feat: AppWorkload enrichment, activity view, GUID registry

[adamgell]

Summary

• Log viewer enrichment: Parse "Get policies" JSON payloads to build GUID→Name mappings, show resolved app names in InfoPane, display structured policy metadata and decoded PowerShell scripts via ScriptCodeViewer
• AppWorkload parser fixes: Fix rotated file detection (prefix match), fix GUID extraction preferring app GUIDs over user GUIDs, add SideCarScriptDetectionManager event extraction
• Activity view: New toggle in Intune timeline groups events by app into collapsible cards with parsed structured fields (intent, detection, applicability, reboot, GRS) as colored tags, inline GUID resolution, and word-wrapped detail messages
• GUID Registry dialog: New Tools menu item showing searchable table of all GUID→Name mappings with source confidence, click-to-copy
• Resizable InfoPane: Drag handle between log list and detail pane

Test plan

• Open AppWorkload logs in log viewer — verify "Get policies" entries show structured policy cards with decoded scripts
• Select log entries containing GUIDs — verify resolved app names appear in InfoPane
• Open rotated AppWorkload files (e.g., AppWorkload-20260401-160729.log) — verify they parse as LogicalRecord, not PhysicalLine
• Run Intune analysis, switch to Activity view — verify events group by app with colored status tags
• Expand activity groups — verify detail messages show resolved app names instead of GUIDs
• Tools → GUID Registry — verify searchable table of GUID→Name mappings
• cargo test from src-tauri/ — all tests pass
• npx tsc --noEmit — no type errors

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR enhances the Intune/AppWorkload diagnostics experience by extracting and surfacing richer app identity and policy/script metadata, adding an “Activity” grouped timeline view, and exposing GUID mappings via a dedicated registry dialog.

Changes:

• Add GUID→Name enrichment from AppWorkload “Get policies” payloads and display resolved names/scripts in the log InfoPane.
• Introduce an Intune timeline view toggle that switches from a flat list to an app-grouped “Activity” view with parsed tags and GUID resolution.
• Add a Tools → GUID Registry dialog plus backend policy metadata extraction and script-body attachment to PowerShell script events.

Reviewed changes

Copilot reviewed 31 out of 33 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/types/intune.ts	Extends shared Intune types with policy metadata and script fields.
src/stores/ui-store.ts	Adds UI state for GUID Registry dialog visibility.
src/stores/log-store.ts	Stores GUID→Name map derived from loaded log entries.
src/stores/intune-store.ts	Adds timeline view mode and stores policyMetadata/guidRegistry.
src/lib/guid-name-map.ts	New utility to parse “Get policies” and resolve GUIDs in messages.
src/hooks/use-context-menu.ts	Ensures clipboard writes are awaited/handled.
src/hooks/use-app-menu.ts	Handles new menu action to open GUID Registry dialog.
src/components/log-view/InfoPane.tsx	Displays resolved GUID names and adds script detail rendering.
src/components/log-view/AppWorkloadScriptDetail.tsx	New component to parse/display policy cards and sidecar script details.
src/components/layout/Toolbar.tsx	Passes guidRegistry/policyMetadata into Intune result metadata flow.
src/components/layout/AppShell.tsx	Adds resizable InfoPane handle and mounts GUID Registry dialog.
src/components/intune/ScriptCodeViewer.tsx	New script viewer with tokenization + copy-to-clipboard.
src/components/intune/IntuneDashboardNavBar.tsx	Adds List/Activity view toggle; hides sort controls in Activity mode.
src/components/intune/EventTimelineRow.tsx	Shows decoded script bodies inline for script events.
src/components/intune/EventTimeline.tsx	Switches between list timeline and activity-grouped view.
src/components/intune/EventActivityView.tsx	New virtualized, collapsible app-grouped activity timeline view.
src/components/dialogs/SettingsDialog.tsx	Adds keyboard navigation support to settings tablist.
src/components/dialogs/GuidRegistryDialog.tsx	New searchable GUID registry dialog with click-to-copy rows.
src-tauri/src/parser/detect.rs	Improves rotated IME/AppWorkload file detection via prefix match.
src-tauri/src/menu.rs	Adds Tools → GUID Registry menu item and action payload mapping.
src-tauri/src/intune/timeline.rs	Updates tests/fixtures for new IntuneEvent fields.
src-tauri/src/intune/policy_parser.rs	New backend parser for “Get policies” payloads + script decode.
src-tauri/src/intune/models.rs	Adds policy metadata models and script fields to IntuneEvent/result.
src-tauri/src/intune/mod.rs	Exposes the new policy_parser module (diagnostics feature gated).
src-tauri/src/intune/event_tracker.rs	Improves GUID extraction and adds sidecar script detection events.
src-tauri/src/event_log/parser.rs	Tracks per-record EVTX parse errors; improves “Unknown” defaults.
src-tauri/src/event_log/live.rs	Updates unimplemented live event log error messaging.
src-tauri/src/commands/intune.rs	Aggregates policy metadata and attaches decoded scripts to script events.
src-tauri/Cargo.toml	Adds base64 dependency for script decoding.
src-tauri/Cargo.lock	Locks base64 dependency version.
package-lock.json	Bumps app version in lockfile.
docs/superpowers/specs/2026-04-01-intune-gantt-view-design.md	Adds design spec for the (named) Gantt/Activity timeline concept.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

mergeGuidNameMap claims it “does not overwrite existing names”, but the spread order return { ...existing, ...additions } will overwrite any existing GUID with a newly parsed name. Either reverse the spread order or explicitly only add keys that don’t already exist (and update the doc if overwriting is intended).

Suggested change

	return { ...existing, ...additions };
	return { ...additions, ...existing };

[Copilot]

The resize useEffect cleans up event listeners on unmount, but if the component unmounts while a drag is in progress, document.body.style.cursor / userSelect will remain set. Consider resetting those styles in the cleanup function when infoPaneResizeRef.current is non-null.

Suggested change

	window.removeEventListener("mouseup", onMouseUp);
	window.removeEventListener("mouseup", onMouseUp);
	if (infoPaneResizeRef.current) {
	infoPaneResizeRef.current = null;
	document.body.style.cursor = "";
	document.body.style.userSelect = "";
	}

[Copilot]

Rows are clickable to copy, but <tr> isn’t keyboard-focusable and doesn’t expose an accessible button role/action, so keyboard/screen-reader users can’t trigger the copy behavior. Consider rendering a <button> inside the cell (or adding tabIndex, role="button", and onKeyDown handlers) and providing an accessible label like “Copy GUID …”.

[Copilot]

decodeBase64 uses atob, which returns a binary/Latin-1 string and will corrupt non-ASCII PowerShell scripts. Prefer decoding to bytes and converting with TextDecoder (and/or handling UTF-16LE if these scripts can be encoded that way) so scripts display correctly.

[Copilot]

parseGetPolicies coerces missing Id to an empty string (id: String(obj.Id ?? "")). If multiple items lack Id, React keys (key={policy.id}) will collide and the UI may render incorrectly. Consider skipping entries without a valid non-empty Id (and ideally validating it looks like a GUID).

[Copilot]

Policy metadata is keyed by policy.id as-is, but later lookups use event.parent_app_guid / event.guid as-is. If casing differs between the policy payload and sidecar/script events, all_policy_metadata.get(guid) will miss and script_body won’t attach. Consider normalizing GUID keys consistently (e.g., store policy IDs lowercased and lowercase the lookup GUID before get).

[Copilot]

extractAppNameFromDetail assumes guidRegistry is keyed by lowercase GUIDs (registry?.[name.toLowerCase()]). If the backend sends GUIDs with original casing, this lookup will miss and grouping/labels will fall back to raw GUIDs. Consider either normalizing the registry keys up-front (preferred) or checking both registry[name.toLowerCase()] and registry[name] here (similar to resolveGuidsInText).

Suggested change

	const entry = registry?.[name.toLowerCase()];
	const lowerKey = name.toLowerCase();
	const entry = registry?.[lowerKey] ?? registry?.[name];

[Copilot]

This new parsing/merging logic is non-trivial (JSON sanitization, extraction, merge semantics) but there are no accompanying unit tests. Since src/lib already has Vitest coverage (e.g., src/lib/column-config.test.ts), consider adding tests for buildGuidNameMap/mergeGuidNameMap/resolveGuidsInMessage, including invalid-escape JSON and merge behavior.

Suggested change

	return { ...existing, ...additions };
	// Existing entries should not be overwritten; let them take precedence.
	return { ...additions, ...existing };

[Copilot]

showGuidRegistryDialog is added to UI state, but closeTransientDialogs doesn’t include it in either the “nothing to close” guard or the set({ ... }) reset (see src/stores/ui-store.ts around lines 469–495). This means global “close transient dialogs” actions (e.g., Escape) may leave the GUID Registry dialog open. Consider adding showGuidRegistryDialog to that helper.

[Copilot]

The new view mode is labeled “Activity” in the UI (ViewModeToggle), but the type/value is "gantt" (IntuneTimelineViewMode = "list" | "gantt"). This mismatch makes the code harder to follow (and the spec doc also refers to “Gantt”). Consider renaming the mode value to "activity" (or renaming the UI label to “Gantt”) for consistency.

Suggested change

	export type IntuneTimelineViewMode = "list" | "gantt";
	export type IntuneTimelineViewMode = "list" | "activity";