v0.31.0

Added

• Case password protection — lock a case with a password (🔒 in the case lifecycle menu); optional "remember on this computer", enforced server-side via an unlock cookie.
• Expandable Host & Account Ranking rows — click a ranked row to see its events/IOCs inline and jump to a cited event in the timeline.
• DFIR-IRIS push case-name override — the push dialog shows and lets you edit the target case name, remembered for future pushes.
• Per-case AI cost tracking — Settings → Diagnostics shows real per-call cost/tokens by Vision/Synthesis/Other and by model.
• Per-case IOC exclude list — exact/suffix/regex rules purge matching IOCs immediately and block their re-import.
• Import upload-only Velociraptor artifacts — paste the GUI's "Uploaded Files" tab URL to import THOR/report-only uploads (now also .csv/.txt/.log/.jsonl).
• Timesketch export (Super Timeline) — push/download the full super-timeline alongside the existing Forensic Timeline export, into separate timelines.
• Vim-style keyboard navigation for the Forensic Timeline — j/k/f/i/p/n/?; toggle in Settings → General, default on (closes #33).
• Permanently delete a case — 🗑️ Delete… in the lifecycle menu, with an optional pre-delete ZIP/encrypted archive.
• Authoritative IOC-to-event provenance for 5 priority importers — IOCs tagged with their exact source-event row, shown as "linked" vs "approximate" (closes #26).
• Evidence drop-folder audit log (drop-log.txt) — every auto-processed file's outcome (imported/failed/pending + reason) is logged.

Changed

• Findings and IOCs panels redesigned as dense tables — grid columns, icon action buttons, and expandable evidence with a real cited-event timeline.
• Full case export/import is now an encrypted archive, not a JSON snapshot — .dfircase zips the whole case directory under AES-256-GCM.
• Pinned Findings folded into the Findings panel — no longer a separate dashboard section.
• Analyst is now the default dashboard view — for any case with no saved per-case choice; Custom still sticks once chosen.

Fixed

• A case's password wasn't asked for again unless you fully closed the browser — setting/changing a password no longer auto-unlocks the setter, and a not-remembered unlock is now forgotten on switch-away/refresh/close.
• "Remove password" always worked even with no password set — Save/Remove now reflect the case's real lock state.
• Timeline Anomalies and other deterministic panels didn't refresh on scope change — they now reload immediately instead of waiting on the next AI re-synthesis.
• Customer Exposure never auto-discovered a domain from the case's own FQDN hosts — now added as an "auto" chip, same as auto-discovered emails.
• DFIR-IRIS push could silently land in an unrelated case — now only reuses a case on an exact name match.
• Dotted config/artifact identifiers misclassified as domain IOCs — the last label must now be a real, commonly-registered TLD.
• Timeline coverage-gap findings survived a scope change — gap findings are now back-linked to their bounding events.
• Structured hostname/fqdn/domain columns skipped internal-zone filtering — .lan/.local/.corp/etc. are now excluded, matching free-text scraping.
• Cited-event badges couldn't be right-clicked to open in a new tab — they now carry a real deep link.
• Timesketch push failures logged a bare fetch failed — the real network cause (ECONNREFUSED/ENOTFOUND/TLS error) is now surfaced.
• A hunt deleted in Velociraptor showed a misleading "collect again later" — now flagged stoppedEarly when terminal well before its scheduled expiry.
• Duplicate-looking playbook items — a next step citing a finding that already has its own auto-task is folded into that task instead of duplicated.
• Marking a finding false positive didn't hide it until the next AI re-synthesis — it now disappears from the Findings panel instantly.
• Key Investigative Questions kept a stale "answered" status after their finding was marked false positive — now force a re-answer or reset to "unknown".
• Timeline row timestamps stuck to the top instead of centering — now vertically centers against the full row height, including multi-line rows.