- indentation; we just tighten the
spacing and add a faint left border to make the hierarchy obvious. */
ul.tree, ul.tree ul {
list-style: none;
padding-left: 1.2rem;
margin: 0;
border-left: 1px dashed var(--pico-muted-border-color);
}
ul.tree > li, ul.tree ul > li {
padding: 0.25rem 0;
}
.proc code.wrap { font-size: 0.9em; }
.proc .proc-meta {
margin-left: 0.5rem;
color: var(--pico-muted-color);
}
.proc mark {
margin-right: 0.4rem;
padding: 0 0.4rem;
font-size: 0.75em;
text-transform: uppercase;
}
.proc details { margin-top: 0.25rem; }
.proc details pre {
margin: 0.25rem 0 0 0;
padding: 0.4rem 0.6rem;
font-size: 0.85em;
}
/* Inline cmdline: the most load-bearing piece of evidence on the
Processes tab for AI-agent triage — "what did node.exe actually
invoke". Rendered flush under the image line in a subtly tinted
code block so it reads as a direct annotation of its process, not
a separate UI element. Horizontal overflow rather than wrap so a
long node bootstrap stays one copy-pasteable line instead of
ballooning the row height. */
.proc-cmdline {
margin: 0.25rem 0 0 0;
padding: 0.35rem 0.55rem;
background: color-mix(in srgb, var(--pico-card-background-color, #111) 60%, transparent);
border-left: 2px solid var(--pico-muted-border-color, #333);
border-radius: 0 2px 2px 0;
max-width: 100%;
overflow-x: auto;
}
.proc-cmdline code {
font-size: 0.82em;
color: var(--pico-color, #ddd);
background: transparent;
padding: 0;
white-space: pre;
}
/* Lifespan chip on the proc-meta line. Dead processes read in muted
text alongside pid/ppid; still-running processes get a green accent
so the eye lands on "who's still alive" when scanning a tree with
dozens of ended children. Not a full badge — just inline colour on
a single word, matching the understatement of the surrounding meta. */
.proc-lifespan {
font-family: var(--pico-font-family-monospace, monospace);
}
.proc-lifespan-running {
color: #10b981;
font-weight: 500;
}
/* Event-filter pills above the Recent events table. Rendered as links so
state lives in the URL (bookmark-friendly) rather than in JS state. */
nav.filter-pills {
display: flex;
flex-wrap: wrap;
gap: 0.4rem;
margin: 0 0 0.75rem 0;
}
nav.filter-pills .pill {
display: inline-block;
padding: 0.2rem 0.75rem;
border: 1px solid var(--pico-muted-border-color);
border-radius: 999px;
font-size: 0.85em;
color: var(--pico-muted-color);
text-decoration: none;
background: transparent;
}
nav.filter-pills .pill.active {
color: var(--pico-primary);
border-color: var(--pico-primary);
background: var(--pico-primary-background, transparent);
}
nav.filter-pills .pill:hover {
border-color: var(--pico-primary);
}
/* Fixed two-column grid used by the Activity tab on session detail.
Each cell holds one topn card and keeps a half-width slot even when
the row has only one card in it — avoids the empty spacer-article
hack we previously used with Pico's flex .grid. Drops to a single
column on narrow viewports so cards stay readable. */
.grid-two-cols {
display: grid;
grid-template-columns: repeat(2, minmax(0, 1fr));
gap: var(--pico-grid-column-gap, 1rem) var(--pico-grid-row-gap, 1rem);
margin-bottom: var(--pico-spacing, 1rem);
}
@media (max-width: 768px) {
.grid-two-cols { grid-template-columns: 1fr; }
}
/* Stat cards — the "at a glance" row across the top of the triage
landing page. Kept flat and compact; a big number + a small label is
the whole job. stat-card-flag colours non-zero risk counters so the
reviewer's eye lands on the card that matters. */
.stat-cards article.stat-card {
margin: 0;
padding: 0.75rem 1rem;
text-align: left;
}
.stat-cards article.stat-card small {
display: block;
color: var(--pico-muted-color);
font-size: 0.8em;
text-transform: uppercase;
letter-spacing: 0.04em;
}
.stat-cards article.stat-card strong {
font-size: 1.8rem;
line-height: 1.2;
}
/* Review-posture micro row inside the Flagged stat-card. Three
compact label/value pairs — Reviewed, Open, MTTA — laid as a
small dl grid below the severity chip row. Small + quiet so it
reads as context under the main number, not a competing headline. */
.stat-posture {
display: grid;
grid-template-columns: repeat(3, 1fr);
gap: 0.35rem 0.75rem;
margin: 0.65rem 0 0 0;
padding-top: 0.55rem;
border-top: 1px solid var(--pico-muted-border-color);
}
.stat-posture > div {
display: flex;
flex-direction: column;
min-width: 0;
}
.stat-posture dt {
color: var(--pico-muted-color);
font-size: 0.66em;
text-transform: uppercase;
letter-spacing: 0.08em;
font-family: var(--font-display);
margin: 0;
}
.stat-posture dd {
margin: 0;
font-size: 0.95rem;
font-weight: 600;
font-variant-numeric: tabular-nums;
color: var(--pico-color);
}
.stat-posture-alert { color: var(--severity-critical-fg); }
/* Severity tier strip under the Flagged stat-card's big number.
Replaces the sparkline when any tier is non-zero — the per-tier
count is a better "is this an emergency" signal than a 14-day
shape line. Wraps onto two lines on narrow cards without forcing
horizontal scroll. */
.stat-severity {
display: flex;
flex-wrap: wrap;
gap: 0.3rem;
margin-top: 0.45rem;
}
.stat-severity .severity-chip {
font-size: 0.66em;
padding: 0.18rem 0.5rem;
}
article.stat-card-flag {
border-left: 4px solid var(--pico-del-color, #c0392b);
}
article.stat-card-flag strong {
color: var(--pico-del-color, #c0392b);
}
article.stat-card-zero {
border-left-color: var(--pico-muted-border-color);
}
article.stat-card-zero strong {
color: var(--pico-muted-color);
}
/* Flagged row tinting in the main sessions table — a faint left accent
so a reviewer scanning the list can spot risky sessions without
reading the Risk column. Using the same del-colour as the Needs-review
panel so the two signals share a visual language. */
tr.row-flagged td:first-child {
border-left: 3px solid var(--pico-del-color, #c0392b);
}
/* Severity-keyed row accents — override the generic red row-flagged
accent when a specific tier class is present. A CISO scanning the
table can triage top-down: reds first, oranges next, yellows as
time allows. Matches the severity-chip palette one-for-one. */
tr.row-severity-critical td:first-child {
border-left: 3px solid var(--severity-critical-fg);
}
tr.row-severity-high td:first-child {
border-left: 3px solid var(--severity-high-fg);
}
tr.row-severity-medium td:first-child {
border-left: 3px solid var(--severity-medium-fg);
}
tr.row-severity-low td:first-child {
border-left: 3px solid var(--severity-low-fg);
}
/* Reviewed row — replaces the red accent with a muted green so a
reviewed-but-still-risky session reads as "handled" not "pending",
without disappearing from the list entirely. */
tr.row-reviewed td:first-child {
border-left: 3px solid rgba(109, 223, 159, 0.5);
}
tr.row-reviewed {
opacity: 0.72;
}
.reviewed-tag {
color: #6ddf9f;
margin-left: 0.35rem;
font-weight: 700;
}
/* Risk badges in the session table. Kept small; they share the pill
shape used elsewhere so the page doesn't feel like four different
designers worked on it. */
mark.risk {
display: inline-block;
padding: 0.05rem 0.4rem;
margin-right: 0.25rem;
border-radius: 4px;
font-size: 0.75em;
text-transform: uppercase;
letter-spacing: 0.03em;
}
/* Explicit colours (not Pico vars) — Pico's dark-theme
--pico-mark-background-color is actually dark blue, which renders
dark-on-dark and is unreadable. Hard-coding keeps the signal
consistent across themes. */
mark.risk-sensitive {
background: #c0392b;
color: #fff;
}
mark.risk-shell {
background: #d9822b;
color: #fff;
}
small.risk-network {
color: var(--pico-muted-color);
font-size: 0.8em;
}
/* Per-process activity in the tree. proc-counts is the inline summary
line ("32 opens · 4 writes · 2 DNS") so a reviewer gets a read on
each node at a glance without expanding anything. The proc-activity
is the drill-down when they want the actual paths. */
.proc-counts {
display: flex;
flex-wrap: wrap;
gap: 0.6rem;
margin: 0.2rem 0 0 0;
font-size: 0.85em;
color: var(--pico-muted-color);
}
.proc-counts .proc-count strong {
color: var(--pico-color);
font-weight: 600;
margin-right: 0.2rem;
}
.proc-counts .proc-count-flag strong {
color: var(--pico-del-color, #c0392b);
}
.proc-activity {
margin-top: 0.25rem;
}
.proc-activity summary {
color: var(--pico-muted-color);
cursor: pointer;
}
.proc-activity-grid {
display: grid;
grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
gap: 0.5rem 1rem;
margin-top: 0.4rem;
}
.proc-activity-grid table {
margin: 0.2rem 0 0 0;
font-size: 0.85em;
}
.proc-activity-grid table td:last-child {
text-align: right;
color: var(--pico-muted-color);
}
/* Badges on the process-tree row: root (existing neutral), shell, and
sensitive. Hard-coded colours because Pico's dark theme maps
--pico-mark-background-color to a dark blue — readable in light
mode, invisible here. */
.proc mark {
background: #6b7280; /* slate — neutral "root" badge */
color: #fff;
}
.proc mark.shell {
background: #d9822b;
color: #fff;
}
.proc mark.sensitive {
background: #c0392b;
color: #fff;
}
.proc.proc-flagged {
border-left: 2px solid var(--pico-del-color, #c0392b);
padding-left: 0.5rem;
}
/* Session timeline — shorter, denser cousin of the trend chart. One
bar per time bin across a session's [first, last] window; the
sensitive overlay reuses the same red as the rest of the risk
language. Ticks sit inside the viewBox so the article stays the
height it reserved. */
article.timeline {
margin: 1.75rem 0 1rem 0;
padding: 0.75rem 1rem 0.5rem 1rem;
background: var(--pico-card-background-color);
border: 1px solid var(--pico-muted-border-color);
border-radius: var(--pico-border-radius);
}
article.timeline header {
margin-bottom: 0.25rem;
padding: 0;
border: none;
background: transparent;
}
article.timeline header small { color: var(--pico-muted-color); }
article.timeline svg {
display: block;
width: 100%;
max-width: 640px;
height: auto;
aspect-ratio: 10 / 1;
}
article.timeline .timeline-axis {
stroke: var(--pico-muted-border-color);
stroke-width: 1;
}
article.timeline .timeline-bar {
fill: var(--pico-primary);
opacity: 0.7;
}
article.timeline .timeline-bar-sensitive {
fill: #c0392b;
}
article.timeline .timeline-tick {
fill: var(--pico-muted-color);
font-size: 9px;
font-family: var(--pico-font-family);
}
/* Hero stat cards — the top row of the landing page. Each card is
"big number" + a small 14-day sparkline pinned to the bottom so the
cards keep a uniform height regardless of whether the sparkline
renders. display:flex with space-between pushes label to the top,
number to the middle, trend to the bottom.
align-items:stretch + height:100% on the row ensures the Flagged
card (which is tallest, having severity chips + review-posture row)
doesn't leave a shorter Probes / Sessions / Sensitive card dangling
beneath it. Without this, the Probes card was sizing to its own
content and hanging into the Agents panel below. */
.hero-stats {
align-items: stretch;
/* Clear air between the hero row and the fleet-breakdown panels
below. Without this the bottom edge of the hero tiles sits
directly against the "AGENTS / TOP SENSITIVE PATHS / TOP
SUSPICIOUS HOSTS" headers, which reads as the hero row
blending into the breakdown row — the two are conceptually
different (hero = fleet macro, breakdown = triage-queue
micro) and should read as different bands. */
margin-bottom: 1.25rem;
}
.hero-stats article.stat-card {
display: flex;
flex-direction: column;
justify-content: space-between;
min-height: 110px;
height: 100%;
padding: 0.75rem 1rem;
}
.hero-stats article.stat-card header {
margin: 0;
padding: 0;
border: none;
background: transparent;
}
.hero-stats article.stat-card header small {
color: var(--pico-muted-color);
font-size: 0.75em;
text-transform: uppercase;
letter-spacing: 0.05em;
font-weight: 500;
}
.hero-stats article.stat-card strong {
display: block;
font-size: 2.1rem;
line-height: 1.1;
font-weight: 600;
margin: 0.2rem 0 0.1rem 0;
font-variant-numeric: tabular-nums;
}
.hero-stats .spark-subtitle {
color: var(--pico-muted-color);
font-size: 0.75em;
}
/* Link variant of a stat card — used on the landing-page Hosts tile
to send the reviewer into /ui/probes. We let Pico's styles
handle colour inheritance, then re-apply the card's flex layout
(none of the base .stat-card rules target , they all qualify on
article.stat-card) and strip the default link underline/decoration
so the card reads as a card, not as a link-in-a-card. */
.hero-stats a.stat-card,
a.stat-card-link {
display: flex;
flex-direction: column;
justify-content: space-between;
min-height: 110px;
height: 100%;
padding: 0.75rem 1rem;
border: var(--pico-border-width, 1px) solid var(--pico-card-border-color, rgba(115, 130, 140, 0.2));
border-radius: var(--pico-border-radius, 0.5rem);
background: var(--pico-card-background-color, transparent);
color: inherit;
text-decoration: none;
transition: border-color 0.15s, transform 0.15s;
}
.hero-stats a.stat-card header,
a.stat-card-link header {
margin: 0;
padding: 0;
border: none;
background: transparent;
}
.hero-stats a.stat-card header small,
a.stat-card-link header small {
color: var(--pico-muted-color);
font-size: 0.75em;
text-transform: uppercase;
letter-spacing: 0.05em;
font-weight: 500;
}
.hero-stats a.stat-card strong,
a.stat-card-link strong {
display: block;
font-size: 2.1rem;
line-height: 1.1;
font-weight: 600;
margin: 0.2rem 0 0.1rem 0;
font-variant-numeric: tabular-nums;
}
.hero-stats a.stat-card:hover,
a.stat-card-link:hover {
border-color: var(--pico-primary);
transform: translateY(-1px);
}
/* The stat-card-flag border-left applies to only in the
existing rule — repeat it for the link variant so a silent-probe
count on the Hosts card gets the same red accent treatment as the
Flagged-sessions card. */
a.stat-card-link.stat-card-flag {
border-left: 4px solid var(--pico-del-color, #c0392b);
}
a.stat-card-link.stat-card-flag strong {
color: var(--pico-del-color, #c0392b);
}
.probe-silent-subtitle {
color: var(--pico-del-color, #c0392b) !important;
font-weight: 600;
}
/* Tiny status dot that sits before the Probes stat-card subtitle so
the card has a bottom-edge visual accent matching the sparklines on
its peer cards — without it the probes tile reads as "empty" next
to the neighbouring Sessions / Flagged / Sensitive cards and visually
bleeds into whatever sits below it. */
.probe-pip {
display: inline-block;
width: 0.5rem;
height: 0.5rem;
border-radius: 50%;
margin-right: 0.4rem;
vertical-align: baseline;
}
.probe-pip-ok {
background: #27ae60;
box-shadow: 0 0 0 2px color-mix(in srgb, #27ae60 22%, transparent);
}
.probe-pip-alert {
background: var(--pico-del-color, #c0392b);
box-shadow: 0 0 0 2px color-mix(in srgb, var(--pico-del-color, #c0392b) 22%, transparent);
}
/* All-sessions page — dedicated browse view for the full fleet. Hero
mirrors the probes page so the two "listing" pages share shape. */
.all-sessions-hero { margin-bottom: 1.25rem; }
.all-sessions-title { margin: 0.25rem 0 0.4rem 0; }
.all-sessions-subtitle { color: var(--pico-muted-color); max-width: 70ch; }
.all-sessions-count { margin: 0.5rem 0 0.75rem 0; color: var(--pico-muted-color); }
/* Activity-tab summary strip. One line of tallies under the hero so
the reviewer reads the rough shape of the session before scrolling
into the per-category cards below. Subdued tone — this is context,
not a headline. */
.activity-summary {
margin: 0.25rem 0 1rem 0;
padding: 0.4rem 0.75rem;
border-left: 3px solid var(--pico-muted-border-color, #333);
color: var(--pico-muted-color);
line-height: 1.5;
}
.activity-summary strong {
color: var(--pico-color);
font-variant-numeric: tabular-nums;
}
/* Dashboard CTA linking to the full list — quiet button sitting
under the fleet panels so a reviewer who finished triage has an
obvious "now browse everything" next step without a second scan. */
.dashboard-allsessions-cta {
margin: 1.25rem 0 0 0;
text-align: right;
}
/* Probe health panel — the /ui/probes page. Table with a status chip
in col 1 (silent rows float to the top via sort, so the chip column
is the scan axis). The chip shares pill geometry with risk-chip but
uses its own colour palette: green/amber/red for fresh/stale/silent. */
.probes-hero { margin-bottom: 1.5rem; }
.probes-title { margin: 0.25rem 0 0.4rem 0; }
.probes-subtitle { color: var(--pico-muted-color); max-width: 70ch; }
.probes-stats { margin-bottom: 1.5rem; }
.probes-table-wrap { overflow-x: auto; }
.probes-table {
width: 100%;
border-collapse: collapse;
}
.probes-table th, .probes-table td {
padding: 0.55rem 0.75rem;
border-bottom: 1px solid var(--pico-card-border-color, rgba(115, 130, 140, 0.15));
text-align: left;
vertical-align: middle;
}
.probes-table th {
font-size: 0.75em;
text-transform: uppercase;
letter-spacing: 0.05em;
color: var(--pico-muted-color);
font-weight: 500;
}
.probe-chip {
display: inline-block;
padding: 0.15rem 0.6rem;
border-radius: 999px;
font-size: 0.72em;
text-transform: uppercase;
letter-spacing: 0.04em;
font-weight: 600;
color: #fff;
}
.probe-chip-fresh { background: var(--status-success); }
.probe-chip-stale { background: var(--status-warning); }
.probe-chip-silent { background: var(--status-danger); }
.probe-row-silent td:first-child {
border-left: 3px solid var(--status-danger);
}
.probe-row-stale td:first-child {
border-left: 3px solid var(--status-warning);
}
.probe-silence { font-variant-numeric: tabular-nums; }
.probe-silence-fresh { color: var(--pico-muted-color); }
.probe-recent { color: var(--pico-muted-color); margin-left: 0.35rem; }
.probe-noname { color: var(--pico-muted-color); font-style: italic; }
.probe-agents code.probe-agent {
font-size: 0.85em;
padding: 0.05rem 0.35rem;
background: var(--pico-code-background-color, rgba(115, 130, 140, 0.08));
border-radius: 4px;
margin-right: 0.2rem;
}
/* Sparkline SVG — fills the width of the card at a fixed height, no
aspect-ratio constraint since the stretching is fine here (the
shape is the signal, not the exact slope). spark-neutral uses
pico-primary for the non-risk metrics; spark-flag uses the same
del-red as the rest of the risk visual language. */
svg.sparkline {
display: block;
width: 100%;
height: 32px;
margin-top: 0.5rem;
}
svg.sparkline .sparkline-line {
fill: none;
stroke-width: 1.5;
vector-effect: non-scaling-stroke;
}
svg.sparkline .sparkline-area {
stroke: none;
opacity: 0.22;
}
svg.sparkline.spark-neutral .sparkline-line { stroke: var(--pico-primary); }
svg.sparkline.spark-neutral .sparkline-area { fill: var(--pico-primary); }
svg.sparkline.spark-flag .sparkline-line { stroke: #c0392b; }
svg.sparkline.spark-flag .sparkline-area { fill: #c0392b; }
/* Fleet-level breakdown row — the two-column strip between the hero
cards and the Needs-review panel. Agents on the left, sensitive
paths on the right; each side is its own article so Pico's card
chrome gives them matching backgrounds + borders. */
.fleet-grid {
margin: 0 0 1rem 0;
}
.fleet-grid article {
margin: 0;
padding: 0.75rem 1rem;
}
.fleet-grid article header {
margin-bottom: 0.5rem;
padding: 0;
border: none;
background: transparent;
}
.fleet-grid article header small { color: var(--pico-muted-color); }
/* Per-agent tiles. Horizontal flex grid so N agents wrap cleanly at
narrow widths. Each tile carries a left accent that goes red when
the agent has any flagged sessions — same vocabulary as the
row-flagged accent in the main table. */
.agent-tiles {
display: flex;
flex-wrap: wrap;
gap: 0.5rem;
}
.agent-tile {
flex: 1 1 180px;
min-width: 160px;
padding: 0.6rem 0.75rem;
background: var(--pico-background-color);
border: 1px solid var(--pico-muted-border-color);
border-left: 3px solid var(--pico-muted-border-color);
border-radius: var(--pico-border-radius);
}
.agent-tile-flag {
border-left-color: #c0392b;
}
.agent-tile .agent-name {
margin-bottom: 0.3rem;
font-size: 0.9em;
}
.agent-tile .agent-name code {
background: transparent;
padding: 0;
font-weight: 600;
}
.agent-tile .agent-metrics {
display: flex;
align-items: baseline;
gap: 0.4rem;
flex-wrap: wrap;
}
.agent-tile .agent-count {
font-size: 1.4rem;
font-weight: 600;
font-variant-numeric: tabular-nums;
}
.agent-tile .agent-label { color: var(--pico-muted-color); }
.agent-tile .agent-flag {
margin-left: auto;
padding: 0.1rem 0.4rem;
border-radius: 4px;
background: rgba(192, 57, 43, 0.18);
color: #e27063;
font-size: 0.75em;
font-weight: 600;
text-transform: uppercase;
letter-spacing: 0.03em;
}
.agent-tile .agent-lastseen {
display: block;
margin-top: 0.3rem;
color: var(--pico-muted-color);
font-size: 0.75em;
}
/* Top sensitive paths panel. Tight table — the interesting columns
are path, hit count, and distinct-host count (the cross-machine
signal). Multi-host rows get a subtle red tint as the "this touched
more than one machine" affordance. */
.sensitive-panel table {
margin: 0;
font-size: 0.9em;
}
.sensitive-panel table code.wrap {
font-size: 0.9em;
}
.sensitive-panel table td:nth-child(3),
.sensitive-panel table td:nth-child(4),
.sensitive-panel table th:nth-child(3),
.sensitive-panel table th:nth-child(4) {
text-align: right;
width: 4rem;
font-variant-numeric: tabular-nums;
}
.sensitive-panel tr.multi-host td:first-child {
border-left: 2px solid #c0392b;
}
.sensitive-panel.sensitive-panel-empty p {
margin: 0;
color: var(--pico-muted-color);
}
/* Dashboard filter bar — sits above the "All sessions" table. Labels
stack above their