Fileorb_v1.0.py

#!/usr/bin/env python3
"""
FileOrb v1.0 — Smart File Organizer + File Intelligence Suite
Pure Python stdlib only (+ optional requests for VirusTotal).
Works on Windows / macOS / Linux.
Run: python fileorb_v1.0.py

Author : Instagram @x404ctl  |  GitHub @MAliXCS
"""
import tkinter as tk
from tkinter import ttk, messagebox, filedialog
import os, shutil, threading, time, json, hashlib, struct, math, stat, subprocess, copy
import urllib.request, urllib.parse, urllib.error
from pathlib import Path
from datetime import datetime

# ── Portable paths — everything lives next to the .py / .exe ─────────────────
if getattr(sys, "frozen", False):
    # Running as PyInstaller .exe — use the folder containing the .exe
    _SCRIPT_DIR = Path(sys.executable).resolve().parent
else:
    # Running as plain .py script
    _SCRIPT_DIR = Path(__file__).resolve().parent

_SETTINGS_FILE = _SCRIPT_DIR / "fileorb_settings.json"
_RULES_FILE    = _SCRIPT_DIR / "fileorb_rules.json"
_QUEUE_FILE    = _SCRIPT_DIR / "fileorb_queue.json"

# ── Palette ───────────────────────────────────────────────────────────────────
BG      = "#F0F2F5"
CARD    = "#FFFFFF"
HEADER  = "#1A202C"
BORDER  = "#E2E8F0"
SEL     = "#EFF6FF"
TEXT    = "#1A202C"
TEXT2   = "#64748B"
TEXT3   = "#94A3B8"
C_BLUE  = "#3B82F6"
C_GREEN = "#10B981"
C_RED   = "#EF4444"
C_ORG   = "#F59E0B"
C_PUR   = "#8B5CF6"
C_PINK  = "#EC4899"
C_TEAL  = "#14B8A6"
C_IND   = "#6366F1"
C_CYAN  = "#06B6D4"
C_LIME  = "#84CC16"
C_ROSE  = "#F43F5E"
C_AMB   = "#D97706"
LOG_BG  = "#0F172A"
C_THREAT_HIGH = "#EF4444"
C_THREAT_MED  = "#F59E0B"
C_THREAT_LOW  = "#10B981"
C_THREAT_NONE = "#64748B"

# ── Magic bytes / file signatures ─────────────────────────────────────────────
FILE_SIGNATURES = {
    b'\x89PNG\r\n\x1a\n':          ("PNG Image",      "image/png"),
    b'\xff\xd8\xff':               ("JPEG Image",     "image/jpeg"),
    b'GIF87a':                     ("GIF Image",      "image/gif"),
    b'GIF89a':                     ("GIF Image",      "image/gif"),
    b'%PDF':                       ("PDF Document",   "application/pdf"),
    b'PK\x03\x04':                 ("ZIP Archive",    "application/zip"),
    b'Rar!\x1a\x07':               ("RAR Archive",    "application/x-rar"),
    b'\x1f\x8b':                   ("GZip Archive",   "application/gzip"),
    b'7z\xbc\xaf\x27\x1c':        ("7-Zip Archive",  "application/x-7z"),
    b'MZ':                         ("PE Executable",  "application/x-msdownload"),
    b'\x7fELF':                    ("ELF Executable", "application/x-elf"),
    b'\xca\xfe\xba\xbe':           ("Mach-O Binary",  "application/x-mach"),
    b'BM':                         ("BMP Image",      "image/bmp"),
    b'ID3':                        ("MP3 Audio",      "audio/mpeg"),
    b'\xff\xfb':                   ("MP3 Audio",      "audio/mpeg"),
    b'fLaC':                       ("FLAC Audio",     "audio/flac"),
    b'OggS':                       ("OGG Audio",      "audio/ogg"),
    b'\x00\x00\x00\x18ftypmp42':  ("MP4 Video",      "video/mp4"),
    b'\x00\x00\x00\x20ftyp':      ("MP4 Video",      "video/mp4"),
    b'RIFF':                       ("RIFF Container", "audio/wav"),
    b'\x1a\x45\xdf\xa3':          ("MKV/WebM Video", "video/x-matroska"),
    b'SQLite format 3':            ("SQLite Database","application/x-sqlite3"),
    b'\xd0\xcf\x11\xe0':          ("MS Office (old)","application/msoffice"),
    b'<!DOCTYPE':                  ("HTML Document",  "text/html"),
    b'<html':                      ("HTML Document",  "text/html"),
    b'<?xml':                      ("XML Document",   "text/xml"),
    b'#!/':                        ("Script File",    "text/x-script"),
    b'#!':                         ("Script File",    "text/x-script"),
}

SUSPICIOUS_EXTENSIONS = {
    ".exe",".bat",".cmd",".vbs",".ps1",".jar",".wsf",".scr",
    ".com",".pif",".reg",".lnk",".hta",".cpl",".msi",".dll",
}

PROTECTED_DIRS = {
    "windows","system32","program files","program files (x86)",
    "appdata","programdata","$recycle.bin","system volume information",
}

def shannon_entropy(data: bytes) -> float:
    """Calculate Shannon entropy of bytes (0.0 – 8.0)."""
    if not data: return 0.0
    freq = [0]*256
    for b in data: freq[b] += 1
    length = len(data)
    ent = 0.0
    for f in freq:
        if f:
            p = f / length
            ent -= p * math.log2(p)
    return round(ent, 4)

def detect_type_by_magic(path: str):
    """Return (description, mime) from first 32 bytes."""
    try:
        with open(path,"rb") as fh:
            header = fh.read(32)
        for sig,(desc,mime) in FILE_SIGNATURES.items():
            if header[:len(sig)] == sig:
                return desc, mime
    except: pass
    return None, None

def extract_exif_jpeg(path: str) -> dict:
    """Pure-stdlib minimal EXIF reader for JPEG files."""
    result = {}
    try:
        with open(path,"rb") as fh:
            data = fh.read(65536)
        # Find EXIF APP1 marker
        i = 0
        while i < len(data)-1:
            if data[i] == 0xFF and data[i+1] == 0xE1:
                length = struct.unpack(">H", data[i+2:i+4])[0]
                seg = data[i+4:i+4+length-2]
                if seg[:4] == b'Exif' and seg[4:6] == b'\x00\x00':
                    tiff = seg[6:]
                    bo = '>' if tiff[:2]==b'MM' else '<'
                    ifd_off = struct.unpack(bo+'I', tiff[4:8])[0]
                    n_tags  = struct.unpack(bo+'H', tiff[ifd_off:ifd_off+2])[0]
                    TAG_NAMES = {
                        0x010E:"ImageDescription", 0x010F:"Make",
                        0x0110:"Model",            0x0112:"Orientation",
                        0x011A:"XResolution",      0x011B:"YResolution",
                        0x0128:"ResolutionUnit",   0x0131:"Software",
                        0x0132:"DateTime",         0x013B:"Artist",
                        0x8769:"ExifIFDPointer",   0x8825:"GPSInfoIFDPointer",
                        0xA002:"PixelXDimension",  0xA003:"PixelYDimension",
                        0x9003:"DateTimeOriginal", 0x9004:"DateTimeDigitized",
                        0x920A:"FocalLength",      0x9201:"ShutterSpeedValue",
                        0x9202:"ApertureValue",    0x9209:"Flash",
                        0x8827:"ISOSpeedRatings",
                    }
                    for t in range(n_tags):
                        entry_off = ifd_off + 2 + t*12
                        if entry_off+12 > len(tiff): break
                        tag_id  = struct.unpack(bo+'H', tiff[entry_off:entry_off+2])[0]
                        tag_type= struct.unpack(bo+'H', tiff[entry_off+2:entry_off+4])[0]
                        count   = struct.unpack(bo+'I', tiff[entry_off+4:entry_off+8])[0]
                        raw_val = tiff[entry_off+8:entry_off+12]
                        if tag_id not in TAG_NAMES: continue
                        name = TAG_NAMES[tag_id]
                        try:
                            if tag_type == 2:  # ASCII
                                str_off = struct.unpack(bo+'I', raw_val)[0] if count > 4 else 0
                                if count > 4:
                                    val = tiff[str_off:str_off+count].rstrip(b'\x00').decode('latin-1','replace')
                                else:
                                    val = raw_val[:count].rstrip(b'\x00').decode('latin-1','replace')
                            elif tag_type == 3:  # SHORT
                                val = struct.unpack(bo+'H', raw_val[:2])[0]
                            elif tag_type == 4:  # LONG
                                val = struct.unpack(bo+'I', raw_val)[0]
                            elif tag_type == 5:  # RATIONAL
                                rat_off = struct.unpack(bo+'I', raw_val)[0]
                                n2,d2 = struct.unpack(bo+'II', tiff[rat_off:rat_off+8])
                                val = f"{n2}/{d2}" if d2 else "0"
                            else:
                                continue
                            result[name] = str(val)
                        except: pass
                break
            i += 1
    except: pass
    return result

def extract_gps_from_exif(exif: dict) -> dict:
    """Parse GPS coords from EXIF dict if present."""
    # Basic presence check — full GPS sub-IFD parsing requires more bytes
    # We flag whether GPS block exists
    gps = {}
    if "GPSInfoIFDPointer" in exif:
        gps["GPS Block"] = "Present (offset: " + str(exif["GPSInfoIFDPointer"]) + ")"
    return gps

def compute_hashes(path: str) -> dict:
    """Compute MD5, SHA1, SHA256 of a file."""
    md5 = hashlib.md5()
    sha1= hashlib.sha1()
    sha256=hashlib.sha256()
    try:
        with open(path,"rb") as fh:
            for chunk in iter(lambda: fh.read(65536), b""):
                md5.update(chunk); sha1.update(chunk); sha256.update(chunk)
        return {"MD5":md5.hexdigest(),"SHA1":sha1.hexdigest(),"SHA256":sha256.hexdigest()}
    except Exception as ex:
        return {"Error": str(ex)}

def analyse_file(path: str) -> dict:
    """Full intelligence scan of a single file."""
    result = {}
    p = Path(path)
    # Basic metadata
    try:
        st = p.stat()
        result["Size (bytes)"] = st.st_size
        result["Size (human)"] = (f"{st.st_size/1048576:.2f} MB" if st.st_size>1048576
                                  else f"{st.st_size/1024:.1f} KB" if st.st_size>1024
                                  else f"{st.st_size} B")
        result["Created"]      = datetime.fromtimestamp(st.st_ctime).strftime("%Y-%m-%d %H:%M:%S")
        result["Modified"]     = datetime.fromtimestamp(st.st_mtime).strftime("%Y-%m-%d %H:%M:%S")
        result["Accessed"]     = datetime.fromtimestamp(st.st_atime).strftime("%Y-%m-%d %H:%M:%S")
        result["Is Symlink"]   = str(p.is_symlink())
        result["Permissions"]  = oct(stat.S_IMODE(st.st_mode))
        result["Hidden"]       = str(p.name.startswith("."))
    except Exception as ex:
        result["Stat Error"] = str(ex)

    # Extension & type detection
    ext = p.suffix.lower()
    result["Extension"] = ext or "(none)"
    result["All Suffixes"] = "".join(p.suffixes)
    magic_desc, magic_mime = detect_type_by_magic(path)
    result["Detected Type"] = magic_desc or "Unknown"
    result["MIME (magic)"]  = magic_mime or "Unknown"
    ext_cat = EXT.get(ext,("Other","Other/Misc",TEXT3,"[?]"))
    result["Ext Category"]  = ext_cat[0]

    # Mismatch detection
    if magic_mime and ext:
        declared = EXT.get(ext,("","","",""))[1].lower()
        if magic_desc and "pdf" in ext and "pdf" not in (magic_mime or ""):
            result["TYPE MISMATCH"] = f"Extension says PDF but magic says: {magic_desc}"
        elif magic_desc and ext in (".jpg",".jpeg") and "jpeg" not in (magic_mime or ""):
            result["TYPE MISMATCH"] = f"Extension says JPEG but magic says: {magic_desc}"

    # Hashes
    result["--- HASHES ---"] = ""
    hashes = compute_hashes(path)
    result.update(hashes)

    # Entropy
    result["--- ENTROPY ---"] = ""
    try:
        sz = Path(path).stat().st_size
        sample_size = min(sz, 65536)
        with open(path,"rb") as fh:
            sample = fh.read(sample_size)
        ent = shannon_entropy(sample)
        result["Shannon Entropy"] = f"{ent:.4f} / 8.0"
        if ent > 7.2:
            result["Entropy Assessment"] = "HIGH — likely encrypted, packed, or compressed"
        elif ent > 5.5:
            result["Entropy Assessment"] = "MEDIUM — mixed content"
        else:
            result["Entropy Assessment"] = "LOW — plain text or structured data"
    except Exception as ex:
        result["Entropy Error"] = str(ex)

    # EXIF / Metadata (JPEG)
    result["--- METADATA ---"] = ""
    if ext in (".jpg",".jpeg"):
        exif = extract_exif_jpeg(path)
        if exif:
            result.update(exif)
            gps = extract_gps_from_exif(exif)
            if gps: result.update(gps)
        else:
            result["EXIF"] = "None found"

    # Suspicious checks
    result["--- SECURITY ---"] = ""
    flags = []
    if ext in SUSPICIOUS_EXTENSIONS:
        flags.append(f"Suspicious extension: {ext}")
    if p.is_symlink():
        flags.append("Is a symbolic link")
    if p.name.startswith("."):
        flags.append("Hidden file (dot-prefix)")
    try:
        ent_val = float(result.get("Shannon Entropy","0").split()[0])
        if ent_val > 7.2 and ext not in (".zip",".rar",".7z",".gz",".mp4",".mkv",".mp3",".flac"):
            flags.append(f"High entropy in non-archive file ({ent_val:.2f}) — possible packing/encryption")
    except: pass
    # Double extension check
    if len(p.suffixes) >= 2:
        flags.append(f"Double extension: {''.join(p.suffixes)} — possible masking")
    result["Suspicious Flags"] = "; ".join(flags) if flags else "None"
    result["Threat Level"] = ("HIGH" if any("High entropy" in f or "Suspicious ext" in f for f in flags)
                               else "MEDIUM" if flags else "CLEAN")
    return result

def vt_lookup(sha256: str, api_key: str) -> dict:
    """Query VirusTotal v3 for a file hash."""
    url = f"https://www.virustotal.com/api/v3/files/{sha256}"
    req = urllib.request.Request(url, headers={"x-apikey": api_key})
    try:
        with urllib.request.urlopen(req, timeout=10) as resp:
            data = json.loads(resp.read())
        attrs = data.get("data",{}).get("attributes",{})
        stats = attrs.get("last_analysis_stats",{})
        results_raw = attrs.get("last_analysis_results",{})
        detections = {k:v for k,v in results_raw.items() if v.get("category")=="malicious"}
        return {
            "status":     "found",
            "malicious":  stats.get("malicious",0),
            "suspicious": stats.get("suspicious",0),
            "undetected": stats.get("undetected",0),
            "total":      sum(stats.values()),
            "detections": detections,
            "name":       attrs.get("meaningful_name",""),
            "type":       attrs.get("type_description",""),
        }
    except urllib.error.HTTPError as ex:
        if ex.code == 404: return {"status":"not_found"}
        return {"status":"error","detail":str(ex)}
    except Exception as ex:
        return {"status":"error","detail":str(ex)}


# ── Extension Map: ext → (category, sub_folder, colour, icon) ─────────────────
# Every extension gets a UNIQUE destination folder
EXT = {
    # Images
    ".jpg":("Images",    "Images/Photos",           C_PUR, "[IMG]"),
    ".jpeg":("Images",    "Images/Photos",           C_PUR, "[IMG]"),
    ".png": ("Images",    "Images/PNG",              C_PUR, "[IMG]"),
    ".gif": ("Images",    "Images/GIFs",             C_PUR, "[GIF]"),
    ".bmp": ("Images",    "Images/BMP",              C_PUR, "[IMG]"),
    ".tiff":("Images",    "Images/TIFF",             C_PUR, "[IMG]"),
    ".tif": ("Images",    "Images/TIFF",             C_PUR, "[IMG]"),
    ".webp":("Images",    "Images/WebP",             C_PUR, "[IMG]"),
    ".heic":("Images",    "Images/Photos",           C_PUR, "[IMG]"),
    ".heif":("Images",    "Images/Photos",           C_PUR, "[IMG]"),
    ".raw": ("Images",    "Images/RAW",              C_PUR, "[IMG]"),
    ".cr2": ("Images",    "Images/RAW",              C_PUR, "[IMG]"),
    ".nef": ("Images",    "Images/RAW",              C_PUR, "[IMG]"),
    ".arw": ("Images",    "Images/RAW",              C_PUR, "[IMG]"),
    ".dng": ("Images",    "Images/RAW",              C_PUR, "[IMG]"),
    ".svg": ("Images",    "Images/Vectors",          C_PUR, "[VEC]"),
    ".eps": ("Images",    "Images/Vectors",          C_PUR, "[VEC]"),
    ".ico": ("Images",    "Images/Icons",            C_PUR, "[ICO]"),
    # Documents
    ".pdf":  ("Documents","Documents/PDF",           C_BLUE,"[DOC]"),
    ".doc":  ("Documents","Documents/Word",          C_BLUE,"[DOC]"),
    ".docx": ("Documents","Documents/Word",          C_BLUE,"[DOC]"),
    ".odt":  ("Documents","Documents/Word",          C_BLUE,"[DOC]"),
    ".rtf":  ("Documents","Documents/Word",          C_BLUE,"[DOC]"),
    ".txt":  ("Documents","Documents/Text",          C_BLUE,"[TXT]"),
    ".md":   ("Documents","Documents/Markdown",      C_BLUE,"[LST]"),
    ".tex":  ("Documents","Documents/LaTeX",         C_BLUE,"[SCR]"),
    ".pages":("Documents","Documents/Word",          C_BLUE,"[DOC]"),
    # Spreadsheets
    ".xls":    ("Spreadsheets","Spreadsheets/Excel", C_TEAL,"[XLS]"),
    ".xlsx":   ("Spreadsheets","Spreadsheets/Excel", C_TEAL,"[XLS]"),
    ".csv":    ("Spreadsheets","Spreadsheets/CSV",   C_TEAL,"[XLS]"),
    ".ods":    ("Spreadsheets","Spreadsheets",       C_TEAL,"[XLS]"),
    ".numbers":("Spreadsheets","Spreadsheets",       C_TEAL,"[XLS]"),
    ".tsv":    ("Spreadsheets","Spreadsheets/CSV",   C_TEAL,"[XLS]"),
    # Presentations
    ".ppt": ("Presentations","Presentations",        C_ROSE,"[PPT]"),
    ".pptx":("Presentations","Presentations",        C_ROSE,"[PPT]"),
    ".odp": ("Presentations","Presentations",        C_ROSE,"[PPT]"),
    ".key": ("Presentations","Presentations/Keynote",C_ROSE,"[PPT]"),
    # Audio
    ".mp3": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".wav": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".flac":("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".aac": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".ogg": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".m4a": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".wma": ("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".aiff":("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".opus":("Audio","Audio/Music",                  C_PINK,"[AUD]"),
    ".mid": ("Audio","Audio/MIDI",                   C_PINK,"[MID]"),
    ".midi":("Audio","Audio/MIDI",                   C_PINK,"[MID]"),
    # FL Studio
    ".flp": ("FL Studio","FL Studio/Projects",       C_PINK,"[FLP]"),
    ".fst": ("FL Studio","FL Studio/Presets",        C_PINK,"[FLP]"),
    ".fsc": ("FL Studio","FL Studio/Chords",         C_PINK,"[FLP]"),
    # Video
    ".mp4": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".mov": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".avi": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".mkv": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".wmv": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".flv": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".webm":("Video","Video/WebM",                   C_TEAL,"[VID]"),
    ".m4v": ("Video","Video/Movies",                 C_TEAL,"[VID]"),
    ".3gp": ("Video","Video/Mobile",                 C_TEAL,"[VID]"),
    ".vob": ("Video","Video/DVD",                    C_TEAL,"[DVD]"),
    # Archives
    ".zip": ("Archives","Archives/ZIP",              C_IND, "[ARC]"),
    ".rar": ("Archives","Archives/RAR",              C_IND, "[ARC]"),
    ".7z":  ("Archives","Archives/7Z",               C_IND, "[ARC]"),
    ".tar": ("Archives","Archives/TAR",              C_IND, "[ARC]"),
    ".gz":  ("Archives","Archives/GZ",               C_IND, "[ARC]"),
    ".bz2": ("Archives","Archives/BZ2",              C_IND, "[ARC]"),
    ".xz":  ("Archives","Archives/XZ",               C_IND, "[ARC]"),
    ".tgz": ("Archives","Archives/TAR",              C_IND, "[ARC]"),
    ".cab": ("Archives","Archives/CAB",              C_IND, "[ARC]"),
    # Disk Images
    ".iso": ("Disk Images","Disk Images/ISO",        C_AMB, "[ISO]"),
    ".img": ("Disk Images","Disk Images/IMG",        C_AMB, "[ISO]"),
    ".dmg": ("Disk Images","Disk Images/DMG",        C_AMB, "[ISO]"),
    ".vhd": ("Disk Images","Disk Images/Virtual",    C_AMB, "[VHD]"),
    ".vmdk":("Disk Images","Disk Images/Virtual",    C_AMB, "[VHD]"),
    # Installers
    ".exe":     ("Installers","Installers/Windows",  C_ORG, "[CFG]"),
    ".msi":     ("Installers","Installers/Windows",  C_ORG, "[CFG]"),
    ".apk":     ("Installers","Installers/Android",  C_ORG, "[APK]"),
    ".ipa":     ("Installers","Installers/iOS",      C_ORG, "[APK]"),
    ".deb":     ("Installers","Installers/Linux",    C_ORG, "[LNX]"),
    ".rpm":     ("Installers","Installers/Linux",    C_ORG, "[LNX]"),
    ".pkg":     ("Installers","Installers/macOS",    C_ORG, "[PKG]"),
    ".appimage":("Installers","Installers/Linux",    C_ORG, "[LNX]"),
    # Scripts
    ".bat": ("Scripts","Scripts/Batch",              C_LIME,"[SCR]"),
    ".sh":  ("Scripts","Scripts/Shell",              C_LIME,"[SCR]"),
    ".ps1": ("Scripts","Scripts/PowerShell",         C_LIME,"[SCR]"),
    # Code
    ".py":    ("Code","Code/Python",                 C_GREEN,"[PY]"),
    ".ipynb": ("Code","Code/Python",                 C_GREEN,"[NB]"),
    ".js":    ("Code","Code/JavaScript",             C_GREEN,"[JS]"),
    ".ts":    ("Code","Code/TypeScript",             C_GREEN,"[ICO]"),
    ".jsx":   ("Code","Code/JavaScript",             C_GREEN,"[JSX]"),
    ".tsx":   ("Code","Code/TypeScript",             C_GREEN,"[JSX]"),
    ".html":  ("Code","Code/Web",                    C_GREEN,"[WEB]"),
    ".htm":   ("Code","Code/Web",                    C_GREEN,"[WEB]"),
    ".css":   ("Code","Code/Web",                    C_GREEN,"[CSS]"),
    ".scss":  ("Code","Code/Web",                    C_GREEN,"[CSS]"),
    ".sass":  ("Code","Code/Web",                    C_GREEN,"[CSS]"),
    ".php":   ("Code","Code/PHP",                    C_GREEN,"[PHP]"),
    ".java":  ("Code","Code/Java",                   C_GREEN,"[JAV]"),
    ".class": ("Code","Code/Java",                   C_GREEN,"[JAV]"),
    ".c":     ("Code","Code/C-CPP",                  C_GREEN,"[C]"),
    ".h":     ("Code","Code/C-CPP",                  C_GREEN,"[C]"),
    ".cpp":   ("Code","Code/C-CPP",                  C_GREEN,"[C]"),
    ".cc":    ("Code","Code/C-CPP",                  C_GREEN,"[C]"),
    ".hpp":   ("Code","Code/C-CPP",                  C_GREEN,"[C]"),
    ".cs":    ("Code","Code/CSharp",                 C_GREEN,"[C#]"),
    ".go":    ("Code","Code/Go",                     C_GREEN,"[GO]"),
    ".rs":    ("Code","Code/Rust",                   C_GREEN,"[RS]"),
    ".rb":    ("Code","Code/Ruby",                   C_GREEN,"[RB]"),
    ".swift": ("Code","Code/Swift",                  C_GREEN,"[PKG]"),
    ".kt":    ("Code","Code/Kotlin",                 C_GREEN,"[KT]"),
    ".r":     ("Code","Code/R",                      C_GREEN,"[R]"),
    ".lua":   ("Code","Code/Lua",                    C_GREEN,"[LUA]"),
    ".pl":    ("Code","Code/Perl",                   C_GREEN,"[PL]"),
    ".sql":   ("Code","Code/SQL",                    C_GREEN,"[SQL]"),
    ".json":  ("Code","Code/Data",                   C_GREEN,"{}"),
    ".xml":   ("Code","Code/Data",                   C_GREEN,"[XML]"),
    ".yaml":  ("Code","Code/Config",                 C_GREEN,"[CFG]"),
    ".yml":   ("Code","Code/Config",                 C_GREEN,"[CFG]"),
    ".toml":  ("Code","Code/Config",                 C_GREEN,"[CFG]"),
    ".ini":   ("Code","Code/Config",                 C_GREEN,"[CFG]"),
    ".env":   ("Code","Code/Config",                 C_GREEN,"[CFG]"),
    ".dart":  ("Code","Code/Dart",                   C_GREEN,"[DRT]"),
    ".vue":   ("Code","Code/JavaScript",             C_GREEN,"[VUE]"),
    ".asm":   ("Code","Code/Assembly",               C_GREEN,"[ASM]"),
    ".vsix":  ("Code","Code/VSCode",                 C_CYAN, "[VSX]"),
    # Adobe
    ".psd":    ("Adobe","Adobe/Photoshop",           C_ORG, "[CSS]"),
    ".psb":    ("Adobe","Adobe/Photoshop",           C_ORG, "[CSS]"),
    ".ai":     ("Adobe","Adobe/Illustrator",         C_ORG, "[CSS]"),
    ".xd":     ("Adobe","Adobe/XD",                  C_ORG, "[CSS]"),
    ".aep":    ("Adobe","Adobe/AfterEffects",        C_ORG, "[AEF]"),
    ".aet":    ("Adobe","Adobe/AfterEffects",        C_ORG, "[AEF]"),
    ".indd":   ("Adobe","Adobe/InDesign",            C_ORG, "[IND]"),
    ".idml":   ("Adobe","Adobe/InDesign",            C_ORG, "[IND]"),
    ".prproj": ("Adobe","Adobe/Premiere",            C_ORG, "[VID]"),
    ".drp":    ("Adobe","Adobe/Premiere",            C_ORG, "[VID]"),
    ".mxf":    ("Adobe","Adobe/Premiere",            C_ORG, "[VID]"),
    ".lrcat":  ("Adobe","Adobe/Lightroom",           C_ORG, "[IMG]"),
    ".sesx":   ("Adobe","Adobe/Audition",            C_ORG, "[SND]"),
    ".fla":    ("Adobe","Adobe/Animate",             C_ORG, "[GIF]"),
    # Blender
    ".blend":  ("Blender","Blender/Projects",        C_AMB, "[KT]"),
    ".blend1": ("Blender","Blender/Backup",          C_AMB, "[KT]"),
    # AutoCAD
    ".dwg": ("CAD","CAD/AutoCAD",                    C_CYAN,"[CAD]"),
    ".dxf": ("CAD","CAD/AutoCAD",                    C_CYAN,"[CAD]"),
    ".dwf": ("CAD","CAD/AutoCAD",                    C_CYAN,"[CAD]"),
    ".dwt": ("CAD","CAD/AutoCAD/Templates",          C_CYAN,"[CAD]"),
    # SolidWorks
    ".sldprt":("CAD","CAD/SolidWorks/Parts",         C_CYAN,"[ASM]"),
    ".sldasm":("CAD","CAD/SolidWorks/Assemblies",    C_CYAN,"[ASM]"),
    ".slddrw":("CAD","CAD/SolidWorks/Drawings",      C_CYAN,"[ASM]"),
    # 3ds Max
    ".max": ("3D","3D/3dsMax",                       C_AMB, "[3D]"),
    ".3ds": ("3D","3D/3dsMax",                       C_AMB, "[3D]"),
    # Other 3D
    ".fbx":  ("3D","3D/Assets/FBX",                  C_AMB, "[3D]"),
    ".obj":  ("3D","3D/Assets/OBJ",                  C_AMB, "[3D]"),
    ".stl":  ("3D","3D/Assets/STL",                  C_AMB, "[3D]"),
    ".dae":  ("3D","3D/Assets/Collada",              C_AMB, "[3D]"),
    ".glb":  ("3D","3D/Assets/GLTF",                 C_AMB, "[3D]"),
    ".gltf": ("3D","3D/Assets/GLTF",                 C_AMB, "[3D]"),
    ".c4d":  ("3D","3D/Cinema4D",                    C_AMB, "[3D]"),
    ".ma":   ("3D","3D/Maya",                        C_AMB, "[3D]"),
    ".mb":   ("3D","3D/Maya",                        C_AMB, "[3D]"),
    ".ztl":  ("3D","3D/ZBrush",                      C_AMB, "[ZBR]"),
    # Fonts
    ".ttf":  ("Fonts","Fonts/TrueType",              C_ROSE,"[FNT]"),
    ".otf":  ("Fonts","Fonts/OpenType",              C_ROSE,"[FNT]"),
    ".woff": ("Fonts","Fonts/Web",                   C_ROSE,"[FNT]"),
    ".woff2":("Fonts","Fonts/Web",                   C_ROSE,"[FNT]"),
    # Ebooks
    ".epub":("Ebooks","Ebooks",                      C_BLUE,"[EBK]"),
    ".mobi":("Ebooks","Ebooks",                      C_BLUE,"[EBK]"),
    ".azw": ("Ebooks","Ebooks/Kindle",               C_BLUE,"[EBK]"),
    ".azw3":("Ebooks","Ebooks/Kindle",               C_BLUE,"[EBK]"),
    ".djvu":("Ebooks","Ebooks",                      C_BLUE,"[EBK]"),
    # Databases
    ".db":      ("Databases","Databases",            C_TEAL,"[SQL]"),
    ".sqlite":  ("Databases","Databases/SQLite",     C_TEAL,"[SQL]"),
    ".sqlite3": ("Databases","Databases/SQLite",     C_TEAL,"[SQL]"),
    ".mdb":     ("Databases","Databases/Access",     C_TEAL,"[SQL]"),
    ".accdb":   ("Databases","Databases/Access",     C_TEAL,"[SQL]"),
    # Torrents / Incomplete
    ".torrent":   ("Downloads","Downloads/Torrents", TEXT3, "[TOR]"),
    ".part":      ("Downloads","Downloads/Incomplete",TEXT3,"[DL]"),
    ".crdownload":("Downloads","Downloads/Incomplete",TEXT3,"[DL]"),
    # Subtitles
    ".srt":("Subtitles","Subtitles",                 C_TEAL,"[SUB]"),
    ".vtt":("Subtitles","Subtitles",                 C_TEAL,"[SUB]"),
    ".ass":("Subtitles","Subtitles",                 C_TEAL,"[SUB]"),
    ".sub":("Subtitles","Subtitles",                 C_TEAL,"[SUB]"),
    # Logs / Backups / Temp
    ".log": ("Logs",   "Logs",                       TEXT3, "[LST]"),
    ".bak": ("Backups","Backups",                    TEXT3, "[VHD]"),
    ".tmp": ("Temp",   "Temp",                       TEXT3, "[TMP]"),
    # System
    ".dll": ("System","System/DLL",                  C_RED, "[SYS]"),
    ".reg": ("System","System/Registry",             C_RED, "[SYS]"),
    # Shortcuts
    ".lnk":   ("Shortcuts","Shortcuts",              TEXT3, "[LNK]"),
    ".url":   ("Shortcuts","Shortcuts",              TEXT3, "[LNK]"),
    ".webloc":("Shortcuts","Shortcuts",              TEXT3, "[LNK]"),
}

def classify(name):
    ext = Path(name).suffix.lower()
    if ext in EXT:
        cat, dest, col, icon = EXT[ext]
        return cat, dest, col, icon
    return "Unknown", "Unknown/Other", TEXT3, "[?]"

# ── Sample file list ───────────────────────────────────────────────────────────
SAMPLES = [
    ("IMG_4829.jpg","3.2 MB","2h ago"), ("invoice_dec.pdf","412 KB","1d ago"),
    ("notes.docx","88 KB","5h ago"),    ("budget.xlsx","1.2 MB","3d ago"),
    ("pitch.pptx","14 MB","1w ago"),    ("song.mp3","8.7 MB","2d ago"),
    ("clip.mp4","450 MB","3d ago"),     ("backup.zip","340 MB","12d ago"),
    ("win11.iso","5.1 GB","20d ago"),   ("setup.exe","1.4 GB","45d ago"),
    ("script.py","4 KB","1h ago"),      ("index.html","8 KB","6h ago"),
    ("main.cpp","12 KB","2d ago"),      ("style.css","3 KB","1d ago"),
    ("app.js","22 KB","4h ago"),        ("design.psd","48 MB","5d ago"),
    ("logo.ai","2.1 MB","1w ago"),      ("scene.blend","18 MB","3d ago"),
    ("drawing.dwg","6.4 MB","2w ago"),  ("part.sldprt","3.2 MB","1w ago"),
    ("track.flp","1.1 MB","3h ago"),    ("model.fbx","22 MB","5d ago"),
    ("font.ttf","180 KB","1mo ago"),    ("book.epub","2.3 MB","2w ago"),
    ("app.db","8.4 MB","6d ago"),       ("old.rar","780 MB","30d ago"),
    ("edit.prproj","3.5 MB","2d ago"),  ("fx.aep","12 MB","4d ago"),
    ("photo.heic","7.2 MB","1d ago"),   ("draft.mov","890 MB","5d ago"),
    ("data.csv","450 KB","2d ago"),     ("paper.tex","28 KB","1w ago"),
    ("scene.max","34 MB","3d ago"),     ("config.yaml","2 KB","1d ago"),
    ("query.sql","6 KB","3d ago"),      ("pack.tar.gz","120 MB","10d ago"),
    ("sub.srt","48 KB","3d ago"),       ("readme.md","12 KB","1h ago"),
    ("slide.key","8 MB","4d ago"),      ("project.flp","2.2 MB","6h ago"),
    ("disk.dmg","4.1 GB","8d ago"),     ("robot.asm","9 KB","2d ago"),
    ("app.dart","6 KB","1d ago"),       ("game.c4d","55 MB","3w ago"),
    ("movie.mkv","8.2 GB","5d ago"),    ("font2.otf","210 KB","2w ago"),
    ("sheet.numbers","3.1 MB","1w ago"),("db.sqlite","18 MB","4d ago"),
]

def make_samples():
    rows = []
    for name, size, age in SAMPLES:
        cat, dest, col, icon = classify(name)
        rows.append({"name":name,"size":size,"age":age,
                     "type":cat,"dest":dest,"conf":95 if cat!="Unknown" else 45,
                     "status":"Pending","note":"","_path":""})
    return rows

# ── Widget factories ──────────────────────────────────────────────────────────
_PAL = {
    "primary": (C_BLUE,  "#FFF","#2563EB"),
    "success": (C_GREEN, "#FFF","#059669"),
    "danger":  (C_RED,   "#FFF","#DC2626"),
    "ghost":   ("#E2E8F0",TEXT2,BORDER),
    "outline": (CARD,    C_BLUE,SEL),
    "dark":    ("#334155","#FFF","#1E293B"),
}
def B(parent, text, cmd, style="primary"):
    bg,fg,hv = _PAL.get(style,_PAL["primary"])
    b = tk.Button(parent,text=text,command=cmd,
                  font=("Segoe UI",9,"bold"),fg=fg,bg=bg,
                  relief="flat",bd=0,cursor="hand2",
                  padx=11,pady=5,
                  activebackground=hv,activeforeground=fg)
    b.bind("<Enter>",lambda e:b.config(bg=hv))
    b.bind("<Leave>",lambda e:b.config(bg=bg))
    return b

def H(p): return tk.Frame(p,bg=BORDER,height=1)
def V(p): return tk.Frame(p,bg=BORDER,width=1)
def L(p,t,sz=9,w="normal",c=TEXT,bg=None):
    return tk.Label(p,text=t,font=("Segoe UI",sz,w),fg=c,bg=bg or p.cget("bg"))

# ── Universal mouse-wheel scroll helper ─────────────────────────────────────
def _bind_scroll(widget, yscroll_cmd, xscroll_cmd=None):
    """Bind mouse wheel (Windows/macOS/Linux) and touchpad scroll to a widget."""
    import sys
    def _on_y(event):
        delta = -1 * int(event.delta / 120) if event.delta else 0
        if delta: yscroll_cmd("scroll", delta, "units")
    def _on_x(event):
        if not xscroll_cmd: return
        delta = -1 * int(event.delta / 120) if event.delta else 0
        if delta: xscroll_cmd("scroll", delta, "units")
    def _on_y_up(event):  yscroll_cmd("scroll", -1, "units")
    def _on_y_dn(event):  yscroll_cmd("scroll",  1, "units")
    # Windows & macOS: MouseWheel event carries event.delta
    widget.bind("<MouseWheel>",       _on_y, add="+")
    widget.bind("<Shift-MouseWheel>", _on_x, add="+")
    # Linux X11 only: Button-4/5 for vertical scroll (no Button-6/7 on Windows)
    if sys.platform.startswith("linux"):
        widget.bind("<Button-4>", _on_y_up, add="+")
        widget.bind("<Button-5>", _on_y_dn, add="+")

# ══════════════════════════════════════════════════════════════════════════════
class App:
    def __init__(self, root):
        self.root = root
        self.root.title("FileOrb v1.0 — Smart File Organizer + Intelligence Suite")
        self.root.geometry("1280x800")
        self.root.minsize(1000,640)
        self.root.configure(bg=BG)

        # ── data & state
        self.files        = make_samples()
        self._log_entries = []
        self._log_paused  = False
        self._log_autoscroll = True
        self._drag        = {"iid":None}
        self._sort_col    = None
        self._sort_asc    = True

        # ── Tk vars (no widgets yet)
        self.v_filter  = tk.StringVar(value="All")
        self.v_scan    = tk.DoubleVar(value=0)
        self.v_status  = tk.StringVar(value="Ready")
        self.v_watch   = tk.StringVar(value="")
        self.v_output  = tk.StringVar(value="")
        self.v_lsearch = tk.StringVar()
        self.v_llevel  = tk.StringVar(value="ALL")
        self.v_lstats  = tk.StringVar(value="")
        self.v_flat    = tk.BooleanVar(value=False)   # flat / single-folder mode
        self.v_vt_key  = tk.StringVar(value="")       # VirusTotal API key
        self._intel_path = None                        # currently analysed path
        # ── Undo / redo stacks (snapshots of self.files list)
        self._undo_stack : list = []
        self._redo_stack : list = []
        # ── Real-time watcher
        self._rt_active   = False
        self._rt_thread   = None
        self._rt_snapshot : set = set()   # filenames seen in last pass
        self.v_rt_status  = tk.StringVar(value="Watcher: OFF")

        # ── Build ALL widgets first
        self._build_styles()
        self._build_header()
        self._build_body()        # sidebar + all tabs
        self._build_statusbar()
        # Hidden dummy for _toggle_realtime — Frame never renders text, never shows
        self._rt_btn = tk.Frame(self.root, width=0, height=0)
        self._rt_btn.place(x=-999, y=-999)   # off-screen, never visible
        # Patch .config so text/bg calls on it are silently ignored
        self._rt_btn.config = lambda **kw: None

        # ── Populate AFTER every widget exists
        self._refresh_table()
        self._refresh_rules()
        self._refresh_analytics()
        self._refresh_ext_table()
        self._log(f"FileOrb v1.0 ready — {len(EXT)} extensions, {len(set(v[0] for v in EXT.values()))} categories.", "success")
        self._log("Intelligence tab: drop any real file to analyse hashes, entropy, EXIF, and threats.", "info")
        # Load portable settings/rules/queue AFTER all widgets exist
        self.root.after(100, self._load_all)

    # ── Styles ────────────────────────────────────────────────────────────────
    def _build_styles(self):
        s = ttk.Style(); s.theme_use("clam")
        s.configure("Treeview", background=CARD, foreground=TEXT,
                    rowheight=30, fieldbackground=CARD,
                    font=("Segoe UI",9), borderwidth=0)
        s.configure("Treeview.Heading", background=BG, foreground=TEXT2,
                    font=("Segoe UI",8,"bold"), relief="flat")
        s.map("Treeview",
              background=[("selected",SEL)], foreground=[("selected",TEXT)])
        s.map("Treeview.Heading", background=[("active",BORDER)])
        s.configure("Horizontal.TProgressbar",
                    troughcolor=BORDER,background=C_BLUE,thickness=5,borderwidth=0)
        s.configure("TNotebook",background=BG,borderwidth=0,tabmargins=0)
        s.configure("TNotebook.Tab",background=CARD,foreground=TEXT2,
                    font=("Segoe UI",9),padding=[14,7],borderwidth=0)
        s.map("TNotebook.Tab",
              background=[("selected",CARD)], foreground=[("selected",C_BLUE)])

    # ── Header ────────────────────────────────────────────────────────────────
    def _build_header(self):
        h = tk.Frame(self.root,bg=HEADER,height=52)
        h.pack(fill="x"); h.pack_propagate(False)
        tk.Label(h,text="*",font=("Segoe UI",15),bg=HEADER,fg=C_BLUE).pack(side="left",padx=(16,4),pady=10)
        tk.Label(h,text="FileOrb",font=("Segoe UI",13,"bold"),bg=HEADER,fg="white").pack(side="left")
        tk.Label(h,text="  Smart File Organizer  v1.0",font=("Segoe UI",9),bg=HEADER,fg=TEXT3).pack(side="left")
        tk.Label(h,text=f"  |  {len(EXT)} file types  •  {len(set(v[0] for v in EXT.values()))} categories  •  Real Organizer",
                 font=("Segoe UI",8),bg=HEADER,fg="#475569").pack(side="left",padx=6)
        tk.Label(h,text="Instagram @x404ctl  |  GitHub @MAliXCS",
                 font=("Segoe UI",7),bg=HEADER,fg="#334155").pack(side="left",padx=10)
        self._dot = tk.Label(h,text="*",font=("Segoe UI",10),bg=HEADER,fg=C_GREEN)
        self._dot.pack(side="right",padx=(0,14))
        tk.Label(h,textvariable=self.v_status,font=("Segoe UI",9),bg=HEADER,fg=TEXT3).pack(side="right")

    # ── Body ──────────────────────────────────────────────────────────────────
    def _build_body(self):
        body = tk.Frame(self.root,bg=BG)
        body.pack(fill="both",expand=True)
        self._build_sidebar(body)
        self._build_notebook(body)

    # ── Sidebar ───────────────────────────────────────────────────────────────
    def _build_sidebar(self, parent):
        sb = tk.Frame(parent,bg=CARD,width=206)
        sb.pack(side="left",fill="y",padx=(10,0),pady=10)
        sb.pack_propagate(False)

        # Drop zone
        dz = tk.Frame(sb,bg=BG,height=88,
                      highlightbackground=BORDER,highlightthickness=2)
        dz.pack(fill="x",padx=10,pady=(10,6)); dz.pack_propagate(False)
        tk.Label(dz,text="[+]",font=("Segoe UI",20),bg=BG,fg=C_BLUE).place(relx=.5,rely=.3,anchor="center")
        tk.Label(dz,text="Drop files / Click to add",font=("Segoe UI",7,"bold"),
                 fg=TEXT3,bg=BG).place(relx=.5,rely=.72,anchor="center")
        def _dz_hover(enter, d=dz):
            d.config(highlightbackground=C_BLUE if enter else BORDER)
        for w in [dz]+list(dz.winfo_children()):
            w.bind("<Button-1>", lambda e: self._browse_add())
            w.bind("<Enter>",    lambda e: _dz_hover(True))
            w.bind("<Leave>",    lambda e: _dz_hover(False))

        H(sb).pack(fill="x",padx=8)

        # Stats
        L(sb,"QUICK STATS",7,"bold",TEXT3,CARD).pack(anchor="w",padx=14,pady=(8,4))
        self._stat = {}
        for key,label,col in [("Pending","Pending",C_ORG),
                               ("Approved","Approved",C_GREEN),
                               ("Moved","Moved",C_BLUE),
                               ("Skipped","Skipped",TEXT3)]:
            r = tk.Frame(sb,bg=CARD); r.pack(fill="x",padx=12,pady=2)
            tk.Label(r,text=label,font=("Segoe UI",9),fg=TEXT2,bg=CARD).pack(side="left")
            v = tk.Label(r,text="0",font=("Segoe UI",9,"bold"),fg=col,bg=CARD)
            v.pack(side="right"); self._stat[key]=v

        H(sb).pack(fill="x",padx=8,pady=4)

        # Activity log header + Clear button
        lh = tk.Frame(sb,bg=CARD); lh.pack(fill="x",padx=6,pady=(0,2))
        L(lh,"ACTIVITY LOG",7,"bold",TEXT3,CARD).pack(side="left",padx=6)
        cb = tk.Button(lh,text="Clear",font=("Segoe UI",7,"bold"),
                       bg=BG,fg=TEXT3,relief="flat",bd=0,
                       padx=6,pady=1,cursor="hand2",
                       command=self._clear_sidebar_log,
                       activebackground="#FEE2E2",activeforeground=C_RED)
        cb.pack(side="right",padx=2,pady=1)
        cb.bind("<Enter>",lambda e:cb.config(bg="#FEE2E2",fg=C_RED))
        cb.bind("<Leave>",lambda e:cb.config(bg=BG,fg=TEXT3))

        self._logbox = tk.Text(sb,bg=CARD,fg=TEXT2,font=("Segoe UI",8),
                               relief="flat",state="disabled",wrap="word",
                               bd=0,highlightthickness=0,cursor="arrow")
        self._logbox.pack(fill="both",expand=True,padx=8,pady=(0,8))
        _bind_scroll(self._logbox, self._logbox.yview)
        for tag,col in [("success",C_GREEN),("warning",C_ORG),
                        ("info",C_BLUE),("error",C_RED)]:
            self._logbox.tag_config(tag,foreground=col)

    # ── Notebook ──────────────────────────────────────────────────────────────
    def _build_notebook(self, parent):
        wrap = tk.Frame(parent,bg=BG)
        wrap.pack(side="left",fill="both",expand=True,padx=10,pady=10)
        self.nb = ttk.Notebook(wrap)
        self.nb.pack(fill="both",expand=True)
        self._build_tab_organize()
        self._build_tab_extensions()
        self._build_tab_rules()
        self._build_tab_analytics()
        self._build_tab_intelligence()
        self._build_tab_logs()
        self._build_tab_settings()

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Organize
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_organize(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Organize  ")

        # toolbar
        tb = tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"Filter:",9,c=TEXT2,bg=CARD).pack(side="left",padx=(10,3))
        self._fbtn = {}
        cats = ["All"] + sorted(set(v[0] for v in EXT.values())) + ["Unknown"]
        for ft in cats[:14]:
            b = tk.Button(tb,text=ft,font=("Segoe UI",7,"bold"),
                          bg=BG,fg=TEXT2,relief="flat",bd=0,
                          padx=5,pady=2,cursor="hand2",
                          command=lambda f=ft: self._set_filter(f))
            b.pack(side="left",padx=1,pady=9); self._fbtn[ft]=b
        V(tb).pack(side="left",fill="y",padx=6,pady=8)
        B(tb,"Scan",        self._run_scan,    "primary").pack(side="left",padx=2,pady=8)
        B(tb,"Apply All",  self._apply_all,   "success").pack(side="left",padx=2,pady=8)
        B(tb,"Undo All",   self._undo_all,    "ghost").pack(side="left",padx=2,pady=8)
        B(tb,"Add Files",  self._browse_add,  "outline").pack(side="left",padx=2,pady=8)
        V(tb).pack(side="left",fill="y",padx=6,pady=8)
        B(tb,"Select All", self._select_all,  "ghost").pack(side="left",padx=2,pady=8)
        H(tab).pack(fill="x")

        # progress bar
        pf = tk.Frame(tab,bg=CARD,height=6); pf.pack(fill="x"); pf.pack_propagate(False)
        self._pb = ttk.Progressbar(pf,variable=self.v_scan,
                                   maximum=100,style="Horizontal.TProgressbar")
        self._pb.pack(fill="x")
        H(tab).pack(fill="x")

        # table
        tf = tk.Frame(tab,bg=CARD); tf.pack(fill="both",expand=True)
        cols = ("icon","name","type","size","age","dest","conf","status","note")
        self.tree = ttk.Treeview(tf,columns=cols,show="headings",selectmode="extended")
        cfg = [("icon","",32),("name","File Name",200),("type","Category",90),
               ("size","Size",72),("age","Age",72),("dest","Destination",185),
               ("conf","Confidence",110),("status","Status",72),("note","Note",160)]
        for c,h,w in cfg:
            self.tree.heading(c,text=h,command=lambda _c=c:self._sort_col_fn(_c))
            self.tree.column(c,width=w,minwidth=20)
        for tag,bg2,fg2 in [("pending",CARD,TEXT),
                             ("approved","#F0FDF4","#065F46"),
                             ("moved","#F0FDF4","#065F46"),
                             ("skipped","#FFF7ED",TEXT2),
                             ("dup","#FFF1F2","#9F1239"),
                             ("lowconf","#FFFBEB","#92400E"),
                             ("dragover",SEL,C_BLUE)]:
            self.tree.tag_configure(tag,background=bg2,foreground=fg2)
        ys=ttk.Scrollbar(tf,orient="vertical",  command=self.tree.yview)
        xs=ttk.Scrollbar(tf,orient="horizontal",command=self.tree.xview)
        self.tree.configure(yscrollcommand=ys.set,xscrollcommand=xs.set)
        self.tree.grid(row=0,column=0,sticky="nsew")
        ys.grid(row=0,column=1,sticky="ns")
        xs.grid(row=1,column=0,sticky="ew")
        tf.grid_rowconfigure(0,weight=1); tf.grid_columnconfigure(0,weight=1)

        # context menu
        self._ctx = tk.Menu(self.root,tearoff=0,font=("Segoe UI",9),
                            bg=CARD,fg=TEXT,activebackground=SEL,
                            activeforeground=C_BLUE,relief="solid",bd=1)
        self._ctx.add_command(label="Approve",            command=self._approve)
        self._ctx.add_command(label="Skip",               command=self._skip)
        self._ctx.add_command(label="Change Destination", command=self._change_dest)
        self._ctx.add_separator()
        self._ctx.add_command(label="View Details",       command=self._view_detail)
        self._ctx.add_command(label="Analyse in Intelligence", command=self._ctx_analyse_intel)
        self._ctx.add_separator()
        self._ctx.add_command(label="Remove from list",   command=self._remove)
        self.tree.bind("<Button-3>",         self._show_ctx)
        self.tree.bind("<Double-Button-1>",  lambda e:self._view_detail())
        self.tree.bind("<Delete>",           lambda e:self._skip())
        self.tree.bind("<<TreeviewSelect>>", self._on_sel)
        self.tree.bind("<ButtonPress-1>",    self._dnd_start)
        self.tree.bind("<B1-Motion>",        self._dnd_motion)
        self.tree.bind("<ButtonRelease-1>",  self._dnd_drop)
        # Ctrl+A → select all rows
        self.tree.bind("<Control-a>",        lambda e:self._select_all())
        self.tree.bind("<Control-A>",        lambda e:self._select_all())
        # Copy / Paste / Cut
        self.tree.bind("<Control-c>",        lambda e:self._copy_selected())
        self.tree.bind("<Control-C>",        lambda e:self._copy_selected())
        self.tree.bind("<Control-x>",        lambda e:self._cut_selected())
        self.tree.bind("<Control-X>",        lambda e:self._cut_selected())
        self.tree.bind("<Control-v>",        lambda e:self._paste_clipboard())
        self.tree.bind("<Control-V>",        lambda e:self._paste_clipboard())
        # Undo / Redo
        self.tree.bind("<Control-z>",        lambda e:self._undo())
        self.tree.bind("<Control-Z>",        lambda e:self._undo())
        self.tree.bind("<Control-y>",        lambda e:self._redo())
        self.tree.bind("<Control-Y>",        lambda e:self._redo())
        self.tree.bind("<Control-Shift-z>",  lambda e:self._redo())
        self.tree.bind("<Control-Shift-Z>",  lambda e:self._redo())
        # Mouse-wheel / touchpad scroll on main table
        _bind_scroll(self.tree, self.tree.yview, self.tree.xview)
        # Global shortcuts (window level so they work anywhere in app)
        self.root.bind("<Control-z>",        lambda e:self._undo())
        self.root.bind("<Control-Z>",        lambda e:self._undo())
        self.root.bind("<Control-y>",        lambda e:self._redo())
        self.root.bind("<Control-Y>",        lambda e:self._redo())
        self.root.bind("<Control-Shift-z>",  lambda e:self._redo())
        self.root.bind("<Control-Shift-Z>",  lambda e:self._redo())

        # bottom bar
        bb = tk.Frame(tab,bg=CARD,height=38); bb.pack(fill="x",side="bottom"); bb.pack_propagate(False)
        H(tab).pack(fill="x",side="bottom")
        self._sel_lbl = tk.Label(bb,text="No selection",font=("Segoe UI",8),fg=TEXT2,bg=CARD)
        self._sel_lbl.pack(side="left",padx=12)
        # Flat-folder toggle
        tk.Checkbutton(bb,text="All files in one folder",variable=self.v_flat,
                       font=("Segoe UI",8),fg=TEXT2,bg=CARD,
                       activebackground=CARD,selectcolor=BG,cursor="hand2").pack(side="left",padx=10)
        B(bb,"Approve",     self._approve,      "success").pack(side="right",padx=4,pady=5)
        B(bb,"Skip",        self._skip,         "danger").pack(side="right",padx=2,pady=5)
        B(bb,"Change Dest", self._change_dest,  "ghost").pack(side="right",padx=2,pady=5)

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Extensions
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_extensions(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Extensions  ")
        tb = tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,f"All Supported Extensions  ({len(EXT)} types  •  {len(set(v[0] for v in EXT.values()))} categories)",
          11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        self._ext_sv = tk.StringVar()
        self._ext_sv.trace_add("write",lambda *a:self._refresh_ext_table())
        tk.Entry(tb,textvariable=self._ext_sv,font=("Segoe UI",9),
                 bg=BG,fg=TEXT,relief="solid",bd=1,width=22).pack(side="right",padx=12,pady=12)
        L(tb,"Search:",9,c=TEXT2,bg=CARD).pack(side="right")
        H(tab).pack(fill="x")

        ef = tk.Frame(tab,bg=CARD); ef.pack(fill="both",expand=True)
        ecols = ("icon","ext","category","destination")
        self.etree = ttk.Treeview(ef,columns=ecols,show="headings",selectmode="browse")
        for c,h,w in [("icon","",36),("ext","Extension",100),
                      ("category","Category",140),("destination","Auto-Destination Folder",440)]:
            self.etree.heading(c,text=h,command=lambda _c=c:self._sort_ext(_c))
            self.etree.column(c,width=w,minwidth=30)
        eys=ttk.Scrollbar(ef,orient="vertical",  command=self.etree.yview)
        exs=ttk.Scrollbar(ef,orient="horizontal",command=self.etree.xview)
        self.etree.configure(yscrollcommand=eys.set,xscrollcommand=exs.set)
        self.etree.grid(row=0,column=0,sticky="nsew")
        eys.grid(row=0,column=1,sticky="ns")
        exs.grid(row=1,column=0,sticky="ew")
        _bind_scroll(self.etree, self.etree.yview, self.etree.xview)
        ef.grid_rowconfigure(0,weight=1); ef.grid_columnconfigure(0,weight=1)
        bb = tk.Frame(tab,bg=CARD,height=28); bb.pack(fill="x",side="bottom"); bb.pack_propagate(False)
        H(tab).pack(fill="x",side="bottom")
        L(bb,f"{len(EXT)} extensions across {len(set(v[0] for v in EXT.values()))} categories — click headers to sort",
          8,c=TEXT2,bg=CARD).pack(side="left",padx=12)

    def _refresh_ext_table(self):
        search = self._ext_sv.get().lower() if hasattr(self,"_ext_sv") else ""
        for iid in self.etree.get_children(): self.etree.delete(iid)
        for ext in sorted(EXT.keys()):
            cat,dest,col,icon = EXT[ext]
            if search and search not in ext and search not in cat.lower() and search not in dest.lower():
                continue
            self.etree.insert("","end",values=(icon,ext,cat,dest))

    def _sort_ext(self, col):
        data = [(self.etree.set(k,col),k) for k in self.etree.get_children()]
        data.sort()
        for i,(_,k) in enumerate(data): self.etree.move(k,"",i)

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Rules
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_rules(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Rules  ")
        tb = tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"Custom Sorting Rules",11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        B(tb,"Delete",self._del_rule, "danger").pack(side="right",padx=10,pady=10)
        B(tb,"Edit",  self._edit_rule,"outline").pack(side="right",padx=2, pady=10)
        B(tb,"Add",   self._add_rule, "primary").pack(side="right",padx=2, pady=10)
        H(tab).pack(fill="x")
        self.rules_data = [
            {"pat":"*.jpg, *.jpeg, *.png, *.gif, *.bmp, *.heic, *.webp","dest":"Images/Photos","on":True},
            {"pat":"*.raw, *.cr2, *.nef, *.arw, *.dng","dest":"Images/RAW","on":True},
            {"pat":"*.svg, *.eps","dest":"Images/Vectors","on":True},
            {"pat":"*.pdf","dest":"Documents/PDF","on":True},
            {"pat":"*.doc, *.docx, *.odt, *.rtf","dest":"Documents/Word","on":True},
            {"pat":"*.xls, *.xlsx","dest":"Spreadsheets/Excel","on":True},
            {"pat":"*.csv, *.tsv","dest":"Spreadsheets/CSV","on":True},
            {"pat":"*.ppt, *.pptx","dest":"Presentations","on":True},
            {"pat":"*.mp3, *.wav, *.flac, *.aac, *.ogg, *.m4a","dest":"Audio/Music","on":True},
            {"pat":"*.mp4, *.mov, *.avi, *.mkv, *.wmv","dest":"Video/Movies","on":True},
            {"pat":"*.zip","dest":"Archives/ZIP","on":True},
            {"pat":"*.rar","dest":"Archives/RAR","on":True},
            {"pat":"*.7z","dest":"Archives/7Z","on":True},
            {"pat":"*.tar, *.gz, *.tgz","dest":"Archives/TAR","on":True},
            {"pat":"*.iso, *.img","dest":"Disk Images/ISO","on":True},
            {"pat":"*.dmg","dest":"Disk Images/DMG","on":True},
            {"pat":"*.exe, *.msi","dest":"Installers/Windows","on":True},
            {"pat":"*.apk","dest":"Installers/Android","on":True},
            {"pat":"*.py, *.ipynb","dest":"Code/Python","on":True},
            {"pat":"*.js, *.ts, *.jsx, *.tsx, *.vue","dest":"Code/JavaScript","on":True},
            {"pat":"*.html, *.htm, *.css, *.scss","dest":"Code/Web","on":True},
            {"pat":"*.c, *.cpp, *.h, *.hpp, *.cc","dest":"Code/C-CPP","on":True},
            {"pat":"*.cs","dest":"Code/CSharp","on":True},
            {"pat":"*.java, *.class","dest":"Code/Java","on":True},
            {"pat":"*.json, *.xml","dest":"Code/Data","on":True},
            {"pat":"*.yaml, *.yml, *.toml, *.ini, *.env","dest":"Code/Config","on":True},
            {"pat":"*.sql","dest":"Code/SQL","on":True},
            {"pat":"*.sh, *.bat, *.ps1","dest":"Scripts","on":True},
            {"pat":"*.psd, *.psb","dest":"Adobe/Photoshop","on":True},
            {"pat":"*.ai","dest":"Adobe/Illustrator","on":True},
            {"pat":"*.aep, *.aet","dest":"Adobe/AfterEffects","on":True},
            {"pat":"*.prproj, *.drp","dest":"Adobe/Premiere","on":True},
            {"pat":"*.indd, *.idml","dest":"Adobe/InDesign","on":True},
            {"pat":"*.blend, *.blend1","dest":"Blender/Projects","on":True},
            {"pat":"*.dwg, *.dxf","dest":"CAD/AutoCAD","on":True},
            {"pat":"*.sldprt, *.sldasm, *.slddrw","dest":"CAD/SolidWorks","on":True},
            {"pat":"*.max, *.3ds","dest":"3D/3dsMax","on":True},
            {"pat":"*.fbx, *.obj, *.stl","dest":"3D/Assets","on":True},
            {"pat":"*.flp, *.fst","dest":"FL Studio/Projects","on":True},
            {"pat":"*.ttf, *.otf, *.woff, *.woff2","dest":"Fonts","on":True},
            {"pat":"*.epub, *.mobi, *.azw","dest":"Ebooks","on":True},
            {"pat":"*.sqlite, *.db","dest":"Databases","on":True},
            {"pat":"invoice_*","dest":"Documents/Finance","on":True},
        ]
        rf = tk.Frame(tab,bg=CARD); rf.pack(fill="both",expand=True)
        rcols = ("pat","dest","on")
        self.rtree = ttk.Treeview(rf,columns=rcols,show="headings",selectmode="browse")
        for c,h,w in [("pat","File Pattern",400),("dest","Destination Folder",280),("on","Active",70)]:
            self.rtree.heading(c,text=h); self.rtree.column(c,width=w,anchor="w" if c!="on" else "center")
        self.rtree.tag_configure("on", foreground=C_GREEN)
        self.rtree.tag_configure("off",foreground=TEXT3)
        ys=ttk.Scrollbar(rf,orient="vertical",command=self.rtree.yview)
        self.rtree.configure(yscrollcommand=ys.set)
        self.rtree.grid(row=0,column=0,sticky="nsew"); ys.grid(row=0,column=1,sticky="ns")
        _bind_scroll(self.rtree, self.rtree.yview)
        rf.grid_rowconfigure(0,weight=1); rf.grid_columnconfigure(0,weight=1)
        self.rtree.bind("<Double-Button-1>",lambda e:self._toggle_rule())
        bb=tk.Frame(tab,bg=CARD,height=36); bb.pack(fill="x",side="bottom"); bb.pack_propagate(False)
        H(tab).pack(fill="x",side="bottom")
        B(bb,"Toggle",self._toggle_rule,"outline").pack(side="left",padx=10,pady=5)
        L(bb,"Double-click a rule to toggle",8,c=TEXT3,bg=CARD).pack(side="right",padx=10)

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Analytics
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_analytics(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Analytics  ")
        tb=tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"Analytics",11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        B(tb,"Refresh",self._refresh_analytics,"outline").pack(side="right",padx=10,pady=10)
        H(tab).pack(fill="x")
        canvas=tk.Canvas(tab,bg=BG,highlightthickness=0)
        sb=ttk.Scrollbar(tab,orient="vertical",command=canvas.yview)
        self._af=tk.Frame(canvas,bg=BG)
        self._af.bind("<Configure>",lambda e:canvas.configure(scrollregion=canvas.bbox("all")))
        canvas.create_window((0,0),window=self._af,anchor="nw")
        canvas.configure(yscrollcommand=sb.set)
        canvas.pack(side="left",fill="both",expand=True)
        sb.pack(side="right",fill="y")
        _bind_scroll(canvas, canvas.yview)
        _bind_scroll(self._af, canvas.yview)

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: File Intelligence
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_intelligence(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Intelligence  ")

        # ── Top toolbar ───────────────────────────────────────────────────────
        tb = tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"File Intelligence",11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        B(tb,"Browse File",     self._intel_browse,    "primary").pack(side="right",padx=6,pady=10)
        B(tb,"Clear",           self._intel_clear,     "ghost").pack(side="right",padx=2,pady=10)
        H(tab).pack(fill="x")

        # ── Path bar ──────────────────────────────────────────────────────────
        pf = tk.Frame(tab,bg=CARD,height=30); pf.pack(fill="x"); pf.pack_propagate(False)
        self._intel_path_var = tk.StringVar(value="No file selected — click Browse File or drag from Organize tab")
        tk.Label(pf,textvariable=self._intel_path_var,font=("Consolas",8),
                 fg=TEXT2,bg=CARD,anchor="w").pack(side="left",padx=12,pady=6,fill="x",expand=True)
        H(tab).pack(fill="x")

        # ── Main pane: left = sub-tabs, right = threat summary ────────────────
        body = tk.Frame(tab,bg=BG); body.pack(fill="both",expand=True)

        # Right panel — threat summary card (fixed width)
        rp = tk.Frame(body,bg=CARD,width=210)
        rp.pack(side="right",fill="y",padx=(0,10),pady=10); rp.pack_propagate(False)
        L(rp,"THREAT SUMMARY",7,"bold",TEXT3,CARD).pack(anchor="w",padx=12,pady=(10,4))
        self._threat_vars = {}
        for key,label in [("level","Threat Level"),("flags","Flags"),
                           ("entropy","Entropy"),("mismatch","Type Match"),
                           ("symlink","Symlink")]:
            r = tk.Frame(rp,bg=CARD); r.pack(fill="x",padx=10,pady=2)
            tk.Label(r,text=label+":",font=("Segoe UI",8,"bold"),fg=TEXT2,bg=CARD,
                     width=11,anchor="w").pack(side="left")
            v = tk.StringVar(value="—")
            lbl = tk.Label(r,textvariable=v,font=("Segoe UI",8),fg=TEXT3,bg=CARD,anchor="w")
            lbl.pack(side="left",fill="x",expand=True)
            self._threat_vars[key] = (v,lbl)

        H(rp).pack(fill="x",padx=8,pady=6)
        L(rp,"HASHES",7,"bold",TEXT3,CARD).pack(anchor="w",padx=12,pady=(0,4))
        self._hash_vars = {}
        for alg in ["MD5","SHA1","SHA256"]:
            tk.Label(rp,text=alg,font=("Segoe UI",7,"bold"),fg=TEXT2,bg=CARD).pack(anchor="w",padx=12)
            v = tk.StringVar(value="—")
            e = tk.Entry(rp,textvariable=v,font=("Consolas",7),fg=C_BLUE,bg=BG,
                         relief="flat",state="readonly",readonlybackground=BG)
            e.pack(fill="x",padx=10,pady=(0,4))
            self._hash_vars[alg] = v

        H(rp).pack(fill="x",padx=8,pady=6)
        L(rp,"VIRUSTOTAL",7,"bold",TEXT3,CARD).pack(anchor="w",padx=12,pady=(0,4))
        self._vt_result_var = tk.StringVar(value="Not checked")
        tk.Label(rp,textvariable=self._vt_result_var,font=("Segoe UI",8),
                 fg=TEXT2,bg=CARD,wraplength=190,justify="left").pack(padx=10,anchor="w")
        B(rp,"VT Lookup",self._vt_lookup_current,"outline").pack(padx=10,pady=6,fill="x")

        # Left panel — sub-notebook
        lp = tk.Frame(body,bg=BG)
        lp.pack(side="left",fill="both",expand=True,padx=10,pady=10)
        self._intel_nb = ttk.Notebook(lp)
        self._intel_nb.pack(fill="both",expand=True)

        # Sub-tab: Metadata table
        mt = tk.Frame(self._intel_nb,bg=CARD)
        self._intel_nb.add(mt,text="Metadata & Properties")
        mf = tk.Frame(mt,bg=CARD); mf.pack(fill="both",expand=True)
        self._meta_tree = ttk.Treeview(mf,columns=("key","val"),show="headings",selectmode="browse")
        self._meta_tree.heading("key",text="Property")
        self._meta_tree.heading("val",text="Value")
        self._meta_tree.column("key",width=220,minwidth=100)
        self._meta_tree.column("val",width=500,minwidth=100)
        mys = ttk.Scrollbar(mf,orient="vertical",  command=self._meta_tree.yview)
        mxs = ttk.Scrollbar(mf,orient="horizontal",command=self._meta_tree.xview)
        self._meta_tree.configure(yscrollcommand=mys.set,xscrollcommand=mxs.set)
        self._meta_tree.grid(row=0,column=0,sticky="nsew")
        mys.grid(row=0,column=1,sticky="ns")
        mxs.grid(row=1,column=0,sticky="ew")
        _bind_scroll(self._meta_tree, self._meta_tree.yview, self._meta_tree.xview)
        mf.grid_rowconfigure(0,weight=1); mf.grid_columnconfigure(0,weight=1)
        self._meta_tree.bind("<Double-Button-1>", self._meta_copy_row)
        tk.Label(mt,text="Double-click a row to copy value to clipboard",
                 font=("Segoe UI",7),fg=TEXT3,bg=CARD).pack(anchor="e",padx=8,pady=2)

        # Sub-tab: Entropy visualiser
        et = tk.Frame(self._intel_nb,bg=CARD)
        self._intel_nb.add(et,text="Entropy Graph")
        L(et,"Shannon Entropy by 4KB Block",9,"bold",TEXT,CARD).pack(anchor="w",padx=12,pady=(8,4))
        L(et,"Red line = 7.2 (packed/encrypted threshold). Higher = more random.",
          8,c=TEXT2,bg=CARD).pack(anchor="w",padx=12)
        self._ent_canvas = tk.Canvas(et,bg=CARD,highlightthickness=0,height=200)
        self._ent_canvas.pack(fill="x",padx=12,pady=8)
        self._ent_canvas.bind("<Configure>",lambda e:self._redraw_entropy())
        self._ent_data   = []

        # Sub-tab: EXIF / GPS
        ex = tk.Frame(self._intel_nb,bg=CARD)
        self._intel_nb.add(ex,text="EXIF / GPS")
        ef2 = tk.Frame(ex,bg=CARD); ef2.pack(fill="both",expand=True)
        self._exif_tree = ttk.Treeview(ef2,columns=("key","val"),show="headings",selectmode="browse")
        self._exif_tree.heading("key",text="EXIF Tag")
        self._exif_tree.heading("val",text="Value")
        self._exif_tree.column("key",width=220,minwidth=80)
        self._exif_tree.column("val",width=480,minwidth=80)
        eys2 = ttk.Scrollbar(ef2,orient="vertical",command=self._exif_tree.yview)
        self._exif_tree.configure(yscrollcommand=eys2.set)
        self._exif_tree.grid(row=0,column=0,sticky="nsew")
        eys2.grid(row=0,column=1,sticky="ns")
        _bind_scroll(self._exif_tree, self._exif_tree.yview)
        ef2.grid_rowconfigure(0,weight=1); ef2.grid_columnconfigure(0,weight=1)
        L(ex,"EXIF extraction available for JPEG/JPG files only.",
          7,c=TEXT3,bg=CARD).pack(anchor="w",padx=12,pady=4)

        # Sub-tab: Security flags
        sf2 = tk.Frame(self._intel_nb,bg=CARD)
        self._intel_nb.add(sf2,text="Security Flags")
        self._sec_text = tk.Text(sf2,font=("Consolas",9),bg=LOG_BG,fg="#CBD5E1",
                                 relief="flat",state="disabled",wrap="word",bd=0,
                                 highlightthickness=0,spacing1=3)
        self._sec_text.pack(fill="both",expand=True,padx=0,pady=0)
        _bind_scroll(self._sec_text, self._sec_text.yview)
        for tag,fc in [("CLEAN","#34D399"),("HIGH","#F87171"),
                       ("MEDIUM","#FCD34D"),("LABEL","#60A5FA"),
                       ("NOTE","#94A3B8"),("FLAG","#FB923C")]:
            self._sec_text.tag_config(tag,foreground=fc)

        # Sub-tab: File Structure Tree
        ft2 = tk.Frame(self._intel_nb,bg=CARD)
        self._intel_nb.add(ft2,text="Structure / Hex Preview")
        L(ft2,"First 512 bytes — Hex + ASCII dump",9,"bold",TEXT,CARD).pack(anchor="w",padx=12,pady=(8,2))
        self._hex_text = tk.Text(ft2,font=("Consolas",9),bg=LOG_BG,fg="#E2E8F0",
                                 relief="flat",state="disabled",wrap="none",bd=0,
                                 highlightthickness=0,spacing1=2)
        hxs = ttk.Scrollbar(ft2,orient="vertical",  command=self._hex_text.yview)
        hys = ttk.Scrollbar(ft2,orient="horizontal",command=self._hex_text.xview)
        self._hex_text.configure(yscrollcommand=hxs.set,xscrollcommand=hys.set)
        self._hex_text.pack(side="left",fill="both",expand=True)
        hxs.pack(side="right",fill="y")
        _bind_scroll(self._hex_text, self._hex_text.yview, self._hex_text.xview)
        self._hex_text.tag_config("addr",foreground="#475569")
        self._hex_text.tag_config("hex", foreground="#93C5FD")
        self._hex_text.tag_config("asc", foreground="#6EE7B7")
        self._hex_text.tag_config("null",foreground="#334155")

    # ── Intelligence actions ──────────────────────────────────────────────────
    def _intel_browse(self):
        path = filedialog.askopenfilename(title="Select file to analyse")
        if path: self._intel_analyse(path)

    def _intel_clear(self):
        self._intel_path = None
        self._intel_path_var.set("No file selected")
        for iid in self._meta_tree.get_children(): self._meta_tree.delete(iid)
        for iid in self._exif_tree.get_children(): self._exif_tree.delete(iid)
        self._ent_data = []; self._redraw_entropy()
        for v,l in self._threat_vars.values(): v.set("—"); l.config(fg=TEXT3)
        for v in self._hash_vars.values(): v.set("—")
        self._vt_result_var.set("Not checked")
        self._sec_text.config(state="normal"); self._sec_text.delete("1.0","end")
        self._sec_text.config(state="disabled")
        self._hex_text.config(state="normal"); self._hex_text.delete("1.0","end")
        self._hex_text.config(state="disabled")

    def _intel_analyse(self, path: str):
        self._intel_path = path
        self._intel_path_var.set(path)
        self._vt_result_var.set("Not checked")
        self._log(f"Analysing: {Path(path).name}", "info")
        def _work():
            result = analyse_file(path)
            # Entropy blocks
            ent_blocks = []
            try:
                block = 4096
                with open(path,"rb") as fh:
                    while True:
                        chunk = fh.read(block)
                        if not chunk: break
                        ent_blocks.append(shannon_entropy(chunk))
            except: pass
            # Hex dump
            hex_lines = []
            try:
                with open(path,"rb") as fh:
                    raw = fh.read(512)
                for offset in range(0,len(raw),16):
                    chunk = raw[offset:offset+16]
                    hex_part = " ".join(f"{b:02X}" for b in chunk).ljust(47)
                    asc_part = "".join(chr(b) if 32<=b<127 else "." for b in chunk)
                    hex_lines.append((f"{offset:08X}  ", hex_part, f"  |{asc_part}|"))
            except: pass
            # EXIF
            exif_data = {}
            if Path(path).suffix.lower() in (".jpg",".jpeg"):
                exif_data = extract_exif_jpeg(path)
            self.root.after(0, lambda: self._intel_populate(result, ent_blocks, hex_lines, exif_data))
        threading.Thread(target=_work, daemon=True).start()

    def _intel_populate(self, result: dict, ent_blocks: list, hex_lines: list, exif_data: dict):
        # Metadata table
        for iid in self._meta_tree.get_children(): self._meta_tree.delete(iid)
        SECTION_KEYS = {"--- HASHES ---","--- ENTROPY ---","--- METADATA ---","--- SECURITY ---"}
        for k,v in result.items():
            if k in SECTION_KEYS:
                self._meta_tree.insert("","end",values=("── "+k.strip("-").strip()+" ──",""),
                                       tags=("section",))
                self._meta_tree.tag_configure("section",foreground=C_BLUE,font=("Segoe UI",8,"bold"))
            else:
                tag = "warn" if ("MISMATCH" in k or k=="Suspicious Flags" and v!="None"
                                  or k=="Threat Level" and v!="CLEAN") else ""
                self._meta_tree.insert("","end",values=(k,v),tags=(tag,))
        self._meta_tree.tag_configure("warn",foreground=C_RED)

        # Hashes
        for alg in ["MD5","SHA1","SHA256"]:
            self._hash_vars[alg].set(result.get(alg,"—"))

        # Entropy graph
        self._ent_data = ent_blocks
        self._redraw_entropy()

        # EXIF
        for iid in self._exif_tree.get_children(): self._exif_tree.delete(iid)
        if exif_data:
            for k,v in exif_data.items():
                self._exif_tree.insert("","end",values=(k,v))
        else:
            self._exif_tree.insert("","end",values=("No EXIF data","File is not JPEG or has no EXIF block"))

        # Threat summary card
        level = result.get("Threat Level","CLEAN")
        flags = result.get("Suspicious Flags","None")
        ent_val= result.get("Shannon Entropy","—")
        mismatch = result.get("TYPE MISMATCH","None")
        symlink  = result.get("Is Symlink","False")
        COLS = {"HIGH":C_THREAT_HIGH,"MEDIUM":C_THREAT_MED,"CLEAN":C_THREAT_LOW}
        data_map = {"level":(level,COLS.get(level,TEXT3)),
                    "flags":(("OK" if flags=="None" else flags[:40]), C_GREEN if flags=="None" else C_ORG),
                    "entropy":(ent_val, C_RED if "HIGH" in str(ent_val) else TEXT2),
                    "mismatch":(("OK" if mismatch=="None" else "MISMATCH!"), C_GREEN if mismatch=="None" else C_RED),
                    "symlink":(symlink, C_ORG if symlink=="True" else TEXT3)}
        for key,(text,col) in data_map.items():
            v,lbl = self._threat_vars[key]
            v.set(text); lbl.config(fg=col)

        # Security report
        self._sec_text.config(state="normal"); self._sec_text.delete("1.0","end")
        self._sec_text.insert("end",f"\n  FILE SECURITY REPORT\n  {'='*50}\n\n","LABEL")
        self._sec_text.insert("end",f"  File       : {self._intel_path_var.get()}\n","NOTE")
        self._sec_text.insert("end",f"  Analysed   : {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n\n","NOTE")
        self._sec_text.insert("end",f"  Threat Level : {level}\n\n",level)
        self._sec_text.insert("end","  SUSPICIOUS FLAGS\n  "+"-"*40+"\n","LABEL")
        if flags and flags != "None":
            for flag in flags.split(";"):
                self._sec_text.insert("end",f"  [FLAG] {flag.strip()}\n","FLAG")
        else:
            self._sec_text.insert("end","  No suspicious flags detected.\n","CLEAN")
        self._sec_text.insert("end","\n  ENTROPY ANALYSIS\n  "+"-"*40+"\n","LABEL")
        ent_assessment = result.get("Entropy Assessment","—")
        self._sec_text.insert("end",f"  {ent_val}  —  {ent_assessment}\n\n",
                               "HIGH" if "HIGH" in ent_assessment else "NOTE")
        self._sec_text.insert("end","  TYPE DETECTION\n  "+"-"*40+"\n","LABEL")
        self._sec_text.insert("end",f"  Extension   : {result.get('Extension','?')}\n","NOTE")
        self._sec_text.insert("end",f"  Magic Type  : {result.get('Detected Type','?')}\n","NOTE")
        self._sec_text.insert("end",f"  MIME        : {result.get('MIME (magic)','?')}\n","NOTE")
        if "TYPE MISMATCH" in result:
            self._sec_text.insert("end",f"\n  [!] {result['TYPE MISMATCH']}\n","HIGH")
        self._sec_text.insert("end","\n  HASHES\n  "+"-"*40+"\n","LABEL")
        for alg in ["MD5","SHA1","SHA256"]:
            self._sec_text.insert("end",f"  {alg:<8}: {result.get(alg,'—')}\n","NOTE")
        self._sec_text.config(state="disabled")

        # Hex dump
        self._hex_text.config(state="normal"); self._hex_text.delete("1.0","end")
        self._hex_text.insert("end","  Offset    Hex Dump                                       ASCII\n","addr")
        self._hex_text.insert("end","  "+"-"*74+"\n","addr")
        for addr, hex_part, asc_part in hex_lines:
            self._hex_text.insert("end","  "+addr,"addr")
            # Colour null bytes differently
            parts = hex_part.split(" ")
            for byte_str in parts:
                if byte_str == "00":
                    self._hex_text.insert("end",byte_str+" ","null")
                else:
                    self._hex_text.insert("end",byte_str+" ","hex")
            self._hex_text.insert("end",asc_part+"\n","asc")
        self._hex_text.config(state="disabled")
        self._log(f"Analysis complete: {Path(self._intel_path).name} — Threat: {level}", 
                  "success" if level=="CLEAN" else "warning")

    def _redraw_entropy(self):
        c = self._ent_canvas
        c.delete("all")
        w = c.winfo_width(); h = c.winfo_height()
        if not w or not self._ent_data: return
        n = len(self._ent_data)
        if n == 0: return
        pad_l,pad_r,pad_t,pad_b = 40,10,10,24
        graph_w = w - pad_l - pad_r
        graph_h = h - pad_t - pad_b
        # Axes
        c.create_line(pad_l,pad_t,pad_l,pad_t+graph_h,fill=BORDER)
        c.create_line(pad_l,pad_t+graph_h,pad_l+graph_w,pad_t+graph_h,fill=BORDER)
        # Y labels
        for val in [0,2,4,6,8]:
            y = pad_t + graph_h - int(val/8.0 * graph_h)
            c.create_text(pad_l-4,y,text=str(val),font=("Segoe UI",7),fill=TEXT3,anchor="e")
            c.create_line(pad_l,y,pad_l+graph_w,y,fill=BORDER,dash=(2,4))
        # Threshold line at 7.2
        y_thr = pad_t + graph_h - int(7.2/8.0*graph_h)
        c.create_line(pad_l,y_thr,pad_l+graph_w,y_thr,fill=C_RED,dash=(4,3),width=1)
        c.create_text(pad_l+graph_w-2,y_thr-6,text="7.2",font=("Segoe UI",7),fill=C_RED,anchor="e")
        # Bars
        bar_w = max(1, graph_w / n)
        for i,ent in enumerate(self._ent_data):
            x0 = pad_l + i*bar_w
            bar_h2 = int(ent/8.0*graph_h)
            y0 = pad_t+graph_h-bar_h2; y1 = pad_t+graph_h
            col = C_RED if ent>7.2 else (C_ORG if ent>5.5 else C_BLUE)
            c.create_rectangle(x0,y0,x0+bar_w-1,y1,fill=col,outline="")
        # X label
        c.create_text(pad_l+graph_w//2,h-4,
                      text=f"{n} blocks x 4KB = ~{n*4} KB analysed",
                      font=("Segoe UI",7),fill=TEXT3)

    def _meta_copy_row(self, event):
        sel = self._meta_tree.selection()
        if not sel: return
        val = self._meta_tree.item(sel[0],"values")
        if val and len(val)>1:
            self.root.clipboard_clear(); self.root.clipboard_append(str(val[1]))
            self._log(f"Copied: {val[1][:60]}","info")

    def _vt_lookup_current(self):
        if not self._intel_path:
            messagebox.showwarning("No file","Analyse a file first."); return
        api_key = self.v_vt_key.get().strip()
        if not api_key:
            messagebox.showwarning("No API Key",
                "Enter your VirusTotal API key in Settings -> VirusTotal API Key.\n"
                "Get a free key at: https://www.virustotal.com"); return
        sha256 = self._hash_vars["SHA256"].get()
        if sha256 in ("—",""):
            messagebox.showwarning("No hash","File has not been analysed yet."); return
        self._vt_result_var.set("Looking up...")
        self._log(f"VT lookup: {sha256[:16]}...","info")
        def _work():
            result = vt_lookup(sha256, api_key)
            def _update():
                if result["status"] == "found":
                    m = result["malicious"]; t = result["total"]
                    text = f"{m}/{t} detections"
                    col  = C_RED if m>0 else C_GREEN
                    self._vt_result_var.set(text)
                    lvl = "HIGH" if m>3 else ("MEDIUM" if m>0 else "CLEAN")
                    self._log(f"VT: {text} — {result.get('name','')}",
                              "error" if m>0 else "success")
                    # Populate security tab with VT results
                    self._sec_text.config(state="normal")
                    self._sec_text.insert("end",f"\n  VIRUSTOTAL\n  {'-'*40}\n","LABEL")
                    self._sec_text.insert("end",f"  SHA256     : {sha256}\n","NOTE")
                    self._sec_text.insert("end",f"  Detections : {m}/{t}\n",
                                          "HIGH" if m>0 else "CLEAN")
                    if result["detections"]:
                        self._sec_text.insert("end","  Engines flagging as malicious:\n","FLAG")
                        for eng,det in list(result["detections"].items())[:10]:
                            self._sec_text.insert("end",f"    - {eng}: {det.get('result','?')}\n","FLAG")
                    self._sec_text.config(state="disabled")
                elif result["status"] == "not_found":
                    self._vt_result_var.set("Not in VT database")
                    self._log("VT: Hash not found in VirusTotal.","warning")
                else:
                    self._vt_result_var.set(f"Error: {result.get('detail','?')[:30]}")
                    self._log(f"VT error: {result.get('detail','')}","error")
            self.root.after(0,_update)
        threading.Thread(target=_work,daemon=True).start()

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Live Logs
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_logs(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Live Logs  ")

        # toolbar
        tb=tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"Live Logs",11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        B(tb,"Clear All",   self._clear_all_logs,  "danger").pack(side="right",padx=8, pady=10)
        B(tb,"Export",      self._export_logs,      "outline").pack(side="right",padx=2, pady=10)
        B(tb,"Pause/Resume",self._toggle_pause,     "ghost").pack(side="right",padx=2, pady=10)
        B(tb,"Jump to End",  self._log_end,          "ghost").pack(side="right",padx=2, pady=10)
        H(tab).pack(fill="x")

        # search + level bar
        sf=tk.Frame(tab,bg=CARD,height=38); sf.pack(fill="x"); sf.pack_propagate(False)
        L(sf,"Search:",9,c=TEXT2,bg=CARD).pack(side="left",padx=(12,4),pady=10)
        self.v_lsearch.trace_add("write",lambda *a:self._filter_log())
        tk.Entry(sf,textvariable=self.v_lsearch,font=("Segoe UI",9),
                 bg=BG,fg=TEXT,relief="solid",bd=1,width=24).pack(side="left",pady=10,padx=(0,8))
        V(sf).pack(side="left",fill="y",padx=4,pady=8)
        L(sf,"Level:",9,c=TEXT2,bg=CARD).pack(side="left",padx=(4,4))
        self._lvl_btns={}
        for lvl,col in [("ALL",TEXT2),("INFO",C_BLUE),("SUCCESS",C_GREEN),("WARNING",C_ORG),("ERROR",C_RED)]:
            b=tk.Button(sf,text=lvl,font=("Segoe UI",7,"bold"),
                        bg=BG,fg=col,relief="flat",bd=0,padx=7,pady=2,cursor="hand2",
                        command=lambda l=lvl:self._set_level(l))
            b.pack(side="left",padx=2,pady=10); self._lvl_btns[lvl]=b
        tk.Label(sf,textvariable=self.v_lstats,font=("Segoe UI",8),
                 fg=TEXT3,bg=CARD).pack(side="right",padx=12)
        H(tab).pack(fill="x")

        # log terminal
        lf=tk.Frame(tab,bg=LOG_BG); lf.pack(fill="both",expand=True)
        self._livelog=tk.Text(lf,bg=LOG_BG,fg="#CBD5E1",
                              font=("Consolas",9),relief="flat",
                              state="disabled",wrap="none",
                              bd=0,highlightthickness=0,
                              cursor="arrow",spacing1=2)
        lys=ttk.Scrollbar(lf,orient="vertical",  command=self._livelog.yview)
        lxs=ttk.Scrollbar(lf,orient="horizontal",command=self._livelog.xview)
        self._livelog.configure(yscrollcommand=lys.set,xscrollcommand=lxs.set)
        self._livelog.grid(row=0,column=0,sticky="nsew")
        lys.grid(row=0,column=1,sticky="ns")
        lxs.grid(row=1,column=0,sticky="ew")
        _bind_scroll(self._livelog, self._livelog.yview, self._livelog.xview)
        lf.grid_rowconfigure(0,weight=1); lf.grid_columnconfigure(0,weight=1)
        for tag,fc,fw in [("ts","#475569","normal"),
                          ("info","#93C5FD","normal"),   ("label_info","#60A5FA","bold"),
                          ("success","#6EE7B7","normal"),("label_success","#34D399","bold"),
                          ("warning","#FCD34D","normal"),("label_warning","#FBBF24","bold"),
                          ("error","#FCA5A5","normal"),  ("label_error","#F87171","bold"),
                          ("hl","#1E3A5F","normal")]:
            self._livelog.tag_config(tag,foreground=fc,font=("Consolas",9,fw))
        self._livelog.tag_config("hl",background="#1E3A5F",foreground="#E2E8F0")
        self._livelog.bind("<MouseWheel>",    lambda e:setattr(self,"_log_autoscroll",False))
        self._livelog.bind("<Double-Button-1>",self._copy_log_line)

        # bottom strip
        bb=tk.Frame(tab,bg=CARD,height=28); bb.pack(fill="x",side="bottom"); bb.pack_propagate(False)
        H(tab).pack(fill="x",side="bottom")
        self._log_cnt=tk.Label(bb,text="",font=("Segoe UI",8),fg=TEXT2,bg=CARD)
        self._log_cnt.pack(side="left",padx=12)
        L(bb,"Double-click any line to copy",8,c=TEXT3,bg=CARD).pack(side="right",padx=12)

        self._set_level("ALL")

    # ══════════════════════════════════════════════════════════════════════════
    # TAB: Settings
    # ══════════════════════════════════════════════════════════════════════════
    def _build_tab_settings(self):
        tab = tk.Frame(self.nb,bg=BG)
        self.nb.add(tab,text="  Settings  ")
        tb=tk.Frame(tab,bg=CARD,height=46); tb.pack(fill="x"); tb.pack_propagate(False)
        L(tb,"Settings",11,"bold",TEXT,CARD).pack(side="left",padx=14,pady=12)
        H(tab).pack(fill="x")
        canvas=tk.Canvas(tab,bg=BG,highlightthickness=0)
        sb=ttk.Scrollbar(tab,orient="vertical",command=canvas.yview)
        sf=tk.Frame(canvas,bg=BG)
        sf.bind("<Configure>",lambda e:canvas.configure(scrollregion=canvas.bbox("all")))
        canvas.create_window((0,0),window=sf,anchor="nw")
        canvas.configure(yscrollcommand=sb.set)
        canvas.pack(side="left",fill="both",expand=True)
        sb.pack(side="right",fill="y")
        _bind_scroll(canvas, canvas.yview)
        _bind_scroll(sf, canvas.yview)

        c=tk.Frame(sf,bg=BG); c.pack(fill="x",padx=24,pady=16)
        L(c,"Folder Configuration",10,"bold").pack(anchor="w",pady=(0,8))
        for label,var in [("Watch Folder:",self.v_watch),("Output Folder:",self.v_output)]:
            r=tk.Frame(c,bg=BG); r.pack(fill="x",pady=3)
            tk.Label(r,text=label,font=("Segoe UI",9),fg=TEXT,bg=BG,width=14,anchor="w").pack(side="left")
            tk.Entry(r,textvariable=var,font=("Segoe UI",9),bg=CARD,
                     fg=TEXT,relief="solid",bd=1,width=44).pack(side="left",padx=(0,6))
            B(r,"Browse",lambda v=var:self._pick_folder(v),"outline").pack(side="left")

        r=tk.Frame(c,bg=BG); r.pack(fill="x",pady=6)
        tk.Checkbutton(r,text="Flat output — put ALL files into one single folder (no subfolders)",
                       variable=self.v_flat,font=("Segoe UI",9),
                       fg=TEXT,bg=BG,activebackground=BG,
                       selectcolor=CARD,cursor="hand2").pack(side="left")

        H(c).pack(fill="x",pady=12)
        L(c,"Safety Settings",10,"bold").pack(anchor="w",pady=(0,8))
        self._sv={}
        for key,label,val in [
            ("trash",   "Send to Recycle Bin — never permanently delete files",True),
            ("conf100", "Ask confirmation when moving 100+ files",             True),
            ("conf1gb", "Ask confirmation when moving 1 GB+ of data",         True),
            ("warn24h", "Extra warning for files newer than 24 hours",        True),
            ("ml",      "ML active learning from corrections",                 True),
            ("cloud",   "Cloud sync awareness (Dropbox / OneDrive)",          False),
            ("rt",      "Real-time folder monitoring (auto-scan on new file)",False),
        ]:
            v=tk.BooleanVar(value=val); self._sv[key]=v
            r=tk.Frame(c,bg=BG); r.pack(fill="x",pady=2)
            tk.Checkbutton(r,text=label,variable=v,font=("Segoe UI",9),
                           fg=TEXT,bg=BG,activebackground=BG,
                           selectcolor=CARD,cursor="hand2").pack(side="left")

        H(c).pack(fill="x",pady=12)
        L(c,"Organize Real Files on Disk",10,"bold").pack(anchor="w",pady=(0,6))
        L(c,"Set both folders above, then click the button to move ALL files in Watch Folder into\n"
            "organized subfolders under Output Folder. Files are matched against the Extension Map.",
          9,c=TEXT2).pack(anchor="w",pady=(0,8))
        B(c,"Organize Files Now",self._organize_real,"success").pack(anchor="w")
        H(c).pack(fill="x",pady=12)
        L(c,"Portable Storage",10,"bold").pack(anchor="w",pady=(0,6))
        L(c,"All settings, rules, and queue are saved automatically next to fileorb_v1.0.py\n"
            "when you close the window or click Save Settings. No installation required.",
          9,c=TEXT2).pack(anchor="w",pady=(0,6))
        for label,path in [("Settings file:", _SETTINGS_FILE),
                            ("Rules file:",    _RULES_FILE),
                            ("Queue file:",    _QUEUE_FILE)]:
            pr=tk.Frame(c,bg=BG); pr.pack(fill="x",pady=1)
            tk.Label(pr,text=label,font=("Segoe UI",8,"bold"),fg=TEXT2,bg=BG,width=14,anchor="w").pack(side="left")
            pv=tk.StringVar(value=str(path))
            pe=tk.Entry(pr,textvariable=pv,font=("Consolas",8),fg=C_BLUE,bg=CARD,
                        relief="solid",bd=1,state="readonly",readonlybackground=CARD,width=54)
            pe.pack(side="left",padx=(0,4))
            def _open_dir(d=_SCRIPT_DIR):
                try:
                    if sys.platform=="win32":   subprocess.Popen(f'explorer "{d}"')
                    elif sys.platform=="darwin": subprocess.Popen(["open",str(d)])
                    else:                        subprocess.Popen(["xdg-open",str(d)])
                except: pass
            B(pr,"Open Folder",_open_dir,"ghost").pack(side="left")
        H(c).pack(fill="x",pady=12)
        L(c,"VirusTotal Integration",10,"bold").pack(anchor="w",pady=(0,6))
        L(c,"Enter your free VirusTotal API key to enable hash lookups from the Intelligence tab.",
          9,c=TEXT2).pack(anchor="w",pady=(0,6))
        vt_r = tk.Frame(c,bg=BG); vt_r.pack(fill="x",pady=3)
        tk.Label(vt_r,text="VT API Key:",font=("Segoe UI",9),fg=TEXT,bg=BG,width=14,anchor="w").pack(side="left")
        tk.Entry(vt_r,textvariable=self.v_vt_key,font=("Consolas",9),bg=CARD,
                 fg=TEXT,relief="solid",bd=1,width=44,show="*").pack(side="left",padx=(0,6))
        tk.Button(vt_r,text="Show",font=("Segoe UI",8),bg=BG,fg=TEXT2,relief="flat",bd=0,
                  padx=6,cursor="hand2",
                  command=lambda e=vt_r: self._toggle_vt_key_vis(e)).pack(side="left")
        H(c).pack(fill="x",pady=12)
        B(c,"Save Settings",self._save_settings,"primary").pack(anchor="w")

    # ── Status bar ────────────────────────────────────────────────────────────
    def _build_statusbar(self):
        H(self.root).pack(fill="x")
        sb=tk.Frame(self.root,bg=CARD,height=26); sb.pack(fill="x"); sb.pack_propagate(False)
        self._btm=tk.Label(sb,text="",font=("Segoe UI",8),fg=TEXT2,bg=CARD)
        self._btm.pack(side="left",padx=12)
        L(sb,f"FileOrb v1.0  |  {len(EXT)} extensions  |  {len(set(v[0] for v in EXT.values()))} categories  |  Intelligence Suite  |  Pure Python stdlib",
          8,c=TEXT3,bg=CARD).pack(side="right",padx=12)

    # ══════════════════════════════════════════════════════════════════════════
    # Table logic
    # ══════════════════════════════════════════════════════════════════════════
    def _cbar(self,p):
        return "█"*(p//10)+"░"*(10-p//10)+f"  {p}%"

    def _refresh_table(self):
        ft=self.v_filter.get()
        for iid in self.tree.get_children(): self.tree.delete(iid)
        for f in self.files:
            if ft!="All" and f["type"]!=ft: continue
            if f["type"]=="Duplicate": tag="dup"
            elif f["conf"]<70: tag="lowconf"
            else: tag=f["status"].lower()
            _,_,_,icon=classify(f["name"])
            self.tree.insert("","end",values=(
                icon,f["name"],f["type"],f["size"],f["age"],
                f["dest"],self._cbar(f["conf"]),f["status"],f.get("note","")
            ),tags=(tag,))
        self._update_stats(); self._update_btm()

    def _sort_col_fn(self,col):
        if self._sort_col==col: self._sort_asc=not self._sort_asc
        else: self._sort_col=col; self._sort_asc=True
        data=[(self.tree.set(k,col),k) for k in self.tree.get_children()]
        data.sort(reverse=not self._sort_asc)
        for i,(_,k) in enumerate(data): self.tree.move(k,"",i)

    def _set_filter(self,ft):
        self.v_filter.set(ft)
        for n,b in self._fbtn.items():
            b.config(bg=C_BLUE if n==ft else BG, fg="white" if n==ft else TEXT2)
        self._refresh_table()

    def _update_stats(self):
        c={k:0 for k in self._stat}
        for f in self.files:
            if f["status"] in c: c[f["status"]]+=1
        for k,w in self._stat.items(): w.config(text=str(c[k]))

    def _update_btm(self):
        t=len(self.files); p=sum(1 for f in self.files if f["status"]=="Pending")
        m=sum(1 for f in self.files if f["status"]=="Moved")
        self._btm.config(text=f"Files: {t}  |  Pending: {p}  |  Organized: {m}")

    def _on_sel(self,e):
        n=len(self.tree.selection())
        self._sel_lbl.config(text=f"{n} file(s) selected" if n else "No selection")

    def _show_ctx(self,e):
        row=self.tree.identify_row(e.y)
        if row: self.tree.selection_set(row); self._ctx.post(e.x_root,e.y_root)

    def _sel_idx(self):
        sel = self.tree.selection()
        if not sel:
            return []
        ft = self.v_filter.get()
        visible = [f for f in self.files if ft == "All" or f["type"] == ft]
        children = list(self.tree.get_children())
        # Build O(1) lookup: iid -> position in visible list
        iid_to_vi = {iid: i for i, iid in enumerate(children)}
        # Build O(1) lookup: visible index -> files index
        vis_to_fi = {vi: self.files.index(visible[vi]) for vi in range(len(visible))}
        out = []
        for iid in sel:
            vi = iid_to_vi.get(iid)
            if vi is not None and vi < len(visible):
                fi = vis_to_fi.get(vi)
                if fi is not None:
                    out.append(fi)
        return out

    def _select_all(self):
        """Select every visible row (Ctrl+A or button)."""
        children = self.tree.get_children()
        if children:
            self.tree.selection_set(children)
            self._sel_lbl.config(text=f"{len(children)} file(s) selected")

    # ── DnD ──────────────────────────────────────────────────────────────────
    def _dnd_start(self,e): self._drag["iid"]=self.tree.identify_row(e.y)
    def _dnd_motion(self,e):
        src=self._drag.get("iid");
        if not src: return
        tgt=self.tree.identify_row(e.y)
        for iid in self.tree.get_children():
            tags=[t for t in self.tree.item(iid,"tags") if t!="dragover"]
            self.tree.item(iid,tags=tags)
        if tgt and tgt!=src:
            self.tree.item(tgt,tags=list(self.tree.item(tgt,"tags"))+["dragover"])
        self.root.config(cursor="fleur")
    def _dnd_drop(self,e):
        self.root.config(cursor="")
        src=self._drag.get("iid");
        if not src: return
        tgt=self.tree.identify_row(e.y)
        for iid in self.tree.get_children():
            tags=[t for t in self.tree.item(iid,"tags") if t!="dragover"]
            self.tree.item(iid,tags=tags)
        if tgt and tgt!=src:
            ch=list(self.tree.get_children()); si,ti=ch.index(src),ch.index(tgt)
            ft=self.v_filter.get()
            vis=[f for f in self.files if ft=="All" or f["type"]==ft]
            if si<len(vis) and ti<len(vis):
                fi,gi=self.files.index(vis[si]),self.files.index(vis[ti])
                self.files[fi],self.files[gi]=self.files[gi],self.files[fi]
                self._refresh_table(); self._log("Rows reordered via drag & drop.","info")
        self._drag["iid"]=None

    # ── Actions ───────────────────────────────────────────────────────────────
    def _approve(self):
        idxs=self._sel_idx()
        if not idxs: self._log("Nothing selected.","warning"); return
        self._push_undo()
        n=0
        for i in idxs:
            if self.files[i]["status"]=="Pending":
                self.files[i]["status"]="Approved"; n+=1
                self._log(f"Approved: {self.files[i]['name']}  →  {self.files[i]['dest']}","success")
        self._refresh_table()
        if n: self._log(f"Approved {n} file(s).","success")

    def _skip(self):
        idxs=self._sel_idx()
        if not idxs: self._log("Nothing selected.","warning"); return
        self._push_undo()
        n=0
        for i in idxs:
            if self.files[i]["status"] in ("Pending","Approved"):
                self.files[i]["status"]="Skipped"; n+=1
                self._log(f"Skipped: {self.files[i]['name']}","warning")
        self._refresh_table()
        if n: self._log(f"Skipped {n} file(s).","info")

    def _remove(self):
        idxs=sorted(self._sel_idx(),reverse=True)
        if not idxs: return
        if not messagebox.askyesno("Remove",f"Remove {len(idxs)} file(s) from list?\n(Not deleted from disk.)"): return
        self._push_undo()
        for i in idxs: self._log(f"Removed: {self.files[i]['name']}","info"); self.files.pop(i)
        self._refresh_table()

    def _view_detail(self):
        sel=self.tree.selection()
        if not sel: return
        vals=self.tree.item(sel[0],"values")
        w=tk.Toplevel(self.root); w.title("File Details"); w.geometry("440x300")
        w.configure(bg=CARD); w.resizable(False,False); w.grab_set()
        L(w,f"{vals[0]}  {vals[1]}",11,"bold",TEXT,CARD).pack(pady=(16,4),padx=20,anchor="w")
        H(w).pack(fill="x",padx=20)
        for h,v in zip(["Category","Size","Age","Destination","Confidence","Status","Note"],vals[2:]):
            r=tk.Frame(w,bg=CARD); r.pack(fill="x",padx=20,pady=2)
            tk.Label(r,text=f"{h}:",width=13,anchor="w",font=("Segoe UI",9,"bold"),fg=TEXT2,bg=CARD).pack(side="left")
            tk.Label(r,text=str(v),anchor="w",font=("Segoe UI",9),fg=TEXT,bg=CARD).pack(side="left")
        B(w,"Close",w.destroy,"ghost").pack(pady=14)

    def _change_dest(self):
        idxs=self._sel_idx()
        if not idxs: self._log("Nothing selected.","warning"); return
        w=tk.Toplevel(self.root); w.title("Change Destination"); w.geometry("380,160".replace(",","x"))
        w.configure(bg=CARD); w.resizable(False,False); w.grab_set()
        L(w,f"New destination for {len(idxs)} file(s):",10,bg=CARD).pack(pady=(16,6),padx=20,anchor="w")
        var=tk.StringVar(value=self.files[idxs[0]]["dest"])
        tk.Entry(w,textvariable=var,font=("Segoe UI",9),bg=BG,fg=TEXT,
                 relief="solid",bd=1,width=40).pack(padx=20)
        def apply():
            nd=var.get().strip()
            if not nd: return
            for i in idxs: self.files[i]["dest"]=nd
            self._refresh_table(); self._log(f"Destination → {nd} for {len(idxs)} file(s).","success"); w.destroy()
        r=tk.Frame(w,bg=CARD); r.pack(pady=10)
        B(r,"Apply",apply,"primary").pack(side="left",padx=4)
        B(r,"Cancel",w.destroy,"ghost").pack(side="left",padx=4)

    def _browse_add(self):
        paths=filedialog.askopenfilenames(title="Select files to add")
        if not paths: return
        for path in paths:
            p=Path(path); cat,dest,col,icon=classify(p.name)
            try:
                sz=p.stat().st_size
                ss=f"{sz/1048576:.1f} MB" if sz>1048576 else f"{sz/1024:.0f} KB"
            except: ss="?"
            self.files.append({"name":p.name,"size":ss,"age":"just now",
                                "type":cat,"dest":dest,"conf":90,
                                "status":"Pending","note":"","_path":str(p)})
            self._log(f"Added: {p.name}  [{cat}]  →  {dest}","success")
        self._refresh_table()
        self._log(f"{len(paths)} file(s) added.","info")

    # ── Scan ──────────────────────────────────────────────────────────────────
    def _run_scan(self):
        watch=self.v_watch.get().strip()
        self.v_status.set("Scanning..."); self._dot.config(fg=C_ORG)
        self.v_scan.set(0)
        self._log("--- Scan started ---","info")
        found=[]
        if watch and os.path.isdir(watch):
            self._log(f"Watch folder: {watch}","info")
            for entry in Path(watch).iterdir():
                if entry.is_file():
                    cat,dest,col,icon=classify(entry.name)
                    try:
                        sz=entry.stat().st_size
                        ss=f"{sz/1048576:.1f} MB" if sz>1048576 else f"{sz/1024:.0f} KB"
                    except: ss="?"
                    found.append({"name":entry.name,"size":ss,"age":"now",
                                  "type":cat,"dest":dest,"conf":95 if cat!="Unknown" else 45,
                                  "status":"Pending","note":"","_path":str(entry)})
        else:
            self._log("No watch folder set — using sample data.","warning")
        def _work():
            stages=[(15,"Reading metadata…"),(35,"Classifying extensions…"),
                    (55,"Detecting duplicates…"),(75,"Applying rules…"),
                    (90,"Building preview…"),(100,"Done.")]
            for pct,msg in stages:
                while self.v_scan.get()<pct:
                    self.v_scan.set(min(self.v_scan.get()+3,pct)); time.sleep(0.018)
                self.root.after(0,lambda m=msg:self._log(m,"info"))
            if found:
                self.files=found
                self.root.after(0,lambda:self._log(f"Found {len(found)} files.","success"))
            else:
                for f in self.files:
                    if f["status"]!="Skipped": f["status"]="Pending"
            self.root.after(0,self._refresh_table)
            self.root.after(0,lambda:self.v_status.set("Ready"))
            self.root.after(0,lambda:self._dot.config(fg=C_GREEN))
            self.root.after(0,lambda:self.v_scan.set(0))
            self.root.after(0,lambda:self._log("--- Scan complete ---","success"))
        threading.Thread(target=_work,daemon=True).start()

    # ── Apply All ─────────────────────────────────────────────────────────────
    def _apply_all(self):
        pending=[f for f in self.files if f["status"] in ("Pending","Approved")]
        if not pending: messagebox.showinfo("Nothing to do","No pending files."); return
        out=self.v_output.get().strip()
        flat=self.v_flat.get()
        flat_note = "\nMode: All files in ONE flat folder (no subfolders)." if flat else ""
        msg=(f"Organize {len(pending)} file(s)?\n\n"
             +(f"Files will be MOVED on disk to:\n{out}{flat_note}" if out and os.path.isdir(out)
               else "No output folder set — files will be marked as Moved (preview only)."))
        if not messagebox.askyesno("Apply All",msg): return
        self.v_status.set("Applying..."); self._dot.config(fg=C_ORG); self.v_scan.set(0)
        self._log(f"--- Applying {len(pending)} file(s) --- {'[FLAT MODE]' if flat else ''}","info")
        def _work():
            errs=0
            for i,f in enumerate(pending):
                self.v_scan.set(int((i+1)/len(pending)*100))
                real=f.get("_path","")
                if out and os.path.isdir(out) and real and os.path.isfile(real):
                    # Flat mode: all files go directly into output folder
                    tdir = Path(out) if flat else Path(out)/f["dest"]
                    try:
                        tdir.mkdir(parents=True,exist_ok=True)
                        tgt=tdir/Path(real).name
                        if tgt.exists(): tgt=tdir/f"{Path(real).stem}_copy{Path(real).suffix}"
                        shutil.move(real,tgt); f["status"]="Moved"; f["_path"]=str(tgt)
                        dest_label = "[flat]" if flat else f["dest"]
                        self.root.after(0,lambda n=f['name'],d=dest_label:self._log(f"Moved: {n}  ->  {d}","success"))
                    except Exception as ex:
                        errs+=1; f["status"]="Pending"
                        self.root.after(0,lambda n=f['name'],e=str(ex):self._log(f"Error: {n} -- {e}","error"))
                else:
                    f["status"]="Moved"
                    dest_label = "[flat]" if flat else f["dest"]
                    self.root.after(0,lambda n=f['name'],d=dest_label:self._log(f"Organized (preview): {n}  ->  {d}","success"))
                time.sleep(0.015)
            self.root.after(0,self._refresh_table)
            self.root.after(0,lambda:self.v_status.set("Ready"))
            self.root.after(0,lambda:self._dot.config(fg=C_GREEN))
            self.root.after(0,lambda:self.v_scan.set(0))
            moved=len([f for f in self.files if f["status"]=="Moved"])
            self.root.after(0,lambda:self._log(f"--- Done: {moved} organized, {errs} error(s) ---",
                                               "success" if not errs else "warning"))
        threading.Thread(target=_work,daemon=True).start()

    def _undo_all(self):
        moved=[f for f in self.files if f["status"]=="Moved"]
        if not moved: messagebox.showinfo("Nothing to undo","No files moved yet."); return
        if not messagebox.askyesno("Undo All",f"Restore {len(moved)} file(s) to Pending?"): return
        self._push_undo()
        for f in moved: f["status"]="Pending"; self._log(f"Restored: {f['name']}","warning")
        self._refresh_table(); self._log(f"Undo complete — {len(moved)} file(s) restored.","warning")

    # ── Real Organize ─────────────────────────────────────────────────────────
    def _organize_real(self):
        watch=self.v_watch.get().strip(); out=self.v_output.get().strip()
        if not watch or not os.path.isdir(watch):
            messagebox.showerror("No Watch Folder","Set a valid Watch Folder first."); return
        if not out or not os.path.isdir(out):
            messagebox.showerror("No Output Folder","Set a valid Output Folder first."); return
        files=list(Path(watch).iterdir()); files=[f for f in files if f.is_file()]
        if not files: messagebox.showinfo("Empty","No files found in watch folder."); return
        flat=self.v_flat.get()
        flat_note="\nMode: All files in ONE flat folder." if flat else ""
        if not messagebox.askyesno("Organize Files",
            f"Found {len(files)} file(s) in:\n{watch}\n\n"
            f"Move into {'output folder directly' if flat else 'organized subfolders'} under:\n{out}{flat_note}\n\nContinue?"): return
        self.v_status.set("Organizing..."); self._dot.config(fg=C_ORG)
        self._log(f"--- Organizing {len(files)} real files --- {'[FLAT MODE]' if flat else ''}","info")
        def _work():
            ok=err=0
            for f in files:
                cat,dest,col,icon=classify(f.name)
                tdir = Path(out) if flat else Path(out)/dest
                try:
                    tdir.mkdir(parents=True,exist_ok=True)
                    tgt=tdir/f.name
                    if tgt.exists(): tgt=tdir/f"{f.stem}_copy{f.suffix}"
                    shutil.move(str(f),tgt); ok+=1
                    dest_label="[flat]" if flat else dest
                    self.root.after(0,lambda n=f.name,d=dest_label:self._log(f"Moved: {n}  ->  {d}","success"))
                except Exception as ex:
                    err+=1
                    self.root.after(0,lambda n=f.name,e=str(ex):self._log(f"Error: {n} -- {e}","error"))
                time.sleep(0.010)
            self.root.after(0,lambda:self.v_status.set("Ready"))
            self.root.after(0,lambda:self._dot.config(fg=C_GREEN))
            self.root.after(0,lambda:self._log(f"--- Done: {ok} moved, {err} error(s) ---",
                                               "success" if not err else "warning"))
            self.root.after(0,lambda:messagebox.showinfo("Done",f"Organized {ok} file(s).\n{err} error(s)."))
        threading.Thread(target=_work,daemon=True).start()

    # ── Rules ─────────────────────────────────────────────────────────────────
    def _refresh_rules(self):
        for iid in self.rtree.get_children(): self.rtree.delete(iid)
        for r in self.rules_data:
            self.rtree.insert("","end",values=(r["pat"],r["dest"],"On" if r["on"] else "Off"),
                              tags=("on" if r["on"] else "off",))

    def _add_rule(self):  self._rule_dlg("Add Rule",{},True)
    def _edit_rule(self):
        sel=self.rtree.selection()
        if not sel: messagebox.showwarning("No selection","Select a rule."); return
        i=list(self.rtree.get_children()).index(sel[0])
        self._rule_dlg("Edit Rule",self.rules_data[i],False,i)

    def _del_rule(self):
        sel=self.rtree.selection()
        if not sel: messagebox.showwarning("No selection","Select a rule."); return
        i=list(self.rtree.get_children()).index(sel[0])
        if messagebox.askyesno("Delete",f"Delete '{self.rules_data[i]['pat']}'?"):
            self.rules_data.pop(i); self._refresh_rules(); self._log("Rule deleted.","info"); self._save_all(silent=True)

    def _toggle_rule(self):
        sel=self.rtree.selection()
        if not sel: return
        i=list(self.rtree.get_children()).index(sel[0])
        self.rules_data[i]["on"]=not self.rules_data[i]["on"]
        self._refresh_rules()
        self._log(f"Rule {'enabled' if self.rules_data[i]['on'] else 'disabled'}: {self.rules_data[i]['pat']}","info")
        self._save_all(silent=True)

    def _rule_dlg(self,title,rule,is_new,idx=None):
        w=tk.Toplevel(self.root); w.title(title); w.geometry("420x210")
        w.configure(bg=CARD); w.resizable(False,False); w.grab_set()
        w._vars={}
        for label,key in [("Pattern (e.g. *.jpg, *.png):","pat"),("Destination folder:","dest")]:
            L(w,label,9,bg=CARD).pack(anchor="w",padx=20,pady=(10,0))
            v=tk.StringVar(value=rule.get(key,""))
            tk.Entry(w,textvariable=v,font=("Segoe UI",9),bg=BG,fg=TEXT,
                     relief="solid",bd=1,width=46).pack(padx=20,pady=(2,0))
            w._vars[key]=v
        en=tk.BooleanVar(value=rule.get("on",True))
        tk.Checkbutton(w,text="Enabled",variable=en,font=("Segoe UI",9),
                       fg=TEXT,bg=CARD,activebackground=CARD,selectcolor=BG).pack(anchor="w",padx=20,pady=6)
        def save():
            p=w._vars["pat"].get().strip(); d=w._vars["dest"].get().strip()
            if not p or not d: messagebox.showwarning("Missing","Fill all fields."); return
            entry={"pat":p,"dest":d,"on":en.get()}
            if is_new: self.rules_data.append(entry)
            else: self.rules_data[idx]=entry
            self._refresh_rules(); self._log(f"Rule saved: {p} → {d}","success"); self._save_all(silent=True); w.destroy()
        r=tk.Frame(w,bg=CARD); r.pack(pady=4)
        B(r,"Save",save,"primary").pack(side="left",padx=4)
        B(r,"Cancel",w.destroy,"ghost").pack(side="left",padx=4)

    # ── Analytics ─────────────────────────────────────────────────────────────
    def _refresh_analytics(self):
        for w in self._af.winfo_children(): w.destroy()
        pad=tk.Frame(self._af,bg=BG); pad.pack(fill="x",padx=16,pady=12)
        by_cat={}
        for f in self.files: by_cat[f["type"]]=by_cat.get(f["type"],0)+1
        L(pad,"Files by Category",10,"bold").pack(anchor="w",pady=(0,8))
        cf=tk.Frame(pad,bg=BG); cf.pack(fill="x")
        CMAP={v[0]:v[2] for v in EXT.values()}; CMAP["Unknown"]=TEXT3
        for i,(cat,cnt) in enumerate(sorted(by_cat.items(),key=lambda x:-x[1])[:10]):
            col=CMAP.get(cat,C_BLUE)
            card=tk.Frame(cf,bg=CARD,relief="solid",bd=1,
                          highlightbackground=BORDER,highlightthickness=1)
            card.grid(row=i//5,column=i%5,padx=4,pady=4,sticky="nsew")
            cf.grid_columnconfigure(i%5,weight=1)
            tk.Label(card,text=str(cnt),font=("Segoe UI",18,"bold"),fg=col,bg=CARD).pack(pady=(8,2))
            tk.Label(card,text=cat,font=("Segoe UI",7,"bold"),fg=TEXT2,bg=CARD).pack(pady=(0,8),padx=6)
        H(pad).pack(fill="x",pady=12)
        L(pad,"Status Overview",10,"bold").pack(anchor="w",pady=(0,8))
        by_st={}
        for f in self.files: by_st[f["status"]]=by_st.get(f["status"],0)+1
        total=len(self.files) or 1
        SCOL={"Pending":C_ORG,"Approved":C_GREEN,"Moved":C_BLUE,"Skipped":TEXT3}
        for st,cnt in sorted(by_st.items()):
            col=SCOL.get(st,TEXT2)
            r=tk.Frame(pad,bg=BG); r.pack(fill="x",pady=3)
            tk.Label(r,text=st,font=("Segoe UI",9),fg=TEXT,bg=BG,width=10,anchor="w").pack(side="left")
            can=tk.Canvas(r,bg=BG,highlightthickness=0,height=16,width=300)
            can.pack(side="left",padx=6)
            bw=int(300*cnt/total)
            can.create_rectangle(0,4,bw,12,fill=col,outline="")
            can.create_rectangle(bw,4,300,12,fill=BORDER,outline="")
            tk.Label(r,text=f"{cnt}  ({cnt*100//total}%)",font=("Segoe UI",9),fg=TEXT2,bg=BG).pack(side="left")
        H(pad).pack(fill="x",pady=12)
        L(pad,"Top Extensions",10,"bold").pack(anchor="w",pady=(0,8))
        ext_c={}
        for f in self.files: ext_c[Path(f["name"]).suffix.lower() or "(none)"]=ext_c.get(Path(f["name"]).suffix.lower() or "(none)",0)+1
        top=sorted(ext_c.items(),key=lambda x:-x[1])[:15]; tm=top[0][1] if top else 1
        ECOL={k:v[2] for k,v in EXT.items()}
        for ext,cnt in top:
            col=ECOL.get(ext,TEXT3)
            r=tk.Frame(pad,bg=BG); r.pack(fill="x",pady=2)
            tk.Label(r,text=ext,font=("Consolas",9,"bold"),fg=C_BLUE,bg=BG,width=10,anchor="w").pack(side="left")
            can=tk.Canvas(r,bg=BG,highlightthickness=0,height=14,width=240)
            can.pack(side="left",padx=4)
            bw=int(240*cnt/tm)
            can.create_rectangle(0,3,bw,11,fill=col,outline="")
            can.create_rectangle(bw,3,240,11,fill=BORDER,outline="")
            tk.Label(r,text=f"{cnt}",font=("Segoe UI",9),fg=TEXT2,bg=BG).pack(side="left")

    # ══════════════════════════════════════════════════════════════════════════
    # Log system
    # ══════════════════════════════════════════════════════════════════════════
    def _log(self,msg,kind="info"):
        ts=datetime.now().strftime("%H:%M:%S.%f")[:-3]
        # sidebar
        self._logbox.config(state="normal")
        self._logbox.insert("end",f"[{ts[:8]}] {msg}\n",kind)
        self._logbox.see("end")
        self._logbox.config(state="disabled")
        # full log
        self._log_entries.append((ts,kind.upper(),msg))
        if not self._log_paused: self._append_line(ts,kind,msg)
        self._update_log_counts()

    def _append_line(self,ts,kind,msg,hl=""):
        LABS={"info":"[INFO   ]","success":"[SUCCESS]","warning":"[WARNING]","error":"[ERROR  ]"}
        lab=LABS.get(kind,"[INFO   ]")
        self._livelog.config(state="normal")
        self._livelog.insert("end",f"  {ts}  ","ts")
        self._livelog.insert("end",f"{lab} ",f"label_{kind}")
        pos0=self._livelog.index("end")
        self._livelog.insert("end",f"{msg}\n",kind)
        if hl:
            start=pos0
            while True:
                p=self._livelog.search(hl,start,stopindex="end",nocase=True)
                if not p: break
                ep=f"{p}+{len(hl)}c"; self._livelog.tag_add("hl",p,ep); start=ep
        if self._log_autoscroll: self._livelog.see("end")
        self._livelog.config(state="disabled")

    def _filter_log(self):
        search=self.v_lsearch.get().lower(); level=self.v_llevel.get()
        self._livelog.config(state="normal"); self._livelog.delete("1.0","end")
        shown=0
        for ts,lvl,msg in self._log_entries:
            if level!="ALL" and lvl!=level: continue
            if search and search not in msg.lower() and search not in ts: continue
            self._append_line(ts,lvl.lower(),msg,search); shown+=1
        self._livelog.config(state="disabled"); self._livelog.see("end")
        self._update_log_counts(shown)

    def _set_level(self,level):
        self.v_llevel.set(level)
        COLS={"ALL":TEXT2,"INFO":C_BLUE,"SUCCESS":C_GREEN,"WARNING":C_ORG,"ERROR":C_RED}
        for lvl,b in self._lvl_btns.items():
            sel=lvl==level; col=COLS.get(lvl,TEXT2)
            b.config(bg=col if sel else BG, fg="white" if sel else col)
        self._filter_log()

    def _update_log_counts(self,shown=None):
        total=len(self._log_entries)
        c={"INFO":0,"SUCCESS":0,"WARNING":0,"ERROR":0}
        for _,lvl,_ in self._log_entries:
            if lvl in c: c[lvl]+=1
        self.v_lstats.set(f"  I:{c['INFO']}  OK:{c['SUCCESS']}  W:{c['WARNING']}  E:{c['ERROR']}")
        sn=shown if shown is not None else total
        if hasattr(self,"_log_cnt"): self._log_cnt.config(text=f"Showing {sn} of {total} entries")

    def _clear_sidebar_log(self):
        self._logbox.config(state="normal"); self._logbox.delete("1.0","end"); self._logbox.config(state="disabled")

    def _clear_all_logs(self):
        if not messagebox.askyesno("Clear All Logs","Delete all log entries? Cannot be undone."): return
        self._log_entries.clear()
        self._logbox.config(state="normal"); self._logbox.delete("1.0","end"); self._logbox.config(state="disabled")
        self._livelog.config(state="normal"); self._livelog.delete("1.0","end"); self._livelog.config(state="disabled")
        self._update_log_counts(0)

    def _toggle_pause(self):
        self._log_paused=not self._log_paused
        if not self._log_paused: self._filter_log()
        self._log(f"Log stream {'PAUSED' if self._log_paused else 'RESUMED'}.","warning" if self._log_paused else "success")

    def _log_end(self):
        self._livelog.see("end"); self._log_autoscroll=True

    def _export_logs(self):
        if not self._log_entries: messagebox.showinfo("Export","No entries."); return
        path=filedialog.asksaveasfilename(title="Export Logs",defaultextension=".txt",
             filetypes=[("Text","*.txt"),("All","*.*")],
             initialfile=f"fileorb_log_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt")
        if not path: return
        try:
            with open(path,"w",encoding="utf-8") as fp:
                fp.write(f"FileOrb Log Export — {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}\n"+"="*70+"\n\n")
                for ts,lvl,msg in self._log_entries: fp.write(f"[{ts}] [{lvl:<7}] {msg}\n")
            self._log(f"Exported {len(self._log_entries)} entries → {Path(path).name}","success")
            messagebox.showinfo("Done",f"Saved {len(self._log_entries)} entries.")
        except Exception as ex: messagebox.showerror("Export failed",str(ex))

    def _copy_log_line(self,event):
        try:
            ls=self._livelog.index(f"@{event.x},{event.y} linestart")
            le=self._livelog.index(f"@{event.x},{event.y} lineend")
            text=self._livelog.get(ls,le).strip()
            if text: self.root.clipboard_clear(); self.root.clipboard_append(text); self._log("Line copied to clipboard.","info")
        except: pass


    # ══════════════════════════════════════════════════════════════════════════
    # Clipboard — Copy / Cut / Paste
    # ══════════════════════════════════════════════════════════════════════════
    def _copy_selected(self):
        """Copy selected rows as TSV text to system clipboard."""
        idxs = self._sel_idx()
        if not idxs:
            self._log("Copy: nothing selected.", "warning"); return
        header = "Name\tCategory\tSize\tAge\tDestination\tStatus"
        rows = [header]
        for i in idxs:
            f = self.files[i]
            rows.append("\t".join([f["name"],f["type"],f["size"],
                                    f["age"],f["dest"],f["status"]]))
        text = "\n".join(rows)
        self.root.clipboard_clear()
        self.root.clipboard_append(text)
        self._log(f"Copied {len(idxs)} row(s) to clipboard.", "info")

    def _cut_selected(self):
        """Cut = copy + remove from list (with undo support)."""
        idxs = self._sel_idx()
        if not idxs:
            self._log("Cut: nothing selected.", "warning"); return
        self._copy_selected()
        self._push_undo()
        removed = []
        for i in sorted(idxs, reverse=True):
            removed.append(self.files[i]["name"])
            self.files.pop(i)
        self._refresh_table()
        self._log(f"Cut {len(removed)} row(s). Press Ctrl+Z to undo.", "warning")

    def _paste_clipboard(self):
        """Paste TSV rows that were previously copied from FileOrb."""
        try:
            text = self.root.clipboard_get()
        except Exception:
            self._log("Paste: clipboard is empty or not text.", "warning"); return
        lines = [l for l in text.strip().splitlines() if l.strip()]
        if len(lines) < 2:
            self._log("Paste: no FileOrb rows found in clipboard.", "warning"); return
        # Skip header line
        added = 0
        self._push_undo()
        for line in lines[1:]:
            cols = line.split("\t")
            if len(cols) < 5: continue
            name,cat,size,age,dest = cols[0],cols[1],cols[2],cols[3],cols[4]
            status = cols[5] if len(cols)>5 else "Pending"
            # Don't duplicate
            if any(f["name"]==name and f["dest"]==dest for f in self.files):
                continue
            cat2,dest2,col,icon = classify(name)
            self.files.append({"name":name,"size":size,"age":age,
                                "type":cat,"dest":dest,"conf":80,
                                "status":"Pending","note":"pasted","_path":""})
            added += 1
        self._refresh_table()
        self._log(f"Pasted {added} row(s) from clipboard.", "success" if added else "warning")

    # ══════════════════════════════════════════════════════════════════════════
    # Undo / Redo
    # ══════════════════════════════════════════════════════════════════════════
    def _push_undo(self):
        """Save a deep snapshot of self.files to the undo stack."""
        self._undo_stack.append(copy.deepcopy(self.files))
        self._redo_stack.clear()          # new action invalidates redo history
        if len(self._undo_stack) > 50:    # cap stack at 50 snapshots
            self._undo_stack.pop(0)

    def _undo(self):
        if not self._undo_stack:
            self._log("Nothing to undo.", "warning"); return
        self._redo_stack.append(copy.deepcopy(self.files))
        self.files = self._undo_stack.pop()
        self._refresh_table()
        self._log(f"Undo — restored to {len(self.files)} files. "
                  f"({len(self._undo_stack)} undo step(s) left)", "warning")

    def _redo(self):
        if not self._redo_stack:
            self._log("Nothing to redo.", "warning"); return
        self._undo_stack.append(copy.deepcopy(self.files))
        self.files = self._redo_stack.pop()
        self._refresh_table()
        self._log(f"Redo — restored to {len(self.files)} files. "
                  f"({len(self._redo_stack)} redo step(s) left)", "info")

    # ══════════════════════════════════════════════════════════════════════════
    # Real-time folder watcher
    # ══════════════════════════════════════════════════════════════════════════
    def _toggle_realtime(self):
        if self._rt_active:
            self._rt_active = False
            self.v_rt_status.set("Watcher: OFF")
            self._rt_btn.config(text="[RT] Watch: OFF", bg="#334155")
            self._log("Real-time watcher stopped.", "warning")
        else:
            watch = self.v_watch.get().strip()
            if not watch or not os.path.isdir(watch):
                messagebox.showwarning("No Watch Folder",
                    "Set a valid Watch Folder in Settings first.")
                return
            self._rt_active = True
            self.v_rt_status.set("Watcher: ON")
            self._rt_btn.config(text="[RT] Watch: ON", bg=C_GREEN)
            self._log(f"Real-time watcher started on: {watch}", "success")
            # Take initial snapshot of existing files so we only react to NEW ones
            try:
                self._rt_snapshot = {e.name for e in Path(watch).iterdir() if e.is_file()}
            except: self._rt_snapshot = set()
            self._rt_thread = threading.Thread(
                target=self._rt_watch_loop, daemon=True)
            self._rt_thread.start()

    def _rt_watch_loop(self):
        """Background thread: polls watch folder every 2s for new files."""
        while self._rt_active:
            time.sleep(2)
            watch = self.v_watch.get().strip()
            if not watch or not os.path.isdir(watch):
                continue
            try:
                current = {e.name: e for e in Path(watch).iterdir() if e.is_file()}
            except: continue
            new_names = set(current.keys()) - self._rt_snapshot
            if new_names:
                self._rt_snapshot = set(current.keys())
                new_rows = []
                for name in sorted(new_names):
                    entry = current[name]
                    cat,dest,col,icon = classify(name)
                    try:
                        sz = entry.stat().st_size
                        ss = (f"{sz/1048576:.1f} MB" if sz>1048576
                              else f"{sz/1024:.0f} KB")
                    except: ss = "?"
                    new_rows.append({
                        "name":name,"size":ss,"age":"just now",
                        "type":cat,"dest":dest,"conf":95 if cat!="Other" else 45,
                        "status":"Pending","note":"auto-detected","_path":str(entry)
                    })
                def _add(rows=new_rows):
                    for row in rows:
                        # Skip if already in list
                        if not any(f["name"]==row["name"] for f in self.files):
                            self.files.append(row)
                            self._log(f"[RT] New file detected: {row['name']} -> {row['dest']}", "success")
                    self._refresh_table()
                self.root.after(0, _add)

    def _ctx_analyse_intel(self):
        """Send selected file (if it has a real path) to the Intelligence tab."""
        idxs = self._sel_idx()
        if not idxs: return
        f = self.files[idxs[0]]
        path = f.get("_path","")
        if not path or not os.path.isfile(path):
            messagebox.showinfo("No real path",
                "This file has no path on disk.\n"
                "Scan a real folder first, or add files via 'Add Files'.")
            return
        # Switch to Intelligence tab (index 4)
        self.nb.select(4)
        self._intel_analyse(path)

    def _toggle_vt_key_vis(self, row_frame):
        for w in row_frame.winfo_children():
            if isinstance(w, tk.Entry):
                w.config(show="" if w.cget("show")=="*" else "*")

    # ── Portable persistence ─────────────────────────────────────────────────
    def _load_all(self):
        """Load settings, rules, and queue from JSON files next to the script."""
        # ── Settings ──────────────────────────────────────────────────────────
        if _SETTINGS_FILE.exists():
            try:
                with open(_SETTINGS_FILE,"r",encoding="utf-8") as fh:
                    s = json.load(fh)
                self.v_watch.set(s.get("watch_folder",""))
                self.v_output.set(s.get("output_folder",""))
                self.v_flat.set(s.get("flat_mode",False))
                self.v_vt_key.set(s.get("vt_api_key",""))
                geo = s.get("geometry","")
                if geo:
                    try: self.root.geometry(geo)
                    except: pass
                sv_map = s.get("safety",{})
                for k,v in sv_map.items():
                    if k in self._sv: self._sv[k].set(v)
                self._log(f"Settings loaded from {_SETTINGS_FILE.name}","success")
            except Exception as ex:
                self._log(f"Could not load settings: {ex}","warning")
        # ── Rules ─────────────────────────────────────────────────────────────
        if _RULES_FILE.exists():
            try:
                with open(_RULES_FILE,"r",encoding="utf-8") as fh:
                    rules = json.load(fh)
                if isinstance(rules,list) and rules:
                    self.rules_data = rules
                    self._refresh_rules()
                    self._log(f"Rules loaded from {_RULES_FILE.name} ({len(rules)} rules)","success")
            except Exception as ex:
                self._log(f"Could not load rules: {ex}","warning")
        # ── Queue ─────────────────────────────────────────────────────────────
        if _QUEUE_FILE.exists():
            try:
                with open(_QUEUE_FILE,"r",encoding="utf-8") as fh:
                    queue = json.load(fh)
                if isinstance(queue,list) and queue:
                    self.files = queue
                    self._refresh_table()
                    self._log(f"Queue restored: {len(queue)} file(s) from last session","info")
            except Exception as ex:
                self._log(f"Could not load queue: {ex}","warning")

    def _save_all(self, silent=False):
        """Save settings, rules, and queue to JSON files next to the script."""
        errors = []
        # ── Settings ──────────────────────────────────────────────────────────
        try:
            s = {
                "watch_folder":  self.v_watch.get(),
                "output_folder": self.v_output.get(),
                "flat_mode":     self.v_flat.get(),
                "vt_api_key":    self.v_vt_key.get(),
                "geometry":      self.root.geometry(),
                "safety": {k: v.get() for k,v in self._sv.items()},
            }
            with open(_SETTINGS_FILE,"w",encoding="utf-8") as fh:
                json.dump(s, fh, indent=2)
        except Exception as ex:
            errors.append(f"settings: {ex}")
        # ── Rules ─────────────────────────────────────────────────────────────
        try:
            with open(_RULES_FILE,"w",encoding="utf-8") as fh:
                json.dump(self.rules_data, fh, indent=2)
        except Exception as ex:
            errors.append(f"rules: {ex}")
        # ── Queue (only non-sample files worth keeping) ───────────────────────
        try:
            saveable = [f for f in self.files if f.get("_path","") or f.get("status") not in ("Pending",)]
            # Also save Pending files that have real paths
            saveable = [f for f in self.files if f.get("_path","")]
            with open(_QUEUE_FILE,"w",encoding="utf-8") as fh:
                json.dump(saveable, fh, indent=2)
        except Exception as ex:
            errors.append(f"queue: {ex}")
        if not silent:
            if errors:
                messagebox.showwarning("Partial Save", "Some data could not be saved:\n" + "\n".join(errors))
            else:
                messagebox.showinfo("Saved", f"All settings saved to:\n{_SCRIPT_DIR}")
        self._log(f"Auto-saved: settings + rules + queue -> {_SCRIPT_DIR.name}/","success" if not errors else "warning")

    def _save_settings(self):
        self._save_all(silent=False)

    def _on_close(self):
        """Called when window is closed — auto-save everything silently."""
        self._save_all(silent=True)
        self.root.destroy()

    # ── Settings helpers ──────────────────────────────────────────────────────
    def _pick_folder(self,var):
        d=filedialog.askdirectory(title="Select Folder")
        if d: var.set(d); self._log(f"Folder set: {d}","info")

# ── Entry ─────────────────────────────────────────────────────────────────────
if __name__ == "__main__":
    root = tk.Tk()
    app = App(root)
    root.protocol("WM_DELETE_WINDOW", app._on_close)
    root.mainloop()