@lancewu602/mihomo-dash 0.0.0-stage → 0.6.1

package/server/tests/system-proxy.test.js

@@ -0,0 +1,497 @@
+/**
+ * 系统代理开关（server/src/shared/system-proxy.js + server/src/http/system-proxy.js）测试。
+ *
+ * 全程用桩执行器：断言真实 argv（不经过 shell、外部字符串不参与拼命令），不碰本机网络设置。
+ * server 那两个端点用 express + 桩执行器直接挂路由验证。运行：npm test
+ */
+import assert from 'node:assert/strict';
+import { after, before, test } from 'node:test';
+import express from 'express';
+import fs from 'node:fs';
+import http from 'node:http';
+import os from 'node:os';
+import path from 'node:path';
+
+/** @type {Record<string, any>} */ let mods = {};
+/** @type {string} */ let tmpDir;
+
+/** scutil --proxy 样例：HTTP/HTTPS 开、SOCKS 关 */
+const SCUTIL_ON = `<dictionary> {
+  ExceptionsList : <array> {
+    0 : localhost
+    1 : 127.0.0.0/8
+    2 : *.local
+  }
+  HTTPEnable : 1
+  HTTPPort : 7890
+  HTTPProxy : 127.0.0.1
+  HTTPSEnable : 1
+  HTTPSPort : 7890
+  HTTPSProxy : 127.0.0.1
+  ProxyAutoConfigEnable : 0
+  ProxyAutoDiscoveryEnable : 0
+  SOCKSEnable : 0
+  SOCKSPort : 0
+}`;
+
+/** 全关 + PAC 开：用来验证 off 时连 PAC 一起清 */
+const SCUTIL_OFF = `<dictionary> {
+  ExceptionsList : <array> {
+    0 : localhost
+    1 : 127.0.0.0/8
+    2 : *.local
+  }
+  HTTPEnable : 0
+  HTTPSEnable : 0
+  ProxyAutoConfigEnable : 0
+  ProxyAutoDiscoveryEnable : 0
+  SOCKSEnable : 0
+}`;
+
+/** 造一份 scutil --proxy 输出：协议全关 + 指定绕过列表（测「绕过项已经齐了」） */
+const scutilWith = (bypass) => `<dictionary> {
+  ExceptionsList : <array> {
+${bypass.map((b, i) => `    ${i} : ${b}`).join('\n')}
+  }
+  HTTPEnable : 0
+  HTTPSEnable : 0
+  ProxyAutoConfigEnable : 0
+  ProxyAutoDiscoveryEnable : 0
+  SOCKSEnable : 0
+}`;
+
+const SCUTIL_PAC = `<dictionary> {
+  HTTPEnable : 0
+  ProxyAutoConfigEnable : 1
+  ProxyAutoConfigURLString : http://example.com/proxy.pac
+  ProxyAutoDiscoveryEnable : 1
+  SOCKSEnable : 0
+}`;
+
+const SERVICE_ORDER = `An asterisk (*) denotes that a network service is disabled.
+(1) Wi-Fi
+(Hardware Port: Wi-Fi, Device: en0)
+
+(2) USB 10/100 LAN
+(Hardware Port: USB 10/100 LAN, Device: en5)
+
+(3) Thunderbolt Bridge
+(Hardware Port: Thunderbolt Bridge, Device: bridge0)
+`;
+
+const ALL_SERVICES = `An asterisk (*) denotes that a network service is disabled.
+Wi-Fi
+USB 10/100 LAN
+*Bluetooth PAN
+Thunderbolt Bridge
+`;
+
+const ROUTE_GET = `   route to: default
+destination: default
+       mask: default
+    gateway: 192.168.1.1
+  interface: en5
+      flags: <UP,GATEWAY,DONE,STATIC,PRCLONING>
+`;
+
+/** 桩执行器：记录 argv，按 handler 返回伪造输出 */
+function stubRun(handler) {
+  const calls = [];
+  const run = (cmd, args) => {
+    calls.push([cmd, ...args]);
+    const out = handler(cmd, args) || {};
+    return {
+      ok: out.ok !== false,
+      status: out.ok === false ? 1 : 0,
+      stdout: out.stdout || '',
+      stderr: out.stderr || '',
+    };
+  };
+  run.calls = calls;
+  run.commands = () => calls.map((c) => c.join(' '));
+  return run;
+}
+
+/** macOS 桩：默认活动服务是 USB 10/100 LAN（en5，与默认路由一致） */
+function macOSRun({ proxy = SCUTIL_ON, extra } = {}) {
+  return stubRun((cmd, args) => {
+    if (cmd === 'scutil') return { stdout: proxy };
+    if (cmd === 'route') return { stdout: ROUTE_GET };
+    if (cmd === 'networksetup') {
+      if (args[0] === '-listnetworkserviceorder') return { stdout: SERVICE_ORDER };
+      if (args[0] === '-listallnetworkservices') return { stdout: ALL_SERVICES };
+      return extra?.(args) || { stdout: '' };
+    }
+    return { ok: false, stderr: `unexpected: ${cmd}` };
+  });
+}
+
+before(async () => {
+  tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mihomo-dash-sysproxy-'));
+  process.env.MIHOMO_DASH_DIR = tmpDir;
+  mods = {
+    shared: await import('../src/shared/system-proxy.js'),
+    routes: await import('../src/http/system-proxy.js'),
+    paths: await import('../src/shared/paths.js'),
+    kernel: await import('../src/kernel/client.js'),
+  };
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+
+after(() => {
+  fs.rmSync(tmpDir, { recursive: true, force: true });
+});
+
+test('parseScutilProxy：解析协议、PAC、绕过列表', () => {
+  const { parseScutilProxy } = mods.shared;
+  const on = parseScutilProxy(SCUTIL_ON);
+  assert.deepEqual(on.protocols.http, { enabled: true, host: '127.0.0.1', port: 7890 });
+  assert.equal(on.protocols.https.enabled, true);
+  assert.equal(on.protocols.socks.enabled, false);
+  assert.equal(on.protocols.socks.port, 0);
+  assert.deepEqual(on.bypass, ['localhost', '127.0.0.0/8', '*.local']);
+  assert.deepEqual(on.autoProxy, { enabled: false, url: null });
+
+  const pac = parseScutilProxy(SCUTIL_PAC);
+  assert.equal(pac.protocols.http.enabled, false);
+  assert.deepEqual(pac.autoProxy, { enabled: true, url: 'http://example.com/proxy.pac' });
+  assert.equal(pac.autoDiscovery, true);
+});
+
+test('parseServiceOrder / parseDefaultInterface：服务顺序与默认路由接口', () => {
+  const { parseServiceOrder, parseDefaultInterface } = mods.shared;
+  assert.deepEqual(parseServiceOrder(SERVICE_ORDER), [
+    { name: 'Wi-Fi', device: 'en0' },
+    { name: 'USB 10/100 LAN', device: 'en5' },
+    { name: 'Thunderbolt Bridge', device: 'bridge0' },
+  ]);
+  assert.equal(parseDefaultInterface(ROUTE_GET), 'en5');
+  assert.equal(parseDefaultInterface('route to: default'), null);
+});
+
+test('macOS read：只动活动服务（默认路由接口 en5 → USB 10/100 LAN）', async () => {
+  const run = macOSRun();
+  const proxy = mods.shared.createSystemProxy({ run, platform: 'darwin' });
+  const state = await proxy.read();
+  assert.equal(state.supported, true);
+  assert.equal(state.service, 'USB 10/100 LAN');
+  assert.equal(state.device, 'en5');
+  assert.equal(state.enabled, true, 'HTTP/HTTPS 开着就算开');
+  assert.equal(state.protocols.http.port, 7890);
+  assert.deepEqual(run.commands(), [
+    'scutil --proxy',
+    'networksetup -listnetworkserviceorder',
+    'networksetup -listallnetworkservices',
+    'route -n get default',
+  ]);
+});
+
+test('macOS off：只关开着的协议，PAC / 自动发现一并清掉', async () => {
+  const run = macOSRun({ proxy: SCUTIL_ON });
+  const proxy = mods.shared.createSystemProxy({ run, platform: 'darwin' });
+  const result = await proxy.setEnabled(false, {});
+  assert.deepEqual(result.applied, ['关闭 HTTP', '关闭 HTTPS']);
+  const writes = run.commands().filter((c) => c.includes('-set'));
+  assert.deepEqual(writes, [
+    'networksetup -setwebproxystate USB 10/100 LAN off',
+    'networksetup -setsecurewebproxystate USB 10/100 LAN off',
+  ]);
+  assert.ok(
+    !run.commands().some((c) => c.includes('socksfirewallproxystate')),
+    '本来就没开的 SOCKS 不该被写',
+  );
+
+  const pacRun = macOSRun({ proxy: SCUTIL_PAC });
+  const pacProxy = mods.shared.createSystemProxy({ run: pacRun, platform: 'darwin' });
+  const pacResult = await pacProxy.setEnabled(false, {});
+  assert.deepEqual(pacResult.applied, ['关闭 PAC（自动代理配置）', '关闭自动代理发现']);
+  assert.ok(
+    pacRun.commands().includes('networksetup -setautoproxystate USB 10/100 LAN off'),
+    'PAC 开着时必须一起关，否则系统还是走代理',
+  );
+});
+
+test('macOS on：写地址+端口（set*proxy 会自动启用），并把固定绕过项补进列表', async () => {
+  const run = macOSRun();
+  const proxy = mods.shared.createSystemProxy({ run, platform: 'darwin' });
+  const result = await proxy.setEnabled(true, { host: '127.0.0.1', port: 7890 });
+  assert.deepEqual(result.applied, [
+    'HTTP → 127.0.0.1:7890',
+    'HTTPS → 127.0.0.1:7890',
+    'SOCKS → 127.0.0.1:7890',
+    `绕过列表 +${result.bypassAdded.length} 项`,
+  ]);
+  // 已有 localhost / 127.0.0.0/8 / *.local：只补缺的，顺序不排（已有的原样保留）
+  const existing = ['localhost', '127.0.0.0/8', '*.local'];
+  assert.deepEqual(
+    result.bypassAdded,
+    mods.shared.BYPASS_DEFAULTS.map((d) => d.value).filter((v) => !existing.includes(v)),
+  );
+  const writes = run.calls.filter((c) => c[0] === 'networksetup' && c[1].startsWith('-set'));
+  assert.deepEqual(writes, [
+    ['networksetup', '-setwebproxy', 'USB 10/100 LAN', '127.0.0.1', '7890'],
+    ['networksetup', '-setsecurewebproxy', 'USB 10/100 LAN', '127.0.0.1', '7890'],
+    ['networksetup', '-setsocksfirewallproxy', 'USB 10/100 LAN', '127.0.0.1', '7890'],
+    [
+      'networksetup',
+      '-setproxybypassdomains',
+      'USB 10/100 LAN',
+      'localhost',
+      '127.0.0.0/8',
+      '*.local',
+      ...result.bypassAdded,
+    ],
+  ]);
+  // 任何调用都必须是「命令 + 参数数组」，不能出现 sh -c 之类
+  assert.ok(!run.calls.some((c) => /^(sh|bash|zsh)$/.test(c[0])), '不允许经过 shell');
+});
+
+test('macOS on：绕过列表已经齐了就不写、不报「补了几项」', async () => {
+  const bypass = [...mods.shared.BYPASS_DEFAULTS.map((d) => d.value), 'my.internal'];
+  const proxy = mods.shared.createSystemProxy({
+    run: macOSRun({ proxy: scutilWith(bypass) }),
+    platform: 'darwin',
+  });
+  const result = await proxy.setEnabled(true, {});
+  assert.deepEqual(result.bypassAdded, []);
+  assert.ok(!result.applied.some((l) => l.includes('绕过列表')));
+});
+
+test('BYPASS_DEFAULTS / mergeBypass：每项都带说明；只补缺的，大小写不敏感，已有顺序原样保留', () => {
+  const { BYPASS_DEFAULTS, mergeBypass } = mods.shared;
+  assert.ok(BYPASS_DEFAULTS.length >= 8, '固定项不该太少');
+  // 面板要拿 note 展示「这一项到底绕过什么」，所以一项都不能缺
+  for (const d of BYPASS_DEFAULTS) {
+    assert.ok(d.value && d.note, `缺 value / note：${JSON.stringify(d)}`);
+  }
+  assert.equal(
+    new Set(BYPASS_DEFAULTS.map((d) => d.value)).size,
+    BYPASS_DEFAULTS.length,
+    '不能有重复',
+  );
+
+  const { list, added } = mergeBypass(['LOCALHOST', 'my.internal']);
+  assert.equal(list[0], 'LOCALHOST', '已有的原样保留（不改大小写、不重排）');
+  assert.equal(list[1], 'my.internal');
+  assert.ok(!added.includes('localhost'), '大小写不敏感：不该重复补');
+  assert.equal(added.length, BYPASS_DEFAULTS.length - 1);
+  // 全都有就不补
+  assert.deepEqual(mergeBypass(BYPASS_DEFAULTS.map((d) => d.value)).added, []);
+});
+
+test('地址 / 端口白名单：非法值在下发命令之前就被拒', async () => {
+  const { assertHostPort } = mods.shared;
+  assert.deepEqual(assertHostPort('127.0.0.1', 7890), { host: '127.0.0.1', port: 7890 });
+  assert.deepEqual(assertHostPort('::1', 1080), { host: '::1', port: 1080 });
+  for (const [host, port] of [
+    ['127.0.0.1; rm -rf /', 7890],
+    ['$(whoami)', 7890],
+    ['127.0.0.1', 0],
+    ['127.0.0.1', 70000],
+    ['127.0.0.1', 'abc'],
+  ]) {
+    assert.throws(() => assertHostPort(host, port), /不合法/);
+  }
+
+  const run = macOSRun();
+  const proxy = mods.shared.createSystemProxy({ run, platform: 'darwin' });
+  await assert.rejects(
+    () => proxy.setEnabled(true, { host: '127.0.0.1; touch /tmp/pwned', port: 7890 }),
+    /不合法/,
+  );
+  const writes = run.calls.filter((c) => c[0] === 'networksetup' && c[1].startsWith('-set'));
+  assert.deepEqual(writes, [], '校验失败时一个写命令都不该发出去');
+});
+
+test('Linux/GNOME：读 mode + 三协议，关=切 none，开=写 host/port 再切 manual', async () => {
+  const gsettings = {
+    'org.gnome.system.proxy mode': "'manual'",
+    'org.gnome.system.proxy http host': "'127.0.0.1'",
+    'org.gnome.system.proxy http port': '7890',
+    'org.gnome.system.proxy https host': "'127.0.0.1'",
+    'org.gnome.system.proxy https port': '7890',
+    'org.gnome.system.proxy socks host': "'127.0.0.1'",
+    'org.gnome.system.proxy socks port': '7890',
+    'org.gnome.system.proxy ignore-hosts': "['localhost', '127.0.0.0/8']",
+  };
+  const run = stubRun((cmd, args) => {
+    assert.equal(cmd, 'gsettings');
+    assert.equal(args[0], 'get');
+    const key = args.slice(1).join(' ');
+    return { stdout: gsettings[key] ?? "''", ok: key in gsettings };
+  });
+  const proxy = mods.shared.createSystemProxy({ run, platform: 'linux' });
+  const state = await proxy.read();
+  assert.equal(state.supported, true);
+  assert.equal(state.enabled, true);
+  assert.equal(state.protocols.http.port, 7890);
+  assert.equal(state.protocols.socks.host, '127.0.0.1');
+  assert.deepEqual(state.bypass, ['localhost', '127.0.0.0/8']);
+
+  const offRun = stubRun((cmd, args) => {
+    if (args[0] === 'set') return { stdout: '' };
+    const key = args.slice(1).join(' ');
+    return { stdout: gsettings[key] ?? "''", ok: key in gsettings };
+  });
+  const offProxy = mods.shared.createSystemProxy({ run: offRun, platform: 'linux' });
+  const off = await offProxy.setEnabled(false, {});
+  assert.deepEqual(off.applied, ['mode → none']);
+  assert.ok(offRun.commands().includes('gsettings set org.gnome.system.proxy mode none'));
+
+  const onRun = stubRun((cmd, args) => {
+    if (args[0] === 'set') return { stdout: '' };
+    const key = args.slice(1).join(' ');
+    return { stdout: gsettings[key] ?? "''", ok: key in gsettings };
+  });
+  const onProxy = mods.shared.createSystemProxy({ run: onRun, platform: 'linux' });
+  const on = await onProxy.setEnabled(true, { host: '127.0.0.1', port: 7891 });
+  const commands = onRun.commands();
+  for (const key of ['http', 'https', 'socks']) {
+    assert.ok(
+      commands.includes(`gsettings set org.gnome.system.proxy.${key} host 127.0.0.1`),
+      `${key} host 要写`,
+    );
+    assert.ok(
+      commands.includes(`gsettings set org.gnome.system.proxy.${key} port 7891`),
+      `${key} port 要写`,
+    );
+  }
+  // 固定绕过项：ignore-hosts 里已有 localhost / 127.0.0.0/8 → 只补缺的，顺序保留已有的
+  assert.deepEqual(
+    on.bypassAdded,
+    mods.shared.BYPASS_DEFAULTS.map((d) => d.value).filter(
+      (v) => !['localhost', '127.0.0.0/8'].includes(v),
+    ),
+  );
+  const ignore = commands.find((c) =>
+    c.startsWith('gsettings set org.gnome.system.proxy ignore-hosts'),
+  );
+  assert.match(
+    ignore,
+    /^gsettings set org\.gnome\.system\.proxy ignore-hosts \['localhost', '127\.0\.0\.0\/8',/,
+  );
+  assert.ok(commands.includes('gsettings set org.gnome.system.proxy mode manual'));
+});
+
+test('非 GNOME / 不支持的平台：read 给提示，写直接拒', async () => {
+  const noGs = stubRun(() => ({ ok: false, stderr: 'gsettings: command not found' }));
+  const linux = mods.shared.createSystemProxy({ run: noGs, platform: 'linux' });
+  const state = await linux.read();
+  assert.equal(state.supported, false);
+  assert.match(state.hint, /gsettings/);
+  await assert.rejects(() => linux.setEnabled(false, {}), /gsettings/);
+
+  const win = mods.shared.createSystemProxy({ run: stubRun(() => ({})), platform: 'win32' });
+  const winState = await win.read();
+  assert.equal(winState.supported, false);
+  assert.match(winState.hint, /Internet 选项/);
+  await assert.rejects(
+    () => win.setEnabled(true, { host: '127.0.0.1', port: 7890 }),
+    /Internet 选项/,
+  );
+});
+
+test('关系统代理（disableSystemProxyIfOn）：开着就关、关着不动、不支持/失败都不抛错', async () => {
+  const calls = [];
+  const spy = (inner) => (cmd, args) => {
+    calls.push(`${cmd} ${args.join(' ')}`);
+    return inner(cmd, args);
+  };
+
+  // 开着（SCUTIL_ON）→ 关：会下发 networksetup 的关闭命令，返回 disabled: true
+  const onRun = spy(macOSRun({ proxy: SCUTIL_ON }));
+  const on = await mods.routes.disableSystemProxyIfOn({ run: onRun, platform: 'darwin' });
+  assert.equal(on.disabled, true);
+  assert.ok(
+    calls.some((c) => c.startsWith('networksetup -setwebproxystate')),
+    `应当真的下发了关闭命令：${calls.join(' | ')}`,
+  );
+
+  // 已经是关的 → 一条写命令都不下发
+  const offCalls = [];
+  const offRun = (cmd, args) => {
+    offCalls.push(`${cmd} ${args.join(' ')}`);
+    return macOSRun({ proxy: SCUTIL_OFF })(cmd, args);
+  };
+  const off = await mods.routes.disableSystemProxyIfOn({ run: offRun, platform: 'darwin' });
+  assert.deepEqual(off, { disabled: false, reason: 'already-off' });
+  assert.equal(offCalls.filter((c) => c.startsWith('networksetup -set')).length, 0);
+
+  // 不支持的平台 / 执行器报错：都不阻止调用方（停内核），只把原因带回来
+  const unsupported = await mods.routes.disableSystemProxyIfOn({
+    run: () => ({ ok: false, stderr: 'no' }),
+    platform: 'win32',
+  });
+  assert.equal(unsupported.disabled, false);
+  assert.equal(unsupported.reason, 'unsupported');
+  const broken = await mods.routes.disableSystemProxyIfOn({
+    run: () => {
+      throw new Error('boom');
+    },
+    platform: 'darwin',
+  });
+  assert.equal(broken.disabled, false);
+  assert.match(broken.reason, /boom/);
+});
+
+test('HTTP 端点：GET 读状态（含内核端口），PUT 开关，非法 body 报 400', async () => {
+  // 桩内核：/configs 报 mixed-port 7890，面板据此知道系统代理该指向哪
+  const kernel = http.createServer((_req, res) => {
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ 'mixed-port': 7890, mode: 'direct' }));
+  });
+  await new Promise((resolve) => kernel.listen(0, '127.0.0.1', resolve));
+  // 代码只读 config.yaml 的 external-controller（MIHOMO_API 已去掉）→ 写一份指向桩内核的配置
+  const cfgDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mihomo-dash-sysproxy-cfg-'));
+  fs.writeFileSync(
+    path.join(cfgDir, 'config.yaml'),
+    `mixed-port: 7890\nexternal-controller: 127.0.0.1:${kernel.address().port}\n`,
+  );
+  process.env.MIHOMO_DIR = cfgDir;
+  // 本用例在运行中换了配置目录：清掉「配置目录」与「控制接口」两个缓存再走
+  mods.paths.resetMihomoDirCache();
+  mods.kernel.resetControllerCache();
+
+  const run = macOSRun();
+  const app = express();
+  app.use(express.json());
+  mods.routes.registerSystemProxyRoutes(app, { run, platform: 'darwin' });
+  const server = app.listen(0, '127.0.0.1');
+  await new Promise((resolve) => server.once('listening', resolve));
+  const base = `http://127.0.0.1:${server.address().port}`;
+
+  try {
+    const got = await (await fetch(`${base}/api/system-proxy`)).json();
+    assert.equal(got.supported, true);
+    assert.equal(got.service, 'USB 10/100 LAN');
+    assert.equal(got.enabled, true);
+    assert.deepEqual(got.target, {
+      host: '127.0.0.1',
+      port: 7890,
+      source: '内核运行时 mixed-port',
+    });
+
+    const off = await fetch(`${base}/api/system-proxy`, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ enabled: false }),
+    });
+    assert.equal(off.status, 200);
+    const offBody = await off.json();
+    assert.deepEqual(offBody.applied, ['关闭 HTTP', '关闭 HTTPS']);
+    assert.equal(offBody.target.port, 7890);
+
+    const bad = await fetch(`${base}/api/system-proxy`, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ enabled: 'yes' }),
+    });
+    assert.equal(bad.status, 400);
+    assert.match((await bad.json()).error, /enabled 必须是/);
+  } finally {
+    server.close();
+    kernel.close();
+    delete process.env.MIHOMO_DIR;
+    fs.rmSync(cfgDir, { recursive: true, force: true });
+  }
+});

package/server/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  // 后端是 JS + JSDoc（零构建）：这份配置主要给编辑器解析、跳转与语法检查用。
+  // 刻意不开 checkJs —— 现在打开会有 900+ 条类型错误（历史代码的 JSDoc 不全），
+  // 那是单独一件事；要开得先清完再把它加进 prepublishOnly。
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "allowJs": true,
+    "checkJs": false,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["node"]
+  },
+  "include": ["src", "tests"]
+}

package/web/dist/assets/index-BpDzYhuI.css

@@ -0,0 +1 @@
+html,body,#root{margin:0;padding:0;height:100%;overflow:hidden}body{font-family:-apple-system,BlinkMacSystemFont,Segoe UI,Inter,PingFang SC,Hiragino Sans GB,Microsoft YaHei,sans-serif;background:var(--bg-layout);color:var(--text)}.pill-group{display:inline-flex;align-items:center;gap:2px;padding:3px;background:var(--pill-track);border-radius:999px}.pill-group-lg{gap:3px;padding:4px}.pill-group-lg .pill-item{padding:4px 16px;font-size:14px}.pill-item{position:relative;border:none;padding:3px 13px;border-radius:999px;background:transparent;font-family:inherit;font-size:13px;line-height:1.7;cursor:pointer;color:var(--text-secondary);transition:color .18s ease}.pill-item:hover:not(:disabled){color:var(--text)}.pill-item:disabled{cursor:not-allowed;opacity:.55}.pill-item[data-active]{color:var(--primary)}.pill-item:focus-visible{outline:2px solid var(--primary);outline-offset:2px}.pill-indicator{position:absolute;top:0;right:0;bottom:0;left:0;border-radius:999px;background:var(--pill-active)}.pill-label{position:relative;z-index:1}.geo-row{display:grid;gap:18px 28px;grid-template-columns:repeat(auto-fit,minmax(240px,1fr))}.metric-grid{display:grid;gap:18px;grid-template-columns:minmax(0,1fr)}@media (min-width: 720px){.metric-grid{grid-template-columns:repeat(3,minmax(0,1fr));gap:0}.metric-grid>*{padding-inline:18px}.metric-grid>*+*{border-inline-start:1px solid var(--hairline-soft)}.metric-grid>*:first-child{padding-inline-start:0}.metric-grid>*:last-child{padding-inline-end:0}}.log-surface{background:var(--bg-inset);border:1px solid var(--hairline-soft);border-radius:10px;padding:10px 12px;overflow:auto;white-space:pre;font-family:ui-monospace,SF Mono,JetBrains Mono,Menlo,Consolas,monospace;font-size:12px;line-height:1.7;color:var(--text)}@media (prefers-reduced-motion: reduce){*,*:before,*:after{animation-duration:.01ms!important;animation-iteration-count:1!important;transition-duration:.01ms!important}}*{scrollbar-width:thin;scrollbar-color:var(--hairline) transparent}*::-webkit-scrollbar{width:8px;height:8px}*::-webkit-scrollbar-thumb{background:var(--hairline);border-radius:4px}*::-webkit-scrollbar-track{background:transparent}.config-editor>[class^=cm-theme],.config-editor .cm-editor,.config-editor .cm-scroller{height:100%}.config-editor .cm-scroller{overflow:auto}