Implemented Threaded Rust Process

It still locks the GIL, but this is the ground work for the non blocking GUI. Python objects are converted to Rust objects in the beginning of the function call so they can be sent to threads safely.

.gitea/workflows/loxide_lib.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Install Prerequisites
         run: |
           apt update
-          apt install curl git python3 pip pkg-config openssl libssl-dev patchelf binutils-mingw-w64-x86-64 mingw-w64 -y
+          apt install curl git python3 pip pkg-config openssl libssl-dev patchelf binutils-mingw-w64-x86-64 mingw-w64 protobuf-compiler -y
           curl https://sh.rustup.rs -sSf | sh -s -- -y
           pip install maturin twine --break-system-packages
 

Loxide.py

@@ -23,39 +23,28 @@
 
 import logging
 import os
-import tempfile
 
-import dotenv
 import urllib3
 
 from services.API import AirlockAPIWrapper
 from services.security import getAPI
+from TUI.TUI import run_Loxide
+from utils.configmanager import get_system_value
 from utils.setup import get_base_directory, setup
-from utils.TUI import run_Loxide
 from utils.utils import irtang
 
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 
 def main():
-
-    if "NUITKA_ONEFILE_PARENT" in os.environ:
-        splash_filename = os.path.join(
-            tempfile.gettempdir(),
-            f"onefile_{int(os.environ['NUITKA_ONEFILE_PARENT'])}_splash_feedback.tmp",
-        )
-        if os.path.exists(splash_filename):
-            os.unlink(splash_filename)
-
     irtang()
     # Determine  working directory, setup directory, configure logging, sent env, get API and URL if not already stored
     setup()
     base_dir = get_base_directory()
     logger = logging.getLogger(__name__)
-    dotenv.load_dotenv(dotenv_path=base_dir / ".env")
 
     try:
-        url = os.getenv("URL")
+        url = get_system_value("URL")
         username = os.getenv("USERNAME")
 
         if not url:
@@ -75,7 +64,7 @@ def main():
         raise ValueError("API key for Loxide is missing.")
 
     api = AirlockAPIWrapper(
-        base_url=str(os.getenv("URL")),
+        base_url=str(url),
         api_key=api_key,
     )
     run_Loxide(api)

TUI/OTP_generate.py

@@ -1,5 +1,5 @@
 import logging
-from typing import List
+from typing import List, Optional
 
 from textual.containers import Horizontal, Vertical
 from textual.css.query import NoMatches
@@ -31,7 +31,11 @@ class OTPGenerator(Widget):
 
     class OTPInfo(Message):
         def __init__(
-            self, devices: List[Agent], requestor: str, reasoning: str, duration: int
+            self,
+            devices: Optional[List[Agent]],
+            requestor: str,
+            reasoning: str,
+            duration: int,
         ):
             super().__init__()
             self.devices = devices
@@ -243,7 +247,7 @@ class OTPGenerator(Widget):
                 self.otp_generated = True
 
                 # Access API from the app - this is the key change!
-                api = self.app.api
+                api = self.app.api  # type: ignore
 
                 output_lines = [
                     "Requested OTP Codes:",

TUI/TUI.py

@@ -1,11 +1,12 @@
 import logging
 import os
 import sys
+from typing import Optional
 
 import dotenv
-from dotenv import set_key
 from textual.app import App, ComposeResult
 from textual.containers import Vertical
+from textual.message import Message
 from textual.reactive import reactive
 from textual.screen import Screen
 from textual.widgets import (
@@ -18,26 +19,27 @@ from textual.widgets import (
     Tabs,
 )
 
-from flows.otp import otp_activities_by_agent, otp_revoke
+from flows.otp import otp_revoke
 from flows.prepPolicy import menu_policy_enforce
-from flows.quietAgent import findQuietAgents
 from models.agent import Agent
 from models.policy import Policy
-from screens.moveagentworkflowscreen import MoveAgentWorkflowScreen
-from screens.otpworkflowscreen import OTPWorkflowScreen
 from services.API import AirlockAPIWrapper
 from services.policyhandler import confirmUpdateAfromE
-from utils.configmanager import load_env
-from utils.setup import get_base_directory, load_user_config
+from TUI.agentmoveoperations import AgentMoveOperations
+from TUI.moveagentworkflowscreen import MoveAgentWorkflowScreen
+from TUI.multiagentselector import MultiAgentSelector
+from TUI.OTP_generate import OTPGenerator
+from TUI.otpactivityscreen import OTPActivitiesScreen
+from TUI.otpworkflowscreen import OTPWorkflowScreen
+from TUI.policytreewidget import PolicyTreeWidget
+from TUI.quietagentworkflowscreen import QuietAgentWorkflowScreen
+from TUI.resultsdisplay import ResultsDisplay
+from TUI.theme_amber_terminal import get_amber_terminal_theme
+from TUI.theme_retro_terminal import get_retro_terminal_theme
+from TUI.themeselector import ThemeSelector
+from utils.configmanager import get_user_value, load_env, save_user_config
+from utils.setup import get_base_directory
 from utils.utils import open_directory
-from widgets.agentmoveoperations import AgentMoveOperations
-from widgets.amber_terminal_theme import get_amber_terminal_theme
-from widgets.multiagentselector import MultiAgentSelector
-from widgets.OTP_generate import OTPGenerator
-from widgets.policytreewidget import PolicyTreeWidget
-from widgets.resultsdisplay import ResultsDisplay
-from widgets.retro_terminal_theme import get_retro_terminal_theme
-from widgets.themeselector import ThemeSelector
 
 dotenv.load_dotenv()
 
@@ -55,53 +57,24 @@ logger = logging.getLogger(__name__)
 # ---------------------------------------------------------------------------
 def _persist_user_theme(theme_name: str) -> None:
     """
-    Store the chosen Textual theme in the user's config:
-      <base>/config/user_config.json
-    and also mirror to <base>/.env so load_env(...) sees it.
+    Store the chosen Textual theme in the user's config using the config manager.
+    No need to touch .env - config manager handles everything.
     """
     base_dir = get_base_directory()
     config_dir = base_dir / "config"
-    user_config_path = config_dir / "user_config.json"
-    env_path = base_dir / ".env"
 
-    # ensure dirs / files exist similarly to setup()
-    config_dir.mkdir(parents=True, exist_ok=True)
-    if not user_config_path.exists():
-        # minimal default like your load_user_config does
-        user_config_path.write_text(
-            '{"URL": "", "LOG_LEVEL": "INFO"}\n', encoding="utf-8"
-        )
-
-    # load existing user config
-    user_conf = load_user_config(config_dir)
-    user_conf["TEXTUAL_THEME"] = theme_name
-
-    # write it back
-    user_config_path.write_text(
-        # pretty print so it stays human-readable
-        __import__("json").dumps(user_conf, indent=4),
-        encoding="utf-8",
-    )
-    logger.debug("Updated user_config.json with TEXTUAL_THEME=%s", theme_name)
-
-    # mirror to .env (like setup.write_config_to_env does)
-    env_path.parent.mkdir(parents=True, exist_ok=True)
-    if not env_path.exists():
-        env_path.touch()
     try:
-        set_key(str(env_path), "TEXTUAL_THEME", theme_name)
-    except Exception as exc:  # keep going even if .env write fails
-        logger.warning("Failed to mirror TEXTUAL_THEME to .env: %s", exc)
-
-    # reload so load_env(...) sees the new value right now
-    dotenv.load_dotenv(dotenv_path=env_path, override=True)
-    logger.debug("Reloaded .env from %s", env_path)
+        save_user_config(config_dir, {"TEXTUAL_THEME": theme_name})
+        logger.debug("Updated user config with TEXTUAL_THEME=%s", theme_name)
+    except Exception as exc:
+        logger.error("Failed to save TEXTUAL_THEME: %s", exc)
 
 
 # ---------------------------------------------------------------------------
 # 1) SCREEN
 # ---------------------------------------------------------------------------
 class MainMenuScreen(Screen):
+    api: AirlockAPIWrapper
     current_tab = reactive("")
 
     BUTTON_DEFS = {
@@ -110,20 +83,19 @@ class MainMenuScreen(Screen):
                 "🖥️ - Find, Move, or Generate OTP for Agents",
                 "move_agent_workflow_button",
             ),
-            ("🔇 - Find Quiet Hosts", "find_quiet_button"),
+            ("📊 - Review and appove OTP Activities", "otp_activities_button"),
+            ("📇 - Find and Move Quiet Hosts to Enforcement", "find_quiet_button"),
         ],
         "policy": [
             ("🔒 - Prepare Policy For Enforcement", "policy_prep_button"),
             ("🔄 - Update Audit Policies", "policy_audit_update_button"),
-            ("📊 - OTP Activities By Agent", "otp_activities_button"),
             ("❌ - Revoke OTPs", "otp_revoke_button"),
         ],
     }
 
-    def __init__(self, api: AirlockAPIWrapper) -> None:
+    def __init__(self) -> None:
         super().__init__()
-        self.api = api
-        self.extras = load_env("EXTRAS")
+        self.extras = get_user_value("EXTRAS", str, "NOTTODAY")
         wd = load_env("WORKING_DIR") or os.getcwd()
         if not os.path.isdir(wd):
             wd = os.getcwd()
@@ -156,6 +128,7 @@ class MainMenuScreen(Screen):
         yield Footer()
 
     def on_mount(self) -> None:
+        api = self.app.api
         self.switch_tab("agent_actions")
 
     # focus helpers
@@ -238,7 +211,6 @@ class MainMenuScreen(Screen):
         """Handle OTP generation request from the workflow."""
         global _PENDING_JOB
 
-        # Log what we received
         logger.info(
             "OTP Generation requested: %d devices, requestor=%s, reason=%s, duration=%d",
             len(message.devices),
@@ -247,7 +219,6 @@ class MainMenuScreen(Screen):
             message.duration,
         )
 
-        # Set up the job to run the OTP generation
         _PENDING_JOB = (
             "otp_workflow",
             message.devices,
@@ -317,38 +288,57 @@ class MainMenuScreen(Screen):
 
         match button_id:
             case "move_agent_workflow_button":
-                # Push Move Agent workflow screen
                 self.app.push_screen(MoveAgentWorkflowScreen(self.app.devices))
                 event.stop()
-                return  # Don't exit the app
+
             case "otp_generate_button":
-                # NEW: Push OTP workflow screen instead of legacy function
                 self.app.push_screen(OTPWorkflowScreen(self.app.devices))
                 event.stop()
-                return  # Don't exit the app
+
             case "find_quiet_button":
-                _PENDING_JOB = ("legacy", findQuietAgents, (self.app.api,), {})
+                self.app.push_screen(
+                    QuietAgentWorkflowScreen(self.app.api, self.app.policies)
+                )
+                event.stop()
+                return
+
             case "otp_activities_button":
-                _PENDING_JOB = ("legacy", otp_activities_by_agent, (self.app.api,), {})
+                self.app.push_screen(OTPActivitiesScreen())
+                event.stop()
+                return
+
             case "otp_revoke_button":
                 _PENDING_JOB = ("legacy", otp_revoke, (self.app.api,), {})
+
             case "policy_prep_button":
                 _PENDING_JOB = ("legacy", menu_policy_enforce, (self.app.api,), {})
+
             case "policy_audit_update_button":
                 _PENDING_JOB = ("legacy", confirmUpdateAfromE, (self.app.api,), {})
+
             case _:
                 self.app.bell()
                 logger.warning("Unknown button pressed: %s", button_id)
                 return
 
+        # Only exit the UI loop when we explicitly queued a legacy job.
+        # The original flow used `self.app.exit()` after setting _PENDING_JOB so
+        # the outer loop could run legacy code. Keep that behavior only for legacy jobs.
         logger.debug("Set _PENDING_JOB = %r", _PENDING_JOB)
-        self.app.exit()
+        if _PENDING_JOB and _PENDING_JOB[0] == "legacy":
+            # let the main loop pick up the legacy job
+            self.app.exit()
 
 
 # ---------------------------------------------------------------------------
 # 2) APP
 # ---------------------------------------------------------------------------
-class Loxide(App):
+class Loxide(App[Message]):
+    api: AirlockAPIWrapper
+    working_dir: str
+    policies: Optional[list[Policy]]
+    devices: Optional[list[Agent]]
+
     CSS = """
     #logo {
         width: 100%;
@@ -358,11 +348,12 @@ class Loxide(App):
     """
     BINDINGS = [
         ("q", "quit", "Quit"),
-        ("d", "open_dir", "Open Directory"),
+        ("f", "open_fe", "Launch Explorer"),
+        ("r", "refresh", "Refresh"),
     ]
 
     def __init__(self, api: AirlockAPIWrapper):
-        self._textual_theme = load_env("TEXTUAL_THEME") or "nord"
+        self._textual_theme = get_user_value("TEXTUAL_THEME", str, "nord")
         super().__init__()
         self.api = api
         wd = load_env("WORKING_DIR") or os.getcwd()
@@ -398,20 +389,24 @@ class Loxide(App):
         self.register_theme(get_retro_terminal_theme())
         self.register_theme(get_amber_terminal_theme())
         self.theme = self._textual_theme
-        self.push_screen(MainMenuScreen(api))
+        self.push_screen(MainMenuScreen())
+
+    def action_refresh(self) -> None:
+        self.refresh_data()
 
     def action_quit(self) -> None:
         global _PENDING_JOB
         _PENDING_JOB = None
         self.exit()
 
-    def action_open_dir(self) -> None:
-        # Refresh data before proceeding
-        self.refresh_data()
-        screen = self.screen_stack[-1]
-        if isinstance(screen, MainMenuScreen):
-            if screen.current_tab != "dir":
-                screen.switch_tab("dir")
+    def action_open_fe(self) -> None:
+        """Open the working directory in the OS file manager (footer binding)."""
+        path_to_open = self.working_dir or os.getcwd()
+        try:
+            open_directory(path_to_open)
+        except Exception as exc:
+            logger.error("Failed to open directory %s: %s", path_to_open, exc)
+            self.bell()  # optional feedback
 
 
 # ---------------------------------------------------------------------------

TUI/agentmoveoperations.py

@@ -1,23 +1,3 @@
-"""
-Agent Move Operations Widget Module
-
-This module provides a Textual-based UI widget for performing bulk operations on
-agent devices in the Airlock system. It allows users to:
-- View selected agents and their current policy assignments
-- Move agents to local approval mode with OTP enforcement
-- Toggle agents between audit and enforcement policy modes
-- Select and move agents to alternate policies (future implementation)
-
-The widget tracks operation state, manages button availability, and displays
-results with success/failure summaries that can be copied to clipboard.
-
-Dependencies:
-    - textual: TUI framework for building the widget and UI components
-    - models.agent: Agent model class
-    - services.agenthandler: Core agent operation functions
-    - flows.localApproval: Local approval workflow handling
-"""
-
 from dataclasses import asdict
 from datetime import datetime
 import logging
@@ -33,9 +13,9 @@ from textual.widget import Widget
 from textual.widgets import Button, DataTable, Header, Static, TextArea
 
 from models.agent import Agent
-from screens.otpworkflowscreen import OTPWorkflowScreen
-from screens.policyselectorscreen import PolicySelectorScreen
-from widgets.OTP_generate import OTPGenerator
+from TUI.OTP_generate import OTPGenerator
+from TUI.otpworkflowscreen import OTPWorkflowScreen
+from TUI.policyselectorscreen import PolicySelectorScreen
 
 logger = logging.getLogger(__name__)
 
@@ -203,21 +183,21 @@ class AgentMoveOperations(Widget):
                 f"Operation: {operation_name}",
                 f"{'=' * 50}",
                 "",
-                f"✅ Successful ({len(successful)}):",
+                f"✅ Successful ({len(successful)}):",
             ]
 
             if successful:
                 for agent, result in successful:
-                    results_lines.append(f"  ✅ {agent.hostname}")
+                    results_lines.append(f"  ✅ {agent.hostname}")
             else:
                 results_lines.append("  (none)")
 
             results_lines.append("")
-            results_lines.append(f"❌ Failed ({len(unsuccessful)}):")
+            results_lines.append(f"❌ Failed ({len(unsuccessful)}):")
 
             if unsuccessful:
                 for agent, error in unsuccessful:
-                    results_lines.append(f"  ❌ {agent.hostname}: {error}")
+                    results_lines.append(f"  ❌ {agent.hostname}: {error}")
             else:
                 results_lines.append("  (none)")
 
@@ -252,9 +232,9 @@ class AgentMoveOperations(Widget):
         - Operations panel: 1/3 width
         - Results area: Initially hidden, shown after operation completion
         """
-        yield Header(show_clock=True, icon="⚙")
+        yield Header(show_clock=True, icon="âš™")
         title_text = Static(
-            f"🖥️ Agent Operations - {len(self.agents)} device(s) selected",
+            f"🖥️ Agent Operations - {len(self.agents)} device(s) selected",
             id="move_ops_title",
         )
         title_text.styles.margin = (0, 0, 1, 0)
@@ -289,32 +269,32 @@ class AgentMoveOperations(Widget):
                 yield operations_label
 
                 # Operation buttons
-                export_csv_btn = Button("📈 Export CSV", id="export_csv_btn")
+                export_csv_btn = Button("📈 Export CSV", id="export_csv_btn")
                 export_csv_btn.styles.width = "100%"
                 export_csv_btn.styles.margin = (0, 0, 1, 0)
                 yield export_csv_btn
 
                 local_approval_btn = Button(
-                    "✔️ Local Approval Mode", id="local_approval_btn"
+                    "✔️ Local Approval Mode", id="local_approval_btn"
                 )
                 local_approval_btn.styles.width = "100%"
                 local_approval_btn.styles.margin = (0, 0, 1, 0)
                 yield local_approval_btn
 
-                otp_gen_btn = Button("🎫 Generate One Time Passes", id="otp_gen_btn")
+                otp_gen_btn = Button("🎫 Generate One Time Passes", id="otp_gen_btn")
                 otp_gen_btn.styles.width = "100%"
                 otp_gen_btn.styles.margin = (0, 0, 1, 0)
                 yield otp_gen_btn
 
                 toggle_enforcement_btn = Button(
-                    "🔄 Toggle Audit/Enforcement", id="toggle_enforcement_btn"
+                    "🔄 Toggle Audit/Enforcement", id="toggle_enforcement_btn"
                 )
                 toggle_enforcement_btn.styles.width = "100%"
                 toggle_enforcement_btn.styles.margin = (0, 0, 1, 0)
                 yield toggle_enforcement_btn
 
                 other_policy_btn = Button(
-                    "🔀 Move to Other Policy", id="other_policy_btn"
+                    "🔀 Move to Other Policy", id="other_policy_btn"
                 )
                 other_policy_btn.styles.width = "100%"
                 other_policy_btn.styles.margin = (0, 0, 1, 0)
@@ -325,7 +305,7 @@ class AgentMoveOperations(Widget):
                 status_label.styles.margin = (2, 0, 0, 0)
                 yield status_label
 
-                back_button = Button("← Back", id="back_button")
+                back_button = Button("← Back", id="back_button")
                 back_button.styles.width = "50%"
                 back_button.styles.margin = (0, 1, 1, 0)
                 yield back_button
@@ -389,17 +369,17 @@ class AgentMoveOperations(Widget):
 
                 pyperclip.copy(results_text.text)
                 self.app.notify(
-                    "📋✅ Results copied to clipboard!",
+                    "📋✅ Results copied to clipboard!",
                     severity="information",
                     timeout=2,
                 )
             except ImportError:
                 self.app.notify(
-                    "❌ pyperclip not installed. Run: pip install pyperclip",
+                    "❌ pyperclip not installed. Run: pip install pyperclip",
                     severity="warning",
                 )
             except Exception as e:
-                self.app.notify(f"❌ Failed to copy: {str(e)}", severity="error")
+                self.app.notify(f"❌ Failed to copy: {str(e)}", severity="error")
             event.stop()
         elif btn_id == "export_csv_btn":
             self._start_export_csv_operation()
@@ -447,7 +427,7 @@ class AgentMoveOperations(Widget):
         self.operation_in_progress = True
 
         status_label = self.query_one("#status_label", Static)
-        status_label.update("✔️ Moving agents to local approval...")
+        status_label.update("✔️ Moving agents to local approval...")
 
         # Get API from app
         api = self.app.api
@@ -482,12 +462,12 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error during local approval operation: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             return
 
         self.operation_in_progress = False
-        status_label.update("✅ Operation complete!")
+        status_label.update("✅ Operation complete!")
 
         # Display results in the widget
         self._display_results("Local Approval Mode", successful, unsuccessful)
@@ -531,9 +511,9 @@ class AgentMoveOperations(Widget):
             file_path = os.path.join(str(path), filename)
             df.to_csv(file_path, index=False)
             successful.append(file_path)
-            status_label.update(f"✅ Exported to {file_path}")
+            status_label.update(f"✅ Exported to {file_path}")
         except Exception:
-            status_label.update("❌ Failed")
+            status_label.update("❌ Failed")
 
         self.operation_in_progress = False
 
@@ -577,7 +557,7 @@ class AgentMoveOperations(Widget):
         self.operation_in_progress = True
 
         status_label = self.query_one("#status_label", Static)
-        status_label.update("⏳ Toggling enforcement mode...")
+        status_label.update("⏳ Toggling enforcement mode...")
 
         # Get API from app
         api = self.app.api
@@ -587,9 +567,9 @@ class AgentMoveOperations(Widget):
 
         try:
             from services.agenthandler import moveAgentToRelatedPolicy
-            from utils.configmanager import get_protected_json
+            from utils.configmanager import get_system_json
 
-            policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+            policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
 
             for agent in self.agents:
                 try:
@@ -613,12 +593,12 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error during toggle enforcement operation: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             return
 
         self.operation_in_progress = False
-        status_label.update("✅ Operation complete!")
+        status_label.update("✅ Operation complete!")
 
         # Display results in the widget
         self._display_results("Toggle Audit/Enforcement", successful, unsuccessful)
@@ -683,7 +663,7 @@ class AgentMoveOperations(Widget):
 
         except Exception as e:
             logger.error(f"Error loading policies: {e}")
-            status_label.update(f"❌ Error: {str(e)}")
+            status_label.update(f"❌ Error: {str(e)}")
             self.operation_in_progress = False
             self.selected_operation = ""
             self.app.notify(f"Failed to load policies: {str(e)}", severity="error")

TUI/allowlistselectionscreen.py

@@ -0,0 +1,657 @@
+from __future__ import annotations
+
+import logging
+from typing import Optional
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import Screen
+from textual.widgets import (
+    Button,
+    DataTable,
+    Footer,
+    Header,
+    Static,
+    TextArea,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class AllowlistSelectionWidget(Static):
+    """
+    Widget for selecting an allowlist and adding hashes to it.
+    Can be reused in different workflows.
+    """
+
+    DEFAULT_CSS = """
+    AllowlistSelectionWidget {
+        height: 1fr;
+        layout: vertical;
+    }
+    #allowlist_main {
+        height: 1fr;
+        width: 100%;
+    }
+    #left_panel {
+        width: 50%;
+        padding: 1;
+        border: solid $primary;
+    }
+    #right_panel {
+        width: 50%;
+        padding: 1;
+        border: solid $primary;
+    }
+    #allowlist_table {
+        height: 70%;
+        margin: 1 0;
+    }
+    #allowlist_table > .datatable--header {
+        text-style: bold;
+        background: $boost;
+    }
+    #allowlist_table Row {
+        height: 1;
+    }
+    #preview_area {
+        height: 60%;
+        margin: 1 0;
+    }
+    #action_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1;
+        content-align: center middle;
+    }
+    .panel-title {
+        text-style: bold;
+        margin: 0 0 1 0;
+    }
+    .info-text {
+        margin: 1 0;
+    }
+    """
+
+    def __init__(
+        self,
+        selected_data: pd.DataFrame,
+        api=None,
+        hostname: Optional[str] = None,
+        otpid: Optional[str] = None,
+        hash_column: str = "sha256",  # Default hash column name
+    ):
+        """
+        Initialize the allowlist selection widget.
+
+        Args:
+            selected_data: DataFrame containing the selected activities
+            api: API instance for making allowlist calls
+            hostname: Optional hostname for context
+            otpid: Optional OTP ID for context
+            hash_column: Name of the column containing hashes (default: "sha256")
+        """
+        super().__init__()
+        self.selected_data = selected_data
+        self.api = api
+        self.hostname = hostname
+        self.otpid = otpid
+        self.hash_column = hash_column
+        self.allowlists = []
+        self.selected_allowlist = None
+        self.hashes_to_add = []
+
+    def compose(self) -> ComposeResult:
+        with Horizontal(id="allowlist_main"):
+            # Left panel - Allowlist selection
+            with Vertical(id="left_panel"):
+                yield Static("Select Allowlist", classes="panel-title")
+                yield Static(
+                    f"Choose an allowlist to add {len(self.selected_data)} selected items",
+                    classes="info-text",
+                )
+
+                # Allowlist table
+                self.allowlist_table = DataTable(id="allowlist_table")
+                self.allowlist_table.cursor_type = "row"
+                yield self.allowlist_table
+
+                # Refresh button
+                self.refresh_btn = Button(
+                    "🔄 Refresh Allowlists", id="refresh_allowlists_btn"
+                )
+                yield self.refresh_btn
+
+            # Right panel - Preview and actions
+            with Vertical(id="right_panel"):
+                yield Static("Preview", classes="panel-title")
+
+                # Context information
+                context_text = []
+                if self.hostname:
+                    context_text.append(f"Host: {self.hostname}")
+                if self.otpid:
+                    context_text.append(f"OTP: {self.otpid}")
+                context_text.append(f"Selected Activities: {len(self.selected_data)}")
+
+                yield Static(" | ".join(context_text), classes="info-text")
+
+                # Preview text area
+                self.preview_area = TextArea(
+                    id="preview_area", read_only=True, language="markdown"
+                )
+                yield self.preview_area
+
+                # Hash statistics
+                self.stats_label = Static("", id="stats_label", classes="info-text")
+                yield self.stats_label
+
+        # Action buttons at bottom
+        with Horizontal(id="action_buttons"):
+            self.back_btn = Button("⬅ Back", id="back_btn")
+            self.add_btn = Button("➕ Add to Allowlist", id="add_to_allowlist_btn")
+
+            self.back_btn.styles.width = "50%"
+            self.add_btn.styles.width = "50%"
+            self.add_btn.disabled = True  # Disabled until allowlist selected
+
+            yield self.back_btn
+            yield self.add_btn
+
+    async def on_mount(self) -> None:
+        """Load allowlists when widget mounts."""
+        await self.load_allowlists()
+        await self.extract_and_preview_hashes()
+
+    async def load_allowlists(self) -> None:
+        """Load available allowlists from API, grouped by policy association."""
+        if not self.api:
+            logger.error("No API available")
+            self.allowlist_table.add_column("Error")
+            self.allowlist_table.add_row("No API available")
+            return
+
+        try:
+            # First, try to get the host's policy if hostname is provided
+            host_policy_allowlists = []
+            host_policy_ids = set()
+            policy_name = "Unknown Policy"  # Default value
+            group_id = None
+
+            if self.hostname:
+                try:
+                    # Get agent info to find its policy
+                    agents_df = self.api.agent_find_by_hostname(self.hostname)
+                    if not agents_df.empty:
+                        # Get the policy group ID for this host
+                        group_id = agents_df.iloc[0].get("groupid")
+
+                        # Look up the policy name from app's cached policies
+                        if (
+                            group_id
+                            and hasattr(self.app, "policies")
+                            and self.app.policies
+                        ):
+                            for policy in self.app.policies:
+                                if policy.groupid == group_id:
+                                    policy_name = policy.name
+                                    logger.info(
+                                        f"Found policy name: '{policy_name}' for group_id: {group_id}"
+                                    )
+                                    break
+
+                        logger.info(
+                            f"Found host '{self.hostname}' in policy '{policy_name}' (group_id: {group_id})"
+                        )
+
+                        if group_id:
+                            # Get allowlists for this policy
+                            policy_allowlists_df = self.api.policy_list_allowlists(
+                                group_id
+                            )
+                            if not policy_allowlists_df.empty:
+                                host_policy_allowlists = policy_allowlists_df.to_dict(
+                                    orient="records"
+                                )
+                                host_policy_ids = {
+                                    al.get("applicationid")
+                                    for al in host_policy_allowlists
+                                }
+                                logger.info(
+                                    f"Found {len(host_policy_allowlists)} allowlists for host's policy"
+                                )
+                except Exception as e:
+                    logger.warning(f"Could not get host's policy allowlists: {e}")
+
+            # If we still don't have a policy name, try to get it from the first allowlist or use a default
+            if not policy_name:
+                # Get all policies and try to find which one has allowlists
+                try:
+                    all_policies_df = self.api.policy_find_all()
+                    if not all_policies_df.empty:
+                        # If we have a group_id from somewhere, use it
+                        if group_id:
+                            policy_row = all_policies_df[
+                                all_policies_df["groupid"] == group_id
+                            ]
+                            if not policy_row.empty:
+                                policy_name = policy_row.iloc[0].get(
+                                    "groupname", "Unknown Policy"
+                                )
+                        else:
+                            # Use the first policy as fallback
+                            policy_name = all_policies_df.iloc[0].get(
+                                "groupname", "Default Policy"
+                            )
+                            logger.info(f"Using first available policy: {policy_name}")
+                    else:
+                        policy_name = "Unknown Policy"
+                except Exception as e:
+                    logger.warning(f"Could not fetch policies: {e}")
+                    policy_name = "Unknown Policy"
+
+            # Get all allowlists
+            all_allowlists_df = self.api.allowlist_find_all()
+
+            if all_allowlists_df.empty:
+                self.allowlist_table.add_column("No Allowlists")
+                self.allowlist_table.add_row("No allowlists found")
+                return
+
+            all_allowlists = all_allowlists_df.to_dict(orient="records")
+
+            # Separate into two groups: policy-associated and others
+            other_allowlists = [
+                al
+                for al in all_allowlists
+                if al.get("applicationid") not in host_policy_ids
+            ]
+
+            # Sort each group alphabetically by name
+            host_policy_allowlists.sort(key=lambda x: x.get("name", "").lower())
+            other_allowlists.sort(key=lambda x: x.get("name", "").lower())
+
+            # Combine lists with policy-associated first
+            self.allowlists = host_policy_allowlists + other_allowlists
+
+            # Setup table columns
+            self.allowlist_table.clear()
+            self.allowlist_table.add_columns("Name", "Application ID", "Type")
+
+            # Track which rows are headers vs actual allowlists
+            self._row_to_allowlist_map = {}
+            current_row = 0
+
+            # Add policy-associated allowlists if any
+            if host_policy_allowlists:
+                # Add section header
+                header_text = f"=== Policy: {policy_name or 'Host Policy'} ==="
+                self.allowlist_table.add_row(header_text, "", "", key="header_policy")
+                current_row += 1
+
+                # Add policy allowlists
+                for idx, allowlist in enumerate(host_policy_allowlists):
+                    name = allowlist.get("name", "Unknown")
+                    app_id = allowlist.get("applicationid", "Unknown")
+
+                    self.allowlist_table.add_row(
+                        f"  {name}",  # Indent to show grouping
+                        app_id,
+                        "Policy",
+                        key=f"policy_{idx}",
+                    )
+                    self._row_to_allowlist_map[current_row] = idx
+                    current_row += 1
+
+            # Add other allowlists
+            if other_allowlists:
+                # Add section header
+                if host_policy_allowlists:
+                    # Add spacer if we have policy allowlists above
+                    self.allowlist_table.add_row("", "", "", key="spacer")
+                    current_row += 1
+
+                self.allowlist_table.add_row(
+                    "=== Other Available Allowlists ===", "", "", key="header_other"
+                )
+                current_row += 1
+
+                # Add other allowlists
+                for idx, allowlist in enumerate(other_allowlists):
+                    name = allowlist.get("name", "Unknown")
+                    app_id = allowlist.get("applicationid", "Unknown")
+
+                    self.allowlist_table.add_row(
+                        f"  {name}",  # Indent to show grouping
+                        app_id,
+                        "General",
+                        key=f"other_{idx}",
+                    )
+                    # Map to the correct index in the combined list
+                    actual_idx = len(host_policy_allowlists) + idx
+                    self._row_to_allowlist_map[current_row] = actual_idx
+                    current_row += 1
+
+            # Log summary
+            logger.info(
+                f"Loaded {len(self.allowlists)} total allowlists: "
+                f"{len(host_policy_allowlists)} policy-associated, "
+                f"{len(other_allowlists)} others"
+            )
+
+            # Update stats label if no allowlists in policy
+            if self.hostname and not host_policy_allowlists:
+                self.stats_label.update(
+                    f"Note: No allowlists found for {self.hostname}'s policy | "
+                    + self.stats_label.content.plain
+                )
+
+        except Exception as exc:
+            logger.exception(f"Failed to load allowlists: {exc}")
+            self.allowlist_table.add_column("Error")
+            self.allowlist_table.add_row(f"Failed to load: {str(exc)}")
+
+    async def extract_and_preview_hashes(self) -> None:
+        """Extract hashes from selected data and show preview."""
+        preview_lines = ["## Hash Extraction Summary\n"]
+
+        # Check for hash column
+        if self.hash_column not in self.selected_data.columns:
+            # Try to find a hash column
+            possible_hash_cols = [
+                "sha256",
+                "SHA256",
+                "hash",
+                "Hash",
+                "sha1",
+                "SHA1",
+                "md5",
+                "MD5",
+                "filehash",
+                "file_hash",
+            ]
+            found_col = None
+            for col in possible_hash_cols:
+                if col in self.selected_data.columns:
+                    found_col = col
+                    break
+
+            if found_col:
+                self.hash_column = found_col
+                preview_lines.append(f"✓ Found hash column: **{found_col}**\n")
+            else:
+                preview_lines.append("⚠️ **No hash column found**\n")
+                preview_lines.append("Available columns:\n")
+                for col in self.selected_data.columns:
+                    if col != "_row_id":
+                        preview_lines.append(f"  - {col}\n")
+
+                self.preview_area.text = "".join(preview_lines)
+                self.stats_label.update("No hashes to add")
+                return
+
+        # Extract unique hashes
+        hashes = self.selected_data[self.hash_column].dropna().unique()
+        self.hashes_to_add = [h for h in hashes if h and str(h).strip()]
+
+        # Build preview
+        preview_lines.append(f"### Found {len(self.hashes_to_add)} unique hashes\n\n")
+
+        # Show sample of hashes (first 10)
+        preview_lines.append("**Sample hashes to be added:**\n```\n")
+        for i, hash_val in enumerate(self.hashes_to_add[:10]):
+            preview_lines.append(f"{i+1}. {hash_val}\n")
+        if len(self.hashes_to_add) > 10:
+            preview_lines.append(f"... and {len(self.hashes_to_add) - 10} more\n")
+        preview_lines.append("```\n\n")
+
+        # Show sample of source data
+        preview_lines.append("**Sample source activities:**\n")
+        sample_cols = [
+            col
+            for col in self.selected_data.columns
+            if col not in ["_row_id"] and col in ["filename", "path", "action", "user"]
+        ]
+        if not sample_cols:
+            sample_cols = [
+                col for col in self.selected_data.columns if col != "_row_id"
+            ][:3]
+
+        if sample_cols:
+            preview_lines.append("```\n")
+            for i, row in self.selected_data[sample_cols].head(5).iterrows():
+                row_text = " | ".join([f"{col}: {row[col]}" for col in sample_cols])
+                preview_lines.append(f"{row_text}\n")
+            preview_lines.append("```\n")
+
+        self.preview_area.text = "".join(preview_lines)
+
+        # Update statistics
+        self.stats_label.update(
+            f"Ready to add {len(self.hashes_to_add)} unique hashes | "
+            f"From {len(self.selected_data)} selected activities"
+        )
+
+    async def on_data_table_row_selected(self, event) -> None:
+        """Handle allowlist selection."""
+        try:
+            # Extract row index from event - handle different event structures
+            row_index = None
+
+            # Try to get row index from coordinate
+            if hasattr(event, "coordinate") and hasattr(event.coordinate, "row"):
+                row_index = event.coordinate.row
+            # Try cursor_row as fallback
+            elif hasattr(event, "cursor_row"):
+                row_index = event.cursor_row
+            # Try getting from the table itself
+            else:
+                table = self.allowlist_table
+                if hasattr(table, "cursor_row"):
+                    row_index = table.cursor_row
+
+            # Validate row index
+            if row_index is not None and isinstance(row_index, int):
+                # Account for group headers in the row count
+                actual_allowlist_index = self._get_allowlist_index_from_row(row_index)
+
+                if (
+                    actual_allowlist_index is not None
+                    and 0 <= actual_allowlist_index < len(self.allowlists)
+                ):
+                    self.selected_allowlist = self.allowlists[actual_allowlist_index]
+                    self.add_btn.disabled = False
+                    self.add_btn.label = (
+                        f"➕ Add to '{self.selected_allowlist.get('name', 'Unknown')}'"
+                    )
+
+                    # Update preview with selection
+                    await self._update_preview_with_selection()
+
+                    logger.info(
+                        f"Selected allowlist: {self.selected_allowlist.get('name')}"
+                    )
+                else:
+                    logger.debug(f"Row {row_index} is a header or invalid")
+            else:
+                logger.warning(f"Could not extract valid row index from event: {event}")
+
+        except Exception as exc:
+            logger.exception(f"Failed to select allowlist: {exc}")
+
+    def _get_allowlist_index_from_row(self, row_index: int) -> Optional[int]:
+        """Convert table row index to allowlist list index, accounting for group headers."""
+        # This will be updated when we have group headers
+        if hasattr(self, "_row_to_allowlist_map"):
+            return self._row_to_allowlist_map.get(row_index)
+        return row_index
+
+    async def _update_preview_with_selection(self) -> None:
+        """Update preview when an allowlist is selected."""
+        if not self.selected_allowlist:
+            return
+
+        current_text = self.preview_area.text
+        # Remove any existing selection header
+        if "### Selected Allowlist:" in current_text:
+            lines = current_text.split("\n")
+            # Find and remove the selection lines
+            new_lines = []
+            skip_next = False
+            for line in lines:
+                if line.startswith("### Selected Allowlist:"):
+                    skip_next = True
+                    continue
+                if skip_next and line.startswith("Application ID:"):
+                    skip_next = False
+                    continue
+                if not skip_next:
+                    new_lines.append(line)
+            current_text = "\n".join(new_lines)
+
+        # Add new selection at the top
+        selection_text = (
+            f"### Selected Allowlist: **{self.selected_allowlist.get('name')}**\n"
+            f"Application ID: {self.selected_allowlist.get('applicationid')}\n\n"
+        )
+        self.preview_area.text = selection_text + current_text
+
+    async def on_button_pressed(self, event) -> None:
+        """Handle button presses."""
+        btn = getattr(event, "button", None) or getattr(event, "sender", None)
+        btn_id = getattr(btn, "id", None) or getattr(event, "button_id", None)
+
+        if btn is self.back_btn or btn_id == "back_btn":
+            await self.app.pop_screen()
+            event.stop()
+            return
+
+        if btn is self.refresh_btn or btn_id == "refresh_allowlists_btn":
+            await self.load_allowlists()
+            event.stop()
+            return
+
+        if btn is self.add_btn or btn_id == "add_to_allowlist_btn":
+            await self.add_hashes_to_allowlist()
+            event.stop()
+            return
+
+    async def add_hashes_to_allowlist(self) -> None:
+        """Add the extracted hashes to the selected allowlist."""
+        if not self.selected_allowlist or not self.hashes_to_add:
+            self.app.notify(
+                "No allowlist selected or no hashes to add", severity="warning"
+            )
+            return
+
+        if not self.api:
+            self.app.notify("API not available", severity="error")
+            return
+
+        try:
+            # Disable button during operation
+            self.add_btn.disabled = True
+            self.add_btn.label = "⏳ Adding hashes..."
+
+            # Call API to add hashes
+            app_id = self.selected_allowlist.get("applicationid")
+            allowlist_name = self.selected_allowlist.get("name", "Unknown")
+
+            logger.info(
+                f"Adding {len(self.hashes_to_add)} hashes to allowlist {allowlist_name} (ID: {app_id})"
+            )
+
+            result = self.api.hash_add_to_allowlist(app_id, self.hashes_to_add)
+
+            # Success notification
+            self.app.notify(
+                f"✅ Successfully added {len(self.hashes_to_add)} hashes to '{allowlist_name}'",
+                title="Success",
+                severity="information",
+                timeout=5,
+            )
+
+            # Update preview to show success
+            self.preview_area.text = (
+                f"## ✅ SUCCESS\n\n"
+                f"Added **{len(self.hashes_to_add)} hashes** to allowlist:\n"
+                f"**{allowlist_name}** (ID: {app_id})\n\n"
+                f"### Operation Details:\n"
+                f"- Source: {self.hostname or 'Multiple hosts'}\n"
+                f"- OTP ID: {self.otpid or 'N/A'}\n"
+                f"- Activities processed: {len(self.selected_data)}\n"
+                f"- Unique hashes added: {len(self.hashes_to_add)}\n"
+            )
+
+            # Change button to "Done"
+            self.add_btn.label = "✅ Done"
+            self.add_btn.disabled = True
+
+        except Exception as exc:
+            logger.exception(f"Failed to add hashes to allowlist: {exc}")
+            self.app.notify(
+                f"❌ Failed to add hashes: {str(exc)}",
+                title="Error",
+                severity="error",
+                timeout=10,
+            )
+
+            # Re-enable button
+            self.add_btn.disabled = False
+            self.add_btn.label = "⟳ Retry Add to Allowlist"
+
+
+class AllowlistSelectionScreen(Screen):
+    """
+    Screen wrapper for the AllowlistSelectionWidget.
+    """
+
+    BINDINGS = [
+        Binding("b", "back", "Back"),
+        Binding("r", "refresh", "Refresh Allowlists"),
+        Binding("enter", "confirm", "Add to Allowlist"),
+    ]
+
+    def __init__(
+        self,
+        selected_data: pd.DataFrame,
+        api=None,
+        hostname: Optional[str] = None,
+        otpid: Optional[str] = None,
+        hash_column: str = "sha256",
+    ):
+        super().__init__()
+        self.selected_data = selected_data
+        self.api = api
+        self.hostname = hostname
+        self.otpid = otpid
+        self.hash_column = hash_column
+
+    def compose(self) -> ComposeResult:
+        yield Header(show_clock=True)
+        self.widget = AllowlistSelectionWidget(
+            self.selected_data,
+            api=self.api,
+            hostname=self.hostname,
+            otpid=self.otpid,
+            hash_column=self.hash_column,
+        )
+        yield self.widget
+        yield Footer()
+
+    async def action_back(self) -> None:
+        """Go back to previous screen."""
+        await self.app.pop_screen()
+
+    async def action_refresh(self) -> None:
+        """Refresh the allowlists."""
+        if hasattr(self, "widget") and self.widget:
+            await self.widget.load_allowlists()
+
+    async def action_confirm(self) -> None:
+        """Confirm and add to allowlist."""
+        if hasattr(self, "widget") and self.widget:
+            if self.widget.selected_allowlist and self.widget.hashes_to_add:
+                await self.widget.add_hashes_to_allowlist()

TUI/moveagentworkflowscreen.py

@@ -1,18 +1,18 @@
-from typing import List
+from typing import List, Optional
 
 from textual.app import ComposeResult
 from textual.screen import Screen
 
 from models.agent import Agent
-from widgets.agentmoveoperations import AgentMoveOperations
-from widgets.multiagentselector import MultiAgentSelector
-from widgets.resultsdisplay import ResultsDisplay
+from TUI.agentmoveoperations import AgentMoveOperations
+from TUI.multiagentselector import MultiAgentSelector
+from TUI.resultsdisplay import ResultsDisplay
 
 
 class MoveAgentWorkflowScreen(Screen):
     """Screen that handles the agent movement workflow."""
 
-    def __init__(self, all_agents: List[Agent]):
+    def __init__(self, all_agents: Optional[List[Agent]]):
         super().__init__()
         self.all_agents = all_agents
         self.selected_agents = None

TUI/multiagentselector.py

@@ -1,6 +1,6 @@
 import difflib
 import re
-from typing import List
+from typing import List, Optional
 
 from textual.containers import Horizontal, Vertical
 from textual.css.query import NoMatches
@@ -25,7 +25,7 @@ class MultiAgentSelector(Widget):
             super().__init__()
             self.selected_agents = selected_agents
 
-    def __init__(self, all_agents: List[Agent]):
+    def __init__(self, all_agents: Optional[List[Agent]]):
         super().__init__()
         self.all_agents = all_agents
         self._match_type = "exact"

TUI/otpactivityscreen.py

@@ -0,0 +1,897 @@
+from __future__ import annotations
+
+from datetime import datetime
+import logging
+import os
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.binding import Binding
+from textual.containers import Horizontal, Vertical
+from textual.screen import Screen
+from textual.widgets import Button, DataTable, Footer, Header, Static
+
+from TUI.allowlistselectionscreen import AllowlistSelectionScreen
+from utils.configmanager import load_env
+
+logger = logging.getLogger(__name__)
+
+
+def _load_working_dir() -> str:
+    """
+    Load the working directory from environment variables or use the current working directory.
+    """
+    wd = os.environ.get("WORKING_DIR")
+    if wd:
+        return wd
+    return os.getcwd()
+
+
+class OTPActivitiesWidget(Static):
+    """
+    Reusable widget that contains the sessions table (left) and an Activity Preview (right).
+    The right side shows an Activity Preview that takes ~75% vertical space, and a lower area
+    with Back and Continue buttons. The Continue button pushes ActivityDetailScreen with the
+    currently-loaded activities.
+    """
+
+    DEFAULT_CSS = """
+    OTPActivitiesWidget {
+        height: 1fr;
+    }
+    #main_row {
+        width: 100%;
+        height: 100%;
+        layout: horizontal;
+    }
+    #left_panel {
+        width: 60%;
+        min-width: 60;
+        border: none;
+    }
+    #right_panel {
+        width: 40%;
+        min-width: 40;
+        border: none;
+        layout: vertical;
+    }
+    #activity_preview_container {
+        height: 1fr;
+        border: none;
+        padding: 1 1;
+    }
+    #activity_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    """
+
+    def compose(self) -> ComposeResult:
+        # Layout: horizontal main row with left & right panels
+        with Horizontal(id="main_row"):
+            # Left: sessions area
+            with Vertical(id="left_panel"):
+                yield Static("OTP Sessions", classes="panel-title")
+                with Vertical(id="sessions_table_container"):
+                    self.sessions_table = DataTable(id="sessions_table")
+                    self.sessions_table.styles.width = "100%"
+                    yield self.sessions_table
+            # Right: Activity Preview (top 3/4) + buttons (bottom 1/4)
+            with Vertical(id="right_panel"):
+                # Activity preview area (takes ~75% of right panel)
+                yield Static("Activity Preview", classes="panel-title")
+                with Vertical(id="activity_preview_container"):
+                    self.activities_table = DataTable(id="activity_preview_table")
+                    yield self.activities_table
+                # Buttons area at the bottom (Back, Continue)
+                with Horizontal(id="activity_buttons"):
+                    # Back takes left side, Continue right side
+                    self.back_btn = Button("Back", id="activity_back_btn")
+                    self.continue_btn = Button("Continue", id="activity_continue_btn")
+                    # Stretch buttons nicely
+                    self.back_btn.styles.width = "50%"
+                    self.continue_btn.styles.width = "50%"
+                    yield self.back_btn
+                    yield self.continue_btn
+
+    async def on_mount(self) -> None:
+        # Configure sessions table and activities preview
+        self.sessions_table.clear()
+        self.sessions_table.add_columns(
+            "otpid", "hostname", "status", "purpose", "granted"
+        )
+        self.activities_table.clear()
+        # activities_table columns are dynamically added when activities are loaded.
+        # Selection behavior
+        self.sessions_table.cursor_type = "row"
+        try:
+            self.sessions_table.zebra_stripes = True
+        except Exception:
+            pass
+        self.activities_table.cursor_type = "row"
+        try:
+            self.activities_table.zebra_stripes = True
+        except Exception:
+            pass
+        # Store state
+        self._sessions_df: pd.DataFrame | None = None
+        self._activities_df: pd.DataFrame | None = None
+        self._selected_session_otpid: str | int | None = None
+
+    async def on_button_pressed(self, event) -> None:  # type: ignore[override]
+        """
+        Handle Back / Continue buttons for the Activity Preview area.
+        """
+        # Try to resolve the button object from the event
+        btn = (
+            getattr(event, "button", None)
+            or getattr(event, "sender", None)
+            or getattr(event, "control", None)
+            or getattr(event, "widget", None)
+        )
+        btn_id = (
+            getattr(btn, "id", None)
+            or getattr(event, "button_id", None)
+            or getattr(event, "id", None)
+        )
+        # ---- Back ----
+        if btn is self.back_btn or btn_id == getattr(self.back_btn, "id", None):
+            while len(self.app.screen_stack) > 2:
+                self.app.pop_screen()
+            event.stop()
+            return
+        # ---- Continue ----
+        if btn is self.continue_btn or btn_id == getattr(self.continue_btn, "id", None):
+            if self._activities_df is None or self._activities_df.empty:
+                logger.info("Continue pressed but no activities loaded.")
+                await self.post_message(
+                    Static("No activities loaded to continue with.")
+                )
+                return
+            # Copy activities DataFrame to pass to new screen
+            activities_copy = self._activities_df.copy()
+            otpid = self._selected_session_otpid
+            # Optionally include hostname if available
+            hostname = None
+            try:
+                if self._sessions_df is not None:
+                    df = self._sessions_df.reset_index(drop=True)
+                    match = df[df["otpid"] == otpid]
+                    if not match.empty:
+                        hostname = match.iloc[0].get("hostname")
+            except Exception:
+                hostname = None
+            # Create and push ActivityDetailScreen, handing the data
+            try:
+                detail_screen = ActivityDetailScreen(
+                    activities_copy, otpid=otpid, hostname=hostname
+                )
+                await self.app.push_screen(detail_screen)
+            except Exception as exc:
+                logger.exception("Failed to push ActivityDetailScreen: %s", exc)
+            return
+        # Unknown button on widget
+        logger.debug(
+            "Unhandled OTPActivitiesWidget button pressed (resolved btn=%r, id=%r)",
+            btn,
+            btn_id,
+        )
+
+    async def on_data_table_row_selected(self, event) -> None:  # type: ignore[override]
+        """
+        Robust handler for DataTable row-selection across Textual micro-versions.
+        Tries many attribute names and shapes:
+         - numeric index (row_key, row_index, index)
+         - coordinate object or tuple (coordinate.row or (row, col))
+         - direct row values (row, values, cells) -> we try to map those back to the sessions DF
+         - table.cursor_row fallback
+        """
+        # 1) Determine the sending table (best-effort)
+        sender = None
+        for attr in ("sender", "table", "data_table", "control"):
+            sender = getattr(event, attr, None)
+            if sender is not None:
+                break
+        if sender is None:
+            sender = self.sessions_table  # Assume sessions_table if unknown
+        # Only respond to selections in the sessions table
+        if sender is not self.sessions_table:
+            return
+
+        # Helper to log and return
+        def _bad(msg: str, *args):
+            logger.warning(msg, *args)
+            return None
+
+        # 2) Try to extract a numeric index
+        row_key = None
+        for attr in ("row_key", "row", "row_index", "index"):
+            row_key = getattr(event, attr, None)
+            if row_key is not None:
+                break
+        # If coordinate: try to extract .row or tuple[0]
+        if row_key is None:
+            coord = getattr(event, "coordinate", None) or getattr(
+                event, "cursor_coordinate", None
+            )
+            if coord is not None:
+                if hasattr(coord, "row"):
+                    row_key = coord.row
+                elif isinstance(coord, (tuple, list)) and len(coord) >= 1:
+                    row_key = coord[0]
+        # If still nothing, maybe the event provides the row's cell values directly
+        row_values = None
+        for attr in ("values", "cells", "row", "row_values", "selected_row_values"):
+            val = getattr(event, attr, None)
+            if val:
+                # Prefer actual sequence of cell values
+                row_values = val
+                break
+        # If we have row_values, try to map them back to the sessions DataFrame
+        if row_values is not None:
+            # Normalize into list of strings for comparison
+            try:
+                vals = [
+                    "" if pd.isna(v) else str(v)
+                    for v in (
+                        list(row_values)
+                        if not isinstance(row_values, str)
+                        else [row_values]
+                    )
+                ]
+            except Exception:
+                vals = [str(row_values)]
+            # Try to match against the expected columns order we render
+            if self._sessions_df is None or self._sessions_df.empty:
+                logger.warning(
+                    "Sessions DataFrame is empty; cannot map selected row values."
+                )
+                return
+            df_ordered = self._sessions_df.reset_index(drop=True)
+            expected_cols = ["otpid", "hostname", "status", "purpose", "granted"]
+
+            # Build stringified candidates for each row in df using the same columns we show
+            def _row_to_vals(sr):
+                out = []
+                for c in expected_cols:
+                    if c in sr:
+                        v = sr[c]
+                        out.append("" if pd.isna(v) else str(v))
+                    else:
+                        out.append("")
+                return out
+
+            match_idx = None
+            for i, sr in df_ordered.iterrows():
+                cand = _row_to_vals(sr)
+                # Compare prefix: row values might be a subset (e.g. only first 3 cols), so compare prefix only
+                if len(vals) <= len(cand) and all(
+                    vals[j] == cand[j] for j in range(len(vals))
+                ):
+                    match_idx = i
+                    break
+            if match_idx is None:
+                # Try looser match: compare first cell only (otpid)
+                first = vals[0] if vals else None
+                if first is not None:
+                    for i, sr in df_ordered.iterrows():
+                        cand0 = "" if pd.isna(sr.get("otpid")) else str(sr.get("otpid"))
+                        if cand0 == first:
+                            match_idx = i
+                            break
+            if match_idx is None:
+                logger.warning(
+                    "Unable to locate DataFrame row matching selected row values: %r",
+                    vals,
+                )
+                return
+            idx = int(match_idx)
+        else:
+            # 3) If we have a row_key, try to normalize to an int index
+            if row_key is not None:
+                try:
+                    idx = int(row_key)
+                except Exception:
+                    # Try converting via string
+                    try:
+                        idx = int(str(row_key))
+                    except Exception:
+                        idx = None
+                if idx is None:
+                    # Final numeric fallback: use sessions_table.cursor_row if present
+                    try:
+                        idx = getattr(self.sessions_table, "cursor_row")
+                    except Exception:
+                        idx = None
+                if idx is None:
+                    _bad("Failed to normalize row/key from event: %r", row_key)
+                    return
+            else:
+                # 4) Try table cursor_row as last resort
+                try:
+                    idx = getattr(self.sessions_table, "cursor_row")
+                except Exception:
+                    logger.warning(
+                        "Could not determine selected row from event: %r", event
+                    )
+                    # Helpful debug hint for you to paste back if still failing:
+                    logger.debug("Event repr for debugging: %r", event)
+                    return
+        # At this point we should have an integer idx
+        try:
+            idx = int(idx)
+        except Exception:
+            logger.exception(
+                "Final normalization of selected row index failed: %r", idx
+            )
+            return
+        # Validate sessions df
+        if self._sessions_df is None or self._sessions_df.empty:
+            logger.warning("Sessions DataFrame empty; nothing to select.")
+            return
+        df_ordered = self._sessions_df.reset_index(drop=True)
+        if idx < 0 or idx >= len(df_ordered):
+            logger.warning(
+                "Selected row index %s out of range (0..%d)", idx, len(df_ordered) - 1
+            )
+            return
+        row_series = df_ordered.iloc[idx]
+        otpid = row_series.get("otpid")
+        hostname = row_series.get("hostname")
+        # Store selected session and fetch activities
+        self._selected_session_otpid = otpid
+        # Obtain api from app (try multiple places)
+        api = (
+            getattr(self.app, "api", None)
+            or getattr(self, "api", None)
+            or getattr(self.app, "airlock_api", None)
+        )
+        if api is None:
+            logger.error("No API available on self.app.api - cannot fetch activities")
+            return
+        logger.info(
+            "Fetching activities for otpid=%s host=%s (selected row=%s)",
+            otpid,
+            hostname,
+            idx,
+        )
+        await self._fetch_activities_for_otpid(api, otpid, hostname=hostname)
+
+    async def load_sessions_from_api(self, api) -> None:
+        """
+        Pulls OTP session lists, adds status column, concatenates and populates the sessions table.
+        """
+        try:
+            active = api.otp_find_active()
+            awaiting = api.otp_find_awaiting()
+            enforced = api.otp_find_enforced()
+            revoked = api.otp_find_revoked()
+        except Exception as exc:
+            logger.exception("Failed to fetch OTP session lists: %s", exc)
+            # Present empty
+            active = awaiting = enforced = revoked = pd.DataFrame()
+
+        # Ensure DataFrame objects
+        def _ensure_df(df):
+            return df if isinstance(df, pd.DataFrame) else pd.DataFrame(df)
+
+        active = _ensure_df(active)
+        awaiting = _ensure_df(awaiting)
+        enforced = _ensure_df(enforced)
+        revoked = _ensure_df(revoked)
+        for df, status in [
+            (active, "active"),
+            (awaiting, "awaiting"),
+            (enforced, "enforced"),
+            (revoked, "revoked"),
+        ]:
+            if "status" not in df.columns:
+                df["status"] = status
+        combined = pd.concat([active, awaiting, enforced, revoked], ignore_index=True)
+        if "otpid" in combined.columns:
+            combined = combined.sort_values(by="otpid", ascending=False)
+        self._sessions_df = combined
+        # Populate DataTable
+        self.sessions_table.clear()
+        # Ensure columns exist in DF and when missing add empty column
+        expected_cols = ["otpid", "hostname", "status", "purpose", "granted"]
+        for col in expected_cols:
+            if col not in combined.columns:
+                combined[col] = ""
+        self.sessions_table.add_columns(*expected_cols)
+        # Add rows
+        for _, row in combined[expected_cols].iterrows():
+            # Convert values to str for safe insertion
+            vals = ["" if pd.isna(v) else v for v in row.to_list()]
+            self.sessions_table.add_row(*[str(v) for v in vals])
+        logger.info("Loaded %d OTP sessions.", len(combined))
+
+    async def _fetch_activities_for_otpid(self, api, otpid, hostname=None) -> None:
+        """
+        Fetch activities DataFrame for a given otpid and populate activities_table.
+        """
+        try:
+            result = api.otp_get_activities(otpid)
+            result_df = (
+                result if isinstance(result, pd.DataFrame) else pd.DataFrame(result)
+            )
+        except Exception as exc:
+            logger.exception("Failed to fetch activities for otpid %s: %s", otpid, exc)
+            result_df = pd.DataFrame()
+        # Attach hostname if provided
+        if hostname is not None:
+            result_df["hostname"] = hostname
+        if result_df.empty:
+            logger.info("No activities found for otpid %s (host: %s)", otpid, hostname)
+            self._activities_df = pd.DataFrame()
+            self.activities_table.clear()
+            return
+        # Store and render
+        self._activities_df = result_df.copy()
+        # Rebuild activities_table columns from result_df
+        self.activities_table.clear()
+        # Ensure stable column order
+        for col in result_df.columns:
+            self.activities_table.add_column(col)
+        # Add rows
+        for _, arow in result_df.iterrows():
+            values = ["" if pd.isna(v) else v for v in arow.to_list()]
+            self.activities_table.add_row(*[str(v) for v in values])
+        logger.info(
+            "Loaded %d activity rows for otpid %s (host: %s)",
+            len(result_df),
+            otpid,
+            hostname,
+        )
+
+    async def export_activities(self) -> None:
+        """
+        Export currently-loaded activities DataFrame to CSV.
+        Can be called directly (programmatically) or from the button handler.
+        """
+        if self._activities_df is None or self._activities_df.empty:
+            logger.info("No activities loaded to export.")
+            # On-screen short message
+            await self.post_message(Static("No activities to export."))
+            return
+        working_dir = _load_working_dir()
+        timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
+        filename = f"otp_activities_{self._selected_session_otpid}_{timestamp}.csv"
+        file_path = os.path.join(working_dir, filename)
+        try:
+            self._activities_df.to_csv(file_path, index=False)
+            logger.info("Exported activities to %s", file_path)
+            await self.post_message(Static(f"✅ Exported activities to: {file_path}"))
+        except Exception as exc:
+            logger.exception("Failed to export activities to %s: %s", file_path, exc)
+            await self.post_message(Static("Failed to export activities; check logs."))
+
+
+class ActivityDetailWidget(Static):
+    """
+    Interactive widget for Activity Detail screen.
+    Shows the provided DataFrame in a DataTable and offers Export + Back buttons.
+    Now includes Select All/None and Add to Allowlist functionality.
+    """
+
+    DEFAULT_CSS = """
+    ActivityDetailWidget {
+        height: 1fr;
+        layout: vertical;
+    }
+    #detail_table_container {
+        height: 1fr;
+        padding: 1 1;
+    }
+    #selection_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    #detail_buttons {
+        height: auto;
+        min-height: 3;
+        padding: 1 1;
+        content-align: center middle;
+    }
+    """
+
+    def __init__(self, activities_df: pd.DataFrame, otpid=None, hostname=None) -> None:
+        super().__init__()
+        self.activities_df = (
+            activities_df.copy()
+            if isinstance(activities_df, pd.DataFrame)
+            else pd.DataFrame(activities_df)
+        )
+        # Add a unique identifier column if not present
+        if "_row_id" not in self.activities_df.columns:
+            self.activities_df["_row_id"] = range(len(self.activities_df))
+
+        self.otpid = otpid
+        self.hostname = hostname
+        self.selected_row_ids = set()  # Track selected rows by unique ID
+        self.row_key_to_id = {}  # Map DataTable row keys to unique row IDs
+        self.table_row_to_id = {}  # Map table row indices to unique row IDs
+        self._last_sort = None  # Track last sort column and order
+
+    def compose(self) -> ComposeResult:
+        yield Static(
+            f"Activity Detail (otpid={self.otpid} host={self.hostname})",
+            classes="panel-title",
+        )
+        # Table container
+        with Vertical(id="detail_table_container"):
+            self.detail_table = DataTable(id="detail_table")
+            yield self.detail_table
+
+        # Original buttons at bottom
+        with Horizontal(id="detail_buttons"):
+            self.detail_back_btn = Button("Back", id="detail_back_btn")
+            self.add_allowlist_btn = Button(
+                "📋 Add Selected to Allowlist", id="add_allowlist_btn"
+            )
+            yield self.add_allowlist_btn
+            yield self.detail_back_btn
+
+    async def on_mount(self) -> None:
+        await self._build_table(rebuild=True)
+        self._update_button_states()
+
+    def _update_button_states(self) -> None:
+        """Update button states based on selection."""
+        has_selection = len(self.selected_row_ids) > 0
+        self.add_allowlist_btn.disabled = not has_selection
+
+        # Update button labels with count
+        count = len(self.selected_row_ids)
+        total = len(self.activities_df)
+
+        if has_selection:
+            self.add_allowlist_btn.label = f"📋 Add {count} Selected to Allowlist"
+        else:
+            self.add_allowlist_btn.label = "📋 Add Selected to Allowlist"
+
+    async def _build_table(self, rebuild: bool = True) -> None:
+        """Rebuild the DataTable. If rebuild=False, only refresh rows."""
+        if rebuild:
+            # Full rebuild: clear columns and rows
+            self.detail_table.clear()
+            self.detail_table.columns.clear()
+            self.row_key_to_id.clear()
+            self.table_row_to_id.clear()
+
+            if self.activities_df is None or self.activities_df.empty:
+                logger.info("ActivityDetailWidget mounted with empty dataframe.")
+                return
+
+            # Add columns (checkbox + data columns, excluding internal _row_id)
+            self.detail_table.add_column("Select", key="select")
+            for col in self.activities_df.columns:
+                if col != "_row_id":  # Don't display the internal ID column
+                    self.detail_table.add_column(col)
+        else:
+            # Partial rebuild: clear rows only
+            self.detail_table.clear()
+            self.row_key_to_id.clear()
+            self.table_row_to_id.clear()
+
+        # Add rows
+        for table_idx, (df_idx, row) in enumerate(self.activities_df.iterrows()):
+            # Get the unique row ID
+            row_id = row["_row_id"]
+
+            # Build values list (excluding _row_id column)
+            vals = []
+            for col in self.activities_df.columns:
+                if col != "_row_id":
+                    v = row[col]
+                    vals.append("" if pd.isna(v) else str(v))
+
+            # Check if this row is selected
+            checkbox = "☑" if row_id in self.selected_row_ids else "☐"
+
+            # Add row to table
+            row_key = self.detail_table.add_row(checkbox, *vals)
+
+            # Map the row key and table index to the unique row ID
+            self.row_key_to_id[row_key] = row_id
+            self.table_row_to_id[table_idx] = row_id
+
+    async def on_data_table_cell_selected(self, event: DataTable.CellSelected) -> None:
+        # Toggle selection when the "Select" column is clicked
+        if event.cell_key.column_key.value == "select":
+            table_row_index = event.coordinate.row
+
+            # Get the unique row ID for this table row
+            row_id = self.table_row_to_id.get(table_row_index)
+            if row_id is not None:
+                # Get the row key for updating the cell
+                row_key = event.cell_key.row_key
+
+                if row_id in self.selected_row_ids:
+                    self.selected_row_ids.remove(row_id)
+                    self.detail_table.update_cell(row_key, "select", "☐")  # Unchecked
+                else:
+                    self.selected_row_ids.add(row_id)
+                    self.detail_table.update_cell(row_key, "select", "☑")  # Checked
+
+                self._update_button_states()
+
+    async def on_data_table_header_selected(
+        self, event: DataTable.HeaderSelected
+    ) -> None:
+        column_key = event.column_key.value if event.column_key else None
+        if not column_key:
+            col_index = event.column_index
+            if col_index == 0:  # First column is "Select"
+                return
+            # Adjust for hidden _row_id column
+            visible_cols = [
+                col for col in self.activities_df.columns if col != "_row_id"
+            ]
+            if col_index - 1 < len(visible_cols):
+                column_key = visible_cols[col_index - 1]
+            else:
+                return
+        if column_key == "select" or column_key == "_row_id":
+            return
+
+        ascending = True
+        if self._last_sort == (column_key, True):
+            ascending = False
+        self._last_sort = (column_key, ascending)
+
+        try:
+            self.activities_df.sort_values(
+                by=column_key, ascending=ascending, inplace=True
+            )
+        except Exception as exc:
+            logger.exception("Failed to sort by column %s: %s", column_key, exc)
+            return
+
+        # ✅ Only refresh rows, not columns
+        await self._build_table(rebuild=False)
+
+    async def on_button_pressed(self, event) -> None:
+        btn = getattr(event, "button", None) or getattr(event, "sender", None)
+        btn_id = getattr(btn, "id", None) or getattr(event, "button_id", None)
+
+        if btn is self.detail_back_btn or btn_id == "detail_back_btn":
+            while len(self.app.screen_stack) > 2:
+                self.app.pop_screen()
+            event.stop()
+            return
+
+        if btn is self.add_allowlist_btn or btn_id == "add_allowlist_btn":
+            await self._open_allowlist_screen()
+            return
+
+    async def _select_all(self) -> None:
+        """Select all rows in the table."""
+        # Add all row IDs to selected set
+        self.selected_row_ids = set(self.activities_df["_row_id"].tolist())
+
+        # Update all checkboxes in the table
+        for row_key, row_id in self.row_key_to_id.items():
+            self.detail_table.update_cell(row_key, "select", "☑")
+
+        self._update_button_states()
+        logger.info(f"Selected all {len(self.selected_row_ids)} rows")
+
+    async def _select_none(self) -> None:
+        """Deselect all rows in the table."""
+        # Clear selected set
+        self.selected_row_ids.clear()
+
+        # Update all checkboxes in the table
+        for row_key, row_id in self.row_key_to_id.items():
+            self.detail_table.update_cell(row_key, "select", "☐")
+
+        self._update_button_states()
+        logger.info("Cleared all selections")
+
+    async def _open_allowlist_screen(self) -> None:
+        """Open the allowlist selection screen with selected activities."""
+        if not self.selected_row_ids:
+            self.app.notify("No rows selected", severity="warning")
+            return
+
+        # Get selected data
+        selected_df = self.get_selected_data()
+
+        # Get API from app
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API available on self.app.api")
+            self.app.notify("API not available", severity="error")
+            return
+
+        # Create and push AllowlistSelectionScreen
+        try:
+            allowlist_screen = AllowlistSelectionScreen(
+                selected_df, api=api, hostname=self.hostname, otpid=self.otpid
+            )
+            await self.app.push_screen(allowlist_screen)
+            logger.info(
+                f"Opened allowlist screen with {len(selected_df)} selected activities"
+            )
+        except ImportError as e:
+            logger.error(f"Failed to import AllowlistSelectionScreen: {e}")
+            self.app.notify("Allowlist screen module not found", severity="error")
+        except Exception as e:
+            logger.exception(f"Failed to open allowlist screen: {e}")
+            self.app.notify(
+                f"Error opening allowlist screen: {str(e)}", severity="error"
+            )
+
+    async def _export_detail_activities(self) -> None:
+        if self.activities_df is None or self.activities_df.empty:
+            logger.info("No activities to export.")
+            await self.mount(
+                Static("❌ No activities to export.", classes="notification")
+            )
+            return
+        if not self.selected_row_ids:
+            logger.info("No rows selected for export.")
+            await self.mount(
+                Static("❌ No rows selected for export.", classes="notification")
+            )
+            return
+        try:
+            working_dir = load_env("WORKING_DIR") or os.getcwd()
+            timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
+            filename = f"otp_activities_detail_{timestamp}.csv"
+            file_path = os.path.join(working_dir, filename)
+            selected_df = self.get_selected_data()
+            selected_df.to_csv(file_path, index=False)
+            logger.info("Exported selected activities to %s", file_path)
+            await self.mount(
+                Static(
+                    f"✅ Exported selected activities to: {filename}",
+                    classes="notification",
+                )
+            )
+        except Exception as exc:
+            logger.exception("Failed to export detail activities: %s", exc)
+            await self.mount(
+                Static(
+                    "❌ Failed to export activities; check logs.",
+                    classes="notification",
+                )
+            )
+
+    # ✅ Helper methods
+    def get_selected_data(self) -> pd.DataFrame:
+        """Return a DataFrame of the selected rows."""
+        if not self.selected_row_ids:
+            return pd.DataFrame()
+        # Filter by selected row IDs and drop the internal _row_id column
+        selected_df = self.activities_df[
+            self.activities_df["_row_id"].isin(self.selected_row_ids)
+        ].copy()
+        if "_row_id" in selected_df.columns:
+            selected_df = selected_df.drop(columns=["_row_id"])
+        return selected_df
+
+    def get_selected_records(self) -> list[dict]:
+        """Return selected rows as a list of dicts."""
+        if not self.selected_row_ids:
+            return []
+        # Filter by selected row IDs and drop the internal _row_id column
+        selected_df = self.activities_df[
+            self.activities_df["_row_id"].isin(self.selected_row_ids)
+        ].copy()
+        if "_row_id" in selected_df.columns:
+            selected_df = selected_df.drop(columns=["_row_id"])
+        return selected_df.to_dict(orient="records")
+
+
+class ActivityDetailScreen(Screen):
+    """
+    Screen that wraps ActivityDetailWidget. Expects a DataFrame passed on init.
+    """
+
+    BINDINGS = [
+        Binding("b", "back", "Back"),
+        Binding("e", "export", "Export"),
+        Binding("a", "select_all", "Select All"),
+        Binding("n", "select_none", "Select None"),
+    ]
+
+    def __init__(self, activities_df: pd.DataFrame, otpid=None, hostname=None) -> None:
+        super().__init__()
+        self._activities_df = (
+            activities_df.copy()
+            if isinstance(activities_df, pd.DataFrame)
+            else pd.DataFrame(activities_df)
+        )
+        self._otpid = otpid
+        self._hostname = hostname
+
+    def compose(self) -> ComposeResult:
+        self.widget = ActivityDetailWidget(
+            self._activities_df, otpid=self._otpid, hostname=self._hostname
+        )
+        yield Header(show_clock=True)
+        yield self.widget
+        yield Footer()
+
+    async def action_back(self) -> None:
+        try:
+            await self.app.pop_screen()
+        except Exception:
+            logger.debug("ActivityDetailScreen.action_back pop_screen failed.")
+
+    async def action_export(self) -> None:
+        # Delegate to widget export helper
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._export_detail_activities()
+
+    async def action_select_all(self) -> None:
+        """Handle 'a' key for select all."""
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._select_all()
+
+    async def action_select_none(self) -> None:
+        """Handle 'n' key for select none."""
+        if hasattr(self, "widget") and self.widget is not None:
+            await self.widget._select_none()
+
+
+class OTPActivitiesScreen(Screen):
+    """
+    A Screen intended to be pushed into an existing Textual App.
+    Usage:
+        app.push_screen(OTPActivitiesScreen())
+    or create this screen and call `await screen.load()` inside your app lifecycle.
+    The screen expects `self.app.api` to exist and be an AirlockAPIWrapper instance.
+    """
+
+    BINDINGS = [
+        Binding("r", "refresh_sessions", "Refresh Sessions"),
+        Binding("e", "export_activities", "Export activities"),
+        Binding("q", "quit", "Quit"),
+    ]
+
+    def compose(self) -> ComposeResult:
+        yield Header()
+        self.widget = OTPActivitiesWidget()
+        yield self.widget
+        yield Footer()
+
+    async def on_show(self) -> None:
+        """Restore focus to the left sessions table when the screen becomes visible."""
+        if hasattr(self, "widget") and hasattr(self.widget, "sessions_table"):
+            self.widget.sessions_table.focus()
+
+    async def on_mount(self) -> None:
+        # Try to load sessions immediately
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.warning("OTPActivitiesScreen mounted but no self.app.api found.")
+        else:
+            await self.widget.load_sessions_from_api(api)
+
+    # Simple actions bound to keys
+    async def action_refresh_sessions(self) -> None:
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API on app; cannot refresh sessions.")
+            return
+        logger.info("Refreshing OTP sessions via API.")
+        await self.widget.load_sessions_from_api(api)
+
+    async def action_quit(self) -> None:
+        # Pop the screen or exit app
+        await self.app.pop_screen()
+
+    # If you want an explicit method to fetch activities for a particular otpid from outside:
+    async def fetch_activities_for_otpid(self, otpid, hostname=None) -> None:
+        api = getattr(self.app, "api", None)
+        if api is None:
+            logger.error("No API on app; cannot fetch activities.")
+            return
+        await self.widget._fetch_activities_for_otpid(api, otpid, hostname=hostname)

TUI/otpworkflowscreen.py

@@ -1,18 +1,18 @@
 # otp_workflow_screen.py
 
-from typing import List
+from typing import List, Optional
 
 from textual.app import ComposeResult
 from textual.screen import Screen
 
 from models.agent import Agent
-from widgets.OTP_generate import OTPGenerator
+from TUI.OTP_generate import OTPGenerator
 
 
 class OTPWorkflowScreen(Screen):
     """Screen that handles the OTP generation workflow without agent selection."""
 
-    def __init__(self, selected_agents: List[Agent]):
+    def __init__(self, selected_agents: Optional[List[Agent]]):
         super().__init__()
         self.selected_agents = selected_agents
 

TUI/policyselector.py

@@ -14,7 +14,7 @@ import pandas as pd
 from textual.containers import Horizontal, Vertical
 from textual.message import Message
 from textual.widget import Widget
-from textual.widgets import Button, DataTable, Footer, Header, Static, TextArea
+from textual.widgets import Button, DataTable, Static, TextArea
 
 from models.policy import Policy
 
@@ -93,7 +93,6 @@ class PolicySelector(Widget):
         - Policy table displaying available policies
         - Back buttons for navigation
         """
-        yield Header(show_clock=True, icon="⚙")
         title_text = Static(
             "🎯 Select Target Policy",
             id="policy_selector_title",
@@ -164,8 +163,6 @@ class PolicySelector(Widget):
                 policy_table.styles.margin = (1, 0, 1, 0)
                 yield policy_table
 
-        yield Footer()
-
     def on_mount(self) -> None:
         """
         Initialize the policy table when the widget is mounted.

TUI/policyselectorscreen.py

@@ -25,7 +25,7 @@ import logging
 from textual.app import ComposeResult
 from textual.screen import Screen
 
-from widgets.policyselector import PolicySelector
+from TUI.policyselector import PolicySelector
 
 logger = logging.getLogger(__name__)
 

TUI/policytreewidget.py

@@ -4,7 +4,7 @@ import logging
 from rich.text import Text
 from textual.containers import Horizontal, Vertical
 from textual.widget import Widget
-from textual.widgets import Input, OptionList, Static, Tree
+from textual.widgets import Input, OptionList, Static, Switch, Tree
 from textual.widgets.option_list import Option
 
 logger = logging.getLogger(__name__)
@@ -19,29 +19,49 @@ class PolicyTreeWidget(Widget):
         self.devices = devices
         self.last_highlighted_node = None
         self.leaf_counts = defaultdict(int)
+        self.match_type = "Count"  # Default to sorting by count
 
     def compose(self):
+        # Create the switch and its label
+        switch = Switch(value=False, id="match_switch")
+        switch.styles.margin = (0, 0, 0, 0)  # top, right, bottom, left
+        switch.styles.padding = (0, 0, 0, 0)
+
+        switch_label = Static("Sort: Count", id="match_switch_label")
+        switch_label.styles.margin = (1, 0, 0, 0)
+        switch_label.styles.padding = (0, 0, 0, 0)
+
+        # Create the tree
         policy_tree = Tree("", id="policy_tree")  # Label set in on_mount
         policy_tree.styles.width = "2fr"
         policy_tree.styles.height = "100%"
 
+        # Create the search box and details pane
         label = Static("Device Search:")
         search_box = Input(
             placeholder="Search policies or devices...", id="tree_search"
         )
         details_pane = Static("", id="details_pane")
 
+        # Layout the UI
         with Horizontal():
             yield policy_tree
             with Vertical() as right_pane:
                 right_pane.styles.width = "3fr"
+                # Use a Horizontal container for the switch and label
+                with Horizontal() as switch_container:
+                    switch_container.styles.height = 3
+                    switch_container.styles.margin = (0, 0, 0, 1)
+                    switch_container.styles.padding = (0, 0, 0, 0)
+                    yield switch
+                    yield switch_label
+                # Add the search box and details pane
                 yield label
                 yield search_box
                 yield details_pane
 
     def on_mount(self) -> None:
         self._precompute_leaf_counts()
-
         # Update root label with total leaf count
         total_leaves = sum(
             self.leaf_counts.get(policy.groupid, 0)
@@ -50,8 +70,9 @@ class PolicyTreeWidget(Widget):
         )
         policy_tree = self.query_one("#policy_tree", Tree)
         policy_tree.root.set_label(f"Agents in Policies: ({total_leaves})")
-
         self._build_tree()
+        # Expand the root node
+        policy_tree.root.expand()
 
     def _precompute_leaf_counts(self):
         """Precompute leaf counts for each policy group."""
@@ -76,15 +97,21 @@ class PolicyTreeWidget(Widget):
 
     def _build_tree(self):
         policy_tree = self.query_one("#policy_tree", Tree)
+        policy_tree.clear()  # Clear existing nodes
         node_map = {}
 
         # Sort top-level policies
         top_policies = [
             p for p in self.policies if p.parent == "global-policy-settings"
         ]
-        top_policies.sort(
-            key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
-        )
+
+        # Sort by count (default) or alphabetically
+        if getattr(self, "match_type", "Count") == "Count":
+            top_policies.sort(
+                key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
+            )
+        else:  # Alphabetical
+            top_policies.sort(key=lambda p: p.name.lower())
 
         for policy in top_policies:
             label = f"{policy.name} ({self.leaf_counts.get(policy.groupid, 0)})"
@@ -98,9 +125,13 @@ class PolicyTreeWidget(Widget):
                 children_by_parent[policy.parent].append(policy)
 
         for parent_id, children in children_by_parent.items():
-            children.sort(
-                key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
-            )
+            if getattr(self, "match_type", "Count") == "Count":
+                children.sort(
+                    key=lambda p: self.leaf_counts.get(p.groupid, 0), reverse=True
+                )
+            else:  # Alphabetical
+                children.sort(key=lambda p: p.name.lower())
+
             parent_node = node_map.get(parent_id)
             if parent_node:
                 for policy in children:
@@ -108,12 +139,17 @@ class PolicyTreeWidget(Widget):
                     node = parent_node.add(label=label, data=policy)
                     node_map[policy.groupid] = node
 
-        # Add devices (leaf nodes)
+        # Add devices (leaf nodes) - always sort alphabetically
+        devices_by_group = defaultdict(list)
         for device in self.devices:
-            group_id = device.groupid
+            devices_by_group[device.groupid].append(device)
+
+        for group_id, devices in devices_by_group.items():
+            devices.sort(key=lambda d: d.hostname.lower())  # Always sort alphabetically
             parent_node = node_map.get(group_id)
             if parent_node:
-                parent_node.add(label=device.hostname, data=device)
+                for device in devices:
+                    parent_node.add(label=device.hostname, data=device)
 
     def _collect_tree_nodes(self, node, all_nodes):
         all_nodes.append(node)
@@ -157,6 +193,13 @@ class PolicyTreeWidget(Widget):
 
         message.stop()
 
+    def on_switch_changed(self, event: Switch.Changed):
+        self.match_type = "Alpha" if event.value else "Count"
+        self.query_one("#match_switch_label", Static).update(
+            f"Sort: {self.match_type.capitalize()}"
+        )
+        self._build_tree()
+
     def on_input_submitted(self, message: Input.Submitted) -> None:
         self._remove_match_selector()
 

TUI/quietagentworkflowscreen.py

@@ -0,0 +1,848 @@
+#    Copyright (C) 2025 James Brotosky, Brandon Wickline
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as published
+#    by the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+"""
+Quiet Agent Workflow Screen Module
+
+Provides a TUI workflow for identifying quiet agents and moving them to target policies.
+This screen replaces the legacy quietAgent.py with a comprehensive TUI interface that:
+1. Allows selection of an initial policy to analyze
+2. Categorizes devices into "Enforce Ready" and "Non-Enforce Ready" based on activity
+3. Allows users to select target policies for each category
+4. Uses the API to move devices to their target policies
+"""
+
+import datetime
+import logging
+import os
+from typing import List, Optional
+
+import pandas as pd
+from textual.app import ComposeResult
+from textual.containers import Horizontal, Vertical
+from textual.reactive import reactive
+from textual.screen import Screen
+from textual.widgets import Button, DataTable, Footer, Header, Static
+
+from models.policy import Policy
+from services.API import AirlockAPIWrapper
+from services.policyhandler import getPolicyInfo
+from TUI.policyselector import PolicySelector
+from utils.configmanager import load_env
+
+logger = logging.getLogger(__name__)
+
+
+class QuietAgentWorkflowScreen(Screen):
+    """
+    A Textual screen for the Quiet Agent analysis and migration workflow.
+
+    This screen provides a multi-step workflow:
+    1. Select initial policy to analyze
+    2. View categorized agents (enforce ready vs. non-enforce ready)
+    3. Select target policies for each category
+    4. Execute agent migrations
+
+    Attributes:
+        api (AirlockAPIWrapper): API wrapper for Airlock operations
+        policies (List[Policy]): List of all available policies
+        selected_policy (Optional[Policy]): The initially selected policy to analyze
+        history_days (int): Number of days of history to pull (default: 150)
+        quiet_days (int): Number of days without execution to be considered quiet (default: 45)
+        agents_df (Optional[pd.DataFrame]): DataFrame of all agents with analysis results
+        enforce_ready_df (Optional[pd.DataFrame]): DataFrame of agents ready for enforcement
+        non_enforce_ready_df (Optional[pd.DataFrame]): DataFrame of agents not ready for enforcement
+        workflow_stage (str): Current stage of the workflow
+    """
+
+    BINDINGS = [
+        ("escape", "go_back", "Back"),
+    ]
+
+    workflow_stage = reactive("select_policy")  # Tracks current workflow stage
+
+    def __init__(self, api: AirlockAPIWrapper, policies: List[Policy]):
+        """
+        Initialize the QuietAgentWorkflowScreen.
+
+        Args:
+            api (AirlockAPIWrapper): API wrapper for Airlock operations
+            policies (List[Policy]): List of all available policies
+        """
+        super().__init__()
+        self.api = api
+        self.policies = policies
+        self.selected_policy: Optional[Policy] = None
+        self.history_days = 150  # Fixed as per requirements
+        self.quiet_days = 45  # Default value
+        self.agents_df: Optional[pd.DataFrame] = None
+        self.enforce_ready_df: Optional[pd.DataFrame] = None
+        self.non_enforce_ready_df: Optional[pd.DataFrame] = None
+        self.enforce_ready_target_policy: Optional[Policy] = None
+        self.non_enforce_ready_target_policy: Optional[Policy] = None
+
+    def compose(self) -> ComposeResult:
+        """Build the UI layout for the workflow screen."""
+        # Include Header and Footer like other standalone screens
+        yield Header(show_clock=True, icon="⚙")
+
+        # Title area
+        title = Static("🔒 Quiet Agent Workflow", id="workflow_title")
+        title.styles.margin = (0, 0, 0, 1)
+        yield title
+
+        # Status area
+        status = Static("Step 1: Select Policy to Analyze", id="workflow_status")
+        status.styles.margin = (0, 0, 1, 1)
+        yield status
+
+        # Content area - dynamically populated based on workflow stage
+        yield Vertical(id="content_area")
+
+        yield Footer()
+
+    def on_mount(self) -> None:
+        """Initialize the screen when mounted."""
+        # Show initial policy selection
+        self._show_policy_selection()
+
+    def watch_workflow_stage(self, old_value: str, new_value: str) -> None:
+        """React to workflow stage changes."""
+        logger.debug(f"Workflow stage changed from {old_value} to {new_value}")
+        self._update_status_message()
+
+    def _update_status_message(self) -> None:
+        """Update the status message based on current workflow stage."""
+        status_widget = self.query_one("#workflow_status", Static)
+
+        stage_messages = {
+            "select_policy": "Step 1: Select Policy to Analyze",
+            "select_quiet_days": "Step 2: Select Quiet Time Period",
+            "analyzing": "📊 Analyzing agent activity...",
+            "view_results": "Step 3: Review Categorized Agents",
+            "select_enforce_target": "Step 4: Select Target Policy for Enforce Ready Agents",
+            "select_non_enforce_target": "Step 5: Select Target Policy for Non-Enforce Ready Agents",
+            "confirm_migration": "Step 6: Confirm and Execute Migration",
+            "executing": "⏳ Executing agent migrations...",
+            "complete": "✅ Migration Complete",
+        }
+
+        status_widget.update(stage_messages.get(self.workflow_stage, "Unknown Stage"))
+
+    def _show_policy_selection(self) -> None:
+        """Show the initial policy selection screen."""
+        self.workflow_stage = "select_policy"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create policy selector widget
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+    def on_policy_selector_policy_selected(
+        self, message: PolicySelector.PolicySelected
+    ) -> None:
+        """Handle policy selection from PolicySelector widget."""
+        # Handle based on current workflow stage
+        if self.workflow_stage == "select_policy":
+            # Initial policy selection for analysis
+            self.selected_policy = message.policy
+            logger.info(f"Selected policy for analysis: {self.selected_policy.name}")
+            self._show_quiet_days_selection()
+        elif self.workflow_stage == "select_enforce_target":
+            # Target policy selection for enforce ready agents
+            self.enforce_ready_target_policy = message.policy
+            logger.info(
+                f"Selected target policy for enforce ready: {message.policy.name}"
+            )
+            self._show_non_enforce_target_selection()
+        elif self.workflow_stage == "select_non_enforce_target":
+            # Target policy selection for non-enforce ready agents
+            self.non_enforce_ready_target_policy = message.policy
+            logger.info(
+                f"Selected target policy for non-enforce ready: {message.policy.name}"
+            )
+            self._show_migration_confirmation()
+
+    def _show_quiet_days_selection(self) -> None:
+        """Show the quiet days selection screen."""
+        self.workflow_stage = "select_quiet_days"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create info text
+        info_widget = Static(
+            f"Policy Selected: {self.selected_policy.name}\n\n"
+            f"History Period: {self.history_days} days\n\n"
+            "Select quiet time period (days without untrusted execution):",
+            id="quiet_days_info",
+        )
+        info_widget.styles.margin = (0, 0, 2, 0)
+        content.mount(info_widget)
+
+        # Create button container and mount it first
+        button_container = Vertical(id="quiet_days_buttons")
+        button_container.styles.height = "auto"
+        content.mount(button_container)
+
+        # Now add buttons to the mounted container
+        for days in [15, 30, 45, 60]:
+            btn = Button(
+                f"{days} days {'(Default)' if days == 45 else ''}",
+                id=f"quiet_days_{days}",
+                classes="quiet_day_btn",
+            )
+            btn.styles.width = "100%"
+            btn.styles.margin = (0, 0, 1, 0)
+            button_container.mount(btn)
+
+        back_btn = Button("← Back", id="back_to_policy_selection")
+        back_btn.styles.width = "100%"
+        back_btn.styles.margin = (2, 0, 0, 0)
+        button_container.mount(back_btn)
+
+    def on_button_pressed(self, event: Button.Pressed) -> None:
+        """Handle button press events."""
+        button_id = event.button.id
+
+        # Quiet days selection buttons
+        if button_id and button_id.startswith("quiet_days_"):
+            days = int(button_id.split("_")[-1])
+            self.quiet_days = days
+            logger.info(f"Selected quiet days: {days}")
+            self._start_analysis()
+            return
+
+        # Navigation buttons
+        if button_id == "back_to_policy_selection":
+            self._show_policy_selection()
+            return
+
+        if button_id == "back_to_results":
+            self._show_results()
+            return
+
+        if button_id == "select_enforce_target_btn":
+            self._show_enforce_target_selection()
+            return
+
+        if button_id == "select_non_enforce_target_btn":
+            self._show_non_enforce_target_selection()
+            return
+
+        if button_id == "skip_enforce_target_btn":
+            # Skip enforce ready target selection
+            self.enforce_ready_target_policy = None
+            self._show_non_enforce_target_selection()
+            return
+
+        if button_id == "skip_non_enforce_target_btn":
+            # Skip non-enforce ready target selection
+            self.non_enforce_ready_target_policy = None
+            self._show_migration_confirmation()
+            return
+
+        if button_id == "confirm_migration_btn":
+            self._execute_migration()
+            return
+
+        if button_id == "cancel_migration_btn":
+            self._show_results()
+            return
+
+        if button_id == "export_results_btn":
+            self._export_results()
+            return
+
+        if button_id == "start_over_btn":
+            self._show_policy_selection()
+            return
+
+    def _start_analysis(self) -> None:
+        """Start the agent activity analysis."""
+        self.workflow_stage = "analyzing"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Show analyzing message with detailed steps
+        analyzing_msg = Static(
+            f"📊 Analyzing Agent Activity\n"
+            f"{'=' * 50}\n\n"
+            f"Policy: {self.selected_policy.name}\n"
+            f"History Period: {self.history_days} days\n"
+            f"Quiet Threshold: {self.quiet_days} days\n\n"
+            f"Progress:\n"
+            f"⏳ Step 1/4: Fetching agents from policy...\n"
+            f"⏱️  Step 2/4: Pulling execution history (this may take a moment)...\n"
+            f"⏱️  Step 3/4: Analyzing activity patterns...\n"
+            f"⏱️  Step 4/4: Categorizing agents...\n\n"
+            f"Please wait - this operation cannot be cancelled.",
+            id="analyzing_message",
+        )
+        analyzing_msg.styles.margin = (2, 1)
+        content.mount(analyzing_msg)
+
+        # Show notification
+        self.app.notify(
+            "Starting analysis - this may take several minutes for large policies",
+            severity="information",
+            timeout=5,
+        )
+
+        # Perform the analysis asynchronously
+        self.call_later(self._perform_analysis)
+
+    def _perform_analysis(self) -> None:
+        """Perform the actual agent activity analysis."""
+        try:
+            # Update status: Fetching agents
+            self._update_analysis_status("Step 1/4: Fetching agents from policy...")
+
+            # Get agents in the selected policy
+            agents = self.api.agents_find_by_group(self.selected_policy.groupid)
+
+            if agents.empty:
+                self.app.notify(
+                    f"No agents found in policy: {self.selected_policy.name}",
+                    severity="warning",
+                    timeout=5,
+                )
+                self._show_policy_selection()
+                return
+
+            agent_count = len(agents)
+            self.app.notify(
+                f"Found {agent_count} agents - fetching execution history...",
+                severity="information",
+                timeout=3,
+            )
+
+            # Update status: Pulling execution history
+            self._update_analysis_status(
+                f"Step 2/4: Pulling execution history for {agent_count} agents...\n"
+                f"(This may take several minutes - progress shown in terminal)"
+            )
+
+            # Get execution history (this shows progress bars in terminal via airlock_libs)
+            policy_exec_history = getPolicyInfo(
+                self.api, self.selected_policy, [1, 2, 6, 7], self.history_days
+            )
+
+            # Update status: Analyzing patterns
+            self._update_analysis_status("Step 3/4: Analyzing activity patterns...")
+            self.app.notify(
+                "History retrieved - analyzing patterns...",
+                severity="information",
+                timeout=2,
+            )
+
+            if policy_exec_history.empty:
+                logger.info(
+                    "No execution history found for the selected policy and time range."
+                )
+                # All agents are quiet (no executions)
+                agents["execution_count"] = 0
+                agents["days_since"] = None
+                agents["required_quiet"] = self.quiet_days
+                agents["enforce_ready"] = True
+            else:
+                # Convert datetime column
+                policy_exec_history["datetime"] = pd.to_datetime(
+                    policy_exec_history["datetime"],
+                    format="%Y-%m-%dT%H:%M:%SZ",
+                    utc=True,
+                )
+
+                # Calculate days ago
+                now = datetime.datetime.now(datetime.timezone.utc)
+                policy_exec_history["days_ago"] = policy_exec_history["datetime"].apply(
+                    lambda dt: (now - dt).days
+                )
+
+                # Count total executions per hostname
+                hostname_counts = policy_exec_history["hostname"].value_counts()
+                agents["execution_count"] = (
+                    agents["hostname"].map(hostname_counts).fillna(0).astype(int)
+                )
+
+                # Find most recent execution per hostname
+                most_recent_exec = policy_exec_history.sort_values(
+                    by="days_ago"
+                ).drop_duplicates(subset="hostname", keep="first")
+
+                # Map most recent execution age to agents
+                agents["days_since"] = agents["hostname"].map(
+                    most_recent_exec.set_index("hostname")["days_ago"]
+                )
+
+                # Check for enforcement readiness
+                agents["required_quiet"] = self.quiet_days
+                agents["enforce_ready"] = agents["days_since"].apply(
+                    lambda x: True if pd.isna(x) or x > self.quiet_days else False
+                )
+
+            # Update status: Categorizing
+            self._update_analysis_status("Step 4/4: Categorizing agents...")
+
+            # Sort agents
+            agents = agents.sort_values(
+                by=["execution_count", "hostname"], ascending=[True, True]
+            )
+
+            # Store the results
+            self.agents_df = agents
+
+            # Categorize agents into DataFrames
+            self.enforce_ready_df = agents[agents["enforce_ready"] == True].copy()
+            self.non_enforce_ready_df = agents[agents["enforce_ready"] == False].copy()
+
+            logger.info(
+                f"Analysis complete: {len(self.enforce_ready_df)} enforce ready, "
+                f"{len(self.non_enforce_ready_df)} non-enforce ready"
+            )
+
+            self.app.notify(
+                f"Analysis complete! Found {len(self.enforce_ready_df)} enforce ready, "
+                f"{len(self.non_enforce_ready_df)} not ready",
+                severity="success",
+                timeout=5,
+            )
+
+            # Show results
+            self._show_results()
+
+        except Exception as e:
+            logger.error(f"Error during analysis: {e}", exc_info=True)
+            self.app.notify(f"Analysis failed: {str(e)}", severity="error", timeout=5)
+            self._show_policy_selection()
+
+    def _update_analysis_status(self, status_text: str) -> None:
+        """Update the analysis status message."""
+        try:
+            analyzing_msg = self.query_one("#analyzing_message", Static)
+
+            # Build updated message
+            updated_text = (
+                f"📊 Analyzing Agent Activity\n"
+                f"{'=' * 50}\n\n"
+                f"Policy: {self.selected_policy.name}\n"
+                f"History Period: {self.history_days} days\n"
+                f"Quiet Threshold: {self.quiet_days} days\n\n"
+                f"Progress:\n"
+                f"✅ {status_text}\n\n"
+                f"Please wait - this operation cannot be cancelled."
+            )
+
+            analyzing_msg.update(updated_text)
+        except Exception as e:
+            logger.debug(f"Could not update analysis status: {e}")
+
+    def _show_results(self) -> None:
+        """Show the categorized results."""
+        self.workflow_stage = "view_results"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Create results display container and mount it first
+        results_container = Vertical(id="results_container")
+        results_container.styles.height = "auto"
+        results_container.styles.margin = (1, 1)
+        content.mount(results_container)
+
+        # Summary statistics
+        total_agents = len(self.enforce_ready_df) + len(self.non_enforce_ready_df)
+        ready_count = len(self.enforce_ready_df)
+        not_ready_count = len(self.non_enforce_ready_df)
+        ready_percentage = (ready_count / total_agents * 100) if total_agents > 0 else 0
+
+        summary = Static(
+            f"Analysis Results for: {self.selected_policy.name}\n\n"
+            f"📊 Total Agents: {total_agents}\n"
+            f"✅ Enforce Ready: {ready_count} ({ready_percentage:.1f}%)\n"
+            f"❌ Not Ready: {not_ready_count} ({100 - ready_percentage:.1f}%)\n\n"
+            f"Quiet Threshold: {self.quiet_days} days\n"
+            f"History Period: {self.history_days} days",
+            id="results_summary",
+        )
+        summary.styles.margin = (0, 0, 2, 0)
+        results_container.mount(summary)
+
+        # Action buttons
+        button_container = Horizontal(id="results_buttons")
+        button_container.styles.height = "auto"
+        results_container.mount(button_container)
+
+        if ready_count > 0:
+            enforce_btn = Button(
+                f"Select Target for Enforce Ready ({ready_count})",
+                id="select_enforce_target_btn",
+            )
+            enforce_btn.styles.margin = (0, 1, 1, 0)
+            button_container.mount(enforce_btn)
+
+        if not_ready_count > 0:
+            non_enforce_btn = Button(
+                f"Select Target for Non-Enforce Ready ({not_ready_count})",
+                id="select_non_enforce_target_btn",
+            )
+            non_enforce_btn.styles.margin = (0, 1, 1, 0)
+            button_container.mount(non_enforce_btn)
+
+        export_btn = Button("💾 Export Results", id="export_results_btn")
+        export_btn.styles.margin = (0, 1, 1, 0)
+        button_container.mount(export_btn)
+
+        start_over_btn = Button("🔄 Start Over", id="start_over_btn")
+        start_over_btn.styles.margin = (0, 0, 1, 0)
+        button_container.mount(start_over_btn)
+
+        # Tables showing agents
+        tables_container = Horizontal()
+        tables_container.styles.height = "1fr"
+        results_container.mount(tables_container)
+
+        # Enforce Ready table
+        if ready_count > 0:
+            enforce_col = Vertical()
+            enforce_col.styles.width = "1fr"
+            enforce_col.styles.margin = (1, 1, 0, 0)
+            tables_container.mount(enforce_col)
+
+            enforce_label = Static("✅ Enforce Ready Agents")
+            enforce_label.styles.margin = (0, 0, 1, 0)
+            enforce_col.mount(enforce_label)
+
+            enforce_table = DataTable(id="enforce_ready_table")
+            enforce_table.styles.height = "1fr"
+            enforce_table.add_columns("Hostname", "Last Exec (days)")
+
+            # Display first 50 agents
+            for idx, row in self.enforce_ready_df.head(50).iterrows():
+                days_since = row["days_since"]
+                days_str = f"{int(days_since)}" if not pd.isna(days_since) else "Never"
+                enforce_table.add_row(row["hostname"], days_str)
+
+            if len(self.enforce_ready_df) > 50:
+                enforce_table.add_row(
+                    f"... and {len(self.enforce_ready_df) - 50} more", ""
+                )
+
+            enforce_col.mount(enforce_table)
+
+        # Non-Enforce Ready table
+        if not_ready_count > 0:
+            non_enforce_col = Vertical()
+            non_enforce_col.styles.width = "1fr"
+            non_enforce_col.styles.margin = (1, 0, 0, 1)
+            tables_container.mount(non_enforce_col)
+
+            non_enforce_label = Static("❌ Non-Enforce Ready Agents")
+            non_enforce_label.styles.margin = (0, 0, 1, 0)
+            non_enforce_col.mount(non_enforce_label)
+
+            non_enforce_table = DataTable(id="non_enforce_ready_table")
+            non_enforce_table.styles.height = "1fr"
+            non_enforce_table.add_columns("Hostname", "Last Exec (days)")
+
+            # Display first 50 agents
+            for idx, row in self.non_enforce_ready_df.head(50).iterrows():
+                days_since = row["days_since"]
+                days_str = f"{int(days_since)}" if not pd.isna(days_since) else "N/A"
+                non_enforce_table.add_row(row["hostname"], days_str)
+
+            if len(self.non_enforce_ready_df) > 50:
+                non_enforce_table.add_row(
+                    f"... and {len(self.non_enforce_ready_df) - 50} more", ""
+                )
+
+            non_enforce_col.mount(non_enforce_table)
+
+    def _show_enforce_target_selection(self) -> None:
+        """Show policy selection for enforce ready agents."""
+        self.workflow_stage = "select_enforce_target"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Info message
+        info = Static(
+            f"Select target policy for {len(self.enforce_ready_df)} Enforce Ready agents\n"
+            f"Source Policy: {self.selected_policy.name}",
+            id="enforce_target_info",
+        )
+        info.styles.margin = (0, 0, 2, 0)
+        content.mount(info)
+
+        # Policy selector
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+        # Skip button
+        skip_btn = Button("⭕️ Skip - No Migration", id="skip_enforce_target_btn")
+        skip_btn.styles.width = "50%"
+        skip_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(skip_btn)
+
+    def _show_non_enforce_target_selection(self) -> None:
+        """Show policy selection for non-enforce ready agents."""
+        self.workflow_stage = "select_non_enforce_target"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Info message
+        info = Static(
+            f"Select target policy for {len(self.non_enforce_ready_df)} Non-Enforce Ready agents\n"
+            f"Source Policy: {self.selected_policy.name}",
+            id="non_enforce_target_info",
+        )
+        info.styles.margin = (0, 0, 2, 0)
+        content.mount(info)
+
+        # Policy selector
+        policy_selector = PolicySelector(self.policies)
+        content.mount(policy_selector)
+
+        # Skip button
+        skip_btn = Button("⭕️ Skip - No Migration", id="skip_non_enforce_target_btn")
+        skip_btn.styles.width = "50%"
+        skip_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(skip_btn)
+
+    def _show_migration_confirmation(self) -> None:
+        """Show migration confirmation screen."""
+        self.workflow_stage = "confirm_migration"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Build confirmation message
+        confirmation_lines = [
+            "🔐 Migration Summary\n",
+            f"Source Policy: {self.selected_policy.name}\n",
+        ]
+
+        if self.enforce_ready_target_policy:
+            confirmation_lines.append(
+                f"\n✅ Enforce Ready Migration:\n"
+                f"  • Agents: {len(self.enforce_ready_df)}\n"
+                f"  • Target: {self.enforce_ready_target_policy.name}\n"
+            )
+
+        if self.non_enforce_ready_target_policy:
+            confirmation_lines.append(
+                f"\n❌ Non-Enforce Ready Migration:\n"
+                f"  • Agents: {len(self.non_enforce_ready_df)}\n"
+                f"  • Target: {self.non_enforce_ready_target_policy.name}\n"
+            )
+
+        if (
+            not self.enforce_ready_target_policy
+            and not self.non_enforce_ready_target_policy
+        ):
+            confirmation_lines.append("\n⚠️ No migrations will be performed.")
+
+        confirmation = Static("".join(confirmation_lines), id="migration_confirmation")
+        confirmation.styles.margin = (1, 1, 2, 1)
+        content.mount(confirmation)
+
+        # Action buttons - mount container first, then add buttons
+        button_container = Horizontal(id="confirmation_buttons")
+        button_container.styles.height = "auto"
+        button_container.styles.margin = (1, 1)
+        content.mount(button_container)
+
+        if self.enforce_ready_target_policy or self.non_enforce_ready_target_policy:
+            confirm_btn = Button("✅ Confirm Migration", id="confirm_migration_btn")
+            confirm_btn.styles.margin = (0, 1, 0, 0)
+            button_container.mount(confirm_btn)
+
+        cancel_btn = Button("❌ Cancel", id="cancel_migration_btn")
+        button_container.mount(cancel_btn)
+
+    def _execute_migration(self) -> None:
+        """Execute the agent migrations."""
+        self.workflow_stage = "executing"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Show executing message
+        executing_msg = Static(
+            "⏳ Executing agent migrations...\nPlease wait...",
+            id="executing_message",
+        )
+        executing_msg.styles.margin = (2, 1)
+        content.mount(executing_msg)
+
+        # Perform migrations asynchronously
+        self.call_later(self._perform_migrations)
+
+    def _perform_migrations(self) -> None:
+        """Perform the actual agent migrations."""
+        successful_migrations = []
+        failed_migrations = []
+
+        try:
+            # Migrate enforce ready agents
+            if self.enforce_ready_target_policy:
+                for idx, row in self.enforce_ready_df.iterrows():
+                    try:
+                        result = self.api.agent_move(
+                            row["agentid"], self.enforce_ready_target_policy.groupid
+                        )
+                        successful_migrations.append(
+                            (row["hostname"], self.enforce_ready_target_policy.name)
+                        )
+                        logger.debug(
+                            f"Moved {row['hostname']} to {self.enforce_ready_target_policy.name}"
+                        )
+                    except Exception as e:
+                        failed_migrations.append((row["hostname"], str(e)))
+                        logger.error(f"Failed to move {row['hostname']}: {e}")
+
+            # Migrate non-enforce ready agents
+            if self.non_enforce_ready_target_policy:
+                for idx, row in self.non_enforce_ready_df.iterrows():
+                    try:
+                        result = self.api.agent_move(
+                            row["agentid"], self.non_enforce_ready_target_policy.groupid
+                        )
+                        successful_migrations.append(
+                            (row["hostname"], self.non_enforce_ready_target_policy.name)
+                        )
+                        logger.debug(
+                            f"Moved {row['hostname']} to {self.non_enforce_ready_target_policy.name}"
+                        )
+                    except Exception as e:
+                        failed_migrations.append((row["hostname"], str(e)))
+                        logger.error(f"Failed to move {row['hostname']}: {e}")
+
+            # Show completion results
+            self._show_completion_results(successful_migrations, failed_migrations)
+
+        except Exception as e:
+            logger.error(f"Error during migration execution: {e}", exc_info=True)
+            self.app.notify(f"Migration failed: {str(e)}", severity="error", timeout=5)
+            self._show_results()
+
+    def _show_completion_results(
+        self, successful: List[tuple], failed: List[tuple]
+    ) -> None:
+        """Show migration completion results."""
+        self.workflow_stage = "complete"
+        content = self.query_one("#content_area", Vertical)
+        content.remove_children()
+
+        # Results summary
+        total_attempted = len(successful) + len(failed)
+        success_rate = (
+            (len(successful) / total_attempted * 100) if total_attempted > 0 else 0
+        )
+
+        results = Static(
+            f"✅ Migration Complete\n\n"
+            f"Total Agents Migrated: {len(successful)}\n"
+            f"Failed Migrations: {len(failed)}\n"
+            f"Success Rate: {success_rate:.1f}%",
+            id="completion_summary",
+        )
+        results.styles.margin = (1, 1, 2, 1)
+        content.mount(results)
+
+        # Details tables
+        if successful:
+            success_container = Vertical()
+            success_container.styles.margin = (0, 1)
+            content.mount(success_container)
+
+            success_label = Static("✅ Successful Migrations")
+            success_label.styles.margin = (0, 0, 1, 0)
+            success_container.mount(success_label)
+
+            success_table = DataTable(id="success_table")
+            success_table.styles.height = "auto"
+            success_table.add_columns("Hostname", "Target Policy")
+
+            for hostname, target_policy in successful[:25]:  # Show first 25
+                success_table.add_row(hostname, target_policy)
+
+            if len(successful) > 25:
+                success_table.add_row(f"... and {len(successful) - 25} more", "")
+
+            success_container.mount(success_table)
+
+        if failed:
+            failed_container = Vertical()
+            failed_container.styles.margin = (2, 1, 0, 1)
+            content.mount(failed_container)
+
+            failed_label = Static("❌ Failed Migrations")
+            failed_label.styles.margin = (0, 0, 1, 0)
+            failed_container.mount(failed_label)
+
+            failed_table = DataTable(id="failed_table")
+            failed_table.styles.height = "auto"
+            failed_table.add_columns("Hostname", "Error")
+
+            for hostname, error in failed[:25]:  # Show first 25
+                failed_table.add_row(hostname, error[:50])  # Truncate error
+
+            if len(failed) > 25:
+                failed_table.add_row(f"... and {len(failed) - 25} more", "")
+
+            failed_container.mount(failed_table)
+
+        # Action button
+        done_btn = Button("✔ Done", id="start_over_btn")
+        done_btn.styles.width = "50%"
+        done_btn.styles.margin = (2, 0, 0, 0)
+        content.mount(done_btn)
+
+    def _export_results(self) -> None:
+        """Export analysis results to CSV."""
+        try:
+            working_dir = load_env("WORKING_DIR") or os.getcwd()
+            filename = os.path.join(
+                working_dir,
+                f"{self.selected_policy.name}_quiet_analysis_{datetime.datetime.now().strftime('%Y%m%d_%H%M%S')}.csv",
+            )
+
+            self.agents_df.to_csv(filename, index=False)
+            logger.info(f"Exported results to {filename}")
+            self.app.notify(
+                f"Results exported to:\n{filename}",
+                severity="information",
+                timeout=5,
+            )
+
+        except Exception as e:
+            logger.error(f"Failed to export results: {e}")
+            self.app.notify(f"Export failed: {str(e)}", severity="error", timeout=5)
+
+    def action_go_back(self) -> None:
+        """Handle back/escape action."""
+        # Depending on stage, go back to previous stage or exit
+        if self.workflow_stage in ["select_policy", "view_results", "complete"]:
+            self.app.pop_screen()
+        elif self.workflow_stage == "select_quiet_days":
+            self._show_policy_selection()
+        elif self.workflow_stage == "select_enforce_target":
+            self._show_results()
+        elif self.workflow_stage == "select_non_enforce_target":
+            if self.enforce_ready_target_policy:
+                self._show_enforce_target_selection()
+            else:
+                self._show_results()
+        elif self.workflow_stage == "confirm_migration":
+            self._show_non_enforce_target_selection()
+        else:
+            self.app.pop_screen()

TUI/theme_amber_terminal.py

@@ -12,7 +12,7 @@ def get_amber_terminal_theme():
         success=Color.parse("#ffb733"),
         warning=Color.parse("#ffff66"),
         error=Color.parse("#ff3300"),
-        surface=Color.parse("#3a1f00"),  # brighter brown for blending
+        surface=Color.parse("#49331a"),  # brighter brown for blending
     )
 
 

airlock_libs/.gitignore

@@ -1,3 +1,4 @@
 /target
 build.sh
-pythontest.py
+pythontest.py
+changelog.md

airlock_libs/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "airlock_libs"
-version = "2.0.0"
+version = "5.0.0"
 edition = "2024"
 
 [lib]
@@ -10,12 +10,21 @@ crate-type = ["cdylib"]
 chrono = "0.4.42"
 indicatif = "0.18.2"
 mongodb = "3.3.0"
+opentelemetry = { version = "0.18.0", features = ["rt-tokio", "metrics", "trace"] }
+opentelemetry-otlp = { version = "0.11.0", features = ["trace", "metrics"] }
+opentelemetry-semantic-conventions = { version = "0.10.0" }
+opentelemetry-proto = { version = "0.1.0"}
 pyo3 = { version = "0.27.0", features = ["extension-module", "generate-import-lib"] }
 reqwest = { version = "0.12.24", features = ["json", "native-tls"] }
 serde = "1.0.228"
 serde-pyobject = "0.8.0"
 serde_json = "1.0.145"
 tokio = { version = "1.48.0", features = ["full"] }
+tonic = { version = "0.8.2", features = ["tls-roots"] }
+tracing = "0.1.41"
+tracing-subscriber = "0.3.20"
+tracing-opentelemetry = "0.32.0"
+pyo3-async-runtimes = { version = "0.27.0", features = ["async-std", "tokio"] }
 
 [package.metadata.maturin]
 generate-abi-stubs = true

airlock_libs/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "airlock_libs"
-version = "2.0.0"
+version = "5.0.0"
 description = "Airlock Digital API Wrapper"
 readme = "README.md"
 license = { text = "AGPL-3.0-only" }

airlock_libs/src/services.rs

@@ -1,7 +1,15 @@
 use chrono::{Duration, Local, NaiveDate};
 use indicatif::{MultiProgress, ProgressBar, ProgressDrawTarget, ProgressStyle};
 use mongodb::bson::oid::ObjectId;
+use opentelemetry::global::shutdown_tracer_provider;
+use opentelemetry::sdk::Resource;
+use opentelemetry::trace::noop::NoopTracerProvider;
+use opentelemetry::trace::{Status, TraceContextExt, TraceError};
+use opentelemetry::{Context, KeyValue, sdk::trace as sdktrace, trace::Tracer};
+use opentelemetry::{Key, global};
+use opentelemetry_otlp::WithExportConfig;
 use pyo3::{prelude::*, types::PyString};
+use pyo3_async_runtimes::async_std;
 use reqwest::{
     Client,
     header::{HeaderMap, HeaderName, HeaderValue},
@@ -18,6 +26,34 @@ use std::{
     str::FromStr,
 };
 
+#[allow(non_snake_case)]
+#[derive(Deserialize, Debug)]
+struct TelemetryConfig {
+    TELEMETRY: bool,
+    TELEM_URL: Option<String>,
+}
+
+impl TelemetryConfig {
+    pub fn load() -> Self {
+        let cfg_path = get_base_directory().join("config\\user_config.json");
+        if !cfg_path.exists() {
+            return Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            };
+        }
+        match fs::read_to_string(&cfg_path) {
+            Ok(contents) => serde_json::from_str::<Self>(&contents).unwrap_or(Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            }),
+            Err(_) => Self {
+                TELEMETRY: false,
+                TELEM_URL: None,
+            },
+        }
+    }
+}
 #[derive(Debug, Deserialize, Serialize)]
 struct ApiResponse {
     error: String,
@@ -53,6 +89,40 @@ struct Group {
     localip: String,
 }
 
+enum ExtractedValues {
+    Headers(reqwest::header::HeaderMap),
+    BaseUrl(String),
+}
+
+trait Converter {
+    fn convert(py: Python<'_>, py_self: &Py<PyAny>, extract_headers: bool) -> ExtractedValues;
+}
+
+struct PyData;
+
+impl Converter for PyData {
+    fn convert(py: Python<'_>, py_self: &Py<PyAny>, extract_headers: bool) -> ExtractedValues {
+        if extract_headers {
+            let headers = py_self.getattr(py, "headers").unwrap().to_string();
+            let headers_replace = headers.replace('\'', "\"");
+            let parsed: Value = serde_json::from_str(headers_replace.as_str()).unwrap();
+            let mut header_map = HeaderMap::new();
+            if let Some(obj) = parsed.as_object() {
+                for (_key, value) in obj {
+                    if let Some(v) = value.as_str() {
+                        let val = HeaderValue::from_str(v).unwrap();
+                        header_map.insert(HeaderName::from_str("X-APIKey").unwrap(), val);
+                    }
+                }
+            }
+            ExtractedValues::Headers(header_map)
+        } else {
+            let base_url = py_self.getattr(py, "base_url").unwrap().to_string();
+            ExtractedValues::BaseUrl(base_url)
+        }
+    }
+}
+
 #[pyfunction]
 pub fn pull_policy_exec_histories(
     py: Python<'_>,
@@ -61,165 +131,254 @@ pub fn pull_policy_exec_histories(
     exec_types: String,
     days: i64,
 ) -> Py<PyString> {
-    let file_path: PathBuf = format!(
-        "{}\\cache\\chunkinator.json",
-        get_base_directory().display()
-    )
-    .into();
-    let writeable_filepath = file_path.clone();
-    if !file_path.exists() {
-        if let Some(parent_dir) = file_path.parent()
-            && !parent_dir.exists()
-        {
-            fs::create_dir_all(parent_dir).unwrap();
-        }
-        fs::File::create(file_path).unwrap();
-    }
-    let data = ApiResponse {
-        error: "Success".to_string(),
-        response: ExecHistories {
-            exechistories: vec![],
-        },
+    let headers: HeaderMap = match PyData::convert(py, &py_self, true) {
+        ExtractedValues::Headers(h) => h,
+        ExtractedValues::BaseUrl(_) => std::process::abort(),
     };
-    let data_write = serde_json::to_string_pretty(&data).expect("Failed to serialize");
-    fs::write(writeable_filepath.clone(), data_write).unwrap();
-    let mut checkpoint_number: String = skipback(days).to_string();
-    let multi_progress = MultiProgress::new();
-    multi_progress.set_draw_target(ProgressDrawTarget::stdout());
-    let progress_bar = multi_progress.add(ProgressBar::new(100));
-    progress_bar.set_style(
-        ProgressStyle::default_bar()
-            .template("Total Completion: {spinner:.green} [{elapsed_precise}] [{bar:40.green/blue}] {pos}/{len}")
-            .unwrap(),
-    );
-    progress_bar.enable_steady_tick(std::time::Duration::from_millis(100));
-    let client = build_client(py, &py_self);
-    let api: Py<PyAny> = py_self;
-    let cutoff = Local::now().naive_local() - Duration::days(days);
-    let mut f = File::open(&writeable_filepath).unwrap();
-    loop {
-        f.seek(SeekFrom::Start(0)).unwrap();
-        let execution_histories = history_logging(
-            py,
-            &api,
-            &exec_types,
-            &checkpoint_number,
-            &policy_names,
-            &client,
-        );
-        let parsed_responses = execution_histories.response.exechistories;
-        if parsed_responses.is_empty() {
-            break;
-        }
-        let mut seen: HashMap<(String, String, String), Group> = if writeable_filepath.exists() {
-            let mut contents = String::new();
-            f.read_to_string(&mut contents).unwrap();
-            let existing_data: ApiResponse =
-                serde_json::from_str(&contents).unwrap_or(ApiResponse {
-                    error: "Success".to_string(),
-                    response: ExecHistories {
-                        exechistories: vec![],
-                    },
-                });
-            existing_data
-                .response
-                .exechistories
-                .into_iter()
-                .map(|entry| {
-                    (
-                        (
-                            entry.sha256.clone(),
-                            entry.filename.clone(),
-                            entry.hostname.clone(),
-                        ),
-                        entry,
-                    )
-                })
-                .collect()
-        } else {
-            HashMap::new()
+    let base_url = match PyData::convert(py, &py_self, false) {
+        ExtractedValues::Headers(_) => std::process::abort(),
+        ExtractedValues::BaseUrl(b) => b,
+    };
+    let handle = std::thread::spawn(move || {
+        let rt = match tokio::runtime::Runtime::new() {
+            Ok(rt) => rt,
+            Err(e) => {
+                println!("Failed to build Tokio Runtime: {:?}", e);
+                std::process::abort();
+            }
         };
-        for (index, executions) in parsed_responses.iter().enumerate() {
-            if executions.checkpoint.is_empty() || executions.datetime.is_empty() {
-                continue;
+        rt.block_on(async {
+            let _ = init_tracer();
+        });
+        let tracer = global::tracer("global_tracer");
+        let _cx = Context::new();
+        let file_path: PathBuf = format!(
+            "{}\\cache\\chunkinator.json",
+            get_base_directory().display()
+        )
+        .into();
+        let writeable_filepath = file_path.clone();
+        if !&file_path.exists() {
+            if let Some(parent_dir) = &file_path.parent()
+                && !parent_dir.exists()
+            {
+                match fs::create_dir_all(parent_dir) {
+                    Ok(_) => {}
+                    Err(e) => {
+                        println!("Failed to Create Directory {:?}: {}", parent_dir, e);
+                        std::process::abort();
+                    }
+                }
             }
-            if index == parsed_responses.len() - 1 {
-                checkpoint_number = executions.checkpoint.clone();
-                break;
-            }
-            let history_date = match NaiveDate::parse_from_str(
-                &executions.datetime.replace(" +0000 UTC", ""),
-                "%Y-%m-%dT%H:%M:%SZ",
-            ) {
-                Ok(date) => date,
-                Err(_) => continue,
-            };
-            if history_date >= cutoff.into() {
-                let key = (
-                    executions.sha256.clone(),
-                    executions.filename.clone(),
-                    executions.hostname.clone(),
-                );
-                seen.entry(key).or_insert(executions.clone());
+            match fs::File::create(&file_path) {
+                Ok(_) => {}
+                Err(e) => {
+                    println!("Failed to Create Directory {:?}: {}", &file_path, e);
+                    std::process::abort();
+                }
             }
         }
-        let final_response = ApiResponse {
+        let data = ApiResponse {
             error: "Success".to_string(),
             response: ExecHistories {
-                exechistories: seen.values().cloned().collect(),
+                exechistories: vec![],
             },
         };
-        let data_write = serde_json::to_string_pretty(&final_response).unwrap();
-        fs::write(&writeable_filepath, data_write).unwrap();
-        if let Some(last_item) = &final_response.response.exechistories.last()
-            && let Ok(last_date) = NaiveDate::parse_from_str(
-                &last_item.datetime.replace(" +0000 UTC", ""),
-                "%Y-%m-%dT%H:%M:%SZ",
-            )
-        {
-            let date_diff = Local::now().naive_local().date() - last_date;
-            let percentage_diff = (days - date_diff.num_days()) as f64 / days as f64 * 100.0;
-            progress_bar.set_position(percentage_diff.round() as u64);
-            progress_bar.set_message("Total Percent Complete");
-        }
-    }
-    progress_bar.finish_with_message("All Checkpoints Complete");
-    let return_data = fs::read_to_string(&writeable_filepath).unwrap();
-    PyString::new(py, &return_data).into()
-}
-
-fn build_client(py: Python<'_>, py_self: &Py<PyAny>) -> Client {
-    let headers = py_self.getattr(py, "headers").unwrap().to_string();
-    let headers_replace = headers.replace('\'', "\"");
-    let parsed: Value = serde_json::from_str(headers_replace.as_str()).unwrap();
-    let mut header_map = HeaderMap::new();
-    if let Some(obj) = parsed.as_object() {
-        for (_key, value) in obj {
-            if let Some(v) = value.as_str() {
-                let val = HeaderValue::from_str(v).unwrap();
-                header_map.insert(HeaderName::from_str("X-APIKey").unwrap(), val);
+        let data_write = serde_json::to_string_pretty(&data).expect("Failed to serialize");
+        match fs::write(writeable_filepath.clone(), data_write) {
+            Ok(_) => {}
+            Err(e) => {
+                println!("Failed to write to: {:?}: {}", &writeable_filepath, e);
+                std::process::abort();
             }
         }
-    }
+        let mut checkpoint_number: String = skipback(days).to_string();
+        let multi_progress = MultiProgress::new();
+        multi_progress.set_draw_target(ProgressDrawTarget::stdout());
+        let progress_bar = multi_progress.add(ProgressBar::new(100));
+        progress_bar.set_style(
+            ProgressStyle::default_bar()
+                .template("Total Completion: {spinner:.green} [{elapsed_precise}] [{bar:40.green/blue}] {pos}/{len}")
+                .unwrap(),
+        );
+        progress_bar.enable_steady_tick(std::time::Duration::from_millis(100));
+        let client = tracer.in_span("Building HTTP Client", |cx| {
+            let client_result = build_client(headers);
+            match client_result {
+                Ok(client_result) => {
+                    cx.span().add_event(
+                        "info",
+                        vec![KeyValue::new(
+                            "Client Built Successfully",
+                            format!("{:?}", client_result),
+                        )],
+                    );
+                    client_result
+                }
+                Err(client_result) => {
+                    cx.span().add_event(
+                        "warn",
+                        vec![KeyValue::new(
+                            "Client Failed to Build",
+                            format!("{:?}", &client_result),
+                        )],
+                    );
+                    cx.span()
+                        .set_status(Status::error("Client Failed to Build"));
+                    println!("Failed to Build Client: {:?}", client_result);
+                    std::process::abort();
+                }
+            }
+        });
+        let cutoff = Local::now().naive_local() - Duration::days(days);
+        let mut f = match File::open(&writeable_filepath) {
+            Ok(f) => f,
+            Err(e) => {
+                println!("Failed to Access {:?}: {}", &writeable_filepath, e);
+                std::process::abort();
+            }
+        };
+        tracer.in_span("Airlock Data Retreival", |cx| {
+            let span = cx.span();
+            span.set_attribute(Key::new("Days").string(days.to_string()));
+            span.set_attribute(KeyValue::new("Policy Name", policy_names.clone()));
+            loop {
+                match f.seek(SeekFrom::Start(0)) {
+                    Ok(_) => {}
+                    Err(e) => {
+                        println!("Failed to seek start of {:?}: {}", f, e);
+                        std::process::abort();
+                    }
+                }
+                let execution_histories = tracer.in_span(checkpoint_number.to_string(), |cx| {
+                    let results: ApiResponse = history_logging(
+                        &base_url,
+                        &exec_types,
+                        &checkpoint_number,
+                        &policy_names,
+                        &client,
+                    );
+                    cx.span().set_attribute(KeyValue::new(
+                        "items_in_response",
+                        results.response.exechistories.len().to_string(),
+                    ));
+                    results
+                });
+                let parsed_responses = execution_histories.response.exechistories;
+                if parsed_responses.is_empty() {
+                    break;
+                }
+                let mut seen: HashMap<(String, String, String), Group> =
+                    if writeable_filepath.exists() {
+                        let mut contents = String::new();
+                        f.read_to_string(&mut contents).unwrap();
+                        let existing_data: ApiResponse =
+                            serde_json::from_str(&contents).unwrap_or(ApiResponse {
+                                error: "Success".to_string(),
+                                response: ExecHistories {
+                                    exechistories: vec![],
+                                },
+                            });
+                        existing_data
+                            .response
+                            .exechistories
+                            .into_iter()
+                            .map(|entry| {
+                                (
+                                    (
+                                        entry.sha256.clone(),
+                                        entry.filename.clone(),
+                                        entry.hostname.clone(),
+                                    ),
+                                    entry,
+                                )
+                            })
+                            .collect()
+                    } else {
+                        HashMap::new()
+                    };
+                for (index, executions) in parsed_responses.iter().enumerate() {
+                    if executions.checkpoint.is_empty() || executions.datetime.is_empty() {
+                        continue;
+                    }
+                    if index == parsed_responses.len() - 1 {
+                        checkpoint_number = executions.checkpoint.clone();
+                        break;
+                    }
+                    let history_date = match NaiveDate::parse_from_str(
+                        &executions.datetime.replace(" +0000 UTC", ""),
+                        "%Y-%m-%dT%H:%M:%SZ",
+                    ) {
+                        Ok(date) => date,
+                        Err(_) => continue,
+                    };
+                    if history_date >= cutoff.into() {
+                        let key = (
+                            executions.sha256.clone(),
+                            executions.filename.clone(),
+                            executions.hostname.clone(),
+                        );
+                        seen.entry(key).or_insert(executions.clone());
+                    }
+                }
+                let final_response = ApiResponse {
+                    error: "Success".to_string(),
+                    response: ExecHistories {
+                        exechistories: seen.values().cloned().collect(),
+                    },
+                };
+                let data_write = serde_json::to_string_pretty(&final_response).unwrap();
+                match fs::write(&writeable_filepath, data_write) {
+                    Ok(_) => {}
+                    Err(e) => {
+                        println!("Failed to write to: {:?}: {}", &writeable_filepath, e);
+                    }
+                }
+                if let Some(last_item) = &final_response.response.exechistories.last()
+                    && let Ok(last_date) = NaiveDate::parse_from_str(
+                        &last_item.datetime.replace(" +0000 UTC", ""),
+                        "%Y-%m-%dT%H:%M:%SZ",
+                    )
+                {
+                    let date_diff = Local::now().naive_local().date() - last_date;
+                    let percentage_diff =
+                        (days - date_diff.num_days()) as f64 / days as f64 * 100.0;
+                    progress_bar.set_position(percentage_diff.round() as u64);
+                    progress_bar.set_message("Total Percent Complete");
+                }
+            }
+        });
+        progress_bar.finish_with_message("All Checkpoints Complete");
+        let return_data = match fs::read_to_string(&writeable_filepath) {
+            Ok(return_data) => return_data,
+            Err(e) => {
+                println!("Failed to read data from: {:?}: {}", &writeable_filepath, e);
+                std::process::abort();
+            }
+        };
+        shutdown_tracer_provider();
+        return_data.to_string()
+    });
+    let gil_value = handle.join().unwrap();
+    Python::attach(|py| PyString::new(py, &gil_value).into())
+}
 
+fn build_client(headers: HeaderMap) -> Result<reqwest::Client, reqwest::Error> {
     Client::builder()
         .danger_accept_invalid_certs(true)
-        .default_headers(header_map)
+        .default_headers(headers)
         .timeout(std::time::Duration::from_secs(300))
         .build()
-        .unwrap()
 }
 
 #[tokio::main]
 async fn history_logging(
-    py: Python<'_>,
-    py_self: &Py<PyAny>,
+    base_url: &String,
     exec_types: &String,
     checkpoint_number: &String,
     policy_names: &String,
     client: &Client,
 ) -> ApiResponse {
-    let base_url = py_self.getattr(py, "base_url").unwrap().to_string();
     let payload = format!(
         r#"{{
         "type": {},
@@ -276,3 +435,26 @@ fn skipback(days: i64) -> ObjectId {
     let objectid_hex = format!("{}0000000000000000", hex_timestamp);
     ObjectId::parse_str(&objectid_hex).expect("Invalid ObjectId hex")
 }
+
+fn init_tracer() -> Result<Option<sdktrace::Tracer>, TraceError> {
+    let cfg = TelemetryConfig::load();
+    if !cfg.TELEMETRY {
+        global::set_tracer_provider(NoopTracerProvider::new());
+        return Ok(None);
+    }
+    let endpoint = cfg.TELEM_URL.unwrap_or_default();
+    let tracer =
+        opentelemetry_otlp::new_pipeline()
+            .tracing()
+            .with_exporter(
+                opentelemetry_otlp::new_exporter()
+                    .tonic()
+                    .with_endpoint(endpoint),
+            )
+            .with_trace_config(sdktrace::config().with_resource(Resource::new(vec![
+                KeyValue::new("service.name", "LoxideLibs"),
+            ])))
+            .install_simple()
+            .unwrap();
+    Ok(Some(tracer))
+}

default_system_config.json

@@ -1,14 +1,39 @@
 {
-  "APPNAME": "AirlockTools",
+  "APPNAME": "Loxide",
   "URL": "https://server:3129",
   "LOG_LEVEL": "INFO",
-  "BAD_PATH_PARTS": ["users","wwwroot","windows\\temp","windows\\task","windows\\system32","startup", "windows\\fonts","Recycle.Bin","AppData","programdata", "Solarwinds","kaseya"],
-  "BAD_PUBLISHERS": ["Brave", "Zoom", "GlavSoft", "VNC"],
-  "PUPS":["logmein","invalid","nmap","LTSvc","VNC","Kaseya","Solarwinds","mRemoteNG"],
+  "BAD_PATH_PARTS": [
+    "users",
+    "wwwroot",
+    "windows\\temp",
+    "windows\\task",
+    "windows\\system32",
+    "startup",
+    "windows\\fonts",
+    "Recycle.Bin",
+    "AppData",
+    "programdata",
+    "Solarwinds",
+    "kaseya"
+  ],
+  "BAD_PUBLISHERS": [
+    "Brave",
+    "Zoom",
+    "GlavSoft",
+    "VNC"
+  ],
+  "PUPS": [
+    "logmein",
+    "invalid",
+    "nmap",
+    "LTSvc",
+    "VNC",
+    "Kaseya",
+    "Solarwinds",
+    "mRemoteNG"
+  ],
   "PATH_EXCLUSION_CONST": 4,
   "MIN_FILES_FOR_PATH": 4,
   "VT_THREAT_TOLERANCE": 4,
-  "POLICY_MAP_ENF_AUD": {
- 
-    }
+  "POLICY_MAP_ENF_AUD": {}
 }

flows/localApproval.py

@@ -10,7 +10,7 @@ from typing import List, Optional
 from models.agent import Agent
 from services.agenthandler import moveAgentToRelatedPolicy, selectAgents
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json
+from utils.configmanager import get_system_json
 from utils.utils import colorText, get_sanitized_input
 
 logger = logging.getLogger(__name__)
@@ -28,7 +28,7 @@ class LocalApprovalRequestor:
             username: Username creating the approvals (for tracking)
         """
         self.api = api
-        self.policy_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+        self.policy_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
         self.username = (
             username or os.getenv("USERNAME") or os.getenv("USER") or "unknown"
         )
@@ -51,7 +51,7 @@ class LocalApprovalRequestor:
             batch_id = int(time.time())
 
         purpose = (
-            f"🎫 Local Approval 🎫 - {duration_minutes} mins - "
+            f"🎫 Local Approval 🎫 - {duration_minutes} mins - "
             f"batch:{batch_id} Client:{agent_id} User:{self.username}"
         )
 
@@ -103,10 +103,10 @@ class LocalApprovalRequestor:
         success_count = 0
         failure_count = 0
 
-        print(colorText(f"\n📦 Processing batch {batch_id}...", "cyan"))
-        print(colorText(f"👤 Requested by: {self.username}", "cyan"))
+        print(colorText(f"\n📦 Processing batch {batch_id}...", "cyan"))
+        print(colorText(f"👤 Requested by: {self.username}", "cyan"))
         print(
-            colorText(f"📊 Moving {len(agents)} agent(s) to local approval\n", "cyan")
+            colorText(f"📊 Moving {len(agents)} agent(s) to local approval\n", "cyan")
         )
 
         for agent in agents:
@@ -125,11 +125,11 @@ class LocalApprovalRequestor:
                 if not move_success:
                     raise Exception("Failed to move to audit policy")
 
-                print(colorText(f"✓ {agent.hostname}", "green"))
+                print(colorText(f"✓ {agent.hostname}", "green"))
                 success_count += 1
 
             except Exception as e:
-                print(colorText(f"✗ {agent.hostname}: {e}", "red"))
+                print(colorText(f"✗ {agent.hostname}: {e}", "red"))
                 logger.error(f"Error processing agent {agent.hostname}: {e}")
                 failure_count += 1
 
@@ -152,7 +152,7 @@ class LocalApprovalRequestor:
         ]
 
         # Display duration options
-        print(colorText("\n⏱️  Select Local Approval Duration:", "white"))
+        print(colorText("\n⏱️  Select Local Approval Duration:", "white"))
         print(colorText("=" * 50, "white"))
 
         for i, (minutes, label) in enumerate(duration_options, start=1):
@@ -166,36 +166,36 @@ class LocalApprovalRequestor:
 
             if 1 <= choice <= len(duration_options):
                 duration_minutes, duration_label = duration_options[choice - 1]
-                print(colorText(f"✓ Selected: {duration_label}", "green"))
+                print(colorText(f"✓ Selected: {duration_label}", "green"))
                 logger.info(f"User selected duration: {duration_minutes} minutes")
             else:
-                print(colorText("❌ Invalid choice.", "red"))
+                print(colorText("❌ Invalid choice.", "red"))
                 logger.warning("Invalid duration choice")
                 return
 
         except ValueError:
-            print(colorText("❌ Invalid input. Please enter a number.", "red"))
+            print(colorText("❌ Invalid input. Please enter a number.", "red"))
             logger.warning("Invalid input for duration selection")
             return
 
         # Select agents
-        print(colorText("\n🎯 Select Agents for Local Approval:", "white"))
+        print(colorText("\n🎯 Select Agents for Local Approval:", "white"))
         agents = selectAgents(self.api)
 
         if not agents:
-            print(colorText("❌ No agents found or error retrieving agents.", "red"))
+            print(colorText("❌ No agents found or error retrieving agents.", "red"))
             logger.warning("No agents selected or error retrieving agents")
             return
 
         # Confirm with user
-        print(colorText("\n📋 Summary:", "cyan"))
+        print(colorText("\n📋 Summary:", "cyan"))
         print(colorText(f"  Duration: {duration_label}", "white"))
         print(colorText(f"  Agents: {len(agents)}", "white"))
 
         confirm = get_sanitized_input("\nProceed? (y/n): ").lower()
 
         if confirm != "y":
-            print(colorText("❌ Operation cancelled.", "yellow"))
+            print(colorText("❌ Operation cancelled.", "yellow"))
             return
 
         # Process the batch
@@ -219,24 +219,25 @@ class LocalApprovalRequestor:
             failure_count: Number of failed operations
         """
         print(colorText(f"\n{'=' * 60}", "white"))
-        print(colorText("📊 Local Approval Summary", "cyan"))
+        print(colorText("📊 Local Approval Summary", "cyan"))
         print(colorText("=" * 60, "white"))
 
-        print(colorText(f"✓ Successfully processed: {success_count}", "green"))
+        print(colorText(f"✓ Successfully processed: {success_count}", "green"))
 
         if failure_count > 0:
-            print(colorText(f"✗ Failed: {failure_count}", "red"))
+            print(colorText(f"✗ Failed: {failure_count}", "red"))
 
-        print(colorText(f"\n📦 Batch ID: {batch_id}", "cyan"))
-        print(colorText(f"⏱️  Duration: {duration_label}", "cyan"))
+        print(colorText(f"\n📦 Batch ID: {batch_id}", "cyan"))
+        print(colorText(f"⏱️  Duration: {duration_label}", "cyan"))
 
         print(colorText("=" * 60, "white"))
-        print(colorText("\n💡 Next Steps:", "yellow"))
-        print(colorText("  • Agents have been moved to audit policies", "white"))
-        print(colorText("  • Local approvals are active", "white"))
+        print(colorText("\n💡 Next Steps:", "yellow"))
+        print(colorText("  • Agents have been moved to audit policies", "white"))
+        print(colorText("  • Local approvals are active", "white"))
         print(
             colorText(
-                f"  • Agents will return to enforcement after {duration_label}", "white"
+                f"  • Agents will return to enforcement after {duration_label}",
+                "white",
             )
         )
         print(colorText("=" * 60 + "\n", "white"))

flows/otp.py

@@ -14,136 +14,18 @@
 #    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 
-from datetime import datetime
 import logging
-import os
 
 import pandas as pd
 
 from services.agenthandler import selectAgents
 from services.API import AirlockAPIWrapper
-from utils.configmanager import load_env
 from utils.selector import Selector
-from utils.utils import colorText, get_sanitized_input
+from utils.utils import get_sanitized_input
 
 logger = logging.getLogger(__name__)
 
 
-def otp_generate(api: AirlockAPIWrapper):
-    otp_dict = {}
-    agents = selectAgents(api)
-    print(colorText("Would you like to continue with these devices?", "white"))
-    for agent in agents:
-        print(agent.hostname)
-    confirm = Selector.confirm()
-    if agents and confirm:
-        requester = get_sanitized_input("Who is requesting the OTP:  ")
-        because = get_sanitized_input("Why/What work are they doing?:  ")
-
-        purpose = f"Requester: {requester} - for : {because}"
-        possible_durations = [15, 60, 360, 1440, 10080]
-
-        print(colorText("Please select a duration in minutes:  ", "white"))
-        print(
-            colorText(
-                "15 mins, 60 mins, 360 mins(6 Hours), 1440 mins (24 Hours), 10080 mins (7 Days):",
-                "white",
-            )
-        )
-        duration_selected = Selector.select_int(possible_durations)
-
-        if isinstance(duration_selected, list):
-            duration_selected = duration_selected[0] if duration_selected else None
-
-        if duration_selected is not None:
-            for agent in agents:
-                logging.info(f"Querying API for {agent.hostname}")
-                otp_code = api.otp_generate(agent.agentid, duration_selected, purpose)
-                logger.debug(f"Generated OTP for {agent.hostname}: {otp_code}")
-                otp_dict[agent.hostname] = otp_code
-
-    print(colorText("Requested Codes:", "green"))
-    for key, value in otp_dict.items():
-        print(colorText(f"{key} | {value}", "green"))
-
-
-def otp_activities_by_agent(api: AirlockAPIWrapper):
-    activeagents = api.otp_find_active()
-    awaitingagents = api.otp_find_awaiting()
-    enforcedagents = api.otp_find_enforced()
-    revokedagents = api.otp_find_revoked()
-
-    # Add a 'status' column to each DataFrame
-    activeagents["status"] = "active"
-    awaitingagents["status"] = "awaiting"
-    enforcedagents["status"] = "enforced"
-    revokedagents["status"] = "revoked"
-
-    # Combine all into one DataFrame
-    combined_agents = pd.concat(
-        [activeagents, awaitingagents, enforcedagents, revokedagents], ignore_index=True
-    )
-    combined_agents = combined_agents.sort_values(by="otpid", ascending=False)
-
-    # Optionally, select specific hosts
-    user_input = (
-        get_sanitized_input("\nWould you like to search for a specific device? (y/n): ")
-        .strip()
-        .lower()
-    )
-    if user_input == "y":
-        agentnames = []
-        agents = selectAgents(api)
-        for agent in agents:
-            agentnames.append(agent.hostname)
-
-        combined_agents = combined_agents[combined_agents["hostname"].isin(agentnames)]
-
-    # Present and select rows
-    selected_rows = Selector.select_dataframe_with_mode(
-        combined_agents,
-        columns=["otpid", "hostname", "status", "purpose", "granted"],
-        header="OTP Sessions",
-    )
-    combined_df = pd.DataFrame()
-
-    for row in selected_rows:
-        otpid = row["otpid"]
-        hostname = row["hostname"]
-        result = api.otp_get_activities(otpid)
-        result["hostname"] = hostname
-        if not result.empty:
-            logger.info(f"Activities for {hostname} (otpid: {otpid}):\n{result}")
-            combined_df = pd.concat([combined_df, result], ignore_index=True)
-        else:
-            logger.info(f"No activities found for {hostname} (otpid: {otpid})")
-
-    user_input = (
-        get_sanitized_input(
-            "\nWould you like to export the results to a CSV file? (y/n): "
-        )
-        .strip()
-        .lower()
-    )
-    if user_input == "y":
-        working_dir = load_env("WORKING_DIR")
-        timestamp = datetime.now().strftime("%Y-%m-%d_%H-%M-%S")
-        filename = f"otp_activities_{timestamp}.csv"
-        file_path = os.path.join(str(working_dir), filename)
-
-        combined_df.to_csv(file_path, index=False)
-        logging.info(f"Exported Data to {file_path}")
-
-        print(
-            colorText(
-                f"\n✅ OTP Activity exported to: {working_dir}\\{filename}",
-                "green",
-            )
-        )
-    else:
-        logging.debug("User declined to export the DataFrame.")
-
-
 def otp_revoke(api: AirlockAPIWrapper):
 
     activeagents = api.otp_find_active()

flows/prepPolicy.py

@@ -25,7 +25,7 @@ import pandas as pd
 from models.execution import ExecutionHistoryRecord
 from models.policy import Allowlist, Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_value, load_env, load_env_json
+from utils.configmanager import get_system_list, get_system_value, load_env
 from utils.selector import Selector
 from utils.utils import (
     areYouSure,
@@ -88,7 +88,7 @@ def sortHashes(
 ):
     working_dir = load_env("WORKING_DIR")
     history_days = Selector.select_value(
-        prompt="Enter how many days of history to pull (1–150): ",
+        prompt="Enter how many days of history to pull (1–150): ",
         value_type=int,
         valid_range=(1, 150),
     )
@@ -157,7 +157,7 @@ def buildPathsandPublishers(selected_policies: List[Policy], split):
         f"{working_dir}\\Approved\\{selected_policies[0].name}_approved_executions.csv"
     )
     path2 = f"{working_dir}\\Approved\\{selected_policies[0].name}_needs_review_executions.csv"
-    path_exclusion_constant = get_protected_value("PATH_EXCLUSION_CONST", cast_type=int)
+    path_exclusion_constant = get_system_value("PATH_EXCLUSION_CONST", cast_type=int)
 
     if os.path.exists(path1):
         df1 = pd.read_csv(path1)
@@ -227,7 +227,7 @@ def buildPathsandPublishers(selected_policies: List[Policy], split):
                 all_approved_hashes["publisher"] != "Not Signed"
             ].drop_duplicates(subset=["publisher"])
             # Remove Bad publisher if somehow they made it this far
-            pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
+            pattern = regulator(get_system_list("BAD_PUBLISHERS"))
             publist = publist[~publist["publisher"].str.contains(pattern, na=False)]
             publist = publist[["publisher"]]
             publist.sort_values(by="publisher", inplace=True)
@@ -313,7 +313,7 @@ def buildPreflights(selected_policies: List[Policy]):
 
 
 def splitFilepathsGrouped(df, path_exclusion_constant, col="filename"):
-    min_files_for_path = get_protected_value("MIN_FILES_FOR_PATH", cast_type=int)
+    min_files_for_path = get_system_value("MIN_FILES_FOR_PATH", cast_type=int)
 
     def clean_split(path):
         if not isinstance(path, (str, bytes, os.PathLike)):
@@ -385,8 +385,8 @@ def calculatePath(approved_hashes, path_exclusion_constant, split):
     else:
         dfs_by_policy = [approved_hashes]
 
-    badpathparts = load_env_json("BAD_PATH_PARTS", "[]")
-    min_files_for_path = get_protected_value("MIN_FILES_FOR_PATH", cast_type=int)
+    badpathparts = get_system_list("BAD_PATH_PARTS")
+    min_files_for_path = get_system_value("MIN_FILES_FOR_PATH", cast_type=int)
 
     processed_dfs = []
 
@@ -655,7 +655,7 @@ def section_header(title):
 
 def printEnforceChecklist(selected_policies, destination_policy, destination_allowlist):
     working_dir = load_env("WORKING_DIR")
-    section_header("🛠️ 🔒 Prepare to Enforce Policy 🛠️ 🔒")
+    section_header("🛠️ 🔒 Prepare to Enforce Policy 🛠️ 🔒")
     print(
         colorText(
             "\nSequentially follow these steps to prepare a policy for enforcement:",
@@ -670,11 +670,11 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         )
     )
     if not selected_policies:
-        print(colorText("  [✗]  No policies have been chosen", "red"))
+        print(colorText("  [✗]  No policies have been chosen", "red"))
     else:
         print(colorText("The following policies have been chosen:", "green"))
         for policy in selected_policies:
-            print(colorText(f"  [✓] {policy.name}", "green"))
+            print(colorText(f"  [✓] {policy.name}", "green"))
 
     # Step 2: Destination Policy and Allowlist
     print(
@@ -683,22 +683,22 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     if destination_policy:
         print(
             colorText(
-                f"  [✓] {destination_policy[0].name} has been selected as the destination policy",
+                f"  [✓] {destination_policy[0].name} has been selected as the destination policy",
                 "green",
             )
         )
     else:
-        print(colorText("  [✗]  No destination policy has been chosen", "red"))
+        print(colorText("  [✗]  No destination policy has been chosen", "red"))
 
     if destination_allowlist:
         print(
             colorText(
-                f"  [✓] {destination_allowlist[0].name} has been selected as allowlist",
+                f"  [✓] {destination_allowlist[0].name} has been selected as allowlist",
                 "green",
             )
         )
     else:
-        print(colorText("  [✗]  No allowlist has been chosen", "red"))
+        print(colorText("  [✗]  No allowlist has been chosen", "red"))
 
     # Step 3: Data Preparation
     print(
@@ -713,9 +713,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓] Data has been fetched"
+                    "  [✓] Data has been fetched"
                     if os.path.exists(review_path)
-                    else "  [✗] Data has not been fetched"
+                    else "  [✗] Data has not been fetched"
                 ),
                 "green" if os.path.exists(review_path) else "red",
             )
@@ -723,7 +723,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check data fetch status", "red"
+                "  [✗]  No policies selected, cannot check data fetch status", "red"
             )
         )
 
@@ -756,9 +756,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Reviewed hashes have been loaded"
+                    "  [✓]  Reviewed hashes have been loaded"
                     if os.path.exists(approved_path)
-                    else "  [✗]  Reviewed hashes have not been loaded"
+                    else "  [✗]  Reviewed hashes have not been loaded"
                 ),
                 "green" if os.path.exists(approved_path) else "red",
             )
@@ -766,9 +766,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Path review list created"
+                    "  [✓]  Path review list created"
                     if os.path.exists(second_review_path)
-                    else "  [✗]  Path review list has not been created"
+                    else "  [✗]  Path review list has not been created"
                 ),
                 "green" if os.path.exists(second_review_path) else "red",
             )
@@ -776,7 +776,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check reviewed hashes or path list",
+                "  [✗]  No policies selected, cannot check reviewed hashes or path list",
                 "red",
             )
         )
@@ -812,9 +812,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Reviewed path list detected"
+                    "  [✓]  Reviewed path list detected"
                     if os.path.exists(reviewed_path)
-                    else "  [✗]  Path review list has not been detected"
+                    else "  [✗]  Path review list has not been detected"
                 ),
                 "green" if os.path.exists(reviewed_path) else "red",
             )
@@ -825,9 +825,9 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
         print(
             colorText(
                 (
-                    "  [✓]  Preflight Path Exclusion List has been generated"
+                    "  [✓]  Preflight Path Exclusion List has been generated"
                     if preflight_ready
-                    else "  [✗]  Preflight Path Exclusion List has not been generated"
+                    else "  [✗]  Preflight Path Exclusion List has not been generated"
                 ),
                 "green" if preflight_ready else "red",
             )
@@ -835,7 +835,7 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     else:
         print(
             colorText(
-                "  [✗]  No policies selected, cannot check preflight status", "red"
+                "  [✗]  No policies selected, cannot check preflight status", "red"
             )
         )
 
@@ -866,5 +866,5 @@ def printEnforceChecklist(selected_policies, destination_policy, destination_all
     print(colorText("     Apply approved hashes to allowlist", "cyan"))
 
     # Utility Options
-    print(colorText("F. 📂  - Open Working Directory", "cyan"))
-    print(colorText("B. 🔚  - Back", "cyan"))
+    print(colorText("F. 📂  - Open Working Directory", "cyan"))
+    print(colorText("B. 🔚  - Back", "cyan"))

flows/quietAgent.py

@@ -1,134 +0,0 @@
-#    Copyright (C) 2025 James Brotosky, Brandon Wickline
-#
-#    This program is free software: you can redistribute it and/or modify
-#    it under the terms of the GNU Affero General Public License as published
-#    by the Free Software Foundation, either version 3 of the License, or
-#    (at your option) any later version.
-#
-#    This program is distributed in the hope that it will be useful,
-#    but WITHOUT ANY WARRANTY; without even the implied warranty of
-#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#    GNU Affero General Public License for more details.
-#
-#    You should have received a copy of the GNU Affero General Public License
-#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-import datetime
-import logging
-
-import dotenv
-import pandas as pd
-
-from flows.prepPolicy import selectPolicies
-from services.API import AirlockAPIWrapper
-from services.policyhandler import getPolicyInfo
-from utils.configmanager import load_env
-from utils.selector import Selector
-from utils.utils import colorText, get_sanitized_input
-
-logger = logging.getLogger(__name__)
-
-
-dotenv.load_dotenv()
-
-
-def findQuietAgents(api: AirlockAPIWrapper):
-    working_dir = load_env("WORKING_DIR")
-    # Get policy selection and agent list
-    selected_policy = selectPolicies(api, False)
-    if selected_policy:
-        agents = api.agents_find_by_group(selected_policy[0].groupid)
-
-        # Prompt user for history range
-        history_days = Selector.select_value(
-            prompt="Enter how many days of history to pull (1–150): ",
-            value_type=int,
-            valid_range=(1, 150),
-        )
-        required_quiet = Selector.select_value(
-            prompt="Enter how many days without an untrusted execution before these are considered ready for enforcement? (1–365): ",
-            value_type=int,
-            valid_range=(1, 150),
-        )
-
-        confirm = Selector.confirm(
-            f"Do you wish to proceed to pull history for {selected_policy[0].name}? Y/N :  "
-        )
-        # Get execution history as a DataFrame
-        if confirm:
-            policy_exec_history = getPolicyInfo(
-                api, selected_policy[0], [1, 2, 6, 7], history_days
-            )
-
-            if policy_exec_history.empty:
-                logging.info(
-                    "No execution history found for the selected policy and time range."
-                )
-                get_sanitized_input("Press enter to continue")
-                return
-
-            # Convert 'datetime' column to timezone-aware datetime objects
-            policy_exec_history["datetime"] = pd.to_datetime(
-                policy_exec_history["datetime"], format="%Y-%m-%dT%H:%M:%SZ", utc=True
-            )
-
-            # Get current UTC time
-            now = datetime.datetime.now(datetime.timezone.utc)
-
-            # Calculate days ago
-            policy_exec_history["days_ago"] = policy_exec_history["datetime"].apply(
-                lambda dt: (now - dt).days
-            )
-
-            # Count total executions per hostname
-            hostname_counts = policy_exec_history["hostname"].value_counts()
-
-            # Map execution counts to agents
-            agents["execution_count"] = (
-                agents["hostname"].map(hostname_counts).fillna(0).astype(int)
-            )
-
-            # Find most recent execution per hostname
-            most_recent_exec = policy_exec_history.sort_values(
-                by="days_ago"
-            ).drop_duplicates(subset="hostname", keep="first")
-
-            # Map most recent execution age to agents
-            agents["days_since"] = agents["hostname"].map(
-                most_recent_exec.set_index("hostname")["days_ago"]
-            )
-
-            # Check for enforcement readiness
-            agents["required_quiet"] = required_quiet
-            agents["enforce_ready"] = agents["days_since"].apply(
-                lambda x: True if pd.isna(x) or x > required_quiet else False
-            )
-
-            # Sort agents by execution count and hostname
-            agents = agents.sort_values(
-                by=["execution_count", "hostname"], ascending=[True, True]
-            )
-
-            # Save to CSV
-            filename = f"{working_dir}\\{selected_policy[0].name}_agents_last_{history_days}_days.csv"
-            logging.debug(f"Saving CSV to {filename}")
-            print(colorText(f"Saving CSV to {filename}", "green"))
-            agents.to_csv(filename, index=False)
-
-            # Summary statistics
-            total_agents = len(agents)
-            ready_agents = agents["enforce_ready"].sum()
-            not_ready_agents = total_agents - ready_agents
-            ready_percentage = (ready_agents / total_agents) * 100
-
-            # Print results
-
-            message = (
-                f"Total agents: {total_agents}\n"
-                f"Agents marked as 'enforce_ready': {ready_agents}\n"
-                f"Agents not ready: {not_ready_agents}\n"
-                f"Percentage ready for enforcement: {ready_percentage:.2f}%"
-            )
-            logger.debug(message)
-            colorText(message, "green")
-    get_sanitized_input("Press enter to continue")

models/execution.py

@@ -28,7 +28,7 @@ import pandas as pd
 
 import airlock_libs
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_value, load_env_json
+from utils.configmanager import get_system_list, get_system_value
 from utils.utils import colorText, regulator
 
 logger = logging.getLogger(__name__)
@@ -90,9 +90,9 @@ class Hash:
 
     @classmethod
     def categorize_hashes(cls, hashes):
-        threat_tolerance = get_protected_value("VT_THREAT_TOLERANCE", cast_type=int)
-        bad_publishers_pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
-        pups_pattern = regulator(load_env_json("PUPS", "[]"))
+        threat_tolerance = get_system_value("VT_THREAT_TOLERANCE", cast_type=int)
+        bad_publishers_pattern = regulator(get_system_list("BAD_PUBLISHERS"))
+        pups_pattern = regulator(get_system_list("PUPS"))
 
         approved_count = 0
         unapproved_count = 0
@@ -145,13 +145,13 @@ class Hash:
                     approved_count += 1
             except (ValueError, TypeError):
                 logger.debug(
-                    "Needs Review: Scannermatch score is missing or invalid. — {e}"
+                    "Needs Review: Scannermatch score is missing or invalid. — {e}"
                 )
                 hash_obj.at_decision = "needs_review"
                 needs_review_count += 1
 
         logger.debug(
-            f"Final counts — Needs Review: {needs_review_count}, Approved: {approved_count}, Unapproved: {unapproved_count}"
+            f"Final counts — Needs Review: {needs_review_count}, Approved: {approved_count}, Unapproved: {unapproved_count}"
         )
         return hashes
 
@@ -384,9 +384,9 @@ class ExecutionHistoryRecord:
         Returns:
             List[ExecutionHistoryRecord]: The same list, with hash_obj.at_decision updated.
         """
-        threat_tolerance = get_protected_value("VT_THREAT_TOLERANCE", cast_type=int)
-        bad_publishers_pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
-        pups_pattern = regulator(load_env_json("PUPS", "[]"))
+        threat_tolerance = get_system_value("VT_THREAT_TOLERANCE", cast_type=int)
+        bad_publishers_pattern = regulator(get_system_list("BAD_PUBLISHERS"))
+        pups_pattern = regulator(get_system_list("PUPS"))
 
         approved_count = 0
         unapproved_count = 0
@@ -443,13 +443,13 @@ class ExecutionHistoryRecord:
                     approved_count += 1
             except (ValueError, TypeError) as e:
                 logger.debug(
-                    f"Needs Review: Scannermatch score is missing or invalid. — {e}"
+                    f"Needs Review: Scannermatch score is missing or invalid. — {e}"
                 )
                 hash_obj.at_decision = "needs_review"
                 needs_review_count += 1
 
         logger.debug(
-            f"Final counts — Needs Review: {needs_review_count}, "
+            f"Final counts — Needs Review: {needs_review_count}, "
             f"Approved: {approved_count}, Unapproved: {unapproved_count}"
         )
 

requirements.txt

@@ -11,4 +11,4 @@ urllib3==2.5.0
 pyperclip==1.11.0
 
 --extra-index-url https://git.racooncity.org/api/packages/brotoskyj/pypi/simple/
-airlock_libs==2.0.0
+airlock_libs==5.0.0

services/API.py

@@ -64,6 +64,23 @@ class AirlockAPIWrapper:
             logger.error(f"API request failed: {e}")
             raise
 
+    def _post_raw(self, endpoint: str, payload: Optional[dict] = None) -> bytes:
+        """
+        Send POST request and return raw response content (bytes).
+        Useful for XML endpoints.
+        """
+        url = f"{self.base_url}{endpoint}"
+        data = json.dumps(payload or {})
+        try:
+            logger.debug(f"POST Request to {url} with payload: {payload}")
+            response = requests.post(url, headers=self.headers, data=data, verify=False)
+            response.raise_for_status()
+            logger.debug(f"Raw response received from {url}")
+            return response.content  # bytes
+        except requests.exceptions.RequestException as e:
+            logger.error(f"API request failed: {e}")
+            raise
+
     # Allowlist Management
     def allowlist_find_all(self) -> pd.DataFrame:
         """
@@ -75,6 +92,12 @@ class AirlockAPIWrapper:
         result = self._post("/v1/application", {})
         return pd.DataFrame(result["response"]["applications"])
 
+    def allowlist_export(self, applicationid) -> bytes:
+        """Return Allowlist XML as bytes to save to file"""
+        payload = {"applicationid": applicationid}
+        result = self._post_raw("/v1/application/export", payload)
+        return result  # should be bytes
+
     # Agent Management
     def agent_find_all(self) -> pd.DataFrame:
         """Retrieve all agents."""
@@ -116,6 +139,30 @@ class AirlockAPIWrapper:
         result = self._post("/v1/agent/find", payload)
         return pd.DataFrame(result["response"]["agents"])
 
+    # Baseline Managment
+    def baseline_find_all(self) -> pd.DataFrame:
+        """Retrieve all Baselines."""
+        result = self._post("/v1/baseline", {})
+        return pd.DataFrame(result["response"]["baselines"])
+
+    def baseline_export(self, baselineid) -> bytes:
+        """Return Baseline XML as bytes to save to file"""
+        payload = {"baselineid": baselineid}
+        result = self._post_raw("/v1/baseline/export", payload)
+        return result
+
+    # Blocklist Managment
+    def blocklist_find_all(self) -> pd.DataFrame:
+        """Retrieve all Baselines."""
+        result = self._post("/v1/blocklist", {})
+        return pd.DataFrame(result["response"]["blocklists"])
+
+    def blocklist_export(self, blocklistid) -> bytes:
+        """Return Blocklist XML as bytes to save to file"""
+        payload = {"blocklistid": blocklistid}
+        result = self._post_raw("/v1/blocklist/export", payload)
+        return result
+
     # Hash Management
     def hash_add_to_allowlist(self, applicationid: str, hashes: List[str]) -> dict:
         """Add hashes to the allowlist for a specific application."""
@@ -253,6 +300,19 @@ class AirlockAPIWrapper:
         }
         return self._post("/v1/group/settings/script_custom", payload)
 
+    def policy_set_upgradetarget(
+        self,
+        groupid: str,
+        windows: str,
+        macos: str,
+    ) -> dict:
+        payload = {
+            "groupid": groupid,
+            "windows": windows,
+            "macos": macos,
+        }
+        return self._post("/v1/group/settings/selfupgrade/target", payload)
+
     # Execution History
     def history_logging(
         self, type: List[str], checkpoint: str, policy: List[str]

services/agenthandler.py

@@ -28,7 +28,7 @@ from flows.prepPolicy import selectPolicies
 from models.agent import Agent
 from models.policy import Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json, load_env
+from utils.configmanager import get_system_json, load_env
 from utils.selector import Selector
 from utils.utils import colorText, get_sanitized_input
 
@@ -38,7 +38,7 @@ logger = logging.getLogger(__name__)
 def devicehistory(api: AirlockAPIWrapper, outputjson: bool):
     agents = selectAgents(api)
     history_days = Selector.select_value(
-        prompt="Enter how many days of history to pull (1–150): ",
+        prompt="Enter how many days of history to pull (1–150): ",
         value_type=int,
         valid_range=(1, 150),
     )
@@ -60,7 +60,7 @@ def devicehistory(api: AirlockAPIWrapper, outputjson: bool):
         except Exception as e:
             print(
                 colorText(
-                    f"❌ Error retrieving history for {agent.hostname}: {e}", "red"
+                    f"❌ Error retrieving history for {agent.hostname}: {e}", "red"
                 )
             )
             continue
@@ -139,7 +139,7 @@ def findAgents(api, return_dataframe):
 
         print(
             colorText(
-                f"\n✅ Matched devices exported to: {working_dir}\\{filename}",
+                f"\n✅ Matched devices exported to: {working_dir}\\{filename}",
                 "green",
             )
         )
@@ -148,7 +148,7 @@ def findAgents(api, return_dataframe):
 
 
 def collect_device_names() -> List[str]:
-    print(colorText("🔍 Device Search", "cyan"))
+    print(colorText("🔍 Device Search", "cyan"))
     print(
         colorText(
             "Enter the device hostnames you'd like to search for, one per line.", "cyan"
@@ -185,7 +185,7 @@ def collect_device_names() -> List[str]:
         else:
             print(
                 colorText(
-                    f"⚠️ Invalid input: '{stripped_line}' — only letters, numbers, underscores, spaces, and hyphens are allowed.",
+                    f"⚠️ Invalid input: '{stripped_line}' — only letters, numbers, underscores, spaces, and hyphens are allowed.",
                     "yellow",
                 )
             )
@@ -235,8 +235,8 @@ def show_unmatched(
         ]
 
     if unmatched:
-        logger.debug(f"⚠️ No matches for: {', '.join(unmatched)}")
-        print(colorText(f"⚠️ No matches for: {', '.join(unmatched)}", "yellow"))
+        logger.debug(f"⚠️ No matches for: {', '.join(unmatched)}")
+        print(colorText(f"⚠️ No matches for: {', '.join(unmatched)}", "yellow"))
 
 
 def enrich_agents(agents: List["Agent"], policies: List["Policy"]):
@@ -248,7 +248,7 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     device_names = collect_device_names()
     if not device_names:
         logger.debug("No device names entered")
-        print(colorText("⚠️ No device names entered.", "red"))
+        print(colorText("⚠️ No device names entered.", "red"))
         return []
 
     use_exact = choose_match_type()
@@ -261,11 +261,11 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     show_unmatched(device_names, matched_agents, use_exact)
 
     if not matched_agents:
-        logger.debug("❌ No matching devices found.")
-        print(colorText("❌ No matching devices found.", "red"))
+        logger.debug("❌ No matching devices found.")
+        print(colorText("❌ No matching devices found.", "red"))
         return []
 
-    print(colorText(f"✅ Found {len(matched_agents)} matching device(s).", "green"))
+    print(colorText(f"✅ Found {len(matched_agents)} matching device(s).", "green"))
     logger.info("Matched agent hostnames:")
     rows = (len(matched_agents) + 2) // 3  # 3 columns
     for row in range(rows):
@@ -283,8 +283,8 @@ def selectAgents(api: "AirlockAPIWrapper") -> List["Agent"]:
     )
 
     if not matched_agents:
-        logger.debug("❌ No matching devices remain after refinement.")
-        print(colorText("❌ No matching devices remain after refinement.", "red"))
+        logger.debug("❌ No matching devices remain after refinement.")
+        print(colorText("❌ No matching devices remain after refinement.", "red"))
         return []
 
     enrich_agents(matched_agents, policies)
@@ -302,10 +302,10 @@ def moveAgentToRelatedPolicy(
     Args:
         api: AirlockAPIWrapper instance.
         agent: Agent object.
-        policy_relationship_map: Dict mapping enforcement → audit.
+        policy_relationship_map: Dict mapping enforcement → audit.
         mode: 'audit' to move to audit, 'enforcement' to move to enforcement.
     """
-    policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+    policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
 
     if mode == "audit":
         if agent.groupid in policy_relationship_map:

services/policyhandler.py

@@ -27,7 +27,7 @@ import tqdm
 
 from models.policy import Policy
 from services.API import AirlockAPIWrapper
-from utils.configmanager import get_protected_json
+from utils.configmanager import get_system_json
 from utils.setup import get_base_directory
 from utils.utils import areYouSure, colorText, get_sanitized_input
 
@@ -236,7 +236,7 @@ def skipback(days):
 
 
 def updateAuditPoliciesFromEnforcementPolices(api: AirlockAPIWrapper):
-    policy_relationship_map = get_protected_json("POLICY_MAP_ENF_AUD", "{}")
+    policy_relationship_map = get_system_json("POLICY_MAP_ENF_AUD", "{}")
     for enforcement_policy, audit_policy in policy_relationship_map.items():
         api.policy_clone(enforcement_policy, audit_policy)
         api.policy_set_auditmode(audit_policy, "1")

utils/configmanager.py

@@ -18,117 +18,280 @@ import logging
 import os
 from pathlib import Path
 import sys
-from typing import Callable, Optional, TypeVar
+from typing import Any, Callable, Optional, TypeVar
 
 T = TypeVar("T")
 logger = logging.getLogger(__name__)
 
-PROTECTED_KEYS = [
+# System config keys - these are immutable and come from system_config.json (bundled in exe)
+SYSTEM_CONFIG_KEYS = [
+    "URL",
     "APPNAME",
     "LOG_LEVEL",
+    "BAD_PATH_PARTS",
+    "BAD_PUBLISHERS",
+    "PUPS",
     "PATH_EXCLUSION_CONST",
     "MIN_FILES_FOR_PATH",
     "VT_THREAT_TOLERANCE",
     "POLICY_MAP_ENF_AUD",
 ]
 
-_protected_config = {}
+# User config keys - these can be changed by the end user
+USER_CONFIG_KEYS = [
+    "TELEMETRY",  # User opt-in/out for telemetry
+    "TELEM_URL",
+    "TEXTUAL_THEME",  # UI theme preference
+    "EXTRAS",  # Feature flags
+]
+
+# In-memory config storage
+_system_config = {}
+_user_config = {}
 
 
 def get_system_config_path() -> Path:
+    """
+    Get path to system_config.json.
+    Priority:
+    1. Bundled in exe (_MEIPASS)
+    2. Next to this file (development)
+    """
     # Check inside bundled EXE directory first
     bundled_dir = Path(getattr(sys, "_MEIPASS", ""))
     bundled_path = bundled_dir / "system_config.json"
     if bundled_path.exists():
         return bundled_path
 
-    # Fallback to external location
+    # Fallback to development location (next to this file)
     return Path(__file__).parent.parent / "system_config.json"
 
 
-def load_protected_config() -> dict:
-    global _protected_config
+def load_system_config() -> dict:
+    """
+    Load system configuration from system_config.json.
+    This should only be called once at startup.
+    Returns the full system config dict.
+    """
+    global _system_config
+
     try:
-        with open(get_system_config_path(), "r") as f:
-            system_config = json.load(f)
+        config_path = get_system_config_path()
+        with open(config_path, "r") as f:
+            _system_config = json.load(f)
+            logger.debug(f"✅ Loaded system config from {config_path}")
     except FileNotFoundError:
-        logging.warning("⚠️ system_config.json not found. Using built-in defaults.")
-        system_config = {
+        logger.warning("⚠️ system_config.json not found. Using minimal defaults.")
+        # Minimal defaults for development without system_config.json
+        _system_config = {
             "APPNAME": "Loxide",
+            "LOG_LEVEL": "INFO",
             "PATH_EXCLUSION_CONST": 4,
             "MIN_FILES_FOR_PATH": 4,
             "VT_THREAT_TOLERANCE": 4,
-            "POLICY_MAP_ENF_AUD": {"enforced_id": "audit_id"},
+            "POLICY_MAP_ENF_AUD": {},
         }
 
-    _protected_config = {key: system_config[key] for key in PROTECTED_KEYS}
-    return _protected_config
+    return _system_config
 
 
-def get_protected_value(
+def get_system_value(
     key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
 ) -> Optional[T]:
-    value = _protected_config.get(key)
+    """
+    Get a value from system config (immutable).
+
+    Parameters:
+        key: The config key to retrieve
+        cast_type: Function to cast the value to desired type
+        default: Default value if key not found
+
+    Returns:
+        The config value cast to the desired type, or default
+    """
+    value = _system_config.get(key)
     if value is None:
-        logging.warning(f"Protected config key '{key}' not found.")
+        logger.warning(f"System config key '{key}' not found.")
         return default
+
     try:
         if isinstance(value, str):
             value = value.strip("'\"")
         return cast_type(value)
     except (ValueError, TypeError):
-        logging.warning(
-            f"Invalid value for protected key '{key}': {value}. Expected type {cast_type.__name__}."
+        logger.warning(
+            f"Invalid value for system key '{key}': {value}. Expected type {cast_type.__name__}."
         )
         return default
 
 
-def get_protected_json(key: str, default: str = "{}") -> dict:
-    raw = _protected_config.get(key, default)
+def get_system_json(key: str, default: Optional[dict] = None) -> dict:
+    """
+    Get a JSON/dict value from system config.
+    Handles both dict values and JSON strings.
+    """
+    if default is None:
+        default = {}
+
+    raw = _system_config.get(key, default)
     if isinstance(raw, dict):
         return raw
+
     try:
         return json.loads(raw)
-    except json.JSONDecodeError:
-        try:
-            escaped = raw.encode("unicode_escape").decode("utf-8")
-            return json.loads(escaped)
-        except Exception as e:
-            logging.error(f"Failed to parse protected JSON key '{key}': {e}")
-            return json.loads(default)
+    except (json.JSONDecodeError, TypeError) as e:
+        logger.error(f"Failed to parse system JSON key '{key}': {e}")
+        return default
 
 
-def load_env_json(key: str, default: str):
-    raw = os.getenv(key, default)
+def get_system_list(key: str, default: Optional[list] = None) -> list:
+    """
+    Get a list value from system config.
+    Handles both list values and JSON strings.
+
+    Parameters:
+        key: The config key to retrieve
+        default: Default value if key not found or parsing fails
+
+    Returns:
+        The list value or default
+    """
+    if default is None:
+        default = []
+
+    raw = _system_config.get(key, default)
+    if isinstance(raw, list):
+        return raw
+
     try:
-        return json.loads(raw)
-    except json.JSONDecodeError:
-        try:
-            escaped = raw.encode("unicode_escape").decode("utf-8")
-            return json.loads(escaped)
-        except Exception as e:
-            logging.error(f"Failed to parse {key}: {e}")
-            return json.loads(default)
+        result = json.loads(raw) if isinstance(raw, str) else raw
+        if isinstance(result, list):
+            return result
+        logger.warning(f"System config key '{key}' is not a list: {type(result)}")
+        return default
+    except (json.JSONDecodeError, TypeError) as e:
+        logger.error(f"Failed to parse system list key '{key}': {e}")
+        return default
+
+
+def load_user_config(config_dir: Path) -> dict:
+    """
+    Load user configuration from user_config.json.
+    Creates the file with defaults if it doesn't exist.
+
+    Parameters:
+        config_dir: Directory containing user_config.json
+
+    Returns:
+        The user config dict
+    """
+    global _user_config
+
+    user_config_path = config_dir / "user_config.json"
+
+    if not user_config_path.exists():
+        # Create default user config
+        default_user_config = {
+            "TELEMETRY": False,
+            "TELEM_URL": "",
+            "TEXTUAL_THEME": "gruvbox",
+            "EXTRAS": "NOTTODAY",
+        }
+        user_config_path.parent.mkdir(parents=True, exist_ok=True)
+        with open(user_config_path, "w") as f:
+            json.dump(default_user_config, f, indent=4)
+        logger.debug(f"Created default user config at {user_config_path}")
+        _user_config = default_user_config
+    else:
+        with open(user_config_path, "r") as f:
+            _user_config = json.load(f)
+        logger.debug(f"✅ Loaded user config from {user_config_path}")
+
+    return _user_config
+
+
+def save_user_config(config_dir: Path, updates: dict) -> None:
+    """
+    Save updates to user configuration.
+    Only keys in USER_CONFIG_KEYS are allowed.
+
+    Parameters:
+        config_dir: Directory containing user_config.json
+        updates: Dict of key-value pairs to update
+    """
+    global _user_config
+
+    # Validate that only user-configurable keys are being updated
+    invalid_keys = [k for k in updates.keys() if k not in USER_CONFIG_KEYS]
+    if invalid_keys:
+        logger.error(f"Attempted to save invalid user config keys: {invalid_keys}")
+        raise ValueError(f"Cannot modify system config keys: {invalid_keys}")
+
+    # Update in-memory config
+    _user_config.update(updates)
+
+    # Write to file
+    user_config_path = config_dir / "user_config.json"
+    user_config_path.parent.mkdir(parents=True, exist_ok=True)
+    with open(user_config_path, "w") as f:
+        json.dump(_user_config, f, indent=4)
+
+    logger.debug(f"✅ Saved user config to {user_config_path}: {updates}")
+
+
+def get_user_value(
+    key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
+) -> Optional[T]:
+    """
+    Get a value from user config (mutable).
+
+    Parameters:
+        key: The config key to retrieve
+        cast_type: Function to cast the value to desired type
+        default: Default value if key not found
+
+    Returns:
+        The config value cast to the desired type, or default
+    """
+    value = _user_config.get(key)
+    if value is None:
+        logger.warning(f"User config key '{key}' not found.")
+        return default
+
+    try:
+        if isinstance(value, str):
+            value = value.strip("'\"")
+        return cast_type(value)
+    except (ValueError, TypeError):
+        logger.warning(
+            f"Invalid value for user key '{key}': {value}. Expected type {cast_type.__name__}."
+        )
+        return default
 
 
 def load_env(
     key: str, cast_type: Callable[[str], T] = str, default: Optional[T] = None
 ) -> Optional[T]:
     """
-    Safely retrieves an environment variable and casts it to the desired type.
+    Safely retrieves an environment variable from .env and casts it to the desired type.
+    This should ONLY be used for runtime/dynamic values like WORKING_DIR.
+
+    For system config, use get_system_value().
+    For user config, use get_user_value().
 
     Parameters:
-        key (str): The name of the environment variable.
-        cast_type (Callable[[str], T], optional): Function to cast the value. Defaults to str.
-        default (Optional[T], optional): Default value if the variable is not set or invalid.
+        key: The name of the environment variable
+        cast_type: Function to cast the value. Defaults to str
+        default: Default value if the variable is not set or invalid
 
     Returns:
-        Optional[T]: The casted value or the default.
+        The casted value or the default
     """
     value = os.getenv(key)
     if value is None:
-        logger.warning(f"Environment variable '{key}' not set.")
+        logger.debug(f"Environment variable '{key}' not set, using default.")
         return default
+
     try:
         value = value.strip("'\"")  # Strip surrounding quotes
         return cast_type(value)
@@ -137,3 +300,46 @@ def load_env(
             f"Invalid value for env var '{key}': {value}. Expected type {cast_type.__name__}."
         )
         return default
+
+
+def load_env_json(key: str, default: str = "[]") -> Any:
+    """
+    Load a JSON value from environment or system config.
+
+    DEPRECATED: This function is kept for backward compatibility.
+    - For system config lists (BAD_PUBLISHERS, PUPS, BAD_PATH_PARTS), use get_system_list()
+    - For system config dicts, use get_system_json()
+    - For actual .env JSON values, parse manually
+
+    This function automatically redirects known system config keys to system config.
+    """
+    # Known system config list keys - redirect to system config
+    system_list_keys = ["BAD_PUBLISHERS", "PUPS", "BAD_PATH_PARTS"]
+    if key in system_list_keys:
+        logger.debug(f"Redirecting load_env_json('{key}') to get_system_list()")
+        return get_system_list(key, json.loads(default) if default else [])
+
+    # Known system config dict keys - redirect to system config
+    system_dict_keys = ["POLICY_MAP_ENF_AUD"]
+    if key in system_dict_keys:
+        logger.debug(f"Redirecting load_env_json('{key}') to get_system_json()")
+        return get_system_json(key, json.loads(default) if default else {})
+
+    # Fall back to reading from .env (backward compatibility for unknown keys)
+    raw = os.getenv(key, default)
+    try:
+        return json.loads(raw)
+    except json.JSONDecodeError:
+        try:
+            escaped = raw.encode("unicode_escape").decode("utf-8")
+            return json.loads(escaped)
+        except Exception as e:
+            logger.error(f"Failed to parse {key}: {e}")
+            return json.loads(default)
+
+
+# Backwards compatibility aliases (deprecated - use get_system_value instead)
+get_protected_value = get_system_value
+get_protected_json = get_system_json
+load_protected_config = load_system_config
+PROTECTED_KEYS = SYSTEM_CONFIG_KEYS  # For backwards compatibility

utils/setup.py

@@ -13,18 +13,20 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import json
 import logging
 import logging.config
 import logging.handlers
 import os
 from pathlib import Path
 import platform
-import sys
 
 from dotenv import load_dotenv, set_key
 
-from utils.configmanager import PROTECTED_KEYS, load_protected_config
+from utils.configmanager import (
+    get_system_value,
+    load_system_config,
+    load_user_config,
+)
 
 
 def get_base_directory() -> Path:
@@ -38,7 +40,7 @@ def get_base_directory() -> Path:
         return home / ".local" / "share" / "Loxide"
 
 
-def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
+def configure_logging(log_dir: Path, log_level: str = "INFO"):
     log_file = log_dir / "Loxide.log"
 
     config = {
@@ -62,12 +64,12 @@ def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
                 "interval": 1,  # Every 1 day
                 "backupCount": 7,  # Keep 7 days of logs
                 "encoding": "utf-8",  # Ensure UTF-8 encoding
-                "level": "DEBUG",  # Always log DEBUG and above
+                "level": "DEBUG",  # Always log DEBUG and above to file
                 "formatter": "detailed",  # Use detailed format
             },
             "console": {
                 "class": "logging.StreamHandler",
-                "level": log_level.upper(),  # Configurable log level
+                "level": log_level.upper(),  # System-configured level for console
                 "formatter": "simple",  # Use simple format
             },
         },
@@ -95,55 +97,15 @@ def configure_logging(log_dir: Path, log_level: str = "DEBUG"):
     logging.getLogger().debug("✅ Logging configured.")
 
 
-def get_system_config_path() -> Path:
-    base_path = Path(
-        getattr(sys, "_MEIPASS", os.path.dirname(os.path.abspath(__file__)))
-    )
-    return base_path.parent / "system_config.json"
-
-
-def load_system_config() -> dict:
-    try:
-        config_path = get_system_config_path()
-        with open(config_path, "r") as f:
-            return json.load(f)
-    except FileNotFoundError:
-        logging.warning("⚠️ system_config.json not found. Using built-in defaults.")
-        return {
-            "APPNAME": "Loxide",
-            "LOG_LEVEL": "DEBUG",
-            "PATH_EXCLUSION_CONST": 4,
-            "MIN_FILES_FOR_PATH": 4,
-            "VT_THREAT_TOLERANCE": 4,
-            "POLICY_MAP_ENF_AUD": {"enforced_id": "audit_id"},
-        }
-
-
-def load_user_config(config_dir: Path) -> dict:
-    user_config_path = config_dir / "user_config.json"
-    if not user_config_path.exists():
-        default_user_config = {"URL": "", "LOG_LEVEL": "INFO"}
-        with open(user_config_path, "w") as f:
-            json.dump(default_user_config, f, indent=4)
-        logging.debug(f"Created user config at {user_config_path}")
-    with open(user_config_path, "r") as f:
-        return json.load(f)
-
-
-def write_config_to_env(config: dict, env_path: Path):
-    for key, value in config.items():
-        if key in PROTECTED_KEYS:
-            continue  # Skip protected keys
-        try:
-            serialized = (
-                json.dumps(value) if isinstance(value, (list, dict)) else str(value)
-            )
-            set_key(env_path, key, serialized)
-        except Exception as e:
-            logging.warning(f"Failed to write {key} to .env: {e}")
-
-
 def setup():
+    """
+    Initialize the application environment:
+    1. Create directory structure
+    2. Load system config (immutable, from system_config.json)
+    3. Load user config (mutable, from user_config.json)
+    4. Configure logging
+    5. Set up .env with WORKING_DIR only
+    """
     base_dir = get_base_directory()
     dirs = {
         "config": base_dir / "config",
@@ -155,20 +117,30 @@ def setup():
         path.mkdir(parents=True, exist_ok=True)
         logging.debug(f"{name.capitalize()} directory ensured at: {path}")
 
+    # Load system config (immutable)
     system_config = load_system_config()
-    configure_logging(dirs["logs"], system_config.get("LOG_LEVEL", "DEBUG"))
 
+    # Configure logging with system-defined log level
+    log_level = get_system_value("LOG_LEVEL", str, "INFO")
+    configure_logging(dirs["logs"], log_level)
+
+    # Load user config (mutable)
+    user_config = load_user_config(dirs["config"])
+
+    # Set up .env file - ONLY for WORKING_DIR (runtime-configurable value)
     env_path = base_dir / ".env"
     if not env_path.exists():
         env_path.touch()
     load_dotenv(dotenv_path=env_path, override=True)
 
+    # Set up working directory (only dynamic value in .env)
     working_dir = Path(os.getenv("WORKING_DIR") or (base_dir / "data"))
     working_dir.mkdir(parents=True, exist_ok=True)
-    set_key(env_path, "WORKING_DIR", str(working_dir))
+    set_key(str(env_path), "WORKING_DIR", str(working_dir))
     os.environ["WORKING_DIR"] = str(working_dir)
     logging.debug(f"Working directory set to: {working_dir}")
 
+    # Create folder structure in working directory
     folders_structure = {
         "Approved": [],
         "Needs_Review": ["Review_First", "Review_Second", "HTML"],
@@ -185,23 +157,4 @@ def setup():
             subfolder_path.mkdir(parents=True, exist_ok=True)
             logging.debug(f" └─ '{subfolder}' subfolder created at: {subfolder_path}")
 
-    user_config = load_user_config(dirs["config"])
-    merged_config = {**system_config, **user_config}
-
-    protected_config = load_protected_config()
-    merged_config.update(protected_config)
-
-    # ✅ URL resolution order: system_config → .env → user prompt
-    url = system_config.get("URL")
-    if not url:
-        url = os.getenv("URL")
-    if not url:
-        url = input(
-            "🌐 Enter the service URL (e.g., https://example.com/api): "
-        ).strip()
-    merged_config["URL"] = url
-    set_key(env_path, "URL", url)
-    os.environ["URL"] = url
-    logging.debug(f"Service URL set to: {url}")
-
-    write_config_to_env(merged_config, env_path)
+    logging.info("✅ Setup complete")