fix: policy_read accidental defaults merge from module split

- _policy_read: remove erroneous _POLICY_DEFAULTS merge (introduced during split)
- fmt.sh: fmt::bytes extracted from cmd::activity::_fmt_bytes
- identity/subnet/policy list: ui::sort_rows applied
- ctx::policies moved from policy.module.sh to context.sh

commands/activity.command.sh

@@ -104,7 +104,7 @@ function cmd::activity::run() {
     return 0
   fi
 
-  # Measure w_peer and w_drops from data
+  # Measure column widths
   local w_peer=16 w_drops=1
   while IFS='|' read -r type rest; do
     case "$type" in
@@ -125,9 +125,9 @@ function cmd::activity::run() {
  
   (( w_peer += 2 ))
  
-  # Compute exact column where drop count starts on peer row:
+  # Compute column where drop count starts on peer row:
   # "  " (2) + name (w_peer) + "  ↓" (3) + rx (10) + "  ↑" (3) + tx (10) + "  " (2)
-  # Note: ↓ and ↑ are multi-byte (3 bytes) but display as 1 char — account for 2 extra bytes each
+  # ↓ and ↑ are multi-byte (3 bytes, 1 visible) — 2 extra bytes each
   # Visible: 2 + w_peer + 2+1 + 10 + 2+1 + 10 + 2 = w_peer + 30
   local drops_col=$(( w_peer + 30 ))
  
@@ -155,8 +155,8 @@ function cmd::activity::run() {
         first_peer=false
  
         local rx_fmt tx_fmt
-        rx_fmt=$(cmd::activity::_fmt_bytes "$rx")
-        tx_fmt=$(cmd::activity::_fmt_bytes "$tx")
+        rx_fmt=$(fmt::bytes "$rx")
+        tx_fmt=$(fmt::bytes "$tx")
  
         local name_pad rx_pad tx_pad
         name_pad=$(printf "%-${w_peer}s" "$name")
@@ -165,8 +165,9 @@ function cmd::activity::run() {
  
         local drop_word="drops"
         [[ "$drops" -eq 1 ]] && drop_word="drop"
-        printf "  \033[1m%s\033[0m  \033[2m↓\033[0m%s  \033[2m↑\033[0m%s  %${w_drops}s %s\n" \
-        "$name_pad" "$rx_pad" "$tx_pad" "$drops" "$drop_word"
+ 
+        ui::activity::peer_row \
+          "$name_pad" "$rx_pad" "$tx_pad" "$drops" "$drop_word" "$w_drops"
         ;;
  
       service)
@@ -175,19 +176,11 @@ function cmd::activity::run() {
         local peer dest_display drop_count
         IFS='|' read -r peer dest_display drop_count <<< "$rest"
  
-        # Compute padding to align drop count with peer drop column
-        # Service row visible prefix: "    → " (6) + ${#dest_display}
-        local arrow_prefix="    → "
-        local prefix_bytes=${#arrow_prefix}  # = 8 due to → being 3 bytes
-        local prefix_len=$(( prefix_bytes + ${#dest_display} ))
-        # local prefix_len=$(( 6 + ${#dest_display} ))
-        local pad_n=$(( drops_col - prefix_len ))
-        [[ $pad_n -lt 1 ]] && pad_n=1
-
         local svc_drop_word="drops"
         [[ "$drop_count" -eq 1 ]] && svc_drop_word="drop"
-        printf "    \033[2m→\033[0m %s%*s  %${w_drops}s %s\n" \
-        "$dest_display" "$pad_n" "" "$drop_count" "$svc_drop_word"
+ 
+        ui::activity::service_row \
+          "$dest_display" "$drop_count" "$svc_drop_word" "$drops_col" "$w_drops"
         ;;
     esac
   done <<< "$data"
@@ -195,21 +188,3 @@ function cmd::activity::run() {
   echo ""
 }
 
-# ============================================
-# Helpers
-# ============================================
-
-function cmd::activity::_fmt_bytes() {
-  local bytes="${1:-0}"
-  if (( bytes == 0 )); then
-    printf "—"
-  elif (( bytes >= 1073741824 )); then
-    printf "%dGB" $(( bytes / 1073741824 ))
-  elif (( bytes >= 1048576 )); then
-    printf "%dMB" $(( bytes / 1048576 ))
-  elif (( bytes >= 1024 )); then
-    printf "%dKB" $(( bytes / 1024 ))
-  else
-    printf "%dB" "$bytes"
-  fi
-}

commands/group.command.sh

@@ -169,6 +169,7 @@ function cmd::group::show() {
   desc=$(json::get "$group_file" "desc")
   ui::row "Description" "${desc:-—}"
 
+  # Load and filter peers
   local peers_list=()
   mapfile -t peers_list < <(json::get "$group_file" "peers") || true
   local filtered=()
@@ -179,8 +180,7 @@ function cmd::group::show() {
   local peer_count=${#peers_list[@]}
   [[ -z "${peers_list[0]:-}" ]] && peer_count=0
 
-  local peer_word="peers"
-  [[ "$peer_count" -eq 1 ]] && peer_word="peer"
+  # Count valid peers (data logic stays in command)
   local valid_count=0
   for p in "${peers_list[@]}"; do
     [[ -z "$p" ]] && continue
@@ -192,7 +192,7 @@ function cmd::group::show() {
   printf "\n"
 
   if [[ "$peer_count" -gt 0 ]]; then
-    # Measure name and IP widths
+    # Measure widths (data logic stays in command)
     local w_name=16 w_ip=13
     for peer_name in "${peers_list[@]}"; do
       [[ -z "$peer_name" ]] && continue
@@ -200,22 +200,8 @@ function cmd::group::show() {
     done
     (( w_name += 2 ))
 
-    for peer_name in "${peers_list[@]}"; do
-      [[ -z "$peer_name" ]] && continue
- 
-      if ! peers::require_exists "$peer_name" > /dev/null 2>&1; then
-        printf "  \033[2m%-${w_name}s  (no longer exists)\033[0m\n" "$peer_name"
-        continue
-      fi
- 
-      local ip rule is_blocked
-      ip=$(peers::get_ip "$peer_name")
-      rule=$(peers::get_meta "$peer_name" "rule")
-      peers::is_blocked "$peer_name" 2>/dev/null && is_blocked="true" || is_blocked="false"
- 
-      ui::group::show_member_row "$peer_name" "$ip" "${rule:--}" \
-        "$is_blocked" "$w_name" "$w_ip"
-    done
+    # Delegate rendering to ui::
+    ui::group::show_peers peers_list "$w_name" "$w_ip"
   else
     printf "  \033[2m—\033[0m\n"
   fi

commands/identity.command.sh

@@ -100,7 +100,7 @@ function cmd::identity::run() {
 
 function cmd::identity::_list() {
   local data
-  data=$(identity::list_data)
+  data=$(identity::list_data | ui::sort_rows 1)
  
   if [[ -z "$data" ]]; then
     log::info "No identities found. Run 'wgctl identity migrate' to create from existing peers."

commands/policy.command.sh

@@ -99,7 +99,7 @@ function cmd::policy::run() {
 
 function cmd::policy::_list() {
   local data
-  data=$(policy::list_data)
+  data=$(policy::list_data | ui::sort_rows 1)
  
   if [[ -z "$data" ]]; then
     log::info "No policies defined."

commands/subnet.command.sh

@@ -85,7 +85,7 @@ function cmd::subnet::run() {
 
 function cmd::subnet::_list() {
   local data
-  data=$(subnet::list_data)
+  data=$(subnet::list_data | ui::sort_rows 1)
  
   if [[ -z "$data" ]]; then
     log::info "No subnets defined."

core/context.sh

@@ -45,6 +45,7 @@ function ctx::meta()            { echo "$_CTX_META"; }
 function ctx::daemon()          { echo "$_CTX_DAEMON"; }
 function ctx::net()             { echo "$_CTX_NET"; }
 function ctx::identities()      { echo "${_CTX_IDENTITY}"; }
+function ctx::policies()        { echo "${_CTX_DATA}/policies.json"; }
 function ctx::subnets()         { echo "${_CTX_DATA}/subnets.json"; }
 function ctx::hosts()           { echo "${_CTX_DATA}/hosts.json"; }
 function ctx::events_log()      { echo "$(ctx::daemon)/events.log"; }

core/fmt.sh

@@ -79,3 +79,17 @@ function fmt::set_date_format() {
   esac
 }
 
+function fmt::bytes() {
+  local bytes="${1:-0}"
+  if (( bytes == 0 )); then
+    printf "—"
+  elif (( bytes >= 1073741824 )); then
+    printf "%dGB" $(( bytes / 1073741824 ))
+  elif (( bytes >= 1048576 )); then
+    printf "%dMB" $(( bytes / 1048576 ))
+  elif (( bytes >= 1024 )); then
+    printf "%dKB" $(( bytes / 1024 ))
+  else
+    printf "%dB" "$bytes"
+  fi
+}

core/json_helper.py

@@ -13,6 +13,13 @@ sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'lib'))
 
 DATETIME_FMT = os.environ.get('WGCTL_DATETIME_FMT', '%Y-%m-%d %H:%M')
 
+_POLICY_DEFAULTS = {
+    'tunnel_mode': 'split',
+    'default_rule': None,
+    'strict_rule': False,
+    'auto_apply': True,
+}
+
 # ── Lazy imports (only load what's needed per command) ──────────────────────
 
 def _events():
@@ -1220,21 +1227,16 @@ def identity_exists(file):
 # ======================================================
 
 def _policy_read(file):
-    """Read policies.json, fall back to hardcoded defaults if missing."""
     try:
         if not os.path.exists(file):
-            return dict(_POLICY_DEFAULTS)
+            return {}
         with open(file) as f:
             content = f.read().strip()
         if not content:
-            return dict(_POLICY_DEFAULTS)
-        data = json.loads(content)
-        # Merge with defaults so hardcoded policies always exist
-        merged = dict(_POLICY_DEFAULTS)
-        merged.update(data)
-        return merged
+            return {}
+        return json.loads(content)
     except Exception:
-        return dict(_POLICY_DEFAULTS)
+        return {}
  
 def _policy_write(file, data):
     """Write policies.json."""

modules/policy.module.sh

@@ -56,8 +56,6 @@ function policy::_hardcoded_field() {
 # Core Accessors
 # ======================================================
 
-function ctx::policies() { echo "${_CTX_DATA}/policies.json"; }
-
 function policy::exists() {
   local name="${1:-}"
   json::policy_exists "$(ctx::policies)" "$name" 2>/dev/null

modules/ui/activity.module.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# ui/activity.module.sh — rendering for wgctl activity
+
+# ui::activity::peer_row <name_pad> <rx_pad> <tx_pad> <drops> <drop_word> <w_drops>
+function ui::activity::peer_row() {
+  local name_pad="${1:-}" rx_pad="${2:-}" tx_pad="${3:-}" \
+        drops="${4:-0}" drop_word="${5:-drops}" w_drops="${6:-1}"
+
+  printf "  \033[1m%s\033[0m  \033[2m↓\033[0m%s  \033[2m↑\033[0m%s  %${w_drops}s %s\n" \
+    "$name_pad" "$rx_pad" "$tx_pad" "$drops" "$drop_word"
+}
+
+# ui::activity::service_row <dest_display> <drop_count> <drop_word> <drops_col> <w_drops>
+function ui::activity::service_row() {
+  local dest_display="${1:-}" drop_count="${2:-0}" drop_word="${3:-drops}" \
+        drops_col="${4:-30}" w_drops="${5:-1}"
+
+  # Align drop count with peer drop column
+  # Service row visible prefix: "    → " (6 visible) + ${#dest_display}
+  # But "→" is 3 bytes, 1 visible — arrow_prefix bytes = 8, visible = 6
+  local arrow_prefix="    → "
+  local prefix_bytes=${#arrow_prefix}   # 8 bytes due to → being 3 bytes
+  local prefix_len=$(( prefix_bytes + ${#dest_display} ))
+  local pad_n=$(( drops_col - prefix_len ))
+  [[ $pad_n -lt 1 ]] && pad_n=1
+
+  printf "    \033[2m→\033[0m %s%*s  %${w_drops}s %s\n" \
+    "$dest_display" "$pad_n" "" "$drop_count" "$drop_word"
+}
+
+# Table versions (kept for future display config)
+function ui::activity::header_table() {
+  printf "\n  %-24s %-14s %-14s %s\n" "PEER" "↓ RX" "↑ TX" "DROPS"
+  printf "  %s\n" "$(printf '─%.0s' {1..65})"
+}
+
+function ui::activity::peer_row_table() {
+  local name="${1:-}" rx_fmt="${2:-}" tx_fmt="${3:-}" \
+        drops="${4:-0}" drop_word="${5:-drops}"
+  printf "  %-24s %-14s %-14s %s %s\n" \
+    "$name" "↓$rx_fmt" "↑$tx_fmt" "$drops" "$drop_word"
+}
+
+function ui::activity::service_row_table() {
+  local dest_display="${1:-}" drop_count="${2:-0}" drop_word="${3:-drops}"
+  printf "    → %-30s %s %s\n" "$dest_display" "$drop_count" "$drop_word"
+}

modules/ui/group.module.sh

@@ -112,6 +112,34 @@ function ui::group::show_member_row_table() {
     "$name" "$ip" "${rule:--}" "${status_color}${status_str}\033[0m"
 }
 
+# ui::group::show_peers <peers_list_nameref> <w_name> <w_ip>
+function ui::group::show_peers() {
+  local -n _peers_list="$1"
+  local w_name="${2:-16}" w_ip="${3:-13}"
+ 
+  if [[ ${#_peers_list[@]} -eq 0 || -z "${_peers_list[0]:-}" ]]; then
+    printf "  \033[2m—\033[0m\n"
+    return 0
+  fi
+ 
+  for peer_name in "${_peers_list[@]}"; do
+    [[ -z "$peer_name" ]] && continue
+ 
+    if ! peers::require_exists "$peer_name" > /dev/null 2>&1; then
+      printf "  \033[2m%-${w_name}s  (no longer exists)\033[0m\n" "$peer_name"
+      continue
+    fi
+ 
+    local ip rule is_blocked
+    ip=$(peers::get_ip "$peer_name")
+    rule=$(peers::get_meta "$peer_name" "rule")
+    peers::is_blocked "$peer_name" 2>/dev/null && is_blocked="true" || is_blocked="false"
+ 
+    ui::group::show_member_row "$peer_name" "$ip" "${rule:--}" \
+      "$is_blocked" "$w_name" "$w_ip"
+  done
+}
+
 
 # ======================================================
 # Helpers