mcp-pacemaker 1.3.1 → 2.0.2

package/bin/windows/src/PoolingSecurityHelper.cs

@@ -10,16 +10,16 @@ public sealed class PoolingSecurityHelper
     private readonly AccessControlSections sections =
         AccessControlSections.Access | AccessControlSections.Owner | AccessControlSections.Group;
 
-    /// <summary>Inspects or preserves Windows file security.</summary>
-    /// <param name="args">One action: inspect or copy. File paths come from MCP_POOL environment variables.</param>
+    /// <summary>Inspects, stages, moves, or preserves Windows file security.</summary>
+    /// <param name="args">One action. File paths come from MCP_POOL environment variables.</param>
     /// <returns>Zero on success, three on a source security conflict, or one on failure.</returns>
     public static int Main(string[] args)
     {
         return new PoolingSecurityHelper().Run(args);
     }
 
-    /// <summary>Runs a security operation without changing file contents.</summary>
-    /// <param name="args">One action: inspect or copy.</param>
+    /// <summary>Runs a native file operation or a legacy security operation.</summary>
+    /// <param name="args">One of inspect-access, stage, move-no-replace, inspect, or copy.</param>
     /// <returns>Zero on success, three on a source security conflict, or one on failure.</returns>
     public int Run(string[] args)
     {
@@ -31,6 +31,15 @@ public sealed class PoolingSecurityHelper
             }
 
             var sourcePath = this.RequiredEnvironment("MCP_POOL_SOURCE");
+            if (args[0] == "inspect-access" ||
+                args[0] == "stage" ||
+                args[0] == "move-no-replace")
+            {
+                var files = new PoolingNativeFiles();
+                Console.WriteLine(files.Run(args[0], sourcePath));
+                return 0;
+            }
+
             if (args[0] == "inspect")
             {
                 Console.WriteLine(this.ReadSecurity(sourcePath).Fingerprint);
@@ -53,7 +62,11 @@ public sealed class PoolingSecurityHelper
                 Console.Error.WriteLine("MCPERR nativeError=" + nativeError.NativeErrorCode);
             }
 
-            return 1;
+            bool conflict = error is PoolingConflictException ||
+                (nativeError != null &&
+                    (nativeError.NativeErrorCode == 80 ||
+                     nativeError.NativeErrorCode == 183));
+            return conflict ? 3 : 1;
         }
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-pacemaker",
-  "version": "1.3.1",
+  "version": "2.0.2",
   "description": "Keeps your MCP servers alive across editor restarts, reboots, and token expiry — pluggable auth, cross-platform auto-start, one-command setup. Zero-dependency bridge; a small CLI for setup.",
   "type": "module",
   "bin": {
@@ -56,7 +56,7 @@
     "compat:clean": "node tools/compatibility/prepare.mjs --clean",
     "test:compat": "node --test --test-concurrency=1 test/compat/gates.test.mjs test/compat/cli-api.test.mjs",
     "test:compat:browser": "node --test --test-concurrency=1 test/compat/browser.test.mjs",
-    "test": "node --test test/bridge.test.mjs test/bridge-controls.test.mjs test/kill-tree.test.mjs test/keepalive.test.mjs test/auth-token.test.mjs test/cold-start.test.mjs test/crash-report.test.mjs test/resume.test.mjs test/config-checks.test.mjs test/config-reload.test.mjs test/health.test.mjs test/cli.test.mjs test/logs.test.mjs test/prewarm.test.mjs test/pooling-config.test.mjs test/pooling-writer.test.mjs test/pooling-api.test.mjs test/pooling-deadlines.test.mjs test/pooling-queue-budget.test.mjs test/windows-security-helper.test.mjs test/tui.test.mjs test/warm-pool.test.mjs test/server-metrics.test.mjs test/admission.test.mjs test/shared-sessions.test.mjs test/shared-http.test.mjs test/cross-host.test.mjs test/suite-integrity.test.mjs test/consumer-package.test.mjs test/notices.test.mjs test/notices-runtime.test.mjs test/npm-publication.test.mjs test/npm-publication-proof.test.mjs test/update-check.test.mjs test/service-lifecycle.test.mjs test/service-supervisor.test.mjs test/npm-publication-gates.test.mjs test/publication-scanners-advisories.test.mjs test/publication-scanners.test.mjs test/service-replacement.test.mjs test/consumer-environment.test.mjs test/npm-publication-external.test.mjs test/npm-publication-matrix.test.mjs test/npm-publication-peer.test.mjs test/publication-scanners-diagnostics.test.mjs test/publication-scanners-publication.test.mjs test/publication-scanners-paths.test.mjs test/npm-publication-local-enforcement.test.mjs test/publication-scanners-admission.test.mjs",
+    "test": "node --test test/bridge.test.mjs test/bridge-controls.test.mjs test/kill-tree.test.mjs test/keepalive.test.mjs test/auth-token.test.mjs test/cold-start.test.mjs test/crash-report.test.mjs test/resume.test.mjs test/config-checks.test.mjs test/config-reload.test.mjs test/health.test.mjs test/cli.test.mjs test/logs.test.mjs test/prewarm.test.mjs test/pooling-batch-scheduler.test.mjs test/pooling-batch-api.test.mjs test/pooling-batch-store.test.mjs test/pooling-batches.test.mjs test/pooling-stage-publication.test.mjs test/pooling-batch-startup.test.mjs test/pooling-postcommit-recovery.test.mjs test/pooling-config.test.mjs test/pooling-writer.test.mjs test/pooling-api.test.mjs test/pooling-deadlines.test.mjs test/pooling-queue-budget.test.mjs test/windows-security-helper.test.mjs test/windows-batch-security.test.mjs test/tui.test.mjs test/warm-pool.test.mjs test/server-metrics.test.mjs test/admission.test.mjs test/shared-sessions.test.mjs test/shared-http.test.mjs test/cross-host.test.mjs test/suite-integrity.test.mjs test/consumer-package.test.mjs test/notices.test.mjs test/notices-runtime.test.mjs test/npm-publication.test.mjs test/npm-publication-proof.test.mjs test/update-check.test.mjs test/service-lifecycle.test.mjs test/service-supervisor.test.mjs test/npm-publication-gates.test.mjs test/npm-publication-matrix.test.mjs test/publication-scanners-advisories.test.mjs test/publication-scanners.test.mjs test/service-replacement.test.mjs test/consumer-environment.test.mjs test/npm-publication-external.test.mjs test/npm-publication-peer.test.mjs test/publication-scanners-diagnostics.test.mjs test/publication-scanners-publication.test.mjs test/publication-scanners-paths.test.mjs test/npm-publication-local-enforcement.test.mjs test/publication-scanners-admission.test.mjs",
     "notices:check": "node tools/third-party-notices/check.mjs",
     "publication:source-gates": "node tools/npm-publication/source-gates.mjs",
     "publication:artifact-gates": "node tools/npm-publication/artifact-gates.mjs",

package/tools/windows-security-helper/README.md

@@ -16,7 +16,113 @@ AnyCPU uses the installed Framework's process architecture; native calls use
 pointer-sized handles. Windows ARM64 execution has not been validated.
 
 The Node caller must launch the package-relative executable directly (no shell)
-with exactly one argument, `inspect` or `copy`, and supply:
+with exactly one action argument. Paths are passed in the environment, never in
+arguments. No action enables privileges.
+
+### Batch file operations
+
+| Action | Environment | UTF-8 stdin |
+| --- | --- | --- |
+| `inspect-access` | `MCP_POOL_SOURCE` | Unused |
+| `stage` | `MCP_POOL_SOURCE`, `MCP_POOL_TEMP` (new destination) | `{"expected":{"identity":"…","revision":"…","security":"…"},"bytes":"<base64>"}` |
+| `move-no-replace` | `MCP_POOL_SOURCE`, `MCP_POOL_TEMP` (destination) | `{"expected":{"identity":"…","revision":"…","security":"…"}}` |
+
+Each successful action writes one JSON line with exactly
+`{identity, revision, security, size}`. Pass only the first three fields back in
+`expected`, not the complete result. `identity` is lowercase hexadecimal
+`volumeSerial:fileIndexHighAndLow` (8 digits, colon, 16 digits). `revision` is
+lowercase SHA256 of the complete bytes; `size` is their integer byte count.
+`security` is a lowercase SHA256 comparison value, not a descriptor to log.
+Custom config paths, including spaces and Unicode, use the same environment API.
+
+All three actions require a disk file, no final-component reparse point, exactly
+one hard link, and at most 1 MiB. Only Normal/Archive file attributes are supported;
+read-only, compressed, encrypted, sparse, hidden, and other attributes fail closed.
+The input envelope is limited to 1,400,000 bytes, strict UTF-8 and depth 8.
+Edited bytes must be canonical base64 decoding to at most 1 MiB of UTF-8.
+The helper does not parse the edited configuration; complete JSON validation and
+allowed field edits remain the Node coordinator's responsibility.
+
+Native `GetSecurityInfo` queries the held handle with `READ_CONTROL` sections
+`0x1f7`. The new actions never call the legacy privileged audit reader.
+The security hash frames `mcp-access-v1`, native owner SID, group SID,
+DACL-protection bit, raw DACL, native label ACL, and attributes with `BinaryWriter`.
+Byte arrays have signed Int32 lengths (`-1` for null). The discriminator is a
+BinaryWriter UTF-8 string; protection and attributes are UInt32, all little-endian.
+The DACL's `SE_DACL_AUTO_INHERITED` (`0x400`) bookkeeping is not hashed: Windows can
+clear it while retaining the exact grants. Defaulted/auto-inherit-request and
+other unsupported descriptor control state is refused. Audit control flags are
+outside this non-audit fingerprint; label ACE bytes and flags remain exact.
+
+Supported DACLs have non-null raw ACLs containing ordinary non-callback allow/deny
+ACEs. Unsupported object/callback/policy ACEs fail closed. No label, or one
+low/medium label with a nonzero mask composed only of NW/NR/NX (`1` through `7`),
+is supported. Only the inherited label ACE flag is allowed. Other native non-audit
+policy is refused.
+
+`stage` opens the source with actual `FILE_READ_DATA | FILE_WRITE_DATA |
+READ_CONTROL` access. Parent DeleteChild authority does not bypass source write
+denial. The held source handle denies other data writers/deleters during staging.
+Expected identity, bytes, and security are checked before creation and again
+around writing. When the source owner equals the caller's user SID or current
+token default owner, that owner is retained. Retaining an already assignable
+default owner avoids an unnecessary ownership change across a version roundtrip.
+Otherwise the caller must already obtain source `READ_CONTROL | WRITE_DAC` through
+`ReOpenFile` on the same object; only simple allow DACLs without OWNER RIGHTS or
+CREATOR special SIDs qualify. The candidate owner then becomes the creator.
+The source group must remain exact or creation/verification fails.
+
+The candidate uses native `CREATE_NEW` with `SECURITY_ATTRIBUTES` containing the
+accepted owner/group/DACL/protection and supported labels **before any bytes**.
+It never clones audit entries or sets SACL protection. A label-bearing creation
+descriptor marks the SACL defaulted (`SE_SACL_DEFAULTED`); this lets Windows inherit
+folder auditing while retaining the supplied mandatory label. The label remains
+part of the exact empty-file verification. Windows inherits the
+destination folder's auditing, including when the source protects its audit ACL.
+File-specific auditing is not detected or promised to carry forward. The UI must
+provide the agreed nonblocking audit-inheritance warning without claiming
+custom rules were detected.
+
+The empty candidate's security must equal the accepted fingerprint before
+`WriteFile`. Bytes are written through that owned handle, flushed using
+`FlushFileBuffers`, and then hashed and security-checked again. Security mismatch
+before writing can leave an empty, securely created candidate. A later failure
+can leave a partially/fully written candidate; callers must validate ownership
+before cleanup, never blindly delete a destination on any failure.
+
+`move-no-replace` holds a source handle with share-read/share-delete, denies data
+writers, and checks identity/content/security before `MoveFileExW(..., 0)`.
+It checks the destination and held object afterward and returns the moved
+descriptor. Existing destinations are never overwritten. There is no exists-check
+followed by an overwriting rename.
+
+**Limits:** the rename API is path-based. Another actor with delete/rename or
+directory/security authority can still swap the source path/ancestors between
+validation and the move, or change security during an operation. Postchecks
+detect some races but cannot undo them. This is not CAS, an atomic two-file
+transaction, a power-loss guarantee, or a complete metadata clone. A failed move
+postcheck can mean the move already happened; the coordinator must inspect
+transaction state before recovery. Deadline/commit gating, rollback/recovery,
+watcher coordination, and the missing-active interval belong to Node.
+
+| Exit | New-action meaning |
+| --- | --- |
+| `0` | One descriptor JSON line; empty stderr |
+| `3` | `PoolingConflictException` for an expected/state mismatch, or `Win32Exception` with native `80`/`183` for an existing destination |
+| `1` | Policy, request, I/O, access, or other failure |
+
+Failures have empty stdout. Stderr is exactly `MCPERR type=<exception type>` and,
+for a `Win32Exception`, a second line `MCPERR nativeError=<integer>`. Relevant
+types are `PoolingPolicyException` (unsupported or mismatched creation security),
+`PoolingConflictException`, `Win32Exception`, `ArgumentException`,
+`FormatException`, `DecoderFallbackException`, and `IOException`. Native `5` is
+access denied; `32` is a sharing violation; `2`/`3` are missing path components.
+No exception messages, paths, token information, config bytes, or descriptors are
+printed. Legacy stale-security conflicts retain their empty-stderr behavior.
+
+### Legacy compatibility
+
+`inspect` and `copy` remain available with their existing contract:
 
 | Environment variable | Used by | Value |
 | --- | --- | --- |
@@ -71,8 +177,12 @@ From the repository root:
 .\tools\windows-security-helper\build.ps1 -Verify -CompilerPath 'C:\path\to\Roslyn\csc.exe'
 ```
 
-The build uses `/noconfig /nostdlib+` with explicit `mscorlib.dll` and `System.dll`
-references, fixed options, LF-normalized UTF-8 source, and mapped source paths.
+The build uses `/noconfig /nostdlib+` with explicit `mscorlib.dll`, `System.dll`,
+`System.Core.dll`, and `System.Web.Extensions.dll` references. JSON serialization
+uses .NET Framework's built-in `JavaScriptSerializer`, not an npm dependency.
+Sources are `AssemblyInfo.cs`, `PoolingSecurityReader.cs`,
+`PoolingSecurityHelper.cs`, and `PoolingNativeFiles.cs`, with fixed options,
+LF-normalized UTF-8 source, and mapped source paths.
 It compiles twice under different temporary paths and refuses unequal bytes.
 Temporary build files are removed by explicit path. No `dotnet build`, runtime
 Framework compiler, NuGet restore, or external binary is involved.
@@ -93,3 +203,36 @@ Audit-denial/delay test variants belong in disposable directories outside `bin/`
 and must never be included in an npm tarball. Release validation must also run
 the real package on supported Windows/Node versions and verify packaged file
 inclusion. This build alone does not establish those platform results.
+
+## Targeted tests
+
+```powershell
+npm exec --no --offline --package=node@20.20.2 -- node --test test/windows-security-helper.test.mjs test/windows-batch-security.test.mjs
+npm exec --no --offline --package=node@22.23.2 -- node --test test/windows-security-helper.test.mjs test/windows-batch-security.test.mjs
+```
+
+The real-helper tests cover descriptor stability, full-byte staging, exact 1 MiB
+bounds, stale identity/revision/security, malformed/bounded input, held writers,
+hard links, and both collision points. There are no successful-path mocks.
+
+The isolated `TEST-SETUP` audit fixture requires an audit-reading oracle token
+and an existing Explorer window. Otherwise that one test explicitly skips.
+Explorer discovery first checks for a process in the current Windows session,
+before COM access or fixture policy changes. An absent process/window produces
+a structured capability reason; discovery exceptions and later worker failures
+remain failures. A skip does not establish audit-oracle coverage: that requires
+a non-skipped result on a machine with both prerequisites.
+It launches the **same Node executable** through Explorer, verifies medium
+integrity and absence of SeSecurityPrivilege, then runs the packaged helper
+directly. The elevated oracle separately verifies raw DACL/group/labels,
+owner rules, unchanged failed sources, and the retained original's complete
+audit descriptor. The mixed audit case retains one explicit plus one inherited
+source rule on `previous`; its new candidate has only the parent's inherited
+rule. A protected audit source also permits folder inheritance on the candidate.
+An incompatible inherited label must leave the candidate empty.
+
+`test/fixtures/windows-batch-security/FixturePolicy.cs` is compiled only by
+TEST-SETUP to establish synthetic raw DACLs and labels; it is not linked into,
+loaded by, or shipped as a dependency of the production helper. All fixture
+policy changes are confined to a fresh owned temporary directory, removed by
+the test. No live files, tasks, bridge, or token privileges are changed.

package/tools/windows-security-helper/build.ps1

@@ -70,8 +70,8 @@ $sourceDirectory = Join-Path $binaryDirectory 'src'
 $binaryName = 'PoolingSecurityHelper.exe'
 $binaryPath = Join-Path $binaryDirectory $binaryName
 $metadataPath = Join-Path $binaryDirectory 'PoolingSecurityHelper.build.json'
-$sourceNames = @('AssemblyInfo.cs', 'PoolingSecurityReader.cs', 'PoolingSecurityHelper.cs')
-$referenceNames = @('mscorlib.dll', 'System.dll')
+$sourceNames = @('AssemblyInfo.cs', 'PoolingSecurityReader.cs', 'PoolingSecurityHelper.cs', 'PoolingNativeFiles.cs')
+$referenceNames = @('mscorlib.dll', 'System.dll', 'System.Core.dll', 'System.Web.Extensions.dll')
 
 if (-not $CompilerPath) {
     $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'

package/ui/dist/assets/index-CaLPg0c-.css

@@ -0,0 +1 @@
+*,:before,:after{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }::backdrop{--tw-border-spacing-x: 0;--tw-border-spacing-y: 0;--tw-translate-x: 0;--tw-translate-y: 0;--tw-rotate: 0;--tw-skew-x: 0;--tw-skew-y: 0;--tw-scale-x: 1;--tw-scale-y: 1;--tw-pan-x: ;--tw-pan-y: ;--tw-pinch-zoom: ;--tw-scroll-snap-strictness: proximity;--tw-gradient-from-position: ;--tw-gradient-via-position: ;--tw-gradient-to-position: ;--tw-ordinal: ;--tw-slashed-zero: ;--tw-numeric-figure: ;--tw-numeric-spacing: ;--tw-numeric-fraction: ;--tw-ring-inset: ;--tw-ring-offset-width: 0px;--tw-ring-offset-color: #fff;--tw-ring-color: rgb(59 130 246 / .5);--tw-ring-offset-shadow: 0 0 #0000;--tw-ring-shadow: 0 0 #0000;--tw-shadow: 0 0 #0000;--tw-shadow-colored: 0 0 #0000;--tw-blur: ;--tw-brightness: ;--tw-contrast: ;--tw-grayscale: ;--tw-hue-rotate: ;--tw-invert: ;--tw-saturate: ;--tw-sepia: ;--tw-drop-shadow: ;--tw-backdrop-blur: ;--tw-backdrop-brightness: ;--tw-backdrop-contrast: ;--tw-backdrop-grayscale: ;--tw-backdrop-hue-rotate: ;--tw-backdrop-invert: ;--tw-backdrop-opacity: ;--tw-backdrop-saturate: ;--tw-backdrop-sepia: ;--tw-contain-size: ;--tw-contain-layout: ;--tw-contain-paint: ;--tw-contain-style: }*,:before,:after{box-sizing:border-box;border-width:0;border-style:solid;border-color:#e5e7eb}:before,:after{--tw-content: ""}html,:host{line-height:1.5;-webkit-text-size-adjust:100%;-moz-tab-size:4;-o-tab-size:4;tab-size:4;font-family:ui-sans-serif,system-ui,sans-serif,"Apple Color Emoji","Segoe UI Emoji",Segoe UI Symbol,"Noto Color Emoji";font-feature-settings:normal;font-variation-settings:normal;-webkit-tap-highlight-color:transparent}body{margin:0;line-height:inherit}hr{height:0;color:inherit;border-top-width:1px}abbr:where([title]){-webkit-text-decoration:underline dotted;text-decoration:underline dotted}h1,h2,h3,h4,h5,h6{font-size:inherit;font-weight:inherit}a{color:inherit;text-decoration:inherit}b,strong{font-weight:bolder}code,kbd,samp,pre{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace;font-feature-settings:normal;font-variation-settings:normal;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}table{text-indent:0;border-color:inherit;border-collapse:collapse}button,input,optgroup,select,textarea{font-family:inherit;font-feature-settings:inherit;font-variation-settings:inherit;font-size:100%;font-weight:inherit;line-height:inherit;letter-spacing:inherit;color:inherit;margin:0;padding:0}button,select{text-transform:none}button,input:where([type=button]),input:where([type=reset]),input:where([type=submit]){-webkit-appearance:button;background-color:transparent;background-image:none}:-moz-focusring{outline:auto}:-moz-ui-invalid{box-shadow:none}progress{vertical-align:baseline}::-webkit-inner-spin-button,::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}summary{display:list-item}blockquote,dl,dd,h1,h2,h3,h4,h5,h6,hr,figure,p,pre{margin:0}fieldset{margin:0;padding:0}legend{padding:0}ol,ul,menu{list-style:none;margin:0;padding:0}dialog{padding:0}textarea{resize:vertical}input::-moz-placeholder,textarea::-moz-placeholder{opacity:1;color:#9ca3af}input::placeholder,textarea::placeholder{opacity:1;color:#9ca3af}button,[role=button]{cursor:pointer}:disabled{cursor:default}img,svg,video,canvas,audio,iframe,embed,object{display:block;vertical-align:middle}img,video{max-width:100%;height:auto}[hidden]:where(:not([hidden=until-found])){display:none}.\!visible{visibility:visible!important}.visible{visibility:visible}.sticky{position:sticky}.top-0{top:0}.z-10{z-index:10}.col-span-full{grid-column:1 / -1}.m-0{margin:0}.mx-auto{margin-left:auto;margin-right:auto}.mb-2{margin-bottom:.5rem}.mb-3{margin-bottom:.75rem}.mb-4{margin-bottom:1rem}.ml-2{margin-left:.5rem}.ml-3{margin-left:.75rem}.ml-auto{margin-left:auto}.mt-1{margin-top:.25rem}.mt-2{margin-top:.5rem}.mt-3{margin-top:.75rem}.mt-4{margin-top:1rem}.flex{display:flex}.table{display:table}.grid{display:grid}.h-2\.5{height:.625rem}.max-h-52{max-height:13rem}.min-h-screen{min-height:100vh}.w-2\.5{width:.625rem}.w-40{width:10rem}.w-full{width:100%}.min-w-0{min-width:0px}.min-w-\[260px\]{min-width:260px}.max-w-\[1160px\]{max-width:1160px}.max-w-\[1400px\]{max-width:1400px}.max-w-\[900px\]{max-width:900px}.flex-1{flex:1 1 0%}.shrink-0{flex-shrink:0}@keyframes spin{to{transform:rotate(360deg)}}.animate-spin{animation:spin 1s linear infinite}.grid-cols-\[14px_160px_1fr\]{grid-template-columns:14px 160px 1fr}.flex-col{flex-direction:column}.flex-wrap{flex-wrap:wrap}.items-start{align-items:flex-start}.items-center{align-items:center}.items-baseline{align-items:baseline}.justify-between{justify-content:space-between}.gap-1{gap:.25rem}.gap-1\.5{gap:.375rem}.gap-2{gap:.5rem}.gap-3{gap:.75rem}.gap-4{gap:1rem}.gap-\[18px\]{gap:18px}.overflow-auto{overflow:auto}.overflow-x-auto{overflow-x:auto}.truncate{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.whitespace-pre-wrap{white-space:pre-wrap}.break-words{overflow-wrap:break-word}.break-all{word-break:break-all}.rounded{border-radius:.25rem}.rounded-full{border-radius:9999px}.rounded-lg{border-radius:.5rem}.rounded-md{border-radius:.375rem}.rounded-xl{border-radius:.75rem}.border{border-width:1px}.border-b{border-bottom-width:1px}.border-t{border-top-width:1px}.border-accent{--tw-border-opacity: 1;border-color:rgb(110 168 254 / var(--tw-border-opacity, 1))}.border-amber{--tw-border-opacity: 1;border-color:rgb(240 180 41 / var(--tw-border-opacity, 1))}.border-amber\/50{border-color:#f0b42980}.border-danger{--tw-border-opacity: 1;border-color:rgb(248 113 113 / var(--tw-border-opacity, 1))}.border-danger\/50{border-color:#f8717180}.border-line{--tw-border-opacity: 1;border-color:rgb(42 47 58 / var(--tw-border-opacity, 1))}.border-ok{--tw-border-opacity: 1;border-color:rgb(52 211 153 / var(--tw-border-opacity, 1))}.bg-accent\/10{background-color:#6ea8fe1a}.bg-amber{--tw-bg-opacity: 1;background-color:rgb(240 180 41 / var(--tw-bg-opacity, 1))}.bg-amber\/5{background-color:#f0b4290d}.bg-danger{--tw-bg-opacity: 1;background-color:rgb(248 113 113 / var(--tw-bg-opacity, 1))}.bg-danger\/5{background-color:#f871710d}.bg-ok{--tw-bg-opacity: 1;background-color:rgb(52 211 153 / var(--tw-bg-opacity, 1))}.bg-panel{--tw-bg-opacity: 1;background-color:rgb(23 26 35 / var(--tw-bg-opacity, 1))}.bg-panel2{--tw-bg-opacity: 1;background-color:rgb(30 34 45 / var(--tw-bg-opacity, 1))}.p-16{padding:4rem}.p-3{padding:.75rem}.p-4{padding:1rem}.p-6{padding:1.5rem}.p-8{padding:2rem}.px-1\.5{padding-left:.375rem;padding-right:.375rem}.px-2{padding-left:.5rem;padding-right:.5rem}.px-2\.5{padding-left:.625rem;padding-right:.625rem}.px-3{padding-left:.75rem;padding-right:.75rem}.px-4{padding-left:1rem;padding-right:1rem}.px-5{padding-left:1.25rem;padding-right:1.25rem}.px-6{padding-left:1.5rem;padding-right:1.5rem}.py-0\.5{padding-top:.125rem;padding-bottom:.125rem}.py-1{padding-top:.25rem;padding-bottom:.25rem}.py-1\.5{padding-top:.375rem;padding-bottom:.375rem}.py-2{padding-top:.5rem;padding-bottom:.5rem}.py-3{padding-top:.75rem;padding-bottom:.75rem}.py-3\.5{padding-top:.875rem;padding-bottom:.875rem}.pb-3{padding-bottom:.75rem}.pt-3{padding-top:.75rem}.text-left{text-align:left}.text-center{text-align:center}.align-top{vertical-align:top}.font-mono{font-family:ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,Liberation Mono,Courier New,monospace}.text-\[11px\]{font-size:11px}.text-\[13px\]{font-size:13px}.text-base{font-size:1rem;line-height:1.5rem}.text-lg{font-size:1.125rem;line-height:1.75rem}.text-sm{font-size:.875rem;line-height:1.25rem}.text-xl{font-size:1.25rem;line-height:1.75rem}.text-xs{font-size:.75rem;line-height:1rem}.font-bold{font-weight:700}.font-medium{font-weight:500}.font-normal{font-weight:400}.font-semibold{font-weight:600}.uppercase{text-transform:uppercase}.capitalize{text-transform:capitalize}.leading-relaxed{line-height:1.625}.text-accent{--tw-text-opacity: 1;color:rgb(110 168 254 / var(--tw-text-opacity, 1))}.text-amber{--tw-text-opacity: 1;color:rgb(240 180 41 / var(--tw-text-opacity, 1))}.text-danger{--tw-text-opacity: 1;color:rgb(248 113 113 / var(--tw-text-opacity, 1))}.text-fg{--tw-text-opacity: 1;color:rgb(230 232 238 / var(--tw-text-opacity, 1))}.text-muted{--tw-text-opacity: 1;color:rgb(154 163 178 / var(--tw-text-opacity, 1))}.text-muted\/40{color:#9aa3b266}.text-muted\/60{color:#9aa3b299}.text-ok{--tw-text-opacity: 1;color:rgb(52 211 153 / var(--tw-text-opacity, 1))}.shadow-\[0_0_6px\]{--tw-shadow: 0 0 6px;--tw-shadow-colored: 0 0 6px var(--tw-shadow-color);box-shadow:var(--tw-ring-offset-shadow, 0 0 #0000),var(--tw-ring-shadow, 0 0 #0000),var(--tw-shadow)}.shadow-ok{--tw-shadow-color: #34d399;--tw-shadow: var(--tw-shadow-colored)}.outline-none{outline:2px solid transparent;outline-offset:2px}.filter{filter:var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)}.\[grid-template-columns\:repeat\(auto-fit\,minmax\(320px\,1fr\)\)\]{grid-template-columns:repeat(auto-fit,minmax(320px,1fr))}:root{color-scheme:dark}body{margin:0;background:#0f1117;color:#e6e8ee;font:14px/1.5 ui-sans-serif,system-ui,Segoe UI,Roboto,sans-serif}.hover\:border-accent:hover{--tw-border-opacity: 1;border-color:rgb(110 168 254 / var(--tw-border-opacity, 1))}.hover\:bg-accent\/20:hover{background-color:#6ea8fe33}.hover\:text-fg:hover{--tw-text-opacity: 1;color:rgb(230 232 238 / var(--tw-text-opacity, 1))}.focus\:border-accent:focus{--tw-border-opacity: 1;border-color:rgb(110 168 254 / var(--tw-border-opacity, 1))}.disabled\:cursor-default:disabled{cursor:default}.disabled\:opacity-40:disabled{opacity:.4}