gui.py

import os
import queue
import threading
import tkinter as tk
from datetime import datetime
from tkinter import ttk, messagebox

import networkx as nx
import ttkbootstrap as tb
import matplotlib.pyplot as plt
import matplotlib.animation as animation
import matplotlib.patches as mpatches
from matplotlib.backends.backend_tkagg import FigureCanvasTkAgg

from api_clients import (
    detect_chain,
    get_btc_usd_price,
    get_wallet_transactions,
)
from alerts import evaluate_transaction_alert
from exporter import export_png, export_report
from monitoring import WatchlistStore, poll_watchlist
from ransomware_db import (
    check_wallet,
    get_graph_reputation,
    get_wallet_reputation,
    summarize_graph_risk,
)
from simulated_data import SIMULATED_TRAIL
from tracker import BlockchainTracker
from utils import justify_simulation

# ---------------------------------------------------------------------------
# Premium dark theme palette
# ---------------------------------------------------------------------------
THEME = {
    "bg": "#0a0e17",
    "bg_panel": "#111827",
    "bg_panel_2": "#0d1420",
    "glass": "#151d2e",
    "glass_border": "#243247",
    "fg": "#e8edf4",
    "fg_dim": "#8b98ab",
    "accent_red": "#ff2d55",
    "accent_amber": "#ffb547",
    "accent_green": "#36d399",
    "accent_cyan": "#22d3ee",
    "neon_red": "#ff3b5c",
    "neon_amber": "#ffb545",
    "success": "#10b981",
    "warning": "#f59e0b",
    "danger": "#ef4444",
    "node_victim": "#36d399",
    "node_mixer": "#ff3b5c",
    "node_trail": "#ffb547",
    "node_noise": "#566274",
    "node_label": "#ff7043",
    "edge_regular": "#2c3d52",
    "edge_path": "#ffb547",
    "font_family": "Segoe UI",
}

RISK_COLORS = {"low": "#10b981", "medium": "#f59e0b", "high": "#ef4444"}


def truncate_address(address, head=8, tail=6):
    """Shorten a long address for display, e.g. 1A1zP1eP...vDivfNa."""
    if len(address) <= head + tail + 3:
        return address
    return f"{address[:head]}...{address[-tail:]}"


class App:
    """
    BlockTrace — Blockchain OSINT Ransomware Tracing Workbench.

    A 3-pane premium dark dashboard:
      - Left:   OSINT threat feeds / risk intelligence
      - Center: glowing fund-flow network graph with animated arrows
      - Right:  chronological transaction timeline with USD values
    """

    def __init__(self, root):
        self.root = root
        self.tool_name = "BlockTrace"
        self.root.title(f"{self.tool_name} — Blockchain OSINT Workbench")
        self.root.geometry("1560x920")
        self.root.minsize(1200, 760)
        self.root.configure(bg=THEME["bg"])

        # Async worker queue (background thread -> UI thread)
        self._worker_queue = queue.Queue()

        # State
        self.previous_tx_count = 0
        self.previous_wallet = None
        self.watchlist_store = WatchlistStore()
        self.current_report = None
        self._worker = None
        self._btc_usd_price = None
        self._anim = None
        self._loading = False
        self._graph_metadata = None

        self._build_styles()
        self._build_ui()
        self._poll_queue()
        self._load_btc_price_async()

    # ------------------------------------------------------------------
    # Styling
    # ------------------------------------------------------------------
    def _build_styles(self):
        style = tb.Style()
        style.configure("TFrame", background=THEME["bg"])
        style.configure(
            "Panel.TFrame",
            background=THEME["bg_panel_2"],
            bordercolor=THEME["glass_border"],
        )
        style.configure(
            "Glass.TFrame",
            background=THEME["glass"],
            bordercolor=THEME["glass_border"],
            borderwidth=1,
        )
        style.configure(
            "TLabel", background=THEME["bg"], foreground=THEME["fg"], font=(THEME["font_family"], 10)
        )
        style.configure(
            "Panel.TLabel", background=THEME["bg_panel_2"], foreground=THEME["fg"]
        )
        style.configure(
            "Header.TLabel", background=THEME["bg_panel_2"], foreground=THEME["fg"],
            font=(THEME["font_family"], 14, "bold"),
        )
        style.configure(
            "Title.TLabel", background=THEME["bg"], foreground=THEME["fg"],
            font=(THEME["font_family"], 24, "bold"),
        )
        style.configure(
            "Dim.TLabel", background=THEME["bg_panel_2"], foreground=THEME["fg_dim"],
            font=(THEME["font_family"], 9),
        )
        style.configure(
            "Amber.TLabel", background=THEME["glass"], foreground=THEME["neon_amber"],
            font=(THEME["font_family"], 10, "bold"),
        )
        style.configure(
            "Red.TLabel", background=THEME["glass"], foreground=THEME["neon_red"],
            font=(THEME["font_family"], 10, "bold"),
        )
        style.configure(
            "Green.TLabel", background=THEME["glass"], foreground=THEME["success"],
            font=(THEME["font_family"], 10, "bold"),
        )
        style.configure(
            "Metric.TLabel", background=THEME["bg_panel_2"], foreground=THEME["fg"],
            font=(THEME["font_family"], 18, "bold"),
        )
        style.configure(
            "MetricCaption.TLabel", background=THEME["bg_panel_2"],
            foreground=THEME["fg_dim"], font=(THEME["font_family"], 8),
        )
        style.configure(
            "TEntry", fieldbackground=THEME["bg_panel"], foreground=THEME["fg"],
            bordercolor=THEME["glass_border"],
        )
        style.configure(
            "Accent.TButton", background=THEME["accent_amber"], foreground="#0a0e17",
            borderwidth=0, font=(THEME["font_family"], 10, "bold"),
        )
        style.configure(
            "Action.TButton", background=THEME["glass"], foreground=THEME["fg"],
            borderwidth=1, bordercolor=THEME["glass_border"],
        )
        style.configure(
            "Danger.TButton", background=THEME["neon_red"], foreground="#ffffff",
            borderwidth=0, font=(THEME["font_family"], 10, "bold"),
        )
        style.configure(
            "Horizontal.TProgressbar", background=THEME["neon_amber"],
            troughcolor=THEME["bg_panel"], bordercolor=THEME["glass_border"],
        )

    # ------------------------------------------------------------------
    # UI Layout
    # ------------------------------------------------------------------
    def _build_ui(self):
        # Root container
        container = ttk.Frame(self.root, style="TFrame", padding=18)
        container.pack(fill="both", expand=True)

        # ===================== HEADER =====================
        header = ttk.Frame(container, style="TFrame")
        header.pack(fill="x", side="top", pady=(0, 12))

        title_block = ttk.Frame(header, style="TFrame")
        title_block.pack(side="left")

        # Logo (if assets/logo.png exists)
        self.logo_image = None
        try:
            base = os.path.dirname(__file__)
            logo_path = os.path.join(base, "assets", "logo.png")
            if os.path.exists(logo_path):
                self.logo_image = tk.PhotoImage(file=logo_path)
                ttk.Label(title_block, image=self.logo_image, style="TLabel").pack(side="left", padx=(0, 10))
        except Exception:
            self.logo_image = None

        ttk.Label(title_block, text=self.tool_name, style="Title.TLabel").pack(side="left")
        ttk.Label(
            title_block,
            text="  Blockchain Intelligence Workbench",
            foreground=THEME["fg_dim"],
            background=THEME["bg"],
            font=(THEME["font_family"], 10),
        ).pack(side="left", pady=(8, 0))

        # Status / scan-time indicators on the right
        status_block = ttk.Frame(header, style="TFrame")
        status_block.pack(side="right")

        self.scan_label = ttk.Label(
            status_block,
            text="● READY FOR INVESTIGATION",
            foreground=THEME["success"],
            background=THEME["bg"],
            font=(THEME["font_family"], 9, "bold"),
        )
        self.scan_label.pack(anchor="e")

        self.price_label = ttk.Label(
            status_block,
            text="BTC/USD: --",
            foreground=THEME["fg_dim"],
            background=THEME["bg"],
            font=(THEME["font_family"], 9),
        )
        self.price_label.pack(anchor="e", pady=(2, 0))

        # ===================== SEARCH BAR =====================
        search_bar = ttk.Frame(container, style="Glass.TFrame", padding=12)
        search_bar.pack(fill="x", side="top", pady=(0, 12))

        ttk.Label(
            search_bar,
            text="🔎  SEARCH WALLET / TX HASH",
            style="Panel.TLabel",
        ).pack(side="left", padx=(4, 8))

        self.entry = ttk.Entry(search_bar, width=58)
        self.entry.pack(side="left", fill="x", expand=True, padx=(0, 8))
        self.entry.bind("<Return>", lambda event: self.run_analysis())

        tb.Button(
            search_bar, text="ANALYZE", bootstyle="warning", command=self.run_analysis
        ).pack(side="left", padx=3)
        tb.Button(
            search_bar, text="WATCH", bootstyle="info", command=self.watch_wallet
        ).pack(side="left", padx=3)
        tb.Button(
            search_bar, text="POLL", bootstyle="secondary", command=self.poll_watchlist
        ).pack(side="left", padx=3)

        actions_menu = tb.Menubutton(search_bar, text="ACTIONS ▼", bootstyle="dark")
        menu = tk.Menu(actions_menu, tearoff=False, bg=THEME["glass"], fg=THEME["fg"],
                       activebackground=THEME["glass_border"], activeforeground=THEME["accent_amber"])
        menu.add_command(label="Export Report (JSON / PDF)", command=self.export)
        menu.add_command(label="Export Graph (PNG)", command=self.export_png)
        menu.add_separator()
        menu.add_command(label="Remove Watch", command=self.remove_watch)
        menu.add_command(label="Project Info", command=self.project_info_page)
        menu.add_separator()
        menu.add_command(label="Exit BlockTrace", command=self.quit_app)
        actions_menu["menu"] = menu
        actions_menu.pack(side="left", padx=3)

        # ===================== METRIC CARDS =====================
        metrics_row = ttk.Frame(container, style="TFrame")
        metrics_row.pack(fill="x", side="top", pady=(0, 12))

        self._metric_frames = {}
        metrics = [
            ("transactions", "TRANSACTIONS", "#22d3ee"),
            ("hops", "TRACE HOPS", "#ffb547"),
            ("evidence", "EVIDENCE TXNS", "#36d399"),
            ("risk", "RISK LEVEL", "#ff3b5c"),
        ]
        for i, (key, caption, accent) in enumerate(metrics):
            card = self._make_metric_card(metrics_row, caption, accent)
            card.pack(side="left", fill="x", expand=True, padx=(0 if i == 0 else 6, 0))
            self._metric_frames[key] = card

        # ===================== 3-PANE DASHBOARD =====================
        # NOTE: previously this row used pack(side="left", expand=False) for the
        # threat and timeline panels, which sized them off their Text widget's
        # requested character width instead of the window — that's what made the
        # third (timeline) panel look cramped. Using grid with explicit weighted
        # columns instead makes all three panels scale proportionally with the
        # window, and the timeline panel gets noticeably more room than before.
        panes = ttk.Frame(container, style="TFrame")
        panes.pack(fill="both", expand=True)
        panes.rowconfigure(0, weight=1)
        panes.columnconfigure(0, weight=2)  # threat intelligence
        panes.columnconfigure(1, weight=5)  # fund-flow graph (largest)
        panes.columnconfigure(2, weight=3)  # transaction timeline (was too narrow)

        # --- LEFT: Threat Intelligence ---
        self.threat_panel = self._make_panel(panes, "THREAT INTELLIGENCE", "#ff3b5c")
        self.threat_panel.grid(row=0, column=0, sticky="nsew", padx=(0, 6), pady=0)
        self.threat_text = self._make_text_widget(self.threat_panel, width=30)
        self.threat_text.pack(fill="both", expand=True, padx=10, pady=(4, 10))
        self.threat_text.tag_configure("high", foreground=THEME["neon_red"])
        self.threat_text.tag_configure("medium", foreground=THEME["neon_amber"])
        self.threat_text.tag_configure("low", foreground=THEME["success"])
        self.threat_text.tag_configure("dim", foreground=THEME["fg_dim"])
        self.threat_text.tag_configure("header", foreground=THEME["fg"], font=(THEME["font_family"], 10, "bold"))
        self._set_panel_text(self.threat_text, "")

        # --- CENTER: Graph ---
        self.graph_panel = self._make_panel(panes, "FUND FLOW NETWORK", "#ffb547")
        self.graph_panel.grid(row=0, column=1, sticky="nsew", padx=6, pady=0)

        self.fig, self.ax = plt.subplots(figsize=(12, 7), facecolor=THEME["bg_panel_2"])
        self.canvas = FigureCanvasTkAgg(self.fig, master=self.graph_panel)
        self.canvas.get_tk_widget().pack(fill="both", expand=True, padx=8, pady=(4, 8))
        self._draw_empty_state()

        # Scan progress bar (hidden by default, shown during analysis)
        self.scan_progress = ttk.Progressbar(
            self.graph_panel, mode="indeterminate", style="Horizontal.TProgressbar"
        )
        self.scan_progress.pack(fill="x", padx=8, pady=(0, 8))
        self.scan_progress.pack_forget()

        # --- RIGHT: Timeline ---
        self.timeline_panel = self._make_panel(panes, "TRANSACTION TIMELINE", "#22d3ee")
        self.timeline_panel.grid(row=0, column=2, sticky="nsew", padx=(6, 0), pady=0)
        self.timeline_text = self._make_text_widget(self.timeline_panel, width=40)
        self.timeline_text.pack(fill="both", expand=True, padx=10, pady=(4, 10))
        self.timeline_text.tag_configure("header", foreground=THEME["fg"], font=(THEME["font_family"], 10, "bold"))
        self.timeline_text.tag_configure("hash", foreground=THEME["accent_cyan"], font=("Consolas", 8))
        self.timeline_text.tag_configure("amt", foreground=THEME["neon_amber"], font=(THEME["font_family"], 9, "bold"))
        self.timeline_text.tag_configure("usd", foreground=THEME["success"])
        self.timeline_text.tag_configure("dim", foreground=THEME["fg_dim"])
        self._set_panel_text(self.timeline_text, "")

        # --- STATUS / DETAILS BAR ---
        self.details_label = ttk.Label(
            container,
            text="No investigation loaded — enter a wallet address or transaction hash.",
            style="Panel.TLabel",
            wraplength=1500,
        )
        self.details_label.pack(fill="x", side="bottom", pady=(10, 0))

    def _make_panel(self, parent, title, accent_hex):
        panel = ttk.Frame(parent, style="Panel.TFrame", padding=0)
        header = ttk.Frame(panel, style="Glass.TFrame", padding=(10, 6))
        header.pack(fill="x", side="top", padx=6, pady=(6, 0))
        ttk.Label(
            header,
            text=f"▍ {title}",
            foreground=accent_hex,
            background=THEME["glass"],
            font=(THEME["font_family"], 10, "bold"),
        ).pack(side="left")
        return panel

    def _make_text_widget(self, parent, width):
        text = tk.Text(
            parent,
            width=width,
            bg=THEME["bg_panel_2"],
            fg=THEME["fg"],
            insertbackground=THEME["neon_amber"],
            relief="flat",
            wrap="word",
            padx=8,
            pady=8,
            spacing3=4,
            selectbackground=THEME["glass_border"],
            font=(THEME["font_family"], 9),
            highlightthickness=0,
        )
        return text

    def _make_metric_card(self, parent, caption, accent):
        card = ttk.Frame(parent, style="Glass.TFrame", padding=(14, 8))
        ttk.Label(card, text=caption, style="MetricCaption.TLabel").pack(anchor="w")
        value = tk.Label(
            card,
            text="--",
            bg=THEME["glass"],
            fg=accent,
            font=(THEME["font_family"], 22, "bold"),
        )
        value.pack(anchor="w", pady=(2, 0))
        return value

    # ------------------------------------------------------------------
    # Text helpers
    # ------------------------------------------------------------------
    def _set_panel_text(self, widget, content):
        widget.configure(state="normal")
        widget.delete("1.0", "end")
        widget.insert("1.0", content)
        widget.configure(state="disabled")

    def _draw_scanning_state(self, wallet):
        """Show an animated 'scanning' message in the graph panel."""
        self.ax.clear()
        self.fig.patch.set_facecolor(THEME["bg_panel_2"])
        self.ax.set_facecolor(THEME["bg_panel_2"])
        self.ax.text(
            0.5, 0.58, "SCANNING BLOCKCHAIN...",
            transform=self.ax.transAxes, ha="center", va="center",
            fontsize=24, fontweight="bold", color=THEME["neon_amber"],
        )
        self.ax.text(
            0.5, 0.48,
            f"{truncate_address(wallet)}",
            transform=self.ax.transAxes, ha="center", va="center",
            fontsize=12, color=THEME["fg"],
        )
        self.ax.text(
            0.5, 0.40,
            "Fetching transaction history from public explorer...",
            transform=self.ax.transAxes, ha="center", va="center",
            fontsize=10, color=THEME["fg_dim"],
        )
        self.ax.set_axis_off()
        self.canvas.draw()

    def _set_default_panel_text(self, threat_text, timeline_text):
        """Show informative placeholder text in the side panels."""
        self._set_panel_text(self.threat_text, threat_text)
        self._set_panel_text(self.timeline_text, timeline_text)

    def _stop_scan_progress(self):
        """Stop and hide the indeterminate progress bar."""
        self.scan_progress.stop()
        self.scan_progress.pack_forget()

    # ------------------------------------------------------------------
    # BTC price (async)
    # ------------------------------------------------------------------
    def _load_btc_price_async(self):
        def fetch():
            price = get_btc_usd_price()
            self._worker_queue.put(("price", price))

        threading.Thread(target=fetch, daemon=True).start()

    # ------------------------------------------------------------------
    # Queue polling (keeps UI responsive)
    # ------------------------------------------------------------------
    def _poll_queue(self):
        try:
            while True:
                kind, payload = self._worker_queue.get_nowait()
                if kind == "price":
                    self._apply_price(payload)
                elif kind == "analysis":
                    self._apply_analysis(payload)
                elif kind == "poll":
                    self._apply_poll_results(payload)
                elif kind == "poll_error":
                    self.scan_label.config(
                        text="● POLL FAILED", foreground=THEME["neon_red"]
                    )
                    messagebox.showerror("Watchlist Poll Failed", payload)
        except queue.Empty:
            pass
        self.root.after(80, self._poll_queue)

    # ------------------------------------------------------------------
    # Analysis (async)
    # ------------------------------------------------------------------
    def run_analysis(self):
        """Start the analysis in a background thread so the UI stays responsive."""
        wallet = self.entry.get().strip()
        if not wallet:
            messagebox.showwarning("Input Error", "Please enter a wallet address.")
            return
        if self._loading:
            messagebox.showinfo("Already running", "An analysis is already in progress.")
            return

        self._loading = True
        self.scan_label.config(
            text="● ANALYZING...", foreground=THEME["neon_amber"]
        )
        self.details_label.config(
            text=f"Scanning {truncate_address(wallet)} — contacting blockchain explorer..."
        )
        self.scan_progress.pack(after=self.canvas.get_tk_widget(), fill="x", padx=8, pady=(0, 8))
        self.scan_progress.start(12)
        self._draw_scanning_state(wallet)
        self._set_default_panel_text(
            "Scanning blockchain...\n\nFetching transaction history\nand building fund-flow graph.\n\nThis may take a few seconds.",
            "Analyzing wallet...\n\nContacting public blockchain explorer.\n\nTransaction timeline will appear here\nonce the scan completes.",
        )

        def worker():
            try:
                result = self._perform_analysis(wallet)
                self._worker_queue.put(("analysis", result))
            except Exception as error:  # pragma: no cover - defensive
                result = {
                    "wallet": wallet,
                    "error": str(error),
                }
                self._worker_queue.put(("analysis", result))

        self._worker = threading.Thread(target=worker, daemon=True)
        self._worker.start()

    def _perform_analysis(self, wallet):
        """Run the full analysis pipeline (blocking; called in a worker thread)."""
        reputation_details = get_wallet_reputation(wallet)
        reputation = check_wallet(wallet)
        data, chain = get_wallet_transactions(wallet)
        tx_count = len(data.get("txs", [])) if data else 0

        # If the public explorer is unreachable, gracefully fall back to the
        # simulated demo trail instead of failing, so the UI always produces output.
        if chain in ("BTC", "BTC_TRANSACTION") and data is None:
            tracker = BlockchainTracker(
                SIMULATED_TRAIL, "Victim_Wallet", "Attacker_Cold_Storage_FINAL"
            )
            is_simulation = True
            chain = "BTC (SIMULATED)"
            tx_count = 0
        elif chain in ("BTC", "BTC_TRANSACTION"):
            trace_wallet = wallet
            if chain == "BTC_TRANSACTION":
                transaction = data.get("txs", [{}])[0] if data else {}
                input_addresses = [
                    item.get("prev_out", {}).get("addr")
                    for item in transaction.get("inputs", [])
                ]
                trace_wallet = next(
                    (address for address in input_addresses if address), ""
                )
                if not trace_wallet:
                    return {
                        "wallet": wallet,
                        "chain": chain,
                        "error": "No traceable input address",
                        "tx_count": tx_count,
                    }
            tracker = BlockchainTracker.from_dynamic_btc_trace(trace_wallet, limit=5)
            is_simulation = False
        else:
            tracker = BlockchainTracker(
                SIMULATED_TRAIL, "Victim_Wallet", "Attacker_Cold_Storage_FINAL"
            )
            is_simulation = True

        graph_reputation = get_graph_reputation(tracker.G.nodes())
        graph_risk = summarize_graph_risk(tracker.G, graph_reputation)
        metrics = tracker.get_metrics()

        same_wallet = self.previous_wallet == wallet
        baseline_count = self.previous_tx_count if same_wallet else tx_count
        alert = evaluate_transaction_alert(baseline_count, tx_count)

        return {
            "wallet": wallet,
            "chain": chain,
            "reputation": reputation,
            "reputation_details": reputation_details,
            "graph_reputation": graph_reputation,
            "graph_risk": graph_risk,
            "alert": alert,
            "metrics": metrics,
            "tracker": tracker,
            "transactions": tx_count,
            "is_simulated": is_simulation,
        }

    def _apply_analysis(self, result):
        """Apply an analysis result on the UI thread."""
        self._loading = False
        self._stop_scan_progress()

        if result.get("error"):
            self.scan_label.config(
                text="● SCAN FAILED", foreground=THEME["neon_red"]
            )
            self.details_label.config(text=result["error"])
            messagebox.showerror(
                "Blockchain data unavailable",
                result["error"] + "\nCheck your connection or try again later.",
            )
            return

        wallet = result["wallet"]
        chain = result["chain"]
        metrics = result["metrics"]
        graph_risk = result["graph_risk"]
        alert = result["alert"]
        is_simulation = result["is_simulated"]
        tx_count = result["transactions"]

        # Update summary cards
        self._metric_frames["transactions"].config(text=str(tx_count))
        self._metric_frames["hops"].config(text=str(metrics["hops"]))
        self._metric_frames["evidence"].config(
            text=str(len(metrics["path_transaction_ids"]))
        )
        risk_level = graph_risk["level"]
        risk_color = RISK_COLORS.get(risk_level, THEME["fg_dim"])
        self._metric_frames["risk"].config(text=risk_level.upper(), fg=risk_color)

        # Update side panels
        self._render_threat_panel(result)
        self._render_timeline_panel(result)

        # Render graph
        self._draw_graph(
            result["tracker"], is_simulation, result["graph_reputation"]
        )

        # Status / scan indicator
        now = datetime.now().strftime("%H:%M:%S")
        self.scan_label.config(
            text=f"● LAST SCAN {now}", foreground=THEME["success"]
        )
        self.details_label.config(
            text=(
                f"Wallet: {truncate_address(wallet)}    Chain: {chain}    "
                f"Reputation: {result['reputation']}    "
                f"Labeled graph addresses: {graph_risk['labeled_addresses']}    "
                f"Risk: {graph_risk['level'].upper()}    "
                f"Hops: {metrics['hops']}    "
                f"Flow bottleneck: {metrics['path_amount']:.8f} BTC\n"
                f"Start: {truncate_address(metrics['start'])}    "
                f"End (terminal): {truncate_address(metrics['end'])}    "
                f"Evidence txns: {len(metrics['path_transaction_ids'])}\n"
                f"Monitoring: {alert['reason']}    "
                f"Note: {justify_simulation() if is_simulation else 'Real transaction data fetched dynamically from public explorers.'}"
            )
        )

        if alert["triggered"]:
            messagebox.showwarning("Alert", alert["reason"])

        self.previous_tx_count = tx_count
        self.previous_wallet = wallet
        self.current_report = {
            "chain": chain,
            "reputation": result["reputation"],
            "reputation_details": result["reputation_details"],
            "graph_reputation": result["graph_reputation"],
            "graph_risk": graph_risk,
            "alert": alert,
            "metrics": metrics,
            "transactions": tx_count,
            "is_simulated": is_simulation,
        }

    # ------------------------------------------------------------------
    # Threat panel rendering
    # ------------------------------------------------------------------
    def _render_threat_panel(self, result):
        graph_risk = result["graph_risk"]
        graph_reputation = result["graph_reputation"]

        self._set_panel_text(self.threat_text, "")
        self.threat_text.configure(state="normal")

        level = graph_risk["level"].upper()
        self.threat_text.insert("end", f"OVERALL RISK  [ ", )
        self.threat_text.tag_add("header", "1.0", "end")
        self.threat_text.insert("end", f"{level}", "high" if level == "HIGH" else "medium" if level == "MEDIUM" else "low")
        self.threat_text.insert("end", " ]\n")
        self.threat_text.insert(
            "end",
            f"LABELED NODES   {graph_risk['labeled_addresses']}\n"
            f"CONFIRMED SOURCE   local_rw_db\n\n",
            "dim",
        )

        for address, finding in graph_risk["findings"].items():
            if finding["indicators"]:
                display = truncate_address(address)
                level_tag = finding["level"]
                self.threat_text.insert("end", f"◉ [{level_tag.upper()}] {display}\n", level_tag)
                for indicator in finding["indicators"]:
                    self.threat_text.insert("end", f"    • {indicator}\n", "dim")

        self.threat_text.insert(
            "end",
            "\nHeuristics: fan-in / fan-out are investigation indicators,\n"
            "not proof of criminal activity.",
            "dim",
        )
        self.threat_text.configure(state="disabled")

    # ------------------------------------------------------------------
    # Timeline panel rendering
    # ------------------------------------------------------------------
    def _render_timeline_panel(self, result):
        self._set_panel_text(self.timeline_text, "")
        self.timeline_text.configure(state="normal")

        price = self._btc_usd_price
        metrics = result["metrics"]

        entries = []
        for edge in metrics["edges"]:
            for record in edge["transaction_records"]:
                entries.append((record, edge))

        # Sort by timestamp descending (most recent first)
        entries.sort(key=lambda item: item[0].get("timestamp") or 0, reverse=True)

        if not entries:
            self.timeline_text.insert(
                "end",
                "Transaction timestamps and hashes will appear here\n"
                "when provided by the explorer.",
                "dim",
            )
            self.timeline_text.configure(state="disabled")
            return

        for record, edge in entries:
            timestamp = record.get("timestamp") or "time unavailable"
            tx_hash = record.get("id") or "unknown"
            amount = edge.get("amount", 0.0)
            source = truncate_address(edge["source"])
            target = truncate_address(edge["target"])

            if isinstance(timestamp, (int, float)):
                formatted_time = datetime.fromtimestamp(timestamp).strftime(
                    "%Y-%m-%d %H:%M:%S"
                )
            else:
                formatted_time = timestamp
            self.timeline_text.insert(
                "end", f"▸ {formatted_time}\n", "header"
            )
            self.timeline_text.insert("end", f"{source}  →  {target}\n", "dim")
            usd_text = ""
            if price:
                usd_text = f"   ≈ ${amount * price:,.2f} USD"
            self.timeline_text.insert("end", f"{amount:,.8f} BTC{usd_text}\n", "amt")
            self.timeline_text.insert("end", f"{tx_hash}\n\n", "hash")

        self.timeline_text.configure(state="disabled")

    # ------------------------------------------------------------------
    # Graph rendering
    # ------------------------------------------------------------------
    def _draw_empty_state(self):
        self.ax.clear()
        self.fig.patch.set_facecolor(THEME["bg_panel_2"])
        self.ax.set_facecolor(THEME["bg_panel_2"])
        self.ax.text(
            0.5, 0.56, "NO INVESTIGATION LOADED",
            transform=self.ax.transAxes, ha="center", va="center",
            fontsize=22, fontweight="bold", color=THEME["fg"],
        )
        self.ax.text(
            0.5, 0.46,
            "Enter a wallet address or Bitcoin transaction hash above to begin tracing",
            transform=self.ax.transAxes, ha="center", va="center",
            fontsize=11, color=THEME["fg_dim"],
        )
        self.ax.set_axis_off()
        self.canvas.draw()

    def _draw_graph(self, tracker, is_simulation=True, graph_reputation=None):
        """Render the glowing fund-flow network graph with animated arrows."""
        self.ax.clear()
        self.fig.patch.set_facecolor(THEME["bg_panel_2"])
        self.ax.set_facecolor(THEME["bg_panel_2"])

        G = tracker.G
        node_count = G.number_of_nodes()

        if is_simulation:
            pos = {
                "Victim_Wallet": (0, 0),
                "Ransom_Address_1A": (2.8, 0),
                "Fee_Address_01": (2.8, -2.0),
                "Intermediate_Wallet_2B": (5.3, 0),
                "Change_Address_2C": (5.3, 2.0),
                "Aggregator_Wallet_3C": (8.1, 0),
                "Fake_Victim_X": (8.1, -2.0),
                "Split_A_4D": (11.0, 1.2),
                "Split_B_4E": (11.0, -1.2),
                "Mixer_Entry_5F": (13.8, 0),
                "Attacker_Cold_Storage_FINAL": (16.0, 0),
            }
        else:
            # A real wallet trace can pull in a large number of raw neighbor
            # addresses (every output of every fetched tx, not just the ones
            # actually traced further). A fixed k was too tight for graphs that
            # size and produced an overlapping hairball, so spacing now grows
            # with node count to keep the layout readable.
            k = max(2.2, 9.0 / max(node_count, 1) ** 0.5)
            pos = nx.spring_layout(G, k=k, seed=42, iterations=80)

        for node in G.nodes():
            if node not in pos:
                pos[node] = (0.0, 0.0)

        graph_reputation = graph_reputation or {}

        # The subset of nodes worth calling out by name: the traced path,
        # the source/target endpoints, and anything matched in the local
        # reputation database. Everything else is real data (kept for the
        # threat panel and exports) but rendered as an unlabeled dot so large
        # traces stay legible instead of drowning in overlapping text.
        important_nodes = set(tracker.malicious_path) | {tracker.source, tracker.target}
        important_nodes |= {
            node for node, rep in graph_reputation.items() if rep.get("matched")
        }
        declutter = (not is_simulation) and node_count > 25
        hidden_label_count = (node_count - len(important_nodes)) if declutter else 0

        # Node styling
        node_colors = []
        node_sizes = []
        for node in G.nodes():
            if graph_reputation.get(node, {}).get("matched"):
                node_colors.append(THEME["node_label"])
            elif node == tracker.source:
                node_colors.append(THEME["node_victim"])
            elif node == tracker.target:
                node_colors.append(THEME["node_mixer"])
            elif node in tracker.malicious_path:
                node_colors.append(THEME["node_trail"])
            else:
                node_colors.append(THEME["node_noise"])

            if node == tracker.source or node == tracker.target:
                node_sizes.append(1800)
            elif node in tracker.malicious_path:
                node_sizes.append(1300)
            elif declutter and node not in important_nodes:
                node_sizes.append(280)
            else:
                node_sizes.append(900)

        # Path edges
        path_edges = list(zip(tracker.malicious_path, tracker.malicious_path[1:]))
        path_edge_set = set(path_edges)
        if declutter:
            # Keep only edges that touch an important node so the raw fan-out
            # noise (dozens of thin lines to minor addresses) doesn't drown
            # out the actual trail. The full edge set still exists in
            # tracker.G for the threat panel, JSON export, and PDF report.
            regular_edges = [
                edge for edge in G.edges()
                if edge not in path_edge_set
                and (edge[0] in important_nodes or edge[1] in important_nodes)
            ]
        else:
            regular_edges = [edge for edge in G.edges() if edge not in path_edge_set]

        # --- Glow effect: draw larger translucent nodes underneath ---
        nx.draw_networkx_nodes(
            G, pos, ax=self.ax, node_color=node_colors,
            node_size=[s * 1.6 for s in node_sizes], alpha=0.18,
        )

        # --- Regular edges ---
        if regular_edges:
            nx.draw_networkx_edges(
                G, pos, ax=self.ax, edgelist=regular_edges,
                arrowstyle="-|>", arrowsize=14,
                edge_color=THEME["edge_regular"], width=1.1, alpha=0.65,
                connectionstyle="arc3,rad=0.12",
            )

        # --- Path edges (glowing amber) ---
        if path_edges:
            # Glow pass
            nx.draw_networkx_edges(
                G, pos, ax=self.ax, edgelist=path_edges,
                arrowstyle="-|>", arrowsize=22,
                edge_color=THEME["node_trail"], width=5.0, alpha=0.2,
                connectionstyle="arc3,rad=0.12",
            )
            # Solid pass
            nx.draw_networkx_edges(
                G, pos, ax=self.ax, edgelist=path_edges,
                arrowstyle="-|>", arrowsize=22,
                edge_color=THEME["node_trail"], width=2.6, alpha=0.95,
                connectionstyle="arc3,rad=0.12",
            )

        # --- Main nodes ---
        nx.draw_networkx_nodes(
            G, pos, ax=self.ax, node_color=node_colors, node_size=node_sizes,
            edgecolors="#0a0e17", linewidths=1.2,
        )

        # --- Labels ---
        for n, (x, y) in pos.items():
            if declutter and n not in important_nodes:
                continue

            if is_simulation:
                label_y = y + (0.42 if abs(y) < 1.2 else 0.28)
            else:
                label_y = y + 0.12

            display = truncate_address(n, head=8, tail=4)
            label_color = "#e7edf5"
            if graph_reputation.get(n, {}).get("matched"):
                label_color = THEME["neon_red"]

            self.ax.text(
                x, label_y, display,
                horizontalalignment="center", fontsize=8,
                color=label_color,
                bbox=dict(facecolor=THEME["bg_panel"], alpha=0.85,
                          edgecolor=THEME["glass_border"], boxstyle="round,pad=0.3"),
            )

        # --- Edge amount labels ---
        edge_labels = {(u, v): f"{d.get('amount', 0.0):.4f} BTC" for u, v, d in G.edges(data=True)}
        for (u, v), label in edge_labels.items():
            if declutter and (u, v) not in path_edge_set and not (
                u in important_nodes and v in important_nodes
            ):
                continue
            if u in pos and v in pos:
                ux, uy = pos[u]
                vx, vy = pos[v]
                mx, my = (ux + vx) / 2.0, (uy + vy) / 2.0
                self.ax.text(
                    mx, my, label, fontsize=7.5, color=THEME["neon_amber"],
                    ha="center", va="center",
                    bbox=dict(facecolor=THEME["bg_panel"], alpha=0.9,
                              edgecolor="none", boxstyle="round,pad=0.2"),
                )

        # --- Legend ---
        legend_patches = [
            mpatches.Patch(color=THEME["node_victim"], label="Victim / Source"),
            mpatches.Patch(color=THEME["node_trail"], label="Main Trail"),
            mpatches.Patch(color=THEME["node_mixer"], label="Mixer / Terminal"),
            mpatches.Patch(color=THEME["node_label"], label="Known Label"),
            mpatches.Patch(color=THEME["node_noise"], label="Noise / Change"),
        ]
        self.ax.legend(
            handles=legend_patches, loc="upper left", fontsize=8,
            facecolor=THEME["bg_panel"], edgecolor=THEME["glass_border"],
            labelcolor=THEME["fg"], framealpha=0.9,
        )

        if hidden_label_count > 0:
            self.ax.text(
                0.99, 0.02,
                f"+{hidden_label_count} minor addresses (labels hidden for clarity — "
                f"still included in threat scan & export)",
                transform=self.ax.transAxes, ha="right", va="bottom",
                fontsize=8, color=THEME["fg_dim"], style="italic",
            )

        self.ax.set_title(
            f"{self.tool_name}  /  RANSOMWARE TRANSACTION FLOW",
            fontsize=14, color=THEME["fg"], pad=18, fontweight="bold",
        )
        self.ax.set_axis_off()
        self.fig.tight_layout()
        self.canvas.draw()

        # --- Animated particles flowing along path edges ---
        self._start_edge_animation(pos, path_edges, tracker)

    def _start_edge_animation(self, pos, path_edges, tracker):
        """Animate glowing particles flowing along the main trail edges."""
        if self._anim:
            try:
                self._anim.event_source.stop()
            except Exception:
                pass
            self._anim = None

        if not path_edges or len(path_edges) < 1:
            return

        # Pre-compute edge midpoints and directions for particle motion
        particles = []
        for edge in path_edges:
            if edge[0] not in pos or edge[1] not in pos:
                continue
            x1, y1 = pos[edge[0]]
            x2, y2 = pos[edge[1]]
            # Midpoint trajectory
            mid_x = (x1 + x2) / 2
            mid_y = (y1 + y2) / 2
            dx = (x2 - x1) * 0.5
            dy = (y2 - y1) * 0.5
            particles.append({"x": mid_x, "y": mid_y, "dx": dx, "dy": dy})

        self._particle_scatter = self.ax.scatter(
            [p["x"] for p in particles],
            [p["y"] for p in particles],
            c=THEME["node_trail"], s=45, alpha=0.9, zorder=10,
        )

        def update(frame):
            offset = (frame % 60) / 60.0  # 0 -> 1
            xs, ys = [], []
            for p in particles:
                # Sine-wave oscillation along the edge for a flowing effect
                t = (offset + 0.5) % 1.0
                xs.append(p["x"] + p["dx"] * (2 * t - 1))
                ys.append(p["y"] + p["dy"] * (2 * t - 1))
            self._particle_scatter.set_offsets(list(zip(xs, ys)))
            return (self._particle_scatter,)

        try:
            self._anim = animation.FuncAnimation(
                self.fig, update, frames=60, interval=40, blit=True, repeat=True
            )
            self.canvas.draw_idle()
        except Exception:
            self._anim = None

    # ------------------------------------------------------------------
    # Pricing helper
    # ------------------------------------------------------------------
    def _apply_price(self, price):
        if price:
            self._btc_usd_price = price
            self.price_label.config(
                text=f"BTC/USD: ${price:,.2f}", foreground=THEME["accent_cyan"]
            )

    # ------------------------------------------------------------------
    # Watchlist
    # ------------------------------------------------------------------
    def watch_wallet(self):
        wallet = self.entry.get().strip()
        if not wallet:
            messagebox.showwarning("Input Error", "Enter a wallet address to monitor.")
            return
        chain = detect_chain(wallet)
        self.watchlist_store.add(wallet, chain=chain)
        messagebox.showinfo("Watchlist Updated", f"Monitoring enabled for {wallet}\nChain: {chain}")

    def remove_watch(self):
        wallet = self.entry.get().strip()
        if not wallet:
            messagebox.showwarning("Input Error", "Enter a wallet address to remove.")
            return
        if self.watchlist_store.remove(wallet):
            messagebox.showinfo("Watchlist Updated", f"Monitoring removed for {wallet}.")
        else:
            messagebox.showinfo("Watchlist", f"No monitoring entry found for {wallet}.")

    def poll_watchlist(self):
        def worker():
            try:
                results = poll_watchlist(
                    self.watchlist_store, get_wallet_transactions
                )
                self._worker_queue.put(("poll", results))
            except Exception as error:
                self._worker_queue.put(("poll_error", str(error)))

        self.scan_label.config(
            text="● POLLING WATCHLIST...", foreground=THEME["neon_amber"]
        )
        threading.Thread(target=worker, daemon=True).start()

    def _apply_poll_results(self, results):
        """Apply watchlist polling results on the UI thread."""
        alerts = [
            result["alert"]["reason"]
            for result in results
            if result["alert"]["triggered"]
        ]
        if alerts:
            self.scan_label.config(
                text="● ALERTS DETECTED", foreground=THEME["neon_red"]
            )
            messagebox.showwarning("Watchlist Alerts", "\n".join(alerts))
        else:
            self.scan_label.config(
                text="● POLL COMPLETE", foreground=THEME["success"]
            )
            messagebox.showinfo(
                "Watchlist",
                f"Polled {len(results)} wallet(s). No new transactions detected.",
            )

    # ------------------------------------------------------------------
    # App lifecycle
    # ------------------------------------------------------------------
    def quit_app(self):
        """Gracefully stop animations and close the application."""
        if self._anim:
            try:
                self._anim.event_source.stop()
            except Exception:
                pass
            self._anim = None
        try:
            self.scan_progress.stop()
        except Exception:
            pass
        self.root.destroy()

    # ------------------------------------------------------------------
    # Export
    # ------------------------------------------------------------------
    def export(self):
        if not hasattr(self, "current_report") or self.current_report is None:
            messagebox.showwarning("Nothing to export", "Please run analysis first.")
            return
        wallet = self.entry.get().strip() or "report"
        json_file, pdf_file = export_report(wallet, self.current_report)
        messagebox.showinfo("Export Successful", f"Saved:\n{json_file}\n{pdf_file}")

    def export_png(self):
        if not hasattr(self, "current_report") or self.current_report is None:
            messagebox.showwarning("Nothing to export", "Run analysis first.")
            return
        wallet = self.entry.get().strip() or "graph"
        try:
            png_file = export_png(self.fig, wallet)
            messagebox.showinfo("PNG Saved", f"Graph image saved as:\n{png_file}")
        except Exception as error:
            messagebox.showerror("Export Error", f"Could not save PNG: {error}")

    # ------------------------------------------------------------------
    # Project info
    # ------------------------------------------------------------------
    def project_info_page(self):
        top = tk.Toplevel(self.root)
        top.title(f"{self.tool_name} - Project Information")
        top.geometry("780x560")
        top.configure(bg=THEME["bg"])
        top.transient(self.root)

        container = ttk.Frame(top, style="TFrame", padding=16)
        container.pack(fill="both", expand=True)

        header = ttk.Label(
            container,
            text=f"{self.tool_name} — Blockchain OSINT Ransomware Tracing",
            font=(THEME["font_family"], 15, "bold"),
            background=THEME["bg"],
            foreground=THEME["accent_amber"],
        )
        header.pack(anchor="w", pady=(0, 12))

        sections = [
            ("Institution", "Geethanjali College of Engineering and Technology"),
            ("Department", "Computer Science & Engineering (Specialization: Cybersecurity)"),
            (
                "Team (5 Members)",
                "1. Vaishnavi Pratha  – ST#IS#7471 – vaishnaviipratha@gmail.com\n"
                "2. Sadhupally Saivarun – ST#IS#7455 – sadhupallysaivarun@gmail.com\n"
                "3. Ch.Pavan – ST#IS#7470 – pavanvinay682@gmail.com\n"
                "4. Bhanu Charan Dappu – ST#IS#7475 – dappubhanu18@gmail.com\n"
                "5. Saikumar Bonthala – ST#IS#7473 – b.saikumar4682@gmail.com",
            ),
            (
                "Project Description",
                "Tracing ransomware & illicit cryptocurrency transactions using public blockchain "
                "data. The tool visualizes flows, flags known malicious wallets, and exports "
                "investigation reports.",
            ),
            (
                "Current Workflow",
                "Enter a wallet address, detect its chain, fetch public history, trace bounded "
                "Bitcoin fund flow, inspect graph evidence, review local reputation findings, "
                "and export the investigation report.",
            ),
            (
                "Data Scope",
                "Live tracing currently supports Bitcoin through public explorers with automatic "
                "failover. Other recognized address formats use the clearly-marked simulated "
                "visualization fallback. Edge evidence includes transaction IDs and block metadata.",
            ),
            ("Technologies", "Python, ttkbootstrap, NetworkX, Matplotlib, public blockchain APIs, OSINT methods."),
            ("Notes on Simulation", justify_simulation()),
            ("Declaration", "This project is developed for academic and investigative purposes only."),
        ]

        for title, text in sections:
            ttk.Label(
                container,
                text=title,
                font=(THEME["font_family"], 11, "bold"),
                background=THEME["bg"],
                foreground=THEME["neon_amber"],
            ).pack(anchor="w", pady=(10, 2))
            ttk.Label(
                container,
                text=text,
                wraplength=720,
                justify="left",
                background=THEME["bg"],
                foreground=THEME["fg"],
            ).pack(anchor="w")

        ttk.Button(
            container, text="Close", command=top.destroy, style="Accent.TButton"
        ).pack(anchor="e", pady=(16, 0))
        top.bind("<Escape>", lambda event: top.destroy())