Overview
Keybinding dispatch in the TUI is layered: an exclusive overlay (form, detail modal, policy YAML viewer) always wins, then a filter mode, then the global router in app.go, then panel-local handlers. Understanding the layer model is the fastest way to reason about which key is swallowed where.
Rendering diagram…
Global keys (always active)
| Key | Action | Notes |
|---|---|---|
Ctrl+C | Quit the TUI | Only hard quit; panels can't swallow this |
? | Open the help overlay | |
: / Ctrl+K | Open the command palette | Focuses the palette input |
/ | Start in-panel filter | Supported in Alerts, Skills, MCPs, Audit |
Tab / Shift+Tab | Cycle panels | In Policy, Tab is panel-local for tab-navigation within the YAML viewer |
1–9 | Jump to panel | Overridden per-panel when panelOwnsDigitShortcut(key) returns true |
0 | Jump to Setup | |
T | Jump to Tools | Uppercase; mnemonic for the panel |
q | Panel-local action | Not a global quit — see note below |
Filter mode
Activated by / in a supported panel. While the filter input is focused:
| Key | Action |
|---|---|
esc | Abort filter, restore view |
enter | Apply filter, keep it visible |
backspace | Delete last character |
| printable | Append to filter string |
Compound syntax: field=value field2>=value2. Supported fields per panel:
| Panel | Fields |
|---|---|
| Alerts | action, type, severity, free-text |
| Skills | trust, verdict, free-text |
| MCPs | state, transport, free-text |
| Audit | event_type, verdict, severity, correlation_id, rule_id |
Exclusive / overlay mode
When any of these are active the panel fully owns keyboard input:
| Panel | Exclusive condition |
|---|---|
| Policy | YAML / Rego viewer is open (m.policy.IsOverlayActive()) |
| Skills | Detail modal open |
| MCPs | Detail modal OR mcpSetForm active |
| Plugins | Detail modal open |
| Tools | Detail modal open |
| Alerts | Detail modal open |
| Audit | Detail modal open |
| Inventory | Detail modal open |
| Setup | Wizard / form / editor active |
In exclusive mode the global router is bypassed — you can type q or 1 freely.
Panel-specific keys
See Panels for every per-panel key.
The short cheatsheet:
| Panel | Key | Action |
|---|---|---|
| Alerts | 1–5 | Severity filter (owned locally) |
| Alerts | f | Cycle action filter |
| Alerts | enter | Open detail |
| Skills | a | Action menu |
| Skills | s | Scan now |
| Skills | q | Quarantine (local) |
| MCPs | a | Action menu |
| MCPs | b / u | Block / unblock |
| Plugins | i / d / e | Install / disable / enable |
| Inventory | 1–4 | Scope filter (skills/mcps/plugins/tools) |
| Policy | enter | Open viewer overlay |
| Policy | e | Edit in $EDITOR |
| Policy | r | Reload policies |
| Policy | t | Run policy tests |
| Policy | n | New policy form |
| Logs | g / G | Top / bottom |
| Logs | f | Toggle follow |
| Audit | / | Compound filter |
| Audit | e | Export filtered view |
| Activity | 1 / 2 | Recent / all-time |
| Setup | enter | Run wizard step |
| Setup | esc | Back |
Command palette keys
When the palette is open:
| Key | Action |
|---|---|
| printable | Append to fuzzy search |
↑ / ↓ | Move match selection |
tab | Cycle categories |
enter | Execute selected command |
esc | Close palette |
backspace | Delete last character |