from rich.text import Text
 from textual.containers import Horizontal, Vertical
 from textual.widget import Widget
-from textual.widgets import Input, OptionList, Static, Tree
+from textual.widgets import Input, OptionList, Static, Switch, Tree
 from textual.widgets.option_list import Option
 
 logger = logging.getLogger(__name__)
@@ -19,29 +19,49 @@ class PolicyTreeWidget(Widget):
         self.devices = devices
         self.last_highlighted_node = None
         self.leaf_counts = defaultdict(int)
+        self.match_type = "Count"  # Default to sorting by count
 
     def compose(self):
+        # Create the switch and its label
+        switch = Switch(value=False, id="match_switch")
+        switch.styles.margin = (0, 0, 0, 0)  # top, right, bottom, left
+        switch.styles.padding = (0, 0, 0, 0)
+
+        switch_label = Static("Sort: Count", id="match_switch_label")
+        switch_label.styles.margin = (1, 0, 0, 0)
+        switch_label.styles.padding = (0, 0, 0, 0)
+
+        # Create the tree
         policy_tree = Tree("", id="policy_tree")  # Label set in on_mount
         policy_tree.styles.width = "2fr"
         policy_tree.styles.height = "100%"
 
+        # Create the search box and details pane
         label = Static("Device Search:")
         search_box = Input(
             placeholder="Search policies or devices...", id="tree_search"
         )
         details_pane = Static("", id="details_pane")
 
+        # Layout the UI
         with Horizontal():
             yield policy_tree
             with Vertical() as right_pane:
                 right_pane.styles.width = "3fr"
+                # Use a Horizontal container for the switch and label
+                with Horizontal() as switch_container:
+                    switch_container.styles.height = 3
+                    switch_container.styles.margin = (0, 0, 0, 1)
+                    switch_container.styles.padding = (0, 0, 0, 0)
+                    yield switch
+                    yield switch_label
+                # Add the search box and details pane
                 yield label
                 yield search_box
                 yield details_pane
 
     def on_mount(self) -> None:
         self._precompute_leaf_counts()
-
         # Update root label with total leaf count
         total_leaves = sum(
             self.leaf_counts.get(policy.groupid, 0)
@@ -50,8 +70,9 @@ class PolicyTreeWidget(Widget):
         )
         policy_tree = self.query_one("#policy_tree", Tree)
         policy_tree.root.set_label(f"Agents in Policies: ({total_leaves})")
-
         self._build_tree()
+        # Expand the root node
+        policy_tree.root.expand()
 
     def _precompute_leaf_counts(self):
         """Precompute leaf counts for each policy group."""
@@ -76,15 +97,21 @@ class PolicyTreeWidget(Widget):
 
     def _build_tree(self):
         policy_tree = self.query_one("#policy_tree", Tree)
+        policy_tree.clear()  # Clear existing nodes
         node_map = {}
 
         # Sort top-level policies
         top_policies = [
             p for p in self.policies if p.parent == "global-policy-settings"
         ]
+
+        # Sort by count (default) or alphabetically
+        if getattr(self, "match_type", "Count") == "Count":
             top_policies.sort(
                 key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
             )
+        else:  # Alphabetical
+            top_policies.sort(key=lambda p: p.name.lower())
 
         for policy in top_policies:
             label = f"{policy.name} ({self.leaf_counts.get(policy.groupid, 0)})"
@@ -98,9 +125,13 @@ class PolicyTreeWidget(Widget):
                 children_by_parent[policy.parent].append(policy)
 
         for parent_id, children in children_by_parent.items():
+            if getattr(self, "match_type", "Count") == "Count":
                 children.sort(
                     key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
                 )
+            else:  # Alphabetical
+                children.sort(key=lambda p: p.name.lower())
+
             parent_node = node_map.get(parent_id)
             if parent_node:
                 for policy in children:
@@ -108,11 +139,16 @@ class PolicyTreeWidget(Widget):
                     node = parent_node.add(label=label, data=policy)
                     node_map[policy.groupid] = node
 
-        # Add devices (leaf nodes)
+        # Add devices (leaf nodes) - always sort alphabetically
+        devices_by_group = defaultdict(list)
         for device in self.devices:
-            group_id = device.groupid
+            devices_by_group[device.groupid].append(device)
+
+        for group_id, devices in devices_by_group.items():
+            devices.sort(key=lambda d: d.hostname.lower())  # Always sort alphabetically
             parent_node = node_map.get(group_id)
             if parent_node:
+                for device in devices:
                     parent_node.add(label=device.hostname, data=device)
 
     def _collect_tree_nodes(self, node, all_nodes):
@@ -157,6 +193,13 @@ class PolicyTreeWidget(Widget):
 
         message.stop()
 
+    def on_switch_changed(self, event: Switch.Changed):
+        self.match_type = "Alpha" if event.value else "Count"
+        self.query_one("#match_switch_label", Static).update(
+            f"Sort: {self.match_type.capitalize()}"
+        )
+        self._build_tree()
+
     def on_input_submitted(self, message: Input.Submitted) -> None:
         self._remove_match_selector()
 

TUI/quietagentworkflowscreen.py

@@ -0,0 +1,848 @@
+#    Copyright (C) 2025 James Brotosky, Brandon Wickline
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as published
+#    by the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""
+Quiet Agent Workflow Screen Module
+
+Provides a TUI workflow for identifying quiet agents and moving them to target policies.
+This screen replaces the legacy quietAgent.py with a comprehensive TUI interface that:
+1. Allows selection of an initial policy to analyze
+2. Categorizes devices into "Enforce Ready" and "Non-Enforce Ready" based on activity
+3. Allows users to select target policies for each category
+4. Uses the API to move devices to their target policies
+"""
+
+import datetime
+import logging
+import os
+from typing import List, Optional
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.containers import Horizontal, Vertical
+from textual.reactive import reactive
+from textual.screen import Screen
+from textual.widgets import Button, DataTable, Footer, Header, Static
+
+from models.policy import Policy
+from services.API import AirlockAPIWrapper
+from services.policyhandler import getPolicyInfo
+from TUI.policyselector import PolicySelector
+from utils.configmanager import load_env
+
+logger = logging.getLogger(__name__)
+
+
+class QuietAgentWorkflowScreen(Screen):
+    """
+    A Textual screen for the Quiet Agent analysis and migration workflow.
+
+    This screen provides a multi-step workflow:
+    1. Select initial policy to analyze
+    2. View categorized agents (enforce ready vs. non-enforce ready)
+    3. Select target policies for each category
+    4. Execute agent migrations
+
+    Attributes:
+        api (AirlockAPIWrapper): API wrapper for Airlock operations
+        policies (List[Policy]): List of all available policies
+        selected_policy (Optional[Policy]): The initially selected policy to analyze
+        history_days (int): Number of days of history to pull (default: 150)
+        quiet_days (int): Number of days without execution to be considered quiet (default: 45)
+        agents_df (Optional[pd.DataFrame]): DataFrame of all agents with analysis results
+        enforce_ready_df (Optional[pd.DataFrame]): DataFrame of agents ready for enforcement
+        non_enforce_ready_df (Optional[pd.DataFrame]): DataFrame of agents not ready for enforcement
+        workflow_stage (str): Current stage of the workflow
+    """
+
+    BINDINGS = [
+        ("escape", "go_back", "Back"),
+    ]
+
+    workflow_stage = reactive("select_policy")  # Tracks current workflow stage
+
+    def __init__(self, api: AirlockAPIWrapper, policies: List[Policy]):
+        """
+        Initialize the QuietAgentWorkflowScreen.
+
+        Args:
+            api (AirlockAPIWrapper): API wrapper for Airlock operations
+            policies (List[Policy]): List of all available policies
+        """
+        super().__init__()
+        self.api = api
+        self.policies = policies
+        self.selected_policy: Optional[Policy] = None
+        self.history_days = 150  # Fixed as per requirements
+        self.quiet_days = 45  # Default value
+        self.agents_df: Optional[pd.DataFrame] = None
+        self.enforce_ready_df: Optional[pd.DataFrame] = None
+        self.non_enforce_ready_df: Optional[pd.DataFrame] = None
+        self.enforce_ready_target_policy: Optional[Policy] = None
+        self.non_enforce_ready_target_policy: Optional[Policy] = None
+
+    def compose(self) -> ComposeResult:
+        """Build the UI layout for the workflow screen."""
+        # Include Header and Footer like other standalone screens
+        yield Header(show_clock=True, icon="⚙")
+
+        # Title area
+        title = Static("🔒 Quiet Agent Workflow", id="workflow_title")
+        title.styles.margin = (0, 0, 0, 1)
+        yield title
+
+        # Status area
+        status = Static("Step 1: Select Policy to Analyze", id="workflow_status")
+        status.styles.margin = (0, 0, 1, 1)
+        yield status
+
+        # Content area - dynamically populated based on workflow stage
+        yield Vertical(id="content_area")
+
+        yield Footer()
+
+    def on_mount(self) -> None:
+        """Initialize the screen when mounted."""
+        # Show initial policy selection
+        self._show_policy_selection()
+
+    def watch_workflow_stage(self, old_value: str, new_value: str) -> None:
+        """React to workflow stage changes."""
+        logger.debug(f"Workflow stage changed from {old_value} to {new_value}")
+        self._update_status_message()
+
+    def _update_status_message(self) -> None:
+        """Update the status message based on current workflow stage."""
+        status_widget = self.query_one("#workflow_status", Static)
+
+        stage_messages = {
+            "select_policy": "Step 1: Select Policy to Analyze",
+            "select_quiet_days": "Step 2: Select Quiet Time Period",
+            "analyzing": "📊 Analyzing agent activity...",
+            "view_results": "Step 3: Review Categorized Agents",
+            "select_enforce_target": "Step 4: Select Target Policy for Enforce Ready Agents",
+            "select_non_enforce_target": "Step 5: Select Target Policy for Non-Enforce Ready Agents",
+            "confirm_migration": "Step 6: Confirm and Execute Migration",
+            "executing": "⏳ Executing agent migrations...",
+            "complete": "✅ Migration Complete",
+        }
+
+        status_widget.update(stage_messages.get(self.workflow_stage, "Unknown Stage"))
+
+    def _show_policy_selection(self) -> None:
+        """Show the initial policy selection screen."""
+        self.workflow_stage = "select_policy"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create policy selector widget
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+    def on_policy_selector_policy_selected(
+        self, message: PolicySelector.PolicySelected
+    ) -> None:
+        """Handle policy selection from PolicySelector widget."""
+        # Handle based on current workflow stage
+        if self.workflow_stage == "select_policy":
+            # Initial policy selection for analysis
+            self.selected_policy = message.policy
+            logger.info(f"Selected policy for analysis: {self.selected_policy.name}")
+            self._show_quiet_days_selection()
+        elif self.workflow_stage == "select_enforce_target":
+            # Target policy selection for enforce ready agents
+            self.enforce_ready_target_policy = message.policy
+            logger.info(
+                f"Selected target policy for enforce ready: {message.policy.name}"
+            )
+            self._show_non_enforce_target_selection()
+        elif self.workflow_stage == "select_non_enforce_target":
+            # Target policy selection for non-enforce ready agents
+            self.non_enforce_ready_target_policy = message.policy
+            logger.info(
+                f"Selected target policy for non-enforce ready: {message.policy.name}"
+            )
+            self._show_migration_confirmation()
+
+    def _show_quiet_days_selection(self) -> None:
+        """Show the quiet days selection screen."""
+        self.workflow_stage = "select_quiet_days"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create info text
+        info_widget = Static(
+            f"Policy Selected: {self.selected_policy.name}\n\n"
+            f"History Period: {self.history_days} days\n\n"
+            "Select quiet time period (days without untrusted execution):",
+            id="quiet_days_info",
+        )
+        info_widget.styles.margin = (0, 0, 2, 0)
+        content.mount(info_widget)
+
+        # Create button container and mount it first
+        button_container = Vertical(id="quiet_days_buttons")
+        button_container.styles.height = "auto"
+        content.mount(button_container)
+
+        # Now add buttons to the mounted container
+        for days in [15, 30, 45, 60]:
+            btn = Button(
+                f"{days} days {'(Default)' if days == 45 else ''}",
+                id=f"quiet_days_{days}",
+                classes="quiet_day_btn",
+            )
+            btn.styles.width = "100%"
+            btn.styles.margin = (0, 0, 1, 0)
+            button_container.mount(btn)
+
+        back_btn = Button("← Back", id="back_to_policy_selection")
+        back_btn.styles.width = "100%"
+        back_btn.styles.margin = (2, 0, 0, 0)
+        button_container.mount(back_btn)
+
+    def on_button_pressed(self, event: Button.Pressed) -> None:
+        """Handle button press events."""
+        button_id = event.button.id
+
+        # Quiet days selection buttons
+        if button_id and button_id.startswith("quiet_days_"):
+            days = int(button_id.split("_")[-1])
+            self.quiet_days = days
+            logger.info(f"Selected quiet days: {days}")
+            self._start_analysis()
+            return
+
+        # Navigation buttons
+        if button_id == "back_to_policy_selection":
+            self._show_policy_selection()
+            return
+
+        if button_id == "back_to_results":
+            self._show_results()
+            return
+
+        if button_id == "select_enforce_target_btn":
+            self._show_enforce_target_selection()
+            return
+
+        if button_id == "select_non_enforce_target_btn":
+            self._show_non_enforce_target_selection()
+            return
+
+        if button_id == "skip_enforce_target_btn":
+            # Skip enforce ready target selection
+            self.enforce_ready_target_policy = None
+            self._show_non_enforce_target_selection()
+            return
+
+        if button_id == "skip_non_enforce_target_btn":
+            # Skip non-enforce ready target selection
+            self.non_enforce_ready_target_policy = None
+            self._show_migration_confirmation()
+            return
+
+        if button_id == "confirm_migration_btn":
+            self._execute_migration()
+            return
+
+        if button_id == "cancel_migration_btn":
+            self._show_results()
+            return
+
+        if button_id == "export_results_btn":
+            self._export_results()
+            return
+
+        if button_id == "start_over_btn":
+            self._show_policy_selection()
+            return
+
+    def _start_analysis(self) -> None:
+        """Start the agent activity analysis."""
+        self.workflow_stage = "analyzing"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Show analyzing message with detailed steps
+        analyzing_msg = Static(
+            f"📊 Analyzing Agent Activity\n"
+            f"{'=' * 50}\n\n"
+            f"Policy: {self.selected_policy.name}\n"
+            f"History Period: {self.history_days} days\n"
+            f"Quiet Threshold: {self.quiet_days} days\n\n"
+            f"Progress:\n"
+            f"⏳ Step 1/4: Fetching agents from policy...\n"
+            f"⏱️  Step 2/4: Pulling execution history (this may take a moment)...\n"
+            f"⏱️  Step 3/4: Analyzing activity patterns...\n"
+            f"⏱️  Step 4/4: Categorizing agents...\n\n"
+            f"Please wait - this operation cannot be cancelled.",
+            id="analyzing_message",
+        )
+        analyzing_msg.styles.margin = (2, 1)
+        content.mount(analyzing_msg)
+
+        # Show notification
+        self.app.notify(
+            "Starting analysis - this may take several minutes for large policies",
+            severity="information",
+            timeout=5,
+        )
+
+        # Perform the analysis asynchronously
+        self.call_later(self._perform_analysis)
+
+    def _perform_analysis(self) -> None:
+        """Perform the actual agent activity analysis."""
+        try:
+            # Update status: Fetching agents
+            self._update_analysis_status("Step 1/4: Fetching agents from policy...")
+
+            # Get agents in the selected policy
+            agents = self.api.agents_find_by_group(self.selected_policy.groupid)
+
+            if agents.empty:
+                self.app.notify(
+                    f"No agents found in policy: {self.selected_policy.name}",
+                    severity="warning",
+                    timeout=5,
+                )
+                self._show_policy_selection()
+                return
+
+            agent_count = len(agents)
+            self.app.notify(
+                f"Found {agent_count} agents - fetching execution history...",
+                severity="information",
+                timeout=3,
+            )
+
+            # Update status: Pulling execution history
+            self._update_analysis_status(
+                f"Step 2/4: Pulling execution history for {agent_count} agents...\n"
+                f"(This may take several minutes - progress shown in terminal)"
+            )
+
+            # Get execution history (this shows progress bars in terminal via airlock_libs)
+            policy_exec_history = getPolicyInfo(
+                self.api, self.selected_policy, [1, 2, 6, 7], self.history_days
+            )
+
+            # Update status: Analyzing patterns
+            self._update_analysis_status("Step 3/4: Analyzing activity patterns...")
+            self.app.notify(
+                "History retrieved - analyzing patterns...",
+                severity="information",
+                timeout=2,
+            )
+
+            if policy_exec_history.empty:
+                logger.info(
+                    "No execution history found for the selected policy and time range."
+                )
+                # All agents are quiet (no executions)
+                agents["execution_count"] = 0
+                agents["days_since"] = None
+                agents["required_quiet"] = self.quiet_days
+                agents["enforce_ready"] = True
+            else:
+                # Convert datetime column
+                policy_exec_history["datetime"] = pd.to_datetime(
+                    policy_exec_history["datetime"],
+                    format="%Y-%m-%dT%H:%M:%SZ",
+                    utc=True,
+                )
+
+                # Calculate days ago
+                now = datetime.datetime.now(datetime.timezone.utc)
+                policy_exec_history["days_ago"] = policy_exec_history["datetime"].apply(
+                    lambda dt: (now - dt).days
+                )
+
+                # Count total executions per hostname
+                hostname_counts = policy_exec_history["hostname"].value_counts()
+                agents["execution_count"] = (
+                    agents["hostname"].map(hostname_counts).fillna(0).astype(int)
+                )
+
+                # Find most recent execution per hostname
+                most_recent_exec = policy_exec_history.sort_values(
+                    by="days_ago"
+                ).drop_duplicates(subset="hostname", keep="first")
+
+                # Map most recent execution age to agents
+                agents["days_since"] = agents["hostname"].map(
+                    most_recent_exec.set_index("hostname")["days_ago"]
+                )
+
+                # Check for enforcement readiness
+                agents["required_quiet"] = self.quiet_days
+                agents["enforce_ready"] = agents["days_since"].apply(
+                    lambda x: True if pd.isna(x) or x > self.quiet_days else False
+                )
+
+            # Update status: Categorizing
+            self._update_analysis_status("Step 4/4: Categorizing agents...")
+
+            # Sort agents
+            agents = agents.sort_values(
+                by=["execution_count", "hostname"], ascending=[True, True]
+            )
+
+            # Store the results
+            self.agents_df = agents
+
+            # Categorize agents into DataFrames
+            self.enforce_ready_df = agents[agents["enforce_ready"] == True].copy()
+            self.non_enforce_ready_df = agents[agents["enforce_ready"] == False].copy()
+
+            logger.info(
+                f"Analysis complete: {len(self.enforce_ready_df)} enforce ready, "
+                f"{len(self.non_enforce_ready_df)} non-enforce ready"
+            )
+
+            self.app.notify(
+                f"Analysis complete! Found {len(self.enforce_ready_df)} enforce ready, "
+                f"{len(self.non_enforce_ready_df)} not ready",
+                severity="success",
+                timeout=5,
+            )
+
+            # Show results
+            self._show_results()
+
+        except Exception as e:
+            logger.error(f"Error during analysis: {e}", exc_info=True)
+            self.app.notify(f"Analysis failed: {str(e)}", severity="error", timeout=5)
+            self._show_policy_selection()
+
+    def _update_analysis_status(self, status_text: str) -> None:
+        """Update the analysis status message."""
+        try:
+            analyzing_msg = self.query_one("#analyzing_message", Static)
+
+            # Build updated message
+            updated_text = (
+                f"📊 Analyzing Agent Activity\n"
+                f"{'=' * 50}\n\n"
+                f"Policy: {self.selected_policy.name}\n"
+                f"History Period: {self.history_days} days\n"
+                f"Quiet Threshold: {self.quiet_days} days\n\n"
+                f"Progress:\n"
+                f"✅ {status_text}\n\n"
+                f"Please wait - this operation cannot be cancelled."
+            )
+
+            analyzing_msg.update(updated_text)
+        except Exception as e:
+            logger.debug(f"Could not update analysis status: {e}")
+
+    def _show_results(self) -> None:
+        """Show the categorized results."""
+        self.workflow_stage = "view_results"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create results display container and mount it first
+        results_container = Vertical(id="results_container")
+        results_container.styles.height = "auto"
+        results_container.styles.margin = (1, 1)
+        content.mount(results_container)
+
+        # Summary statistics
+        total_agents = len(self.enforce_ready_df) + len(self.non_enforce_ready_df)
+        ready_count = len(self.enforce_ready_df)
+        not_ready_count = len(self.non_enforce_ready_df)
+        ready_percentage = (ready_count / total_agents * 100) if total_agents > 0 else 0
+
+        summary = Static(
+            f"Analysis Results for: {self.selected_policy.name}\n\n"
+            f"📊 Total Agents: {total_agents}\n"
+            f"✅ Enforce Ready: {ready_count} ({ready_percentage:.1f}%)\n"
+            f"❌ Not Ready: {not_ready_count} ({100 - ready_percentage:.1f}%)\n\n"
+            f"Quiet Threshold: {self.quiet_days} days\n"
+            f"History Period: {self.history_days} days",
+            id="results_summary",
+        )
+        summary.styles.margin = (0, 0, 2, 0)
+        results_container.mount(summary)
+
+        # Action buttons
+        button_container = Horizontal(id="results_buttons")
+        button_container.styles.height = "auto"
+        results_container.mount(button_container)
+
+        if ready_count > 0:
+            enforce_btn = Button(
+                f"Select Target for Enforce Ready ({ready_count})",
+                id="select_enforce_target_btn",
+            )
+            enforce_btn.styles.margin = (0, 1, 1, 0)
+            button_container.mount(enforce_btn)
+
+        if not_ready_count > 0:
+            non_enforce_btn = Button(
+                f"Select Target for Non-Enforce Ready ({not_ready_count})",
+                id="select_non_enforce_target_btn",
+            )
+            non_enforce_btn.styles.margin = (0, 1, 1, 0)
+            button_container.mount(non_enforce_btn)
+
+        export_btn = Button("💾 Export Results", id="export_results_btn")
+        export_btn.styles.margin = (0, 1, 1, 0)
+        button_container.mount(export_btn)
+
+        start_over_btn = Button("🔄 Start Over", id="start_over_btn")
+        start_over_btn.styles.margin = (0, 0, 1, 0)
+        button_container.mount(start_over_btn)
+
+        # Tables showing agents
+        tables_container = Horizontal()
+        tables_container.styles.height = "1fr"
+        results_container.mount(tables_container)
+
+        # Enforce Ready table
+        if ready_count > 0:
+            enforce_col = Vertical()
+            enforce_col.styles.width = "1fr"
+            enforce_col.styles.margin = (1, 1, 0, 0)
+            tables_container.mount(enforce_col)
+
+            enforce_label = Static("✅ Enforce Ready Agents")
+            enforce_label.styles.margin = (0, 0, 1, 0)
+            enforce_col.mount(enforce_label)
+
+            enforce_table = DataTable(id="enforce_ready_table")
+            enforce_table.styles.height = "1fr"
+            enforce_table.add_columns("Hostname", "Last Exec (days)")
+
+            # Display first 50 agents
+            for idx, row in self.enforce_ready_df.head(50).iterrows():
+                days_since = row["days_since"]
+                days_str = f"{int(days_since)}" if not pd.isna(days_since) else "Never"
+                enforce_table.add_row(row["hostname"], days_str)
+
+            if len(self.enforce_ready_df) > 50:
+                enforce_table.add_row(
+                    f"... and {len(self.enforce_ready_df) - 50} more", ""
+                )
+
+            enforce_col.mount(enforce_table)
+
+        # Non-Enforce Ready table
+        if not_ready_count > 0:
+            non_enforce_col = Vertical()
+            non_enforce_col.styles.width = "1fr"
+            non_enforce_col.styles.margin = (1, 0, 0, 1)
+            tables_container.mount(non_enforce_col)
+
+            non_enforce_label = Static("❌ Non-Enforce Ready Agents")
+            non_enforce_label.styles.margin = (0, 0, 1, 0)
+            non_enforce_col.mount(non_enforce_label)
+
+            non_enforce_table = DataTable(id="non_enforce_ready_table")
+            non_enforce_table.styles.height = "1fr"
+            non_enforce_table.add_columns("Hostname", "Last Exec (days)")
+
+            # Display first 50 agents
+            for idx, row in self.non_enforce_ready_df.head(50).iterrows():
+                days_since = row["days_since"]
+                days_str = f"{int(days_since)}" if not pd.isna(days_since) else "N/A"
+                non_enforce_table.add_row(row["hostname"], days_str)
+
+            if len(self.non_enforce_ready_df) > 50:
+                non_enforce_table.add_row(
+                    f"... and {len(self.non_enforce_ready_df) - 50} more", ""
+                )
+
+            non_enforce_col.mount(non_enforce_table)
+
+    def _show_enforce_target_selection(self) -> None:
+        """Show policy selection for enforce ready agents."""
+        self.workflow_stage = "select_enforce_target"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Info message
+        info = Static(
+            f"Select target policy for {len(self.enforce_ready_df)} Enforce Ready agents\n"
+            f"Source Policy: {self.selected_policy.name}",
+            id="enforce_target_info",
+        )
+        info.styles.margin = (0, 0, 2, 0)
+        content.mount(info)
+
+        # Policy selector
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+        # Skip button
+        skip_btn = Button("⭕️ Skip - No Migration", id="skip_enforce_target_btn")
+        skip_btn.styles.width = "50%"
+        skip_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(skip_btn)
+
+    def _show_non_enforce_target_selection(self) -> None:
+        """Show policy selection for non-enforce ready agents."""
+        self.workflow_stage = "select_non_enforce_target"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Info message
+        info = Static(
+            f"Select target policy for {len(self.non_enforce_ready_df)} Non-Enforce Ready agents\n"
+            f"Source Policy: {self.selected_policy.name}",
+            id="non_enforce_target_info",
+        )
+        info.styles.margin = (0, 0, 2, 0)
+        content.mount(info)
+
+        # Policy selector
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+        # Skip button
+        skip_btn = Button("⭕️ Skip - No Migration", id="skip_non_enforce_target_btn")
+        skip_btn.styles.width = "50%"
+        skip_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(skip_btn)
+
+    def _show_migration_confirmation(self) -> None:
+        """Show migration confirmation screen."""
+        self.workflow_stage = "confirm_migration"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Build confirmation message
+        confirmation_lines = [
+            "🔐 Migration Summary\n",
+            f"Source Policy: {self.selected_policy.name}\n",
+        ]
+
+        if self.enforce_ready_target_policy:
+            confirmation_lines.append(
+                f"\n✅ Enforce Ready Migration:\n"
+                f"  • Agents: {len(self.enforce_ready_df)}\n"
+                f"  • Target: {self.enforce_ready_target_policy.name}\n"
+            )
+
+        if self.non_enforce_ready_target_policy:
+            confirmation_lines.append(
+                f"\n❌ Non-Enforce Ready Migration:\n"
+                f"  • Agents: {len(self.non_enforce_ready_df)}\n"
+                f"  • Target: {self.non_enforce_ready_target_policy.name}\n"
+            )
+
+        if (
+            not self.enforce_ready_target_policy
+            and not self.non_enforce_ready_target_policy
+        ):
+            confirmation_lines.append("\n⚠️ No migrations will be performed.")
+
+        confirmation = Static("".join(confirmation_lines), id="migration_confirmation")
+        confirmation.styles.margin = (1, 1, 2, 1)
+        content.mount(confirmation)
+
+        # Action buttons - mount container first, then add buttons
+        button_container = Horizontal(id="confirmation_buttons")
+        button_container.styles.height = "auto"
+        button_container.styles.margin = (1, 1)
+        content.mount(button_container)
+
+        if self.enforce_ready_target_policy or self.non_enforce_ready_target_policy:
+            confirm_btn = Button("✅ Confirm Migration", id="confirm_migration_btn")
+            confirm_btn.styles.margin = (0, 1, 0, 0)
+            button_container.mount(confirm_btn)
+
+        cancel_btn = Button("❌ Cancel", id="cancel_migration_btn")
+        button_container.mount(cancel_btn)
+
+    def _execute_migration(self) -> None:
+        """Execute the agent migrations."""
+        self.workflow_stage = "executing"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Show executing message
+        executing_msg = Static(
+            "⏳ Executing agent migrations...\nPlease wait...",
+            id="executing_message",
+        )
+        executing_msg.styles.margin = (2, 1)
+        content.mount(executing_msg)
+
+        # Perform migrations asynchronously
+        self.call_later(self._perform_migrations)
+
+    def _perform_migrations(self) -> None:
+        """Perform the actual agent migrations."""
+        successful_migrations = []
+        failed_migrations = []
+
+        try:
+            # Migrate enforce ready agents
+            if self.enforce_ready_target_policy:
+                for idx, row in self.enforce_ready_df.iterrows():
+                    try:
+                        result = self.api.agent_move(
+                            row["agentid"], self.enforce_ready_target_policy.groupid
+                        )
+                        successful_migrations.append(
+                            (row["hostname"], self.enforce_ready_target_policy.name)
+                        )
+                        logger.debug(
+                            f"Moved {row['hostname']} to {self.enforce_ready_target_policy.name}"
+                        )
+                    except Exception as e:
+                        failed_migrations.append((row["hostname"], str(e)))
+                        logger.error(f"Failed to move {row['hostname']}: {e}")
+
+            # Migrate non-enforce ready agents
+            if self.non_enforce_ready_target_policy:
+                for idx, row in self.non_enforce_ready_df.iterrows():
+                    try:
+                        result = self.api.agent_move(
+                            row["agentid"], self.non_enforce_ready_target_policy.groupid
+                        )
+                        successful_migrations.append(
+                            (row["hostname"], self.non_enforce_ready_target_policy.name)
+                        )
+                        logger.debug(
+                            f"Moved {row['hostname']} to {self.non_enforce_ready_target_policy.name}"
+                        )
+                    except Exception as e:
+                        failed_migrations.append((row["hostname"], str(e)))
+                        logger.error(f"Failed to move {row['hostname']}: {e}")
+
+            # Show completion results
+            self._show_completion_results(successful_migrations, failed_migrations)
+
+        except Exception as e:
+            logger.error(f"Error during migration execution: {e}", exc_info=True)
+            self.app.notify(f"Migration failed: {str(e)}", severity="error", timeout=5)
+            self._show_results()
+
+    def _show_completion_results(
+        self, successful: List[tuple], failed: List[tuple]
+    ) -> None:
+        """Show migration completion results."""
+        self.workflow_stage = "complete"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Results summary
+        total_attempted = len(successful) + len(failed)
+        success_rate = (
+            (len(successful) / total_attempted * 100) if total_attempted > 0 else 0
+        )
+
+        results = Static(
+            f"✅ Migration Complete\n\n"
+            f"Total Agents Migrated: {len(successful)}\n"
+            f"Failed Migrations: {len(failed)}\n"
+            f"Success Rate: {success_rate:.1f}%",
+            id="completion_summary",
+        )
+        results.styles.margin = (1, 1, 2, 1)
+        content.mount(results)
+
+        # Details tables
+        if successful:
+            success_container = Vertical()
+            success_container.styles.margin = (0, 1)
+            content.mount(success_container)
+
+            success_label = Static("✅ Successful Migrations")
+            success_label.styles.margin = (0, 0, 1, 0)
+            success_container.mount(success_label)
+
+            success_table = DataTable(id="success_table")
+            success_table.styles.height = "auto"
+            success_table.add_columns("Hostname", "Target Policy")
+
+            for hostname, target_policy in successful[:25]:  # Show first 25
+                success_table.add_row(hostname, target_policy)
+
+            if len(successful) > 25:
+                success_table.add_row(f"... and {len(successful) - 25} more", "")
+
+            success_container.mount(success_table)
+
+        if failed:
+            failed_container = Vertical()
+            failed_container.styles.margin = (2, 1, 0, 1)
+            content.mount(failed_container)
+
+            failed_label = Static("❌ Failed Migrations")
+            failed_label.styles.margin = (0, 0, 1, 0)
+            failed_container.mount(failed_label)
+
+            failed_table = DataTable(id="failed_table")
+            failed_table.styles.height = "auto"
+            failed_table.add_columns("Hostname", "Error")
+
+            for hostname, error in failed[:25]:  # Show first 25
+                failed_table.add_row(hostname, error[:50])  # Truncate error
+
+            if len(failed) > 25:
+                failed_table.add_row(f"... and {len(failed) - 25} more", "")
+
+            failed_container.mount(failed_table)
+
+        # Action button
+        done_btn = Button("✔ Done", id="start_over_btn")
+        done_btn.styles.width = "50%"
+        done_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(done_btn)
+
+    def _export_results(self) -> None:
+        """Export analysis results to CSV."""
+        try:
+            working_dir = load_env("WORKING_DIR") or os.getcwd()
+            filename = os.path.join(
+                working_dir,
+                f"{self.selected_policy.name}_quiet_analysis_{datetime.datetime.now().strftime('%Y%m%d_%H%M%S')}.csv",
+            )
+
+            self.agents_df.to_csv(filename, index=False)
+            logger.info(f"Exported results to {filename}")
+            self.app.notify(
+                f"Results exported to:\n{filename}",
+                severity="information",
+                timeout=5,
+            )
+
+        except Exception as e:
+            logger.error(f"Failed to export results: {e}")
+            self.app.notify(f"Export failed: {str(e)}", severity="error", timeout=5)
+
+    def action_go_back(self) -> None:
+        """Handle back/escape action."""
+        # Depending on stage, go back to previous stage or exit
+        if self.workflow_stage in ["select_policy", "view_results", "complete"]:
+            self.app.pop_screen()
+        elif self.workflow_stage == "select_quiet_days":
+            self._show_policy_selection()
+        elif self.workflow_stage == "select_enforce_target":
+            self._show_results()
+        elif self.workflow_stage == "select_non_enforce_target":
+            if self.enforce_ready_target_policy:
+                self._show_enforce_target_selection()
+            else:
+                self._show_results()
+        elif self.workflow_stage == "confirm_migration":
+            self._show_non_enforce_target_selection()
+        else:
+            self.app.pop_screen()

TUI/theme_amber_terminal.py

@@ -12,7 +12,7 @@ def get_amber_terminal_theme():
         success=Color.parse("#ffb733"),
         warning=Color.parse("#ffff66"),
         error=Color.parse("#ff3300"),
-        surface=Color.parse("#3a1f00"),  # brighter brown for blending
+        surface=Color.parse("#49331a"),  # brighter brown for blending
     )
 
 

airlock_libs/.gitignore

@@ -1,3 +1,4 @@
 /target
 build.sh
 pythontest.py
+changelog.md

airlock_libs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "airlock_libs"
-version = "2.0.0"
+version = "4.0.1"
 edition = "2024"
 
 [lib]
@@ -10,12 +10,20 @@ crate-type = ["cdylib"]
 chrono = "0.4.42"
 indicatif = "0.18.2"
 mongodb = "3.3.0"
+opentelemetry = { version = "0.18.0", features = ["rt-tokio", "metrics", "trace"] }
+opentelemetry-otlp = { version = "0.11.0", features = ["trace", "metrics"] }
+opentelemetry-semantic-conventions = { version = "0.10.0" }
+opentelemetry-proto = { version = "0.1.0"}
 pyo3 = { version = "0.27.0", features = ["extension-module", "generate-import-lib"] }
 reqwest = { version = "0.12.24", features = ["json", "native-tls"] }
 serde = "1.0.228"
 serde-pyobject = "0.8.0"
 serde_json = "1.0.145"
 tokio = { version = "1.48.0", features = ["full"] }
+tonic = { version = "0.8.2", features = ["tls-roots"] }
+tracing = "0.1.41"
+tracing-subscriber = "0.3.20"
+tracing-opentelemetry = "0.32.0"
 
 [package.metadata.maturin]
 generate-abi-stubs = true

airlock_libs/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "airlock_libs"
-version = "2.0.0"
+version = "4.0.1"
 description = "Airlock Digital API Wrapper"
 readme = "README.md"
 license = { text = "AGPL-3.0-only" }

airlock_libs/src/services.rs

@@ -1,6 +1,13 @@
 use chrono::{Duration, Local, NaiveDate};
 use indicatif::{MultiProgress, ProgressBar, ProgressDrawTarget, ProgressStyle};
 use mongodb::bson::oid::ObjectId;
+use opentelemetry::global::shutdown_tracer_provider;
+use opentelemetry::sdk::Resource;
+use opentelemetry::trace::noop::NoopTracerProvider;
+use opentelemetry::trace::{Status, TraceContextExt, TraceError};
+use opentelemetry::{Context, KeyValue, sdk::trace as sdktrace, trace::Tracer};
+use opentelemetry::{Key, global};
+use opentelemetry_otlp::WithExportConfig;
 use pyo3::{prelude::*, types::PyString};
 use reqwest::{
     Client,
@@ -18,6 +25,34 @@ use std::{
     str::FromStr,
 };
 
+#[allow(non_snake_case)]
+#[derive(Deserialize, Debug)]
+struct TelemetryConfig {
+    TELEMETRY: bool,
+    TELEM_URL: Option<String>,
+}
+
+impl TelemetryConfig {
+    pub fn load() -> Self {
+        let cfg_path = get_base_directory().join("config\\user_config.json");
+        if !cfg_path.exists() {
+            return Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            };
+        }
+        match fs::read_to_string(&cfg_path) {
+            Ok(contents) => serde_json::from_str::<Self>(&contents).unwrap_or(Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            }),
+            Err(_) => Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            },
+        }
+    }
+}
 #[derive(Debug, Deserialize, Serialize)]
 struct ApiResponse {
     error: String,
@@ -61,19 +96,37 @@ pub fn pull_policy_exec_histories(
     exec_types: String,
     days: i64,
 ) -> Py<PyString> {
+    let rt = tokio::runtime::Runtime::new().unwrap();
+    rt.block_on(async {
+        let _ = init_tracer();
+    });
+    let tracer = global::tracer("global_tracer");
+    let _cx = Context::new();
     let file_path: PathBuf = format!(
         "{}\\cache\\chunkinator.json",
         get_base_directory().display()
     )
     .into();
     let writeable_filepath = file_path.clone();
-    if !file_path.exists() {
+    if !&file_path.exists() {
-        if let Some(parent_dir) = file_path.parent()
+        if let Some(parent_dir) = &file_path.parent()
             && !parent_dir.exists()
         {
-            fs::create_dir_all(parent_dir).unwrap();
+            match fs::create_dir_all(parent_dir) {
+                Ok(_) => {}
+                Err(e) => {
+                    println!("Failed to Create Directory {:?}: {}", parent_dir, e);
+                    std::process::abort();
+                }
+            }
+        }
+        match fs::File::create(&file_path) {
+            Ok(_) => {}
+            Err(e) => {
+                println!("Failed to Create Directory {:?}: {}", &file_path, e);
+                std::process::abort();
+            }
         }
-        fs::File::create(file_path).unwrap();
     }
     let data = ApiResponse {
         error: "Success".to_string(),
@@ -93,13 +146,57 @@ pub fn pull_policy_exec_histories(
             .unwrap(),
     );
     progress_bar.enable_steady_tick(std::time::Duration::from_millis(100));
-    let client = build_client(py, &py_self);
+    let client = tracer.in_span("Building HTTP Client", |cx| {
+        let client_result = build_client(py, &py_self);
+        match client_result {
+            Ok(client_result) => {
+                cx.span().add_event(
+                    "info",
+                    vec![KeyValue::new(
+                        "Client Built Successfully",
+                        format!("{:?}", client_result),
+                    )],
+                );
+                client_result
+            }
+            Err(client_result) => {
+                cx.span().add_event(
+                    "warn",
+                    vec![KeyValue::new(
+                        "Client Failed to Build",
+                        format!("{:?}", &client_result),
+                    )],
+                );
+                cx.span()
+                    .set_status(Status::error("Client Failed to Build"));
+                println!("Failed to Build Client: {:?}", client_result);
+                std::process::abort();
+            }
+        }
+    });
     let api: Py<PyAny> = py_self;
     let cutoff = Local::now().naive_local() - Duration::days(days);
-    let mut f = File::open(&writeable_filepath).unwrap();
+    let mut f = match File::open(&writeable_filepath) {
+        Ok(f) => f,
+        Err(e) => {
+            println!("Failed to Access {:?}: {}", &writeable_filepath, e);
+            std::process::abort();
+        }
+    };
+    tracer.in_span("Airlock Data Retreival", |cx| {
+        let span = cx.span();
+        span.set_attribute(Key::new("Days").string(days.to_string().to_string()));
+        span.set_attribute(KeyValue::new("Policy Name", policy_names.clone()));
         loop {
-        f.seek(SeekFrom::Start(0)).unwrap();
+            match f.seek(SeekFrom::Start(0)) {
-        let execution_histories = history_logging(
+                Ok(_) => {}
+                Err(e) => {
+                    println!("Failed to seek start of {:?}: {}", f, e);
+                    std::process::abort();
+                }
+            }
+            let execution_histories = tracer.in_span(checkpoint_number.to_string(), |cx| {
+                let results: ApiResponse = history_logging(
                     py,
                     &api,
                     &exec_types,
@@ -107,11 +204,18 @@ pub fn pull_policy_exec_histories(
                     &policy_names,
                     &client,
                 );
+                cx.span().set_attribute(KeyValue::new(
+                    "items_in_response",
+                    results.response.exechistories.len().to_string(),
+                ));
+                results
+            });
             let parsed_responses = execution_histories.response.exechistories;
             if parsed_responses.is_empty() {
                 break;
             }
-        let mut seen: HashMap<(String, String, String), Group> = if writeable_filepath.exists() {
+            let mut seen: HashMap<(String, String, String), Group> = if writeable_filepath.exists()
+            {
                 let mut contents = String::new();
                 f.read_to_string(&mut contents).unwrap();
                 let existing_data: ApiResponse =
@@ -183,12 +287,14 @@ pub fn pull_policy_exec_histories(
                 progress_bar.set_message("Total Percent Complete");
             }
         }
+    });
     progress_bar.finish_with_message("All Checkpoints Complete");
     let return_data = fs::read_to_string(&writeable_filepath).unwrap();
+    shutdown_tracer_provider();
     PyString::new(py, &return_data).into()
 }
 
-fn build_client(py: Python<'_>, py_self: &Py<PyAny>) -> Client {
+fn build_client(py: Python<'_>, py_self: &Py<PyAny>) -> Result<reqwest::Client, reqwest::Error> {
     let headers = py_self.getattr(py, "headers").unwrap().to_string();
     let headers_replace = headers.replace('\'', "\"");
     let parsed: Value = serde_json::from_str(headers_replace.as_str()).unwrap();
@@ -207,7 +313,6 @@ fn build_client(py: Python<'_>, py_self: &Py<PyAny>) -> Client {
         .default_headers(header_map)
         .timeout(std::time::Duration::from_secs(300))
         .build()
-        .unwrap()
 }
 
 #[tokio::main]
@@ -276,3 +381,26 @@ fn skipback(days: i64) -> ObjectId {
     let objectid_hex = format!("{}0000000000000000", hex_timestamp);
     ObjectId::parse_str(&objectid_hex).expect("Invalid ObjectId hex")
 }
+
+fn init_tracer() -> Result<Option<sdktrace::Tracer>, TraceError> {
+    let cfg = TelemetryConfig::load();
+    if !cfg.TELEMETRY {
+        global::set_tracer_provider(NoopTracerProvider::new());
+        return Ok(None);
+    }
+    let endpoint = cfg.TELEM_URL.unwrap_or_default();
+    let tracer =
+        opentelemetry_otlp::new_pipeline()
+            .tracing()
+            .with_exporter(
+                opentelemetry_otlp::new_exporter()
+                    .tonic()
+                    .with_endpoint(endpoint),
+            )
+            .with_trace_config(sdktrace::config().with_resource(Resource::new(vec![
+                KeyValue::new("service.name", "LoxideLibs"),
+            ])))
+            .install_simple()
+            .unwrap();
+    Ok(Some(tracer))
+}

default_system_config.json

@@ -1,14 +1,39 @@
 {
-  "APPNAME": "AirlockTools",
+  "APPNAME": "Loxide",
   "URL": "https://server:3129",
   "LOG_LEVEL": "INFO",
-  "BAD_PATH_PARTS": ["users","wwwroot","windows\\temp","windows\\task","windows\\system32","startup", "windows\\fonts","Recycle.Bin","AppData","programdata", "Solarwinds","kaseya"],
+  "BAD_PATH_PARTS": [
-  "BAD_PUBLISHERS": ["Brave", "Zoom", "GlavSoft", "VNC"],
+    "users",
-  "PUPS":["logmein","invalid","nmap","LTSvc","VNC","Kaseya","Solarwinds","mRemoteNG"],
+    "wwwroot",
+    "windows\\temp",
+    "windows\\task",
+    "windows\\system32",
+    "startup",
+    "windows\\fonts",
+    "Recycle.Bin",
+    "AppData",
+    "programdata",
+    "Solarwinds",
+    "kaseya"
+  ],
+  "BAD_PUBLISHERS": [
+    "Brave",
+    "Zoom",
+    "GlavSoft",
+    "VNC"
+  ],
+  "PUPS": [
+    "logmein",
+    "invalid",
+    "nmap",
+    "LTSvc",
+    "VNC",
+    "Kaseya",
+    "Solarwinds",
+    "mRemoteNG"
+  ],
   "PATH_EXCLUSION_CONST": 4,
   "MIN_FILES_FOR_PATH": 4,
   "VT_THREAT_TOLERANCE": 4,
-  "POLICY_MAP_ENF_AUD": {
+  "POLICY_MAP_ENF_AUD": {}
- 
-    }
 }

flows/localApproval.py

@@ -10,7 +10,7 @@ from typing import List, Optional
 from models.agent import Agent
 from services.agenthandler import moveAgentToRelatedPolicy, selectAgents
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json
+from utils.configmanager import get_system_json
 from utils.utils import colorText, get_sanitized_input
 
 logger = logging.getLogger(__name__)
@@ -28,7 +28,7 @@ class LocalApprovalRequestor:
             username: Username creating the approvals (for tracking)
         """
         self.api = api
-        self.policy_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+        self.policy_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
         self.username = (
             username or os.getenv("USERNAME") or os.getenv("USER") or "unknown"
         )
@@ -51,7 +51,7 @@ class LocalApprovalRequestor:
             batch_id = int(time.time())
 
         purpose = (
-            f"🎫 Local Approval 🎫 - {duration_minutes} mins - "
+            f"🎫 Local Approval 🎫 - {duration_minutes} mins - "
             f"batch:{batch_id} Client:{agent_id} User:{self.username}"
         )
 
@@ -103,10 +103,10 @@ class LocalApprovalRequestor:
         success_count = 0
         failure_count = 0
 
-        print(colorText(f"\n📦 Processing batch {batch_id}...", "cyan"))
+        print(colorText(f"\n📦 Processing batch {batch_id}...", "cyan"))
-        print(colorText(f"👤 Requested by: {self.username}", "cyan"))
+        print(colorText(f"👤 Requested by: {self.username}", "cyan"))
         print(
-            colorText(f"📊 Moving {len(agents)} agent(s) to local approval\n", "cyan")
+            colorText(f"📊 Moving {len(agents)} agent(s) to local approval\n", "cyan")
         )
 
         for agent in agents:
@@ -125,11 +125,11 @@ class LocalApprovalRequestor:
                 if not move_success:
                     raise Exception("Failed to move to audit policy")
 
-                print(colorText(f"✓ {agent.hostname}", "green"))
+                print(colorText(f"✓ {agent.hostname}", "green"))
                 success_count += 1
 
             except Exception as e:
-                print(colorText(f"✗ {agent.hostname}: {e}", "red"))
+                print(colorText(f"✗ {agent.hostname}: {e}", "red"))
                 logger.error(f"Error processing agent {agent.hostname}: {e}")
                 failure_count += 1
 
@@ -152,7 +152,7 @@ class LocalApprovalRequestor:
         ]
 
         # Display duration options
-        print(colorText("\n⏱️  Select Local Approval Duration:", "white"))
+        print(colorText("\n⏱️  Select Local Approval Duration:", "white"))
         print(colorText("=" * 50, "white"))
 
         for i, (minutes, label) in enumerate(duration_options, start=1):
@@ -166,36 +166,36 @@ class LocalApprovalRequestor:
 
             if 1 <= choice <= len(duration_options):
                 duration_minutes, duration_label = duration_options[choice - 1]
-                print(colorText(f"✓ Selected: {duration_label}", "green"))
+                print(colorText(f"✓ Selected: {duration_label}", "green"))
                 logger.info(f"User selected duration: {duration_minutes} minutes")
             else:
-                print(colorText("❌ Invalid choice.", "red"))
+                print(colorText("❌ Invalid choice.", "red"))
                 logger.warning("Invalid duration choice")
                 return
 
         except ValueError:
-            print(colorText("❌ Invalid input. Please enter a number.", "red"))
+            print(colorText("❌ Invalid input. Please enter a number.", "red"))
             logger.warning("Invalid input for duration selection")
             return
 
         # Select agents
-        print(colorText("\n🎯 Select Agents for Local Approval:", "white"))
+        print(colorText("\n🎯 Select Agents for Local Approval:", "white"))
         agents = selectAgents(self.api)
 
         if not agents:
-            print(colorText("❌ No agents found or error retrieving agents.", "red"))
+            print(colorText("❌ No agents found or error retrieving agents.", "red"))
             logger.warning("No agents selected or error retrieving agents")
             return
 
         # Confirm with user
-        print(colorText("\n📋 Summary:", "cyan"))
+        print(colorText("\n📋 Summary:", "cyan"))
         print(colorText(f"  Duration: {duration_label}", "white"))
         print(colorText(f"  Agents: {len(agents)}", "white"))
 
         confirm = get_sanitized_input("\nProceed? (y/n): ").lower()
 
         if confirm != "y":
-            print(colorText("❌ Operation cancelled.", "yellow"))
+            print(colorText("❌ Operation cancelled.", "yellow"))
             return
 
         # Process the batch
@@ -219,24 +219,25 @@ class LocalApprovalRequestor:
             failure_count: Number of failed operations
         """
         print(colorText(f"\n{'=' * 60}", "white"))
-        print(colorText("📊 Local Approval Summary", "cyan"))
+        print(colorText("📊 Local Approval Summary", "cyan"))
         print(colorText("=" * 60, "white"))
 
-        print(colorText(f"✓ Successfully processed: {success_count}", "green"))
+        print(colorText(f"✓ Successfully processed: {success_count}", "green"))
 
         if failure_count > 0:
-            print(colorText(f"✗ Failed: {failure_count}", "red"))
+            print(colorText(f"✗ Failed: {failure_count}", "red"))
 
-        print(colorText(f"\n📦 Batch ID: {batch_id}", "cyan"))
+        print(colorText(f"\n📦 Batch ID: {batch_id}", "cyan"))
-        print(colorText(f"⏱️  Duration: {duration_label}", "cyan"))
+        print(colorText(f"⏱️  Duration: {duration_label}", "cyan"))
 
         print(colorText("=" * 60, "white"))
-        print(colorText("\n💡 Next Steps:", "yellow"))
+        print(colorText("\n💡 Next Steps:", "yellow"))
-        print(colorText("  • Agents have been moved to audit policies", "white"))
+        print(colorText("  • Agents have been moved to audit policies", "white"))
-        print(colorText("  • Local approvals are active", "white"))
+        print(colorText("  • Local approvals are active", "white"))
         print(
             colorText(
-                f"  • Agents will return to enforcement after {duration_label}", "white"
+                f"  • Agents will return to enforcement after {duration_label}",
+                "white",
             )
         )
         print(colorText("=" * 60 + "\n", "white"))

flows/otp.py

@@ -14,136 +14,18 @@
 #    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 
-from datetime import datetime
 import logging
-import os
 
 import pandas as pd
 
 from services.agenthandler import selectAgents
 from services.API import AirlockAPIWrapper
-from utils.configmanager import load_env
 from utils.selector import Selector
-from utils.utils import colorText, get_sanitized_input
+from utils.utils import get_sanitized_input
 
 logger = logging.getLogger(__name__)
 
 
-def otp_generate(api: AirlockAPIWrapper):
-    otp_dict = {}
-    agents = selectAgents(api)
-    print(colorText("Would you like to continue with these devices?", "white"))
-    for agent in agents:
-        print(agent.hostname)
-    confirm = Selector.confirm()
-    if agents and confirm:
-        requester = get_sanitized_input("Who is requesting the OTP:  ")
-        because = get_sanitized_input("Why/What work are they doing?:  ")
-
-        purpose = f"Requester: {requester} - for : {because}"
-        possible_durations = [15, 60, 360, 1440, 10080]
-
-        print(colorText("Please select a duration in minutes:  ", "white"))
-        print(
-            colorText(
-                "15 mins, 60 mins, 360 mins(6 Hours), 1440 mins (24 Hours), 10080 mins (7 Days):",
-                "white",
-            )
-        )
-        duration_selected = Selector.select_int(possible_durations)
-
-        if isinstance(duration_selected, list):
-            duration_selected = duration_selected[0] if duration_selected else None
-
-        if duration_selected is not None:
-            for agent in agents:
-                logging.info(f"Querying API for {agent.hostname}")
-                otp_code = api.otp_generate(agent.agentid, duration_selected, purpose)
-                logger.debug(f"Generated OTP for {agent.hostname}: {otp_code}")
-                otp_dict[agent.hostname] = otp_code
-
-    print(colorText("Requested Codes:", "green"))
-    for key, value in otp_dict.items():
-        print(colorText(f"{key} | {value}", "green"))
-
-
-def otp_activities_by_agent(api: AirlockAPIWrapper):
-    activeagents = api.otp_find_active()
-    awaitingagents = api.otp_find_awaiting()
-    enforcedagents = api.otp_find_enforced()
-    revokedagents = api.otp_find_revoked()
-
-    # Add a 'status' column to each DataFrame
-    activeagents["status"] = "active"
-    awaitingagents["status"] = "awaiting"
-    enforcedagents["status"] = "enforced"
-    revokedagents["status"] = "revoked"
-
-    # Combine all into one DataFrame
-    combined_agents = pd.concat(
-        [activeagents, awaitingagents, enforcedagents, revokedagents], ignore_index=True
-    )
-    combined_agents = combined_agents.sort_values(by="otpid", ascending=False)
-
-    # Optionally, select specific hosts
-    user_input = (
-        get_sanitized_input("\nWould you like to search for a specific device? (y/n): ")
-        .strip()
-        .lower()
-    )
-    if user_input == "y":
-        agentnames = []
-        agents = selectAgents(api)
-        for agent in agents:
-            agentnames.append(agent.hostname)
-
-        combined_agents = combined_agents[combined_agents["hostname"].isin(agentnames)]
-
-    # Present and select rows
-    selected_rows = Selector.select_dataframe_with_mode(
-        combined_agents,
-        columns=["otpid", "hostname", "status", "purpose", "granted"],
-        header="OTP Sessions",
-    )
-    combined_df = pd.DataFrame()
-
-    for row in selected_rows:
-        otpid = row["otpid"]
-        hostname = row["hostname"]
-        result = api.otp_get_activities(otpid)
-        result["hostname"] = hostname
-        if not result.empty:
-            logger.info(f"Activities for {hostname} (otpid: {otpid}):\n{result}")
-            combined_df = pd.concat([combined_df, result], ignore_index=True)
-        else:
-            logger.info(f"No activities found for {hostname} (otpid: {otpid})")
-
-    user_input = (
-        get_sanitized_input(
-            "\nWould you like to export the results to a CSV file? (y/n): "
-        )
-        .strip()
-        .lower()
-    )
-    if user_input == "y":
-        working_dir = load_env("WORKING_DIR")
-        timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
-        filename = f"otp_activities_{timestamp}.csv"
-        file_path = os.path.join(str(working_dir), filename)
-
-        combined_df.to_csv(file_path, index=False)
-        logging.info(f"Exported Data to {file_path}")
-
-        print(
-            colorText(
-                f"\n✅ OTP Activity exported to: {working_dir}\\{filename}",
-                "green",
-            )
-        )
-    else:
-        logging.debug("User declined to export the DataFrame.")
-
-
 def otp_revoke(api: AirlockAPIWrapper):
 
     activeagents = api.otp_find_active()

flows/prepPolicy.py

@@ -25,7 +25,7 @@ import pandas as pd
 from models.execution import ExecutionHistoryRecord
 from models.policy import Allowlist, Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_value, load_env, load_env_json
+from utils.configmanager import get_system_list, get_system_value, load_env
 from utils.selector import Selector
 from utils.utils import (
     areYouSure,
@@ -88,7 +88,7 @@ def sortHashes(
 ):
     working_dir = load_env("WORKING_DIR")
     history_days = Selector.select_value(
-        prompt="Enter how many days of history to pull (1–150): ",
+        prompt="Enter how many days of history to pull (1–150): ",
         value_type=int,
         valid_range=(1, 150),
     )
@@ -157,7 +157,7 @@ def buildPathsandPublishers(selected_policies: List[Policy], split):
         f"{working_dir}\\Approved\\{selected_policies[0].name}_approved_executions.csv"
     )
     path2 = f"{working_dir}\\Approved\\{selected_policies[0].name}_needs_review_executions.csv"
-    path_exclusion_constant = get_protected_value("PATH_EXCLUSION_CONST", cast_type=int)
+    path_exclusion_constant = get_system_value("PATH_EXCLUSION_CONST", cast_type=int)
 
     if os.path.exists(path1):
         df1 = pd.read_csv(path1)
@@ -227,7 +227,7 @@ def buildPathsandPublishers(selected_policies: List[Policy], split):
                 all_approved_hashes["publisher"] != "Not Signed"
             ].drop_duplicates(subset=["publisher"])
             # Remove Bad publisher if somehow they made it this far
-            pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
+            pattern = regulator(get_system_list("BAD_PUBLISHERS"))
             publist = publist[~publist["publisher"].str.contains(pattern, na=False)]
             publist = publist[["publisher"]]
             publist.sort_values(by="publisher", inplace=True)
@@ -313,7 +313,7 @@ def buildPreflights(selected_policies: List[Policy]):
 
 
 def splitFilepathsGrouped(df, path_exclusion_constant, col="filename"):
-    min_files_for_path = get_protected_value("MIN_FILES_FOR_PATH", cast_type=int)
+    min_files_for_path = get_system_value("MIN_FILES_FOR_PATH", cast_type=int)
 
     def clean_split(path):
         if not isinstance(path, (str, bytes, os.PathLike)):
@@ -385,8 +385,8 @@ def calculatePath(approved_hashes, path_exclusion_constant, split):
     else:
         dfs_by_policy = [approved_hashes]
 
-    badpathparts = load_env_json("BAD_PATH_PARTS", "[]")
+    badpathparts = get_system_list("BAD_PATH_PARTS")
-    min_files_for_path = get_protected_value("MIN_FILES_FOR_PATH", cast_type=int)
+    min_files_for_path = get_system_value("MIN_FILES_FOR_PATH", cast_type=int)
 
     processed_dfs = []
 
@@ -655,7 +655,7 @@ def section_header(title):
 
 def printEnforceChecklist(selected_policies, destination_policy, destination_allowlist):
     working_dir = load_env("WORKING_DIR")
-    section_header("🛠️ 🔒 Prepare to Enforce Policy 🛠️ 🔒")
+    section_header("🛠️ 🔒 Prepare to Enforce Policy 🛠️ 🔒")
     print(
         colorText(
             "\nSequentially follow these steps to prepare a policy for enforcement:",
@@ -670,11 +670,11 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         )
     )
     if not selected_policies:
-        print(colorText("  [✗]  No policies have been chosen", "red"))
+        print(colorText("  [✗]  No policies have been chosen", "red"))
     else:
         print(colorText("The following policies have been chosen:", "green"))
         for policy in selected_policies:
-            print(colorText(f"  [✓] {policy.name}", "green"))
+            print(colorText(f"  [✓] {policy.name}", "green"))
 
     # Step 2: Destination Policy and Allowlist
     print(
@@ -683,22 +683,22 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     if destination_policy:
         print(
             colorText(
-                f"  [✓] {destination_policy[0].name} has been selected as the destination policy",
+                f"  [✓] {destination_policy[0].name} has been selected as the destination policy",
                 "green",
             )
         )
     else:
-        print(colorText("  [✗]  No destination policy has been chosen", "red"))
+        print(colorText("  [✗]  No destination policy has been chosen", "red"))
 
     if destination_allowlist:
         print(
             colorText(
-                f"  [✓] {destination_allowlist[0].name} has been selected as allowlist",
+                f"  [✓] {destination_allowlist[0].name} has been selected as allowlist",
                 "green",
             )
         )
     else:
-        print(colorText("  [✗]  No allowlist has been chosen", "red"))
+        print(colorText("  [✗]  No allowlist has been chosen", "red"))
 
     # Step 3: Data Preparation
     print(
@@ -713,9 +713,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓] Data has been fetched"
+                    "  [✓] Data has been fetched"
                     if os.path.exists(review_path)
-                    else "  [✗] Data has not been fetched"
+                    else "  [✗] Data has not been fetched"
                 ),
                 "green" if os.path.exists(review_path) else "red",
             )
@@ -723,7 +723,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check data fetch status", "red"
+                "  [✗]  No policies selected, cannot check data fetch status", "red"
             )
         )
 
@@ -756,9 +756,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Reviewed hashes have been loaded"
+                    "  [✓]  Reviewed hashes have been loaded"
                     if os.path.exists(approved_path)
-                    else "  [✗]  Reviewed hashes have not been loaded"
+                    else "  [✗]  Reviewed hashes have not been loaded"
                 ),
                 "green" if os.path.exists(approved_path) else "red",
             )
@@ -766,9 +766,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Path review list created"
+                    "  [✓]  Path review list created"
                     if os.path.exists(second_review_path)
-                    else "  [✗]  Path review list has not been created"
+                    else "  [✗]  Path review list has not been created"
                 ),
                 "green" if os.path.exists(second_review_path) else "red",
             )
@@ -776,7 +776,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check reviewed hashes or path list",
+                "  [✗]  No policies selected, cannot check reviewed hashes or path list",
                 "red",
             )
         )
@@ -812,9 +812,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Reviewed path list detected"
+                    "  [✓]  Reviewed path list detected"
                     if os.path.exists(reviewed_path)
-                    else "  [✗]  Path review list has not been detected"
+                    else "  [✗]  Path review list has not been detected"
                 ),
                 "green" if os.path.exists(reviewed_path) else "red",
             )
@@ -825,9 +825,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Preflight Path Exclusion List has been generated"
+                    "  [✓]  Preflight Path Exclusion List has been generated"
                     if preflight_ready
-                    else "  [✗]  Preflight Path Exclusion List has not been generated"
+                    else "  [✗]  Preflight Path Exclusion List has not been generated"
                 ),
                 "green" if preflight_ready else "red",
             )
@@ -835,7 +835,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check preflight status", "red"
+                "  [✗]  No policies selected, cannot check preflight status", "red"
             )
         )
 
@@ -866,5 +866,5 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     print(colorText("     Apply approved hashes to allowlist", "cyan"))
 
     # Utility Options
-    print(colorText("F. 📂  - Open Working Directory", "cyan"))
+    print(colorText("F. 📂  - Open Working Directory", "cyan"))
-    print(colorText("B. 🔚  - Back", "cyan"))
+    print(colorText("B. 🔚  - Back", "cyan"))

flows/quietAgent.py

@@ -1,134 +0,0 @@
-#    Copyright (C) 2025 James Brotosky, Brandon Wickline
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as published
-#    by the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-import datetime
-import logging
-
-import dotenv
-import pandas as pd
-
-from flows.prepPolicy import selectPolicies
-from services.API import AirlockAPIWrapper
-from services.policyhandler import getPolicyInfo
-from utils.configmanager import load_env
-from utils.selector import Selector
-from utils.utils import colorText, get_sanitized_input
-
-logger = logging.getLogger(__name__)
-
-
-dotenv.load_dotenv()
-
-
-def findQuietAgents(api: AirlockAPIWrapper):
-    working_dir = load_env("WORKING_DIR")
-    # Get policy selection and agent list
-    selected_policy = selectPolicies(api, False)
-    if selected_policy:
-        agents = api.agents_find_by_group(selected_policy[0].groupid)
-
-        # Prompt user for history range
-        history_days = Selector.select_value(
-            prompt="Enter how many days of history to pull (1–150): ",
-            value_type=int,
-            valid_range=(1, 150),
-        )
-        required_quiet = Selector.select_value(
-            prompt="Enter how many days without an untrusted execution before these are considered ready for enforcement? (1–365): ",
-            value_type=int,
-            valid_range=(1, 150),
-        )
-
-        confirm = Selector.confirm(
-            f"Do you wish to proceed to pull history for {selected_policy[0].name}? Y/N :  "
-        )
-        # Get execution history as a DataFrame
-        if confirm:
-            policy_exec_history = getPolicyInfo(
-                api, selected_policy[0], [1, 2, 6, 7], history_days
-            )
-
-            if policy_exec_history.empty:
-                logging.info(
-                    "No execution history found for the selected policy and time range."
-                )
-                get_sanitized_input("Press enter to continue")
-                return
-
-            # Convert 'datetime' column to timezone-aware datetime objects
-            policy_exec_history["datetime"] = pd.to_datetime(
-                policy_exec_history["datetime"], format="%Y-%m-%dT%H:%M:%SZ", utc=True
-            )
-
-            # Get current UTC time
-            now = datetime.datetime.now(datetime.timezone.utc)
-
-            # Calculate days ago
-            policy_exec_history["days_ago"] = policy_exec_history["datetime"].apply(
-                lambda dt: (now - dt).days
-            )
-
-            # Count total executions per hostname
-            hostname_counts = policy_exec_history["hostname"].value_counts()
-
-            # Map execution counts to agents
-            agents["execution_count"] = (
-                agents["hostname"].map(hostname_counts).fillna(0).astype(int)
-            )
-
-            # Find most recent execution per hostname
-            most_recent_exec = policy_exec_history.sort_values(
-                by="days_ago"
-            ).drop_duplicates(subset="hostname", keep="first")
-
-            # Map most recent execution age to agents
-            agents["days_since"] = agents["hostname"].map(
-                most_recent_exec.set_index("hostname")["days_ago"]
-            )
-
-            # Check for enforcement readiness
-            agents["required_quiet"] = required_quiet
-            agents["enforce_ready"] = agents["days_since"].apply(
-                lambda x: True if pd.isna(x) or x > required_quiet else False
-            )
-
-            # Sort agents by execution count and hostname
-            agents = agents.sort_values(
-                by=["execution_count", "hostname"], ascending=[True, True]
-            )
-
-            # Save to CSV
-            filename = f"{working_dir}\\{selected_policy[0].name}_agents_last_{history_days}_days.csv"
-            logging.debug(f"Saving CSV to {filename}")
-            print(colorText(f"Saving CSV to {filename}", "green"))
-            agents.to_csv(filename, index=False)
-
-            # Summary statistics
-            total_agents = len(agents)
-            ready_agents = agents["enforce_ready"].sum()
-            not_ready_agents = total_agents - ready_agents
-            ready_percentage = (ready_agents / total_agents) * 100
-
-            # Print results
-
-            message = (
-                f"Total agents: {total_agents}\n"
-                f"Agents marked as 'enforce_ready': {ready_agents}\n"
-                f"Agents not ready: {not_ready_agents}\n"
-                f"Percentage ready for enforcement: {ready_percentage:.2f}%"
-            )
-            logger.debug(message)
-            colorText(message, "green")
-    get_sanitized_input("Press enter to continue")

models/execution.py

@@ -28,7 +28,7 @@ import pandas as pd
 
 import airlock_libs
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_value, load_env_json
+from utils.configmanager import get_system_list, get_system_value
 from utils.utils import colorText, regulator
 
 logger = logging.getLogger(__name__)
@@ -90,9 +90,9 @@ class Hash:
 
     @classmethod
     def categorize_hashes(cls, hashes):
-        threat_tolerance = get_protected_value("VT_THREAT_TOLERANCE", cast_type=int)
+        threat_tolerance = get_system_value("VT_THREAT_TOLERANCE", cast_type=int)
-        bad_publishers_pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
+        bad_publishers_pattern = regulator(get_system_list("BAD_PUBLISHERS"))
-        pups_pattern = regulator(load_env_json("PUPS", "[]"))
+        pups_pattern = regulator(get_system_list("PUPS"))
 
         approved_count = 0
         unapproved_count = 0
@@ -145,13 +145,13 @@ class Hash:
                     approved_count += 1
             except (ValueError, TypeError):
                 logger.debug(
-                    "Needs Review: Scannermatch score is missing or invalid. — {e}"
+                    "Needs Review: Scannermatch score is missing or invalid. — {e}"
                 )
                 hash_obj.at_decision = "needs_review"
                 needs_review_count += 1
 
         logger.debug(
-            f"Final counts — Needs Review: {needs_review_count}, Approved: {approved_count}, Unapproved: {unapproved_count}"
+            f"Final counts — Needs Review: {needs_review_count}, Approved: {approved_count}, Unapproved: {unapproved_count}"
         )
         return hashes
 
@@ -384,9 +384,9 @@ class ExecutionHistoryRecord:
         Returns:
             List[ExecutionHistoryRecord]: The same list, with hash_obj.at_decision updated.
         """
-        threat_tolerance = get_protected_value("VT_THREAT_TOLERANCE", cast_type=int)
+        threat_tolerance = get_system_value("VT_THREAT_TOLERANCE", cast_type=int)
-        bad_publishers_pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
+        bad_publishers_pattern = regulator(get_system_list("BAD_PUBLISHERS"))
-        pups_pattern = regulator(load_env_json("PUPS", "[]"))
+        pups_pattern = regulator(get_system_list("PUPS"))
 
         approved_count = 0
         unapproved_count = 0
@@ -443,13 +443,13 @@ class ExecutionHistoryRecord:
                     approved_count += 1
             except (ValueError, TypeError) as e:
                 logger.debug(
-                    f"Needs Review: Scannermatch score is missing or invalid. — {e}"
+                    f"Needs Review: Scannermatch score is missing or invalid. — {e}"
                 )
                 hash_obj.at_decision = "needs_review"
                 needs_review_count += 1
 
         logger.debug(
-            f"Final counts — Needs Review: {needs_review_count}, "
+            f"Final counts — Needs Review: {needs_review_count}, "
             f"Approved: {approved_count}, Unapproved: {unapproved_count}"
         )
 

requirements.txt

@@ -11,4 +11,4 @@ urllib3==2.5.0
 pyperclip==1.11.0
 
 --extra-index-url https://git.racooncity.org/api/packages/brotoskyj/pypi/simple/
-airlock_libs==2.0.0
+airlock_libs==4.0.1

services/API.py

@@ -64,6 +64,23 @@ class AirlockAPIWrapper:
             logger.error(f"API request failed: {e}")
             raise
 
+    def _post_raw(self, endpoint: str, payload: Optional[dict] = None) -> bytes:
+        """
+        Send POST request and return raw response content (bytes).
+        Useful for XML endpoints.
+        """
+        url = f"{self.base_url}{endpoint}"
+        data = json.dumps(payload or {})
+        try:
+            logger.debug(f"POST Request to {url} with payload: {payload}")
+            response = requests.post(url, headers=self.headers, data=data, verify=False)
+            response.raise_for_status()
+            logger.debug(f"Raw response received from {url}")
+            return response.content  # bytes
+        except requests.exceptions.RequestException as e:
+            logger.error(f"API request failed: {e}")
+            raise
+
     # Allowlist Management
     def allowlist_find_all(self) -> pd.DataFrame:
         """
@@ -75,6 +92,12 @@ class AirlockAPIWrapper:
         result = self._post("/v1/application", {})
         return pd.DataFrame(result["response"]["applications"])
 
+    def allowlist_export(self, applicationid) -> bytes:
+        """Return Allowlist XML as bytes to save to file"""
+        payload = {"applicationid": applicationid}
+        result = self._post_raw("/v1/application/export", payload)
+        return result  # should be bytes
+
     # Agent Management
     def agent_find_all(self) -> pd.DataFrame:
         """Retrieve all agents."""
@@ -116,6 +139,30 @@ class AirlockAPIWrapper:
         result = self._post("/v1/agent/find", payload)
         return pd.DataFrame(result["response"]["agents"])
 
+    # Baseline Managment
+    def baseline_find_all(self) -> pd.DataFrame:
+        """Retrieve all Baselines."""
+        result = self._post("/v1/baseline", {})
+        return pd.DataFrame(result["response"]["baselines"])
+
+    def baseline_export(self, baselineid) -> bytes:
+        """Return Baseline XML as bytes to save to file"""
+        payload = {"baselineid": baselineid}
+        result = self._post_raw("/v1/baseline/export", payload)
+        return result
+
+    # Blocklist Managment
+    def blocklist_find_all(self) -> pd.DataFrame:
+        """Retrieve all Baselines."""
+        result = self._post("/v1/blocklist", {})
+        return pd.DataFrame(result["response"]["blocklists"])
+
+    def blocklist_export(self, blocklistid) -> bytes:
+        """Return Blocklist XML as bytes to save to file"""
+        payload = {"blocklistid": blocklistid}
+        result = self._post_raw("/v1/blocklist/export", payload)
+        return result
+
     # Hash Management
     def hash_add_to_allowlist(self, applicationid: str, hashes: List[str]) -> dict:
         """Add hashes to the allowlist for a specific application."""
@@ -253,6 +300,19 @@ class AirlockAPIWrapper:
         }
         return self._post("/v1/group/settings/script_custom", payload)
 
+    def policy_set_upgradetarget(
+        self,
+        groupid: str,
+        windows: str,
+        macos: str,
+    ) -> dict:
+        payload = {
+            "groupid": groupid,
+            "windows": windows,
+            "macos": macos,
+        }
+        return self._post("/v1/group/settings/selfupgrade/target", payload)
+
     # Execution History
     def history_logging(
         self, type: List[str], checkpoint: str, policy: List[str]

services/agenthandler.py

@@ -28,7 +28,7 @@ from flows.prepPolicy import selectPolicies
 from models.agent import Agent
 from models.policy import Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json, load_env
+from utils.configmanager import get_system_json, load_env
 from utils.selector import Selector
 from utils.utils import colorText, get_sanitized_input
 
@@ -38,7 +38,7 @@ logger = logging.getLogger(__name__)
 def devicehistory(api: AirlockAPIWrapper, outputjson: bool):
     agents = selectAgents(api)
     history_days = Selector.select_value(
-        prompt="Enter how many days of history to pull (1–150): ",
+        prompt="Enter how many days of history to pull (1–150): ",
         value_type=int,
         valid_range=(1, 150),
     )
@@ -60,7 +60,7 @@ def devicehistory(api: AirlockAPIWrapper, outputjson: bool):
         except Exception as e:
             print(
                 colorText(
-                    f"❌ Error retrieving history for {agent.hostname}: {e}", "red"
+                    f"❌ Error retrieving history for {agent.hostname}: {e}", "red"
                 )
             )
             continue
@@ -139,7 +139,7 @@ def findAgents(api, return_dataframe):
 
         print(
             colorText(
-                f"\n✅ Matched devices exported to: {working_dir}\\{filename}",
+                f"\n✅ Matched devices exported to: {working_dir}\\{filename}",
                 "green",
             )
         )
@@ -148,7 +148,7 @@ def findAgents(api, return_dataframe):
 
 
 def collect_device_names() -> List[str]:
-    print(colorText("🔍 Device Search", "cyan"))
+    print(colorText("🔍 Device Search", "cyan"))
     print(
         colorText(
             "Enter the device hostnames you'd like to search for, one per line.", "cyan"
@@ -185,7 +185,7 @@ def collect_device_names() -> List[str]:
         else:
             print(
                 colorText(
-                    f"⚠️ Invalid input: '{stripped_line}' — only letters, numbers, underscores, spaces, and hyphens are allowed.",
+                    f"⚠️ Invalid input: '{stripped_line}' — only letters, numbers, underscores, spaces, and hyphens are allowed.",
                     "yellow",
                 )
             )
@@ -235,8 +235,8 @@ def show_unmatched(
         ]
 
     if unmatched:
-        logger.debug(f"⚠️ No matches for: {', '.join(unmatched)}")
+        logger.debug(f"⚠️ No matches for: {', '.join(unmatched)}")
-        print(colorText(f"⚠️ No matches for: {', '.join(unmatched)}", "yellow"))
+        print(colorText(f"⚠️ No matches for: {', '.join(unmatched)}", "yellow"))
 
 
 def enrich_agents(agents: List["Agent"], policies: List["Policy"]):
@@ -248,7 +248,7 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     device_names = collect_device_names()
     if not device_names:
         logger.debug("No device names entered")
-        print(colorText("⚠️ No device names entered.", "red"))
+        print(colorText("⚠️ No device names entered.", "red"))
         return []
 
     use_exact = choose_match_type()
@@ -261,11 +261,11 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     show_unmatched(device_names, matched_agents, use_exact)
 
     if not matched_agents:
-        logger.debug("❌ No matching devices found.")
+        logger.debug("❌ No matching devices found.")
-        print(colorText("❌ No matching devices found.", "red"))
+        print(colorText("❌ No matching devices found.", "red"))
         return []
 
-    print(colorText(f"✅ Found {len(matched_agents)} matching device(s).", "green"))
+    print(colorText(f"✅ Found {len(matched_agents)} matching device(s).", "green"))
     logger.info("Matched agent hostnames:")
     rows = (len(matched_agents) + 2) // 3  # 3 columns
     for row in range(rows):
@@ -283,8 +283,8 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     )
 
     if not matched_agents:
-        logger.debug("❌ No matching devices remain after refinement.")
+        logger.debug("❌ No matching devices remain after refinement.")
-        print(colorText("❌ No matching devices remain after refinement.", "red"))
+        print(colorText("❌ No matching devices remain after refinement.", "red"))
         return []
 
     enrich_agents(matched_agents, policies)
@@ -302,10 +302,10 @@ def moveAgentToRelatedPolicy(
     Args:
         api: AirlockAPIWrapper instance.
         agent: Agent object.
-        policy_relationship_map: Dict mapping enforcement → audit.
+        policy_relationship_map: Dict mapping enforcement → audit.
         mode: 'audit' to move to audit, 'enforcement' to move to enforcement.
     """
-    policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+    policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
 
     if mode == "audit":
         if agent.groupid in policy_relationship_map:

services/policyhandler.py

@@ -27,7 +27,7 @@ import tqdm
 
 from models.policy import Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json
+from utils.configmanager import get_system_json
 from utils.setup import get_base_directory
 from utils.utils import areYouSure, colorText, get_sanitized_input
 
@@ -236,7 +236,7 @@ def skipback(days):
 
 
 def updateAuditPoliciesFromEnforcementPolices(api: AirlockAPIWrapper):
-    policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+    policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
     for enforcement_policy, audit_policy in policy_relationship_map.items():
         api.policy_clone(enforcement_policy, audit_policy)
         api.policy_set_auditmode(audit_policy, "1")

utils/configmanager.py

@@ -18,117 +18,280 @@ import logging
 import os
 from pathlib import Path
 import sys
-from typing import Callable, Optional, TypeVar
+from typing import Any, Callable, Optional, TypeVar
 
 T = TypeVar("T")
 logger = logging.getLogger(__name__)
 
-PROTECTED_KEYS = [
+# System config keys - these are immutable and come from system_config.json (bundled in exe)
+SYSTEM_CONFIG_KEYS = [
+    "URL",
     "APPNAME",
     "LOG_LEVEL",
+    "BAD_PATH_PARTS",
+    "BAD_PUBLISHERS",
+    "PUPS",
     "PATH_EXCLUSION_CONST",
     "MIN_FILES_FOR_PATH",
     "VT_THREAT_TOLERANCE",
     "POLICY_MAP_ENF_AUD",
 ]
 
-_protected_config = {}
+# User config keys - these can be changed by the end user
+USER_CONFIG_KEYS = [
+    "TELEMETRY",  # User opt-in/out for telemetry
+    "TELEM_URL",
+    "TEXTUAL_THEME",  # UI theme preference
+    "EXTRAS",  # Feature flags
+]
+
+# In-memory config storage
+_system_config = {}
+_user_config = {}
 
 
 def get_system_config_path() -> Path:
+    """
+    Get path to system_config.json.
+    Priority:
+    1. Bundled in exe (_MEIPASS)
+    2. Next to this file (development)
+    """
     # Check inside bundled EXE directory first
     bundled_dir = Path(getattr(sys, "_MEIPASS", ""))
     bundled_path = bundled_dir / "system_config.json"
     if bundled_path.exists():
         return bundled_path
 
-    # Fallback to external location
+    # Fallback to development location (next to this file)
     return Path(__file__).parent.parent / "system_config.json"
 
 
-def load_protected_config() -> dict:
+def load_system_config() -> dict:
-    global _protected_config
+    """
+    Load system configuration from system_config.json.
+    This should only be called once at startup.
+    Returns the full system config dict.
+    """
+    global _system_config
+
     try:
-        with open(get_system_config_path(), "r") as f:
+        config_path = get_system_config_path()
-            system_config = json.load(f)
+        with open(config_path, "r") as f:
+            _system_config = json.load(f)
+            logger.debug(f"✅ Loaded system config from {config_path}")
     except FileNotFoundError:
-        logging.warning("⚠️ system_config.json not found. Using built-in defaults.")
+        logger.warning("⚠️ system_config.json not found. Using minimal defaults.")
-        system_config = {
+        # Minimal defaults for development without system_config.json
+        _system_config = {
             "APPNAME": "Loxide",
+            "LOG_LEVEL": "INFO",
             "PATH_EXCLUSION_CONST": 4,
             "MIN_FILES_FOR_PATH": 4,
             "VT_THREAT_TOLERANCE": 4,
-            "POLICY_MAP_ENF_AUD": {"enforced_id": "audit_id"},
+            "POLICY_MAP_ENF_AUD": {},
         }
 
-    _protected_config = {key: system_config[key] for key in PROTECTED_KEYS}
+    return _system_config
-    return _protected_config
 
 
-def get_protected_value(
+def get_system_value(
     key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
 ) -> Optional[T]:
-    value = _protected_config.get(key)
+    """
+    Get a value from system config (immutable).
+
+    Parameters:
+        key: The config key to retrieve
+        cast_type: Function to cast the value to desired type
+        default: Default value if key not found
+
+    Returns:
+        The config value cast to the desired type, or default
+    """
+    value = _system_config.get(key)
     if value is None:
-        logging.warning(f"Protected config key '{key}' not found.")
+        logger.warning(f"System config key '{key}' not found.")
         return default
+
     try:
         if isinstance(value, str):
             value = value.strip("'\"")
         return cast_type(value)
     except (ValueError, TypeError):
-        logging.warning(
+        logger.warning(
-            f"Invalid value for protected key '{key}': {value}. Expected type {cast_type.__name__}."
+            f"Invalid value for system key '{key}': {value}. Expected type {cast_type.__name__}."
         )
         return default
 
 
-def get_protected_json(key: str, default: str = "{}") -> dict:
+def get_system_json(key: str, default: Optional[dict] = None) -> dict:
-    raw = _protected_config.get(key, default)
+    """
+    Get a JSON/dict value from system config.
+    Handles both dict values and JSON strings.
+    """
+    if default is None:
+        default = {}
+
+    raw = _system_config.get(key, default)
     if isinstance(raw, dict):
         return raw
+
     try:
         return json.loads(raw)
-    except json.JSONDecodeError:
+    except (json.JSONDecodeError, TypeError) as e:
-        try:
+        logger.error(f"Failed to parse system JSON key '{key}': {e}")
-            escaped = raw.encode("unicode_escape").decode("utf-8")
+        return default
-            return json.loads(escaped)
-        except Exception as e:
-            logging.error(f"Failed to parse protected JSON key '{key}': {e}")
-            return json.loads(default)
 
 
-def load_env_json(key: str, default: str):
+def get_system_list(key: str, default: Optional[list] = None) -> list:
-    raw = os.getenv(key, default)
+    """
+    Get a list value from system config.
+    Handles both list values and JSON strings.
+
+    Parameters:
+        key: The config key to retrieve
+        default: Default value if key not found or parsing fails
+
+    Returns:
+        The list value or default
+    """
+    if default is None:
+        default = []
+
+    raw = _system_config.get(key, default)
+    if isinstance(raw, list):
+        return raw
+
     try:
-        return json.loads(raw)
+        result = json.loads(raw) if isinstance(raw, str) else raw
-    except json.JSONDecodeError:
+        if isinstance(result, list):
+            return result
+        logger.warning(f"System config key '{key}' is not a list: {type(result)}")
+        return default
+    except (json.JSONDecodeError, TypeError) as e:
+        logger.error(f"Failed to parse system list key '{key}': {e}")
+        return default
+
+
+def load_user_config(config_dir: Path) -> dict:
+    """
+    Load user configuration from user_config.json.
+    Creates the file with defaults if it doesn't exist.
+
+    Parameters:
+        config_dir: Directory containing user_config.json
+
+    Returns:
+        The user config dict
+    """
+    global _user_config
+
+    user_config_path = config_dir / "user_config.json"
+
+    if not user_config_path.exists():
+        # Create default user config
+        default_user_config = {
+            "TELEMETRY": False,
+            "TELEM_URL": "",
+            "TEXTUAL_THEME": "gruvbox",
+            "EXTRAS": "NOTTODAY",
+        }
+        user_config_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(user_config_path, "w") as f:
+            json.dump(default_user_config, f, indent=4)
+        logger.debug(f"Created default user config at {user_config_path}")
+        _user_config = default_user_config
+    else:
+        with open(user_config_path, "r") as f:
+            _user_config = json.load(f)
+        logger.debug(f"✅ Loaded user config from {user_config_path}")
+
+    return _user_config
+
+
+def save_user_config(config_dir: Path, updates: dict) -> None:
+    """
+    Save updates to user configuration.
+    Only keys in USER_CONFIG_KEYS are allowed.
+
+    Parameters:
+        config_dir: Directory containing user_config.json
+        updates: Dict of key-value pairs to update
+    """
+    global _user_config
+
+    # Validate that only user-configurable keys are being updated
+    invalid_keys = [k for k in updates.keys() if k not in USER_CONFIG_KEYS]
+    if invalid_keys:
+        logger.error(f"Attempted to save invalid user config keys: {invalid_keys}")
+        raise ValueError(f"Cannot modify system config keys: {invalid_keys}")
+
+    # Update in-memory config
+    _user_config.update(updates)
+
+    # Write to file
+    user_config_path = config_dir / "user_config.json"
+    user_config_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(user_config_path, "w") as f:
+        json.dump(_user_config, f, indent=4)
+
+    logger.debug(f"✅ Saved user config to {user_config_path}: {updates}")
+
+
+def get_user_value(
+    key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
+) -> Optional[T]:
+    """
+    Get a value from user config (mutable).
+
+    Parameters:
+        key: The config key to retrieve
+        cast_type: Function to cast the value to desired type
+        default: Default value if key not found
+
+    Returns:
+        The config value cast to the desired type, or default
+    """
+    value = _user_config.get(key)
+    if value is None:
+        logger.warning(f"User config key '{key}' not found.")
+        return default
+
     try:
-            escaped = raw.encode("unicode_escape").decode("utf-8")
+        if isinstance(value, str):
-            return json.loads(escaped)
+            value = value.strip("'\"")
-        except Exception as e:
+        return cast_type(value)
-            logging.error(f"Failed to parse {key}: {e}")
+    except (ValueError, TypeError):
-            return json.loads(default)
+        logger.warning(
+            f"Invalid value for user key '{key}': {value}. Expected type {cast_type.__name__}."
+        )
+        return default
 
 
 def load_env(
     key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
 ) -> Optional[T]:
     """
-    Safely retrieves an environment variable and casts it to the desired type.
+    Safely retrieves an environment variable from .env and casts it to the desired type.
+    This should ONLY be used for runtime/dynamic values like WORKING_DIR.
+
+    For system config, use get_system_value().
+    For user config, use get_user_value().
 
     Parameters:
-        key (str): The name of the environment variable.
+        key: The name of the environment variable
-        cast_type (Callable[[str], T], optional): Function to cast the value. Defaults to str.
+        cast_type: Function to cast the value. Defaults to str
-        default (Optional[T], optional): Default value if the variable is not set or invalid.
+        default: Default value if the variable is not set or invalid
 
     Returns:
-        Optional[T]: The casted value or the default.
+        The casted value or the default
     """
     value = os.getenv(key)
     if value is None:
-        logger.warning(f"Environment variable '{key}' not set.")
+        logger.debug(f"Environment variable '{key}' not set, using default.")
         return default
+
     try:
         value = value.strip("'\"")  # Strip surrounding quotes
         return cast_type(value)
@@ -137,3 +300,46 @@ def load_env(
             f"Invalid value for env var '{key}': {value}. Expected type {cast_type.__name__}."
         )
         return default
+
+
+def load_env_json(key: str, default: str = "[]") -> Any:
+    """
+    Load a JSON value from environment or system config.
+
+    DEPRECATED: This function is kept for backward compatibility.
+    - For system config lists (BAD_PUBLISHERS, PUPS, BAD_PATH_PARTS), use get_system_list()
+    - For system config dicts, use get_system_json()
+    - For actual .env JSON values, parse manually
+
+    This function automatically redirects known system config keys to system config.
+    """
+    # Known system config list keys - redirect to system config
+    system_list_keys = ["BAD_PUBLISHERS", "PUPS", "BAD_PATH_PARTS"]
+    if key in system_list_keys:
+        logger.debug(f"Redirecting load_env_json('{key}') to get_system_list()")
+        return get_system_list(key, json.loads(default) if default else [])
+
+    # Known system config dict keys - redirect to system config
+    system_dict_keys = ["POLICY_MAP_ENF_AUD"]
+    if key in system_dict_keys:
+        logger.debug(f"Redirecting load_env_json('{key}') to get_system_json()")
+        return get_system_json(key, json.loads(default) if default else {})
+
+    # Fall back to reading from .env (backward compatibility for unknown keys)
+    raw = os.getenv(key, default)
+    try:
+        return json.loads(raw)
+    except json.JSONDecodeError:
+        try:
+            escaped = raw.encode("unicode_escape").decode("utf-8")
+            return json.loads(escaped)
+        except Exception as e:
+            logger.error(f"Failed to parse {key}: {e}")
+            return json.loads(default)
+
+
+# Backwards compatibility aliases (deprecated - use get_system_value instead)
+get_protected_value = get_system_value
+get_protected_json = get_system_json
+load_protected_config = load_system_config
+PROTECTED_KEYS = SYSTEM_CONFIG_KEYS  # For backwards compatibility

utils/setup.py

@@ -13,18 +13,20 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import json
 import logging
 import logging.config
 import logging.handlers
 import os
 from pathlib import Path
 import platform
-import sys
 
 from dotenv import load_dotenv, set_key
 
-from utils.configmanager import PROTECTED_KEYS, load_protected_config
+from utils.configmanager import (
+    get_system_value,
+    load_system_config,
+    load_user_config,
+)
 
 
 def get_base_directory() -> Path:
@@ -38,7 +40,7 @@ def get_base_directory() -> Path:
         return home / ".local" / "share" / "Loxide"
 
 
-def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
+def configure_logging(log_dir: Path, log_level: str = "INFO"):
     log_file = log_dir / "Loxide.log"
 
     config = {
@@ -62,12 +64,12 @@ def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
                 "interval": 1,  # Every 1 day
                 "backupCount": 7,  # Keep 7 days of logs
                 "encoding": "utf-8",  # Ensure UTF-8 encoding
-                "level": "DEBUG",  # Always log DEBUG and above
+                "level": "DEBUG",  # Always log DEBUG and above to file
                 "formatter": "detailed",  # Use detailed format
             },
             "console": {
                 "class": "logging.StreamHandler",
-                "level": log_level.upper(),  # Configurable log level
+                "level": log_level.upper(),  # System-configured level for console
                 "formatter": "simple",  # Use simple format
             },
         },
@@ -95,55 +97,15 @@ def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
     logging.getLogger().debug("✅ Logging configured.")
 
 
-def get_system_config_path() -> Path:
-    base_path = Path(
-        getattr(sys, "_MEIPASS", os.path.dirname(os.path.abspath(__file__)))
-    )
-    return base_path.parent / "system_config.json"
-
-
-def load_system_config() -> dict:
-    try:
-        config_path = get_system_config_path()
-        with open(config_path, "r") as f:
-            return json.load(f)
-    except FileNotFoundError:
-        logging.warning("⚠️ system_config.json not found. Using built-in defaults.")
-        return {
-            "APPNAME": "Loxide",
-            "LOG_LEVEL": "DEBUG",
-            "PATH_EXCLUSION_CONST": 4,
-            "MIN_FILES_FOR_PATH": 4,
-            "VT_THREAT_TOLERANCE": 4,
-            "POLICY_MAP_ENF_AUD": {"enforced_id": "audit_id"},
-        }
-
-
-def load_user_config(config_dir: Path) -> dict:
-    user_config_path = config_dir / "user_config.json"
-    if not user_config_path.exists():
-        default_user_config = {"URL": "", "LOG_LEVEL": "INFO"}
-        with open(user_config_path, "w") as f:
-            json.dump(default_user_config, f, indent=4)
-        logging.debug(f"Created user config at {user_config_path}")
-    with open(user_config_path, "r") as f:
-        return json.load(f)
-
-
-def write_config_to_env(config: dict, env_path: Path):
-    for key, value in config.items():
-        if key in PROTECTED_KEYS:
-            continue  # Skip protected keys
-        try:
-            serialized = (
-                json.dumps(value) if isinstance(value, (list, dict)) else str(value)
-            )
-            set_key(env_path, key, serialized)
-        except Exception as e:
-            logging.warning(f"Failed to write {key} to .env: {e}")
-
-
 def setup():
+    """
+    Initialize the application environment:
+    1. Create directory structure
+    2. Load system config (immutable, from system_config.json)
+    3. Load user config (mutable, from user_config.json)
+    4. Configure logging
+    5. Set up .env with WORKING_DIR only
+    """
     base_dir = get_base_directory()
     dirs = {
         "config": base_dir / "config",
@@ -155,20 +117,30 @@ def setup():
         path.mkdir(parents=True, exist_ok=True)
         logging.debug(f"{name.capitalize()} directory ensured at: {path}")
 
+    # Load system config (immutable)
     system_config = load_system_config()
-    configure_logging(dirs["logs"], system_config.get("LOG_LEVEL", "DEBUG"))
 
+    # Configure logging with system-defined log level
+    log_level = get_system_value("LOG_LEVEL", str, "INFO")
+    configure_logging(dirs["logs"], log_level)
+
+    # Load user config (mutable)
+    user_config = load_user_config(dirs["config"])
+
+    # Set up .env file - ONLY for WORKING_DIR (runtime-configurable value)
     env_path = base_dir / ".env"
     if not env_path.exists():
         env_path.touch()
     load_dotenv(dotenv_path=env_path, override=True)
 
+    # Set up working directory (only dynamic value in .env)
     working_dir = Path(os.getenv("WORKING_DIR") or (base_dir / "data"))
     working_dir.mkdir(parents=True, exist_ok=True)
-    set_key(env_path, "WORKING_DIR", str(working_dir))
+    set_key(str(env_path), "WORKING_DIR", str(working_dir))
     os.environ["WORKING_DIR"] = str(working_dir)
     logging.debug(f"Working directory set to: {working_dir}")
 
+    # Create folder structure in working directory
     folders_structure = {
         "Approved": [],
         "Needs_Review": ["Review_First", "Review_Second", "HTML"],
@@ -185,23 +157,4 @@ def setup():
             subfolder_path.mkdir(parents=True, exist_ok=True)
             logging.debug(f" └─ '{subfolder}' subfolder created at: {subfolder_path}")
 
-    user_config = load_user_config(dirs["config"])
+    logging.info("✅ Setup complete")
-    merged_config = {**system_config, **user_config}
-
-    protected_config = load_protected_config()
-    merged_config.update(protected_config)
-
-    # ✅ URL resolution order: system_config → .env → user prompt
-    url = system_config.get("URL")
-    if not url:
-        url = os.getenv("URL")
-    if not url:
-        url = input(
-            "🌐 Enter the service URL (e.g., https://example.com/api): "
-        ).strip()
-    merged_config["URL"] = url
-    set_key(env_path, "URL", url)
-    os.environ["URL"] = url
-    logging.debug(f"Service URL set to: {url}")
-
-    write_config_to_env(merged_config, env_path)