RootGuardPage.cpp

Go to the documentation of this file.

/*
 * BastionGuard™ RootGuard GTK integration
 * Copyright (C) 2025–2026 Calogero Scarnà
 * SPDX-License-Identifier: GPL-3.0-or-later
 */
#include "RootGuardPage.hpp"
#include "rootguard/rootguard_shared.h"
 
#include <glibmm/i18n.h>
#include <glibmm/markup.h>
#include <glibmm/main.h>
 
#include <algorithm>
#include <filesystem>
#include <set>
#include <sstream>
#include <vector>
 
namespace {
 
Gtk::Box* make_status_item(const Glib::ustring& label, Gtk::Label& value)
{
    auto* box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 4);
    box->add_css_class("rootguard-status-item");
    box->set_hexpand(true);
 
    auto* name = Gtk::make_managed<Gtk::Label>(label);
    name->set_halign(Gtk::Align::CENTER);
    name->add_css_class("rootguard-status-label");
    box->append(*name);
 
    value.set_halign(Gtk::Align::CENTER);
    value.set_wrap(true);
    value.add_css_class("rootguard-status-value");
    box->append(value);
    return box;
}
 
bool has_exact_path(const BastionGuard::RootGuard::Event& event)
{
    return !event.filename.empty() && event.filename.front() == '/';
}
 
Glib::ustring path_resolution_text(const BastionGuard::RootGuard::Event& event)
{
    if (event.path_resolution == "protected-baseline")
        return _("exact path from protected baseline");
    if (event.path_resolution == "proc-fd")
        return _("exact path resolved from the process file descriptor");
    if (event.path_resolution == "process-cwd")
        return _("exact path resolved from the process working directory");
    if (event.path_resolution == "kernel-exact")
        return _("exact path supplied by the kernel event");
    if (event.path_resolution == "lsm-exact")
        return _("exact path captured by the LSM before the metadata operation");
    return _("basename only; the exact path was unavailable in this event");
}
 
Glib::ustring incident_title(const BastionGuard::RootGuard::Event& event)
{
    const bool blocked = event.verdict == "blocked";
    const bool audit = event.verdict == "audit";
 
    if (event.event == "service-blocked")
        return blocked
            ? _("System service stopped and runtime-blocked")
            : _("System service blocking failed");
    if ((event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        return _("Unusual permission-change burst detected");
    if (event.event == "integrity-drift")
        return _("Protected file integrity changed");
    if (event.event == "permission-change")
        return blocked ? _("Permission change blocked")
                       : audit ? _("Permission change observed")
                               : _("Permission change detected");
    if (event.event == "owner-change")
        return blocked ? _("Ownership change blocked")
                       : audit ? _("Ownership change observed")
                               : _("Ownership change detected");
    if (event.event == "protected-unlink")
        return blocked ? _("Protected file removal blocked")
                       : audit ? _("Protected file removal observed")
                               : _("Protected file removal detected");
    if (event.event == "protected-rename")
        return blocked ? _("Protected file rename blocked")
                       : audit ? _("Protected file rename observed")
                               : _("Protected file rename detected");
    if (event.event == "protected-hardlink")
        return blocked ? _("Protected hard-link creation blocked")
                       : audit ? _("Protected hard-link creation observed")
                               : _("Protected hard-link creation detected");
    if (event.event == "xattr-change")
        return blocked ? _("Extended-attribute change blocked")
                       : audit ? _("Extended-attribute change observed")
                               : _("Extended-attribute change detected");
    if (event.event == "acl-change")
        return blocked ? _("ACL change blocked")
                       : audit ? _("ACL change observed")
                               : _("ACL change detected");
    return blocked ? _("Protected metadata change blocked")
                   : audit ? _("Protected metadata change observed")
                           : _("Protected metadata change detected");
}
 
Glib::ustring incident_detail(const BastionGuard::RootGuard::Event& event)
{
    std::ostringstream output;
    output << "Affected object: "
           << (event.filename.empty() ? "--" : event.filename);
 
    if (has_exact_path(event)) {
        const std::filesystem::path affected(event.filename);
        const std::string directory = affected.parent_path().string();
        output << "\nAffected directory: "
               << (directory.empty() ? "/" : directory);
    } else {
        output << "\nAffected directory: unavailable";
    }
 
    output << "\nPath resolution: " << path_resolution_text(event).raw();
 
    if (event.device != 0 || event.inode != 0)
        output << "\nTarget identity: " << event.device << ':' << event.inode;
 
    output << "\nProcess name: "
           << (event.comm.empty() ? "unknown" : event.comm)
           << "\nProcess identifiers: PID " << event.pid
           << " · TGID " << event.tgid
           << " · PPID " << event.ppid;
 
    if (!event.parent_comm.empty())
        output << "\nParent process: " << event.parent_comm
               << " (PID " << event.ppid << ')';
    if (!event.parent_executable.empty())
        output << "\nParent executable: " << event.parent_executable;
 
    if (!event.actor_executable.empty()) {
        output << "\nActor executable: " << event.actor_executable;
    } else {
        output << "\nActor executable: unresolved";
    }
 
    if (event.actor_device != 0 || event.actor_inode != 0)
        output << "\nActor identity: " << event.actor_device
               << ':' << event.actor_inode;
    if (event.old_euid == event.new_euid)
        output << "\nActor EUID: " << event.old_euid;
    else
        output << "\nActor EUID transition: " << event.old_euid
               << " → " << event.new_euid;
 
    if (event.old_mode != event.new_mode) {
        output << "\nMode: " << std::oct << (event.old_mode & 07777U)
               << " → " << (event.new_mode & 07777U) << std::dec;
    }
    if (event.old_uid != event.new_uid || event.old_gid != event.new_gid) {
        output << "\nOwner: " << event.old_uid << ':' << event.old_gid
               << " → " << event.new_uid << ':' << event.new_gid;
    }
    if ((event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        output << "\nBurst size in kernel window: " << event.auxiliary;
    output << "\nVerdict: " << event.verdict
           << " · Reason: 0x" << std::hex << event.reason_flags << std::dec;
    if (BastionGuard::RootGuard::is_system_service_path(event.filename))
        output << "\nScope: system service definition";
    return output.str();
}
 
bool restore_available(const BastionGuard::RootGuard::Event& event)
{
    if (event.rule_id == 0 || !has_exact_path(event))
        return false;
 
    constexpr std::uint32_t kBaselineFileReplaced = 1U << 20;
    constexpr std::uint32_t kProtectedMissing = 1U << 21;
    if ((event.reason_flags & (kBaselineFileReplaced | kProtectedMissing)) != 0)
        return false;
    return event.event == "permission-change" ||
           event.event == "owner-change" ||
           event.event == "integrity-drift" ||
           event.event == "service-blocked";
}
 
bool remove_available(const BastionGuard::RootGuard::Event& event)
{
    if (event.rule_id == 0 || !has_exact_path(event))
        return false;
 
    constexpr std::uint32_t kProtectedMissing = 1U << 21;
    if ((event.reason_flags & kProtectedMissing) != 0)
        return false;
 
    return event.event == "permission-change" ||
           event.event == "owner-change" ||
           event.event == "xattr-change" ||
           event.event == "acl-change" ||
           event.event == "integrity-drift";
}
 
Glib::ustring recovery_note(const BastionGuard::RootGuard::Event& event)
{
    if (event.rule_id == 0)
        return _("This event belongs to global filesystem surveillance. No protected baseline is attached, so Restore and Quarantine are unavailable.");
    if (!has_exact_path(event))
        return _("RootGuard has the filesystem identity but not an exact path. Destructive actions are disabled to avoid acting on the wrong object.");
    if (event.event == "protected-unlink")
        return event.verdict == "blocked"
            ? _("The removal was denied; the file is still present and no restore is required.")
            : _("The file was removed in audit mode. Automatic restore is impossible without a trusted backup or package copy.");
    if (event.event == "protected-rename")
        return _("Automatic recovery is unavailable for rename events. Restore the file from a trusted package or backup.");
    if (event.event == "protected-hardlink")
        return _("No automatic action is offered for hard-link events. Review the source and destination manually.");
    return {};
}
 
std::string incident_key(const BastionGuard::RootGuard::Event& event)
{
    if (has_exact_path(event))
        return event.filename;
    return event.filename + "\n" + std::to_string(event.device) + ':' +
           std::to_string(event.inode);
}
 
bool closes_incident(const BastionGuard::RootGuard::Event& event)
{
    return event.event == "file-restored" ||
           event.event == "file-quarantined" ||
           event.event == "integrity-restored";
}
 
void clear_list(Gtk::ListBox& list)
{
    while (auto* child = list.get_first_child())
        list.remove(*child);
}
 
void append_path_row(Gtk::ListBox& list, const std::string& path)
{
    auto* label = Gtk::make_managed<Gtk::Label>(path);
    label->set_halign(Gtk::Align::START);
    label->set_hexpand(true);
    label->set_selectable(true);
    label->set_margin(8);
    label->set_tooltip_text(path);
    list.append(*label);
}
 
std::string trim_copy(std::string value)
{
    const auto first = value.find_first_not_of(" \t\r\n");
    if (first == std::string::npos)
        return {};
    const auto last = value.find_last_not_of(" \t\r\n");
    return value.substr(first, last - first + 1);
}
 
std::string rules_signature(const BastionGuard::RootGuard::ApplicationRules& rules)
{
    std::ostringstream output;
    const auto append = [&output](const char marker,
                                  const std::vector<std::string>& values) {
        output << marker << ':' << values.size() << '\n';
        for (const auto& value : values)
            output << value << '\n';
    };
    append('A', rules.trustedApplications);
    append('T', rules.trustedExecutables);
    append('D', rules.deniedExecutables);
    return output.str();
}
 
} // namespace
 
RootGuardPage::RootGuardPage()
    : Gtk::Box(Gtk::Orientation::VERTICAL, 8)
{
    set_margin(12);
    set_hexpand(true);
    set_vexpand(true);
 
    auto* title_box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL);
    title_box->add_css_class("secure-headerbar");
    title_box->set_margin_bottom(4);
 
    title_.set_text(_("🛡️ RootGuard — Permission and Privilege Protection"));
    title_.set_margin(8);
    title_.set_halign(Gtk::Align::CENTER);
    title_.set_hexpand(true);
    title_.add_css_class("secure-header-title");
    title_box->append(title_);
    append(*title_box);
 
    auto* summary = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    summary->set_homogeneous(true);
    summary->append(*make_status_item(_("Service"), service_value_));
    summary->append(*make_status_item(_("Mode"), mode_value_));
    summary->append(*make_status_item(_("Init system"), init_value_));
    summary->append(*make_status_item(_("PID"), pid_value_));
    append(*summary);
 
    page_stack_.set_hexpand(true);
    page_stack_.set_vexpand(true);
    page_stack_.set_hhomogeneous(false);
    page_stack_.set_vhomogeneous(false);
 
    page_switcher_.set_stack(page_stack_);
    page_switcher_.set_halign(Gtk::Align::CENTER);
    page_switcher_.set_margin_top(2);
    page_switcher_.set_margin_bottom(2);
    append(page_switcher_);
 
    // Overview tab.
    auto* overview = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    overview->set_margin_top(8);
    overview->set_hexpand(true);
    overview->set_vexpand(true);
 
    auto* protection_box = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    protection_box->set_halign(Gtk::Align::CENTER);
    protection_label_.set_text(_("Immediate permission blocking"));
    protection_label_.set_tooltip_text(
        _("Blocks protected system metadata changes before they are committed."));
    protection_box->append(protection_label_);
    protection_box->append(protection_switch_);
 
    protection_info_button_.set_label("ⓘ");
    protection_info_button_.set_has_frame(false);
    protection_info_button_.set_tooltip_text(_("Show protection scope"));
    auto* protection_info = Gtk::make_managed<Gtk::Label>(
        _("Immediate blocking applies to protected system paths and service definitions. "
          "User home directories remain audit-only because BastionGuard Anti-Ransomware "
          "is responsible for enforcement on user data. Routine desktop and browser "
          "metadata activity can be classified under Application rules without granting "
          "privilege-transition trust."));
    protection_info->set_wrap(true);
    protection_info->set_max_width_chars(58);
    protection_info->set_margin(14);
    protection_info->set_halign(Gtk::Align::START);
    protection_info_popover_.set_autohide(true);
    protection_info_popover_.set_child(*protection_info);
    protection_info_button_.set_popover(protection_info_popover_);
    protection_box->append(protection_info_button_);
    overview->append(*protection_box);
 
    auto* scope = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    scope->set_homogeneous(true);
    scope->set_margin_start(40);
    scope->set_margin_end(40);
    scope->append(*make_status_item(_("Protected system paths"), system_scope_value_));
    scope->append(*make_status_item(_("User home"), home_scope_value_));
    overview->append(*scope);
 
    auto* scope_note = Gtk::make_managed<Gtk::Label>(
        _("RootGuard records privilege-relevant global metadata. Lower-risk changes remain "
          "visible as observations; only high-signal incidents generate popups."));
    scope_note->set_wrap(true);
    scope_note->set_halign(Gtk::Align::CENTER);
    scope_note->add_css_class("dim-label");
    overview->append(*scope_note);
 
    auto* controls = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    controls->set_halign(Gtk::Align::CENTER);
 
    start_button_.set_label(_("▶ Start"));
    stop_button_.set_label(_("■ Stop"));
    reload_button_.set_label(_("↻ Reload policy"));
    restart_button_.set_label(_("⟳ Restart"));
    refresh_button_.set_label(_("Refresh"));
    start_button_.add_css_class("btn-primary");
    stop_button_.add_css_class("btn-danger");
    reload_button_.add_css_class("btn-warning");
 
    controls->append(start_button_);
    controls->append(stop_button_);
    controls->append(reload_button_);
    controls->append(restart_button_);
    controls->append(refresh_button_);
    overview->append(*controls);
 
    auto* overview_spacer = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL);
    overview_spacer->set_vexpand(true);
    overview->append(*overview_spacer);
    page_stack_.add(*overview, "overview", _("Overview"));
 
    // Incidents tab.
    auto* incidents_panel = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    incidents_panel->set_hexpand(true);
    incidents_panel->set_vexpand(true);
    incidents_panel->set_margin_top(8);
 
    incidents_title_.set_text(_("Security observations and active incidents"));
    incidents_title_.set_halign(Gtk::Align::START);
    incidents_title_.add_css_class("BastionGuard-title");
    incidents_panel->append(incidents_title_);
 
    incidents_list_.set_selection_mode(Gtk::SelectionMode::NONE);
    incidents_list_.add_css_class("rootguard-incident-list");
    incidents_scroller_.set_hexpand(true);
    incidents_scroller_.set_vexpand(true);
    incidents_scroller_.set_min_content_height(280);
    incidents_scroller_.set_policy(Gtk::PolicyType::AUTOMATIC,
                                   Gtk::PolicyType::AUTOMATIC);
    incidents_scroller_.set_child(incidents_list_);
    incidents_panel->append(incidents_scroller_);
    page_stack_.add(*incidents_panel, "incidents", _("Incidents"));
 
    // Events tab.
    auto* events_panel = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    events_panel->set_hexpand(true);
    events_panel->set_vexpand(true);
    events_panel->set_margin_top(8);
 
    auto* events_header = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    auto* events_label = Gtk::make_managed<Gtk::Label>(_("Recent RootGuard events"));
    events_label->set_halign(Gtk::Align::START);
    events_label->set_hexpand(true);
    events_label->add_css_class("BastionGuard-title");
    show_trusted_.set_label(_("Show trusted events"));
    show_trusted_.set_active(true);
    show_trusted_.set_tooltip_text(
        _("Trusted application activity is shown by default for maximum transparency. "
          "Disable this option only to focus on audit and blocked events."));
    events_header->append(*events_label);
    events_header->append(show_trusted_);
    events_panel->append(*events_header);
 
    events_view_.set_editable(false);
    events_view_.set_cursor_visible(false);
    events_view_.set_monospace(true);
    events_view_.set_wrap_mode(Gtk::WrapMode::WORD_CHAR);
    events_view_.set_left_margin(8);
    events_view_.set_right_margin(8);
    events_view_.set_top_margin(8);
    events_view_.set_bottom_margin(8);
    events_view_.add_css_class("rootguard-terminal");
 
    events_scroller_.set_hexpand(true);
    events_scroller_.set_vexpand(true);
    events_scroller_.set_min_content_height(280);
    events_scroller_.set_policy(Gtk::PolicyType::AUTOMATIC,
                                Gtk::PolicyType::AUTOMATIC);
    events_scroller_.set_child(events_view_);
    events_panel->append(events_scroller_);
    page_stack_.add(*events_panel, "events", _("Events"));
 
    // Application rules tab, with nested tabs to keep the page compact.
    auto* rules_page = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    rules_page->set_hexpand(true);
    rules_page->set_vexpand(true);
    rules_page->set_margin_top(8);
 
    auto* rules_intro = Gtk::make_managed<Gtk::Label>(
        _("Manage executable identities used by RootGuard. Saving validates the policy, "
          "requests administrator authentication, and restarts RootGuard so the new inode "
          "identities take effect immediately."));
    rules_intro->set_wrap(true);
    rules_intro->set_halign(Gtk::Align::START);
    rules_page->append(*rules_intro);
 
    auto* defaults_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    defaults_row->set_halign(Gtk::Align::END);
    auto* add_defaults = Gtk::make_managed<Gtk::Button>(
        _("Add installed desktop/browser defaults"));
    add_defaults->set_tooltip_text(
        _("Adds only known executables that exist on this computer. Review the list before saving."));
    defaults_row->append(*add_defaults);
    rules_page->append(*defaults_row);
 
    rules_stack_.set_hexpand(true);
    rules_stack_.set_vexpand(true);
    rules_stack_.set_hhomogeneous(false);
    rules_stack_.set_vhomogeneous(false);
    rules_switcher_.set_stack(rules_stack_);
    rules_switcher_.set_halign(Gtk::Align::CENTER);
    rules_page->append(rules_switcher_);
 
    rules_stack_.add(
        *make_rule_editor(
            _("Trusted applications"),
            _("Routine desktop, file-manager and browser compatibility activity. Matching "
              "legacy global events can become trusted, but direct privilege-metadata signals "
              "are never suppressed by this list. This list never grants privilege trust."),
            trusted_applications_list_, trusted_applications_entry_),
        "trusted-applications", _("Trusted apps"));
 
    rules_stack_.add(
        *make_rule_editor(
            _("Privilege-trusted executables"),
            _("Executables allowed as legitimate actors in RootGuard privilege-transition "
              "checks. Existing files are still subject to ownership and identity validation."),
            trusted_executables_list_, trusted_executables_entry_),
        "trusted-executables", _("Privilege trusted"));
 
    rules_stack_.add(
        *make_rule_editor(
            _("Blocked executables"),
            _("Executables blocked during RootGuard privilege-transition checks. This is not "
              "a general application-launch blacklist."),
            denied_executables_list_, denied_executables_entry_),
        "denied-executables", _("Blocked"));
 
    // The switcher only controls the stack; the stack itself must also be
    // inserted into the widget hierarchy or its rule editors remain invisible.
    rules_page->append(rules_stack_);
 
    auto* save_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 8);
    save_row->set_halign(Gtk::Align::END);
    save_rules_button_.set_label(_("Save rules and restart RootGuard"));
    save_rules_button_.add_css_class("btn-primary");
    save_rules_button_.set_sensitive(false);
    save_row->append(save_rules_button_);
    rules_page->append(*save_row);
 
    rules_status_.set_halign(Gtk::Align::START);
    rules_status_.set_wrap(true);
    rules_status_.add_css_class("dim-label");
    rules_status_.set_text(
        _("Unsaved changes are never applied silently. RootGuard restarts only after a successful policy save."));
    rules_page->append(rules_status_);
    page_stack_.add(*rules_page, "application-rules", _("Application rules"));
 
    append(page_stack_);
 
    status_.set_halign(Gtk::Align::CENTER);
    status_.set_wrap(true);
    status_.set_margin_top(2);
    append(status_);
 
    client_update_connection_ = client_.signal_updated().connect(
        sigc::mem_fun(*this, &RootGuardPage::on_snapshot));
 
    start_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Requesting service start…")); client_.start_service(); });
    stop_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Requesting service stop…")); client_.stop_service(); });
    reload_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Reloading RootGuard policy…")); client_.reload_policy(); });
    restart_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Restarting RootGuard…")); client_.restart_service(); });
    refresh_button_.signal_clicked().connect(
        [this] { status_.set_text(_("Refreshing RootGuard status…")); client_.refresh(); });
    show_trusted_.signal_toggled().connect([this] {
        // Filtering is a local presentation choice. Re-render the most recent
        // snapshot immediately instead of waiting for the asynchronous client
        // refresh/next timer tick.
        if (last_snapshot_) {
            render_events(*last_snapshot_);
            return;
        }
        client_.refresh();
    });
    protection_switch_.property_active().signal_changed().connect(
        sigc::mem_fun(*this, &RootGuardPage::on_protection_toggled));
    save_rules_button_.signal_clicked().connect(
        sigc::mem_fun(*this, &RootGuardPage::save_application_rules));
    add_defaults->signal_clicked().connect(
        sigc::mem_fun(*this, &RootGuardPage::add_installed_application_defaults));
 
    auto_refresh_connection_ = Glib::signal_timeout().connect_seconds(
        sigc::mem_fun(*this, &RootGuardPage::on_auto_refresh), 1);
 
    service_value_.set_text(_("Checking…"));
    mode_value_.set_text(Glib::ustring("—"));
    init_value_.set_text(Glib::ustring("—"));
    pid_value_.set_text(Glib::ustring("—"));
    system_scope_value_.set_text(_("Checking…"));
    home_scope_value_.set_text(_("Audit-only"));
    status_.set_text(_("Loading RootGuard status and recent security events…"));
    client_.refresh();
}
 
RootGuardPage::~RootGuardPage()
{
    alive_->store(false, std::memory_order_release);
    if (client_update_connection_.connected())
        client_update_connection_.disconnect();
    if (auto_refresh_connection_.connected())
        auto_refresh_connection_.disconnect();
    while (!alert_queue_.empty())
        alert_queue_.pop();
    if (current_alert_)
        current_alert_->hide();
    current_alert_.reset();
}
 
Gtk::Box* RootGuardPage::make_rule_editor(const Glib::ustring& title,
                                          const Glib::ustring& description,
                                          Gtk::ListBox& list,
                                          Gtk::Entry& entry)
{
    auto* editor = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 6);
    editor->set_hexpand(true);
    editor->set_vexpand(true);
    editor->set_margin_top(6);
 
    auto* heading = Gtk::make_managed<Gtk::Label>(title);
    heading->set_halign(Gtk::Align::START);
    heading->add_css_class("BastionGuard-title");
    editor->append(*heading);
 
    auto* explanation = Gtk::make_managed<Gtk::Label>(description);
    explanation->set_halign(Gtk::Align::START);
    explanation->set_wrap(true);
    explanation->add_css_class("dim-label");
    editor->append(*explanation);
 
    list.set_selection_mode(Gtk::SelectionMode::SINGLE);
    list.add_css_class("rootguard-rule-list");
    auto* scroller = Gtk::make_managed<Gtk::ScrolledWindow>();
    scroller->set_hexpand(true);
    scroller->set_vexpand(true);
    scroller->set_min_content_height(210);
    scroller->set_policy(Gtk::PolicyType::AUTOMATIC,
                         Gtk::PolicyType::AUTOMATIC);
    scroller->set_child(list);
    editor->append(*scroller);
 
    auto* input_row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
    entry.set_hexpand(true);
    entry.set_placeholder_text(_("Absolute executable path, for example /usr/bin/firefox"));
    auto* add = Gtk::make_managed<Gtk::Button>(_("Add"));
    auto* remove = Gtk::make_managed<Gtk::Button>(_("Remove selected"));
    add->add_css_class("btn-primary");
    remove->add_css_class("btn-danger");
    input_row->append(entry);
    input_row->append(*add);
    input_row->append(*remove);
    editor->append(*input_row);
 
    add->signal_clicked().connect([this, &entry, &list] {
        add_rule_from_entry(entry, list);
    });
    entry.signal_activate().connect([this, &entry, &list] {
        add_rule_from_entry(entry, list);
    });
    remove->signal_clicked().connect([this, &list] {
        remove_selected_rule(list);
    });
    return editor;
}
 
void RootGuardPage::add_rule_from_entry(Gtk::Entry& entry, Gtk::ListBox& list)
{
    const std::string raw = trim_copy(entry.get_text().raw());
    if (raw.empty()) {
        rules_status_.set_text(_("Enter an absolute executable path first."));
        return;
    }
 
    std::filesystem::path candidate(raw);
    if (!candidate.is_absolute()) {
        rules_status_.set_text(_("Application rules require an absolute path beginning with /."));
        return;
    }
 
    candidate = candidate.lexically_normal();
    const std::string normalized = candidate.string();
    const auto current = collect_rules(list);
    if (std::find(current.begin(), current.end(), normalized) != current.end()) {
        rules_status_.set_text(_("That executable path is already present in this list."));
        return;
    }
 
    append_path_row(list, normalized);
    entry.set_text("");
    mark_rules_dirty();
}
 
void RootGuardPage::add_installed_application_defaults()
{
    static const std::vector<std::string> candidates {
        "/usr/bin/gnome-shell",
        "/usr/bin/nautilus",
        "/usr/bin/plasmashell",
        "/usr/bin/kwin_wayland",
        "/usr/bin/dolphin",
        "/usr/bin/xfdesktop",
        "/usr/bin/xfwm4",
        "/usr/bin/thunar",
        "/usr/bin/cinnamon",
        "/usr/bin/nemo",
        "/usr/bin/mate-panel",
        "/usr/bin/caja",
        "/usr/bin/firefox",
        "/usr/lib/firefox/firefox",
        "/usr/bin/chromium",
        "/usr/bin/google-chrome-stable",
        "/usr/bin/brave",
        "/usr/bin/vivaldi-stable",
    };
 
    auto current = collect_rules(trusted_applications_list_);
    std::set<std::string> present(current.begin(), current.end());
    std::size_t added = 0;
    for (const auto& candidate : candidates) {
        std::error_code error;
        const auto status = std::filesystem::status(candidate, error);
        if (error || !std::filesystem::is_regular_file(status))
            continue;
        const auto permissions = status.permissions();
        const bool executable =
            (permissions & std::filesystem::perms::owner_exec) !=
                std::filesystem::perms::none ||
            (permissions & std::filesystem::perms::group_exec) !=
                std::filesystem::perms::none ||
            (permissions & std::filesystem::perms::others_exec) !=
                std::filesystem::perms::none;
        if (!executable)
            continue;
 
        const auto canonical = std::filesystem::weakly_canonical(candidate, error);
        const std::string normalized = error
            ? std::filesystem::path(candidate).lexically_normal().string()
            : canonical.string();
        if (!present.insert(normalized).second)
            continue;
        append_path_row(trusted_applications_list_, normalized);
        ++added;
    }
 
    if (added == 0) {
        rules_status_.set_text(
            _("No new installed desktop or browser defaults were found."));
        return;
    }
    mark_rules_dirty();
    rules_status_.set_text(Glib::ustring::compose(
        _("Added %1 installed desktop/browser executable(s). Review and save to restart RootGuard."),
        added));
}
 
void RootGuardPage::remove_selected_rule(Gtk::ListBox& list)
{
    auto* row = list.get_selected_row();
    if (!row) {
        rules_status_.set_text(_("Select a rule to remove."));
        return;
    }
    list.remove(*row);
    mark_rules_dirty();
}
 
void RootGuardPage::mark_rules_dirty()
{
    rules_dirty_ = true;
    rules_status_.set_text(
        _("Rules have unsaved changes. Saving will validate the policy and restart RootGuard."));
    save_rules_button_.set_sensitive(!rules_saving_);
}
 
std::vector<std::string> RootGuardPage::collect_rules(const Gtk::ListBox& list) const
{
    std::vector<std::string> values;
    for (auto* widget = list.get_first_child(); widget;
         widget = widget->get_next_sibling()) {
        const auto* row = dynamic_cast<const Gtk::ListBoxRow*>(widget);
        if (!row)
            continue;
        const auto* label = dynamic_cast<const Gtk::Label*>(row->get_child());
        if (!label)
            continue;
        const std::string value = trim_copy(label->get_text().raw());
        if (!value.empty())
            values.push_back(value);
    }
    std::sort(values.begin(), values.end());
    values.erase(std::unique(values.begin(), values.end()), values.end());
    return values;
}
 
void RootGuardPage::populate_application_rules(
    const BastionGuard::RootGuard::ApplicationRules& rules)
{
    const std::string signature = rules_signature(rules);
    if (rules_dirty_ || rules_saving_ || signature == rules_signature_)
        return;
 
    const auto populate = [](Gtk::ListBox& list,
                             std::vector<std::string> values) {
        clear_list(list);
        std::sort(values.begin(), values.end());
        values.erase(std::unique(values.begin(), values.end()), values.end());
        for (const auto& path : values)
            append_path_row(list, path);
    };
 
    populate(trusted_applications_list_, rules.trustedApplications);
    populate(trusted_executables_list_, rules.trustedExecutables);
    populate(denied_executables_list_, rules.deniedExecutables);
    rules_signature_ = signature;
}
 
void RootGuardPage::save_application_rules()
{
    BastionGuard::RootGuard::ApplicationRules rules;
    rules.trustedApplications = collect_rules(trusted_applications_list_);
    rules.trustedExecutables = collect_rules(trusted_executables_list_);
    rules.deniedExecutables = collect_rules(denied_executables_list_);
 
    std::set<std::string> trusted;
    trusted.insert(rules.trustedApplications.begin(), rules.trustedApplications.end());
    trusted.insert(rules.trustedExecutables.begin(), rules.trustedExecutables.end());
    for (const auto& denied : rules.deniedExecutables) {
        if (trusted.count(denied) != 0) {
            rules_status_.set_text(
                _("The same executable cannot be both trusted and blocked."));
            return;
        }
    }
 
    rules_saving_ = true;
    save_rules_button_.set_sensitive(false);
    rules_status_.set_text(
        _("Saving application rules and restarting RootGuard… Administrator authentication may be requested."));
    status_.set_text(_("Saving RootGuard application rules…"));
    client_.save_application_rules(std::move(rules));
}
 
bool RootGuardPage::on_auto_refresh()
{
    client_.refresh();
    return true;
}
 
void RootGuardPage::on_protection_toggled()
{
    if (updating_switch_)
        return;
    protection_switch_.set_sensitive(false);
    const bool enabled = protection_switch_.get_active();
    status_.set_text(enabled
        ? _("Enabling immediate blocking for protected system paths; user home remains audit-only…")
        : _("Switching RootGuard system-path protection to audit mode…"));
    client_.set_immediate_protection(enabled);
}
 
void RootGuardPage::on_snapshot(const BastionGuard::RootGuard::Snapshot& snapshot)
{
    // Keep a local copy so event filtering reacts immediately when the user
    // toggles trusted-event visibility.
    last_snapshot_ = snapshot;
 
    service_value_.set_text(snapshot.service.active ? _("Active") : _("Inactive"));
    mode_value_.set_text(snapshot.service.immediateProtection
        ? _("Immediate block")
        : snapshot.service.mode.empty() ? "unknown" : snapshot.service.mode);
    init_value_.set_text(snapshot.service.init_system.empty()
                             ? "unknown"
                             : snapshot.service.init_system);
    pid_value_.set_text(snapshot.service.pid.empty() ? "—" : snapshot.service.pid);
 
    system_scope_value_.set_text(snapshot.service.immediateProtection
        ? _("Immediate blocking") : _("Audit-only"));
    home_scope_value_.set_text(snapshot.service.blockUserHome
        ? _("Blocking enabled by manual policy")
        : _("Audit-only · Anti-Ransomware enforcement"));
 
    start_button_.set_sensitive(!snapshot.service.active);
    stop_button_.set_sensitive(snapshot.service.active);
    reload_button_.set_sensitive(snapshot.service.active);
    restart_button_.set_sensitive(snapshot.service.active);
 
    updating_switch_ = true;
    protection_switch_.set_active(snapshot.service.immediateProtection);
    updating_switch_ = false;
    protection_switch_.set_sensitive(snapshot.service.active && !rules_saving_);
 
    if (rules_saving_ && !snapshot.operation_message.empty()) {
        rules_saving_ = false;
        if (snapshot.operation_success) {
            rules_dirty_ = false;
            rules_signature_.clear();
            rules_status_.set_text(
                _("Application rules saved and RootGuard restarted successfully."));
        } else {
            rules_status_.set_text(Glib::ustring::compose(
                _("Application rules were not applied: %1"),
                snapshot.operation_message));
        }
    }
    save_rules_button_.set_sensitive(rules_dirty_ && !rules_saving_);
    populate_application_rules(snapshot.application_rules);
 
    if (!snapshot.operation_message.empty()) {
        status_.set_text(snapshot.operation_success
                             ? Glib::ustring::compose(_("✅ %1"), snapshot.operation_message)
                             : Glib::ustring::compose(_("❌ %1"), snapshot.operation_message));
    } else if (snapshot.service.active && snapshot.service.immediateProtection) {
        status_.set_text(snapshot.service.autoBlockServices
            ? _("RootGuard blocks protected system changes and contains affected services. User home remains audit-only under Anti-Ransomware protection.")
            : _("RootGuard blocks protected system metadata changes. User home remains audit-only under Anti-Ransomware protection."));
    } else if (snapshot.service.active) {
        status_.set_text(
            _("RootGuard is monitoring filesystem metadata in audit mode. Global privilege events are sampled and destructive permission bursts are aggregated."));
    } else {
        status_.set_text(_("RootGuard is not running."));
    }
 
    render_incidents(snapshot);
    render_events(snapshot);
    queue_new_alerts(snapshot);
}
 
void RootGuardPage::render_incidents(const BastionGuard::RootGuard::Snapshot& snapshot)
{
    clear_list(incidents_list_);
 
    std::vector<BastionGuard::RootGuard::Event> incidents;
    std::set<std::string> closed_paths;
    std::set<std::string> displayed_paths;
    for (auto iterator = snapshot.events.rbegin(); iterator != snapshot.events.rend(); ++iterator) {
        if (closes_incident(*iterator) && !iterator->filename.empty()) {
            closed_paths.insert(incident_key(*iterator));
            continue;
        }
        if (!BastionGuard::RootGuard::is_security_observation(*iterator))
            continue;
        if (closed_paths.count(incident_key(*iterator)) != 0 ||
            displayed_paths.count(incident_key(*iterator)) != 0 ||
            dismissed_paths_.count(incident_key(*iterator)) != 0)
            continue;
        if (dismissed_events_.count(
                BastionGuard::RootGuard::event_fingerprint(*iterator)) != 0)
            continue;
        displayed_paths.insert(incident_key(*iterator));
        incidents.push_back(*iterator);
        if (incidents.size() >= 60)
            break;
    }
 
    if (incidents.empty()) {
        auto* empty = Gtk::make_managed<Gtk::Label>(
            _("No unresolved observations or blocked changes."));
        empty->set_margin(16);
        empty->set_halign(Gtk::Align::CENTER);
        incidents_list_.append(*empty);
        return;
    }
 
    for (const auto& event : incidents) {
        auto* row = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 8);
        row->set_margin(8);
        row->add_css_class("rootguard-incident-row");
 
        auto* title = Gtk::make_managed<Gtk::Label>(incident_title(event));
        title->set_halign(Gtk::Align::START);
        const auto severity = BastionGuard::RootGuard::classify_event(event);
        if (event.verdict == "blocked")
            title->add_css_class("rootguard-blocked");
        else if (severity == BastionGuard::RootGuard::EventSeverity::Incident)
            title->add_css_class("rootguard-alert");
        else
            title->add_css_class("dim-label");
        row->append(*title);
 
        auto* detail = Gtk::make_managed<Gtk::Label>(incident_detail(event));
        detail->set_halign(Gtk::Align::START);
        detail->set_wrap(true);
        detail->set_selectable(true);
        row->append(*detail);
 
        const bool audit_event = event.verdict == "audit";
        const bool can_restore = !audit_event && restore_available(event);
        const bool can_remove = !audit_event && remove_available(event);
 
        if (!can_restore && !can_remove) {
            const auto note_text = audit_event
                ? Glib::ustring(
                    _("Audit observation: RootGuard did not block or alter the operation."))
                : recovery_note(event);
            if (!note_text.empty()) {
                auto* note = Gtk::make_managed<Gtk::Label>(note_text);
                note->set_halign(Gtk::Align::START);
                note->set_wrap(true);
                note->add_css_class("dim-label");
                row->append(*note);
            }
        }
 
        auto* actions = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 6);
        actions->set_halign(Gtk::Align::END);
 
        if (can_restore) {
            auto* restore = Gtk::make_managed<Gtk::Button>(_("Restore"));
            restore->add_css_class("btn-primary");
            restore->signal_clicked().connect([this, event] { restore_event(event); });
            actions->append(*restore);
        }
        if (can_remove) {
            auto* remove = Gtk::make_managed<Gtk::Button>(_("Quarantine"));
            remove->add_css_class("btn-danger");
            remove->signal_clicked().connect([this, event] { remove_event(event); });
            actions->append(*remove);
        }
 
        auto* dismiss = Gtk::make_managed<Gtk::Button>(_("Dismiss"));
        dismiss->signal_clicked().connect([this, event] { dismiss_event(event); });
        actions->append(*dismiss);
        row->append(*actions);
        incidents_list_.append(*row);
    }
}
 
void RootGuardPage::render_events(const BastionGuard::RootGuard::Snapshot& snapshot)
{
    std::ostringstream output;
    std::size_t visible = 0;
    for (auto iterator = snapshot.events.rbegin(); iterator != snapshot.events.rend(); ++iterator) {
        if (!show_trusted_.get_active() && iterator->verdict == "trusted")
            continue;
        output << BastionGuard::RootGuard::format_event(*iterator) << '\n';
        if (++visible >= 150)
            break;
    }
    if (visible == 0) {
        if (snapshot.events.empty()) {
            output << _("No RootGuard events are available yet.") << '\n';
        } else {
            output << _("Only trusted events are available. Enable “Show trusted events” to display them.")
                   << '\n';
        }
    }
    events_view_.get_buffer()->set_text(output.str());
}
 
void RootGuardPage::queue_new_alerts(const BastionGuard::RootGuard::Snapshot& snapshot)
{
    std::vector<BastionGuard::RootGuard::Event> new_events;
    for (const auto& event : snapshot.events) {
        if (event.verdict == "trusted")
            continue;
        if (closes_incident(event) && !event.filename.empty()) {
            notified_paths_.erase(incident_key(event));
            dismissed_paths_.erase(incident_key(event));
            continue;
        }
        if (!BastionGuard::RootGuard::is_actionable_incident(event))
            continue;
 
        const std::string fingerprint =
            BastionGuard::RootGuard::event_fingerprint(event);
        if (!seen_events_.insert(fingerprint).second)
            continue;
 
        const bool service_failure = event.event == "service-blocked" &&
                                     event.verdict != "blocked";
        const bool first_for_path = notified_paths_.insert(incident_key(event)).second;
        if (event.event != "service-blocked")
            dismissed_paths_.erase(incident_key(event));
 
        if (!initial_snapshot_ &&
            dismissed_events_.count(fingerprint) == 0 &&
            (first_for_path || service_failure)) {
            new_events.push_back(event);
        }
    }
    initial_snapshot_ = false;
 
    std::set<std::string> selected_paths;
    std::vector<BastionGuard::RootGuard::Event> selected;
    for (auto iterator = new_events.rbegin(); iterator != new_events.rend(); ++iterator) {
        const std::string key = incident_key(*iterator) + "\n" +
            (iterator->event == "service-blocked" && iterator->verdict != "blocked"
                ? "failure" : "incident");
        if (selected_paths.insert(key).second)
            selected.push_back(*iterator);
    }
    /*
     * Never build a popup backlog. Protected/service incidents take priority and
     * may interrupt immediately; a global metadata burst is deliberately much
     * quieter because backup/package activity can resemble a burst. The full
     * history always remains in Incidents/Events.
     */
    const auto critical = std::find_if(
        selected.begin(), selected.end(), [](const auto& event) {
            return event.rule_id != 0 || event.event == "service-blocked";
        });
    if (!current_alert_ && alert_queue_.empty() && critical != selected.end()) {
        alert_queue_.push(*critical);
    } else if (!current_alert_ && alert_queue_.empty() && !selected.empty()) {
        constexpr auto globalBurstPopupInterval = std::chrono::minutes(15);
        const auto now = std::chrono::steady_clock::now();
        const auto burst = std::find_if(
            selected.begin(), selected.end(), [](const auto& event) {
                return event.rule_id == 0 &&
                       (event.reason_flags & RG_REASON_METADATA_BURST) != 0;
            });
        const bool cooldownExpired =
            last_global_burst_alert_shown_.time_since_epoch().count() == 0 ||
            now - last_global_burst_alert_shown_ >= globalBurstPopupInterval;
        if (burst != selected.end() && cooldownExpired)
            alert_queue_.push(*burst);
    }
 
    if (!current_alert_)
        show_next_alert();
}
 
void RootGuardPage::show_next_alert()
{
    if (current_alert_ || alert_queue_.empty())
        return;
 
    const auto event = alert_queue_.front();
    alert_queue_.pop();
    if (event.rule_id == 0 &&
        (event.reason_flags & RG_REASON_METADATA_BURST) != 0)
        last_global_burst_alert_shown_ = std::chrono::steady_clock::now();
    current_alert_ = std::make_unique<Gtk::Window>();
    auto* win = current_alert_.get();
    win->set_title("");
    win->set_default_size(720, 520);
    win->set_resizable(true);
    win->set_modal(false);
    win->add_css_class("BastionGuard-popup");
    win->add_css_class("BastionGuard-dialog");
    if (auto* root = dynamic_cast<Gtk::Window*>(get_root()))
        win->set_transient_for(*root);
 
    auto* header = Gtk::make_managed<Gtk::HeaderBar>();
    header->set_show_title_buttons(false);
    header->set_decoration_layout("");
    header->add_css_class("custom-headerbar");
    auto* header_title = Gtk::make_managed<Gtk::Label>(
        event.event == "service-blocked"
            ? (event.verdict == "blocked"
                ? _("🛑 System service blocked")
                : _("⚠️ System service block failed"))
            : (event.reason_flags & RG_REASON_METADATA_BURST) != 0
                ? _("⚠️ Unusual permission-change burst")
            : event.rule_id == 0
                ? _("⚠️ Filesystem metadata change observed")
                : event.verdict == "blocked"
                    ? _("🛑 Protected change blocked")
                    : event.verdict == "audit"
                        ? _("⚠️ Protected change observed")
                        : _("⚠️ Protected change detected"));
    header_title->add_css_class("BastionGuard-title");
    header->pack_start(*header_title);
    win->set_titlebar(*header);
 
    auto* content = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::VERTICAL, 10);
    content->set_margin(18);
    win->set_child(*content);
 
    const Glib::ustring message_template =
        (event.reason_flags & RG_REASON_METADATA_BURST) != 0
            ? _("RootGuard detected many destructive permission/ownership changes in a short kernel window. Latest object:\n<b>%1</b>")
        : event.rule_id == 0
            ? _("RootGuard observed a filesystem metadata change to:\n<b>%1</b>")
            : event.verdict == "blocked"
                ? _("RootGuard blocked a change to:\n<b>%1</b>")
                : event.verdict == "audit"
                    ? _("RootGuard observed a change to:\n<b>%1</b>")
                    : _("RootGuard detected a change to:\n<b>%1</b>");
    auto* message = Gtk::make_managed<Gtk::Label>(
        Glib::ustring::compose(
            message_template,
            Glib::Markup::escape_text(event.filename.empty() ? "--" : event.filename)));
    message->set_use_markup(true);
    message->set_wrap(true);
    message->set_selectable(true);
    message->set_halign(Gtk::Align::CENTER);
    content->append(*message);
 
    auto* detail = Gtk::make_managed<Gtk::Label>(incident_detail(event));
    detail->set_wrap(true);
    detail->set_selectable(true);
    detail->set_halign(Gtk::Align::START);
    detail->set_valign(Gtk::Align::START);
    detail->set_xalign(0.0F);
 
    auto* detail_scroller = Gtk::make_managed<Gtk::ScrolledWindow>();
    detail_scroller->set_hexpand(true);
    detail_scroller->set_vexpand(true);
    detail_scroller->set_min_content_height(220);
    detail_scroller->set_policy(Gtk::PolicyType::AUTOMATIC,
                                Gtk::PolicyType::AUTOMATIC);
    detail_scroller->set_child(*detail);
    content->append(*detail_scroller);
 
    if (!has_exact_path(event)) {
        auto* path_notice = Gtk::make_managed<Gtk::Label>(
            _("Transparency notice: the kernel event contained only a basename. RootGuard "
              "shows the filesystem identity and disables path-based actions rather than "
              "guessing an unsafe path."));
        path_notice->set_wrap(true);
        path_notice->set_halign(Gtk::Align::CENTER);
        path_notice->add_css_class("dim-label");
        content->append(*path_notice);
    }
 
    if (BastionGuard::RootGuard::is_system_service_path(event.filename)) {
        auto* service_notice = Gtk::make_managed<Gtk::Label>(
            event.event == "service-blocked"
                ? (event.verdict == "blocked"
                    ? _("The affected system service has been stopped immediately. On systemd it is also runtime-masked.")
                    : _("RootGuard could not stop the affected service. Review the init-system logs immediately."))
                : event.verdict == "blocked"
                    ? _("RootGuard requested immediate service containment. A follow-up event will confirm the init-system action.")
                    : _("Audit mode never stops or masks services. This event is informational only."));
        service_notice->set_wrap(true);
        service_notice->add_css_class("rootguard-blocked");
        service_notice->set_halign(Gtk::Align::CENTER);
        content->append(*service_notice);
    }
 
    const bool audit_event = event.verdict == "audit";
    const bool can_restore = !audit_event && restore_available(event);
    const bool can_remove = !audit_event && remove_available(event);
    const auto note_text = audit_event
        ? Glib::ustring(
            _("Audit mode recorded this event without blocking or altering the operation. This notification is acknowledgement-only."))
        : recovery_note(event);
    if (!note_text.empty() && !can_restore && !can_remove) {
        auto* note = Gtk::make_managed<Gtk::Label>(note_text);
        note->set_wrap(true);
        note->set_halign(Gtk::Align::CENTER);
        note->add_css_class("dim-label");
        content->append(*note);
    }
 
    auto* buttons = Gtk::make_managed<Gtk::Box>(Gtk::Orientation::HORIZONTAL, 10);
    buttons->set_halign(Gtk::Align::CENTER);
 
    auto* acknowledge = Gtk::make_managed<Gtk::Button>(
        event.verdict == "blocked" ? _("Keep blocked") : _("Acknowledge"));
    buttons->append(*acknowledge);
 
    if (can_restore) {
        auto* restore = Gtk::make_managed<Gtk::Button>(_("Restore"));
        restore->add_css_class("btn-primary");
        restore->signal_clicked().connect([this, event] {
            restore_event(event);
            close_current_alert();
        });
        buttons->append(*restore);
    }
    if (can_remove) {
        auto* remove = Gtk::make_managed<Gtk::Button>(_("Quarantine"));
        remove->add_css_class("btn-danger");
        remove->signal_clicked().connect([this, event] {
            remove_event(event);
            close_current_alert();
        });
        buttons->append(*remove);
    }
    content->append(*buttons);
 
    acknowledge->signal_clicked().connect([this, event] {
        dismiss_alert(event);
        close_current_alert();
    });
    win->signal_close_request().connect([this, event]() -> bool {
        dismiss_alert(event);
        close_current_alert();
        return true;
    }, false);
    win->present();
}
 
void RootGuardPage::close_current_alert()
{
    if (!current_alert_)
        return;
    auto* window = current_alert_.get();
    window->hide();
    const auto alive = alive_;
    Glib::signal_idle().connect_once([this, window, alive] {
        if (!alive->load(std::memory_order_acquire))
            return;
        if (current_alert_.get() == window)
            current_alert_.reset();
        show_next_alert();
    });
}
 
void RootGuardPage::dismiss_alert(const BastionGuard::RootGuard::Event& event)
{
    dismissed_events_.insert(BastionGuard::RootGuard::event_fingerprint(event));
}
 
void RootGuardPage::dismiss_event(const BastionGuard::RootGuard::Event& event)
{
    dismissed_events_.insert(BastionGuard::RootGuard::event_fingerprint(event));
    dismissed_paths_.insert(incident_key(event));
    client_.refresh();
}
 
void RootGuardPage::restore_event(const BastionGuard::RootGuard::Event& event)
{
    status_.set_text(_("Restoring protected metadata and unblocking the service…"));
    client_.restore_event(event);
}
 
void RootGuardPage::remove_event(const BastionGuard::RootGuard::Event& event)
{
    status_.set_text(
        _("Moving the protected file from its original path into quarantine…"));
    client_.remove_event(event);
}