app.py

from __future__ import annotations

import ctypes
import os
import queue
import sys
import threading
import tkinter as tk
from tkinter import filedialog, messagebox, ttk
from typing import Dict, Optional

import pystray
from PIL import Image, ImageDraw, ImageTk

from ssh_tunnel_manager import (
    APP_NAME,
    APP_VERSION,
    PASSWORD_ENV,
    ConfigStore,
    ServerConfig,
    SingleInstanceGuard,
    TunnelManager,
    ensure_ssh_available,
    ssh_not_found_message,
    test_remote_connection,
)


# A calm, system-like light palette inspired by Apple's semantic colors.
BG = "#F3F5F9"
SURFACE = "#FFFFFF"
SURFACE_ALT = "#F7F8FB"
TEXT = "#171A21"
TEXT_SECONDARY = "#687083"
TEXT_TERTIARY = "#9299A8"
LINE = "#E4E8EF"
LINE_STRONG = "#D7DCE5"
ACCENT = "#0A84FF"
ACCENT_HOVER = "#0075E6"
ACCENT_SOFT = "#EAF4FF"
GREEN = "#28B463"
GREEN_SOFT = "#EAF8F0"
ORANGE = "#E58A00"
ORANGE_SOFT = "#FFF5DF"
RED = "#E5484D"
RED_SOFT = "#FFF0F0"
PURPLE = "#7357D9"
PURPLE_SOFT = "#F1EEFF"

FONT = "PingFang SC" if sys.platform == "darwin" else "Microsoft YaHei UI"

TUNNEL_LABELS = {
    "stopped": "已停止",
    "configuring": "配置中",
    "connecting": "连接中",
    "running": "运行中",
    "retrying": "重连中",
    "error": "异常",
}
TEST_LABELS = {
    "untested": "未检测",
    "testing": "检测中",
    "success": "网络可用",
    "failed": "检测失败",
}
AUTH_LABELS = {
    "default": "SSH Config / Agent",
    "password": "登录密码",
    "key": "OpenSSH 私钥",
}
ACTIVE_STATES = {"configuring", "connecting", "running", "retrying"}


def center_window(window: tk.Toplevel, parent: tk.Misc) -> None:
    window.update_idletasks()
    width = window.winfo_width()
    height = window.winfo_height()
    x = parent.winfo_rootx() + max(0, (parent.winfo_width() - width) // 2)
    y = parent.winfo_rooty() + max(0, (parent.winfo_height() - height) // 2)
    window.geometry(f"+{x}+{y}")


class HoverButton(tk.Button):
    """Flat button with predictable cross-platform colors."""

    PALETTES = {
        "primary": (ACCENT, ACCENT_HOVER, "#FFFFFF"),
        "secondary": ("#EEF1F6", "#E4E8EF", TEXT),
        "ghost": (SURFACE, ACCENT_SOFT, ACCENT),
        "danger": (RED_SOFT, "#FFE2E2", RED),
        "success": (GREEN_SOFT, "#DDF3E7", GREEN),
    }

    def __init__(
        self,
        master: tk.Misc,
        *,
        variant: str = "secondary",
        compact: bool = False,
        **kwargs,
    ) -> None:
        normal, hover, foreground = self.PALETTES[variant]
        super().__init__(
            master,
            bg=normal,
            fg=foreground,
            activebackground=hover,
            activeforeground=foreground,
            disabledforeground=TEXT_TERTIARY,
            relief="flat",
            borderwidth=0,
            highlightthickness=0,
            cursor="hand2",
            font=(FONT, 9 if compact else 10, "bold"),
            padx=12 if compact else 17,
            pady=6 if compact else 9,
            **kwargs,
        )
        self._normal_bg = normal
        self._hover_bg = hover
        self.bind("<Enter>", self._on_enter, add="+")
        self.bind("<Leave>", self._on_leave, add="+")

    def _on_enter(self, _event: tk.Event) -> None:
        if str(self["state"]) != "disabled":
            self.configure(bg=self._hover_bg)

    def _on_leave(self, _event: tk.Event) -> None:
        self.configure(bg=self._normal_bg)


class ScrollableFrame(tk.Frame):
    def __init__(self, master: tk.Misc, *, bg: str = SURFACE, **kwargs) -> None:
        super().__init__(master, bg=bg, **kwargs)
        self.canvas = tk.Canvas(
            self, bg=bg, highlightthickness=0, borderwidth=0
        )
        self.scrollbar = ttk.Scrollbar(
            self, orient="vertical", command=self.canvas.yview
        )
        self.inner = tk.Frame(self.canvas, bg=bg)
        self._window_id = self.canvas.create_window(
            (0, 0), window=self.inner, anchor="nw"
        )
        self.canvas.configure(yscrollcommand=self.scrollbar.set)
        self.canvas.pack(side="left", fill="both", expand=True)
        self.scrollbar.pack(side="right", fill="y")
        self.inner.bind("<Configure>", self._sync_scrollregion)
        self.canvas.bind("<Configure>", self._sync_width)
        self.canvas.bind("<Enter>", self._bind_wheel)
        self.canvas.bind("<Leave>", self._unbind_wheel)

    def _sync_scrollregion(self, _event: tk.Event) -> None:
        self.canvas.configure(scrollregion=self.canvas.bbox("all"))

    def _sync_width(self, event: tk.Event) -> None:
        self.canvas.itemconfigure(self._window_id, width=event.width)

    def _bind_wheel(self, _event: tk.Event) -> None:
        self.canvas.bind_all("<MouseWheel>", self._on_mousewheel)

    def _unbind_wheel(self, _event: tk.Event) -> None:
        self.canvas.unbind_all("<MouseWheel>")

    def _on_mousewheel(self, event: tk.Event) -> None:
        self.canvas.yview_scroll(int(-event.delta / 120), "units")


class ServerDialog(tk.Toplevel):
    def __init__(
        self, parent: tk.Tk, existing: Optional[ServerConfig] = None
    ) -> None:
        super().__init__(parent)
        self.parent = parent
        self.existing = existing
        self.result: Optional[ServerConfig] = None
        self.title("编辑服务器" if existing else "添加服务器")
        self.configure(bg=BG)
        self.resizable(False, True)
        self.minsize(660, 620)
        height = min(760, max(620, parent.winfo_screenheight() - 100))
        self.geometry(f"660x{height}")

        values = existing or ServerConfig("临时", "temp", 57897)
        try:
            existing_password = values.password() if existing else ""
        except (OSError, ValueError):
            existing_password = ""
        self.variables = {
            "name": tk.StringVar(value="" if not existing else values.name),
            "ssh_host": tk.StringVar(value="" if not existing else values.ssh_host),
            "ssh_port": tk.StringVar(value=str(values.ssh_port)),
            "username": tk.StringVar(value=values.username),
            "proxy_jump": tk.StringVar(value=values.proxy_jump),
            "remote_port": tk.StringVar(value=str(values.remote_port)),
            "local_host": tk.StringVar(value=values.local_host),
            "local_port": tk.StringVar(value=str(values.local_port)),
            "auth_mode": tk.StringVar(value=values.auth_mode),
            "password": tk.StringVar(value=existing_password),
            "key_file": tk.StringVar(value=values.key_file),
            "remote_proxy_user_configured": tk.BooleanVar(
                value=not values.manage_remote_proxy
            ),
        }
        self.auth_buttons: Dict[str, tk.Radiobutton] = {}
        self._build_ui()
        self._update_auth_fields()
        self.bind("<Escape>", lambda _event: self.destroy())
        self.transient(parent)
        self.grab_set()
        center_window(self, parent)
        self.after(50, self.name_entry.focus_set)

    def _build_ui(self) -> None:
        header = tk.Frame(self, bg=SURFACE, padx=28, pady=20)
        header.pack(fill="x")
        tk.Label(
            header,
            text="编辑服务器" if self.existing else "添加服务器",
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 18, "bold"),
        ).pack(anchor="w")
        tk.Label(
            header,
            text="配置 SSH 登录方式和反向代理路径",
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).pack(anchor="w", pady=(5, 0))

        body = ScrollableFrame(self, bg=BG)
        body.pack(fill="both", expand=True)
        form = body.inner
        form.configure(padx=28, pady=20)

        server_group = self._group(form, "服务器", "目标主机与登录身份")
        server_group.pack(fill="x", pady=(0, 14))
        self.name_entry = self._field(
            server_group, "服务器名称", self.variables["name"], 0, 0, columnspan=2
        )
        self._field(
            server_group, "主机 / SSH Config 别名", self.variables["ssh_host"], 1, 0
        )
        self._field(server_group, "SSH 端口", self.variables["ssh_port"], 1, 1)
        self._field(server_group, "登录用户名", self.variables["username"], 2, 0)
        self._field(
            server_group,
            "跳板机 / ProxyJump（可选）",
            self.variables["proxy_jump"],
            2,
            1,
        )

        route_group = self._group(form, "隧道路由", "远端端口如何回到本地代理")
        route_group.pack(fill="x", pady=(0, 14))
        route_inner = route_group.winfo_children()[0]
        self._field(
            route_group, "远程监听端口", self.variables["remote_port"], 0, 0
        )
        self._field(route_group, "本地代理地址", self.variables["local_host"], 0, 1)
        self._field(route_group, "本地代理端口", self.variables["local_port"], 1, 0)
        route_hint = tk.Frame(route_inner, bg=ACCENT_SOFT, padx=14, pady=10)
        route_hint.grid(row=6, column=0, columnspan=2, sticky="ew", pady=(8, 0))
        tk.Label(
            route_hint,
            text="远端 127.0.0.1 : 端口   →   SSH 反向隧道   →   本地代理",
            bg=ACCENT_SOFT,
            fg=ACCENT,
            font=(FONT, 9, "bold"),
        ).pack(anchor="w")

        auth_group = self._group(form, "认证方式", "选择 SSH 使用的凭据")
        auth_group.pack(fill="x", pady=(0, 14))
        auth_inner = auth_group.winfo_children()[0]
        selector = tk.Frame(auth_inner, bg="#EEF1F6", padx=3, pady=3)
        selector.grid(row=2, column=0, columnspan=2, sticky="ew", pady=(14, 4))
        for index, (value, label) in enumerate(
            (
                ("default", "SSH Config / Agent"),
                ("password", "登录密码"),
                ("key", "OpenSSH 私钥"),
            )
        ):
            selector.grid_columnconfigure(index, weight=1)
            button = tk.Radiobutton(
                selector,
                text=label,
                value=value,
                variable=self.variables["auth_mode"],
                indicatoron=False,
                command=self._update_auth_fields,
                relief="flat",
                borderwidth=0,
                highlightthickness=0,
                selectcolor=SURFACE,
                bg="#EEF1F6",
                activebackground=SURFACE,
                fg=TEXT_SECONDARY,
                activeforeground=TEXT,
                font=(FONT, 9, "bold"),
                padx=8,
                pady=8,
                cursor="hand2",
            )
            button.grid(row=0, column=index, sticky="ew", padx=1)
            self.auth_buttons[value] = button

        self.password_entry = self._field(
            auth_group,
            "登录密码",
            self.variables["password"],
            1,
            0,
            columnspan=2,
            show="●",
        )
        key_wrap = tk.Frame(auth_inner, bg=SURFACE)
        key_wrap.grid(row=6, column=0, columnspan=2, sticky="ew", pady=(12, 0))
        key_wrap.grid_columnconfigure(0, weight=1)
        tk.Label(
            key_wrap,
            text="私钥路径",
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).grid(row=0, column=0, columnspan=2, sticky="w", pady=(0, 6))
        self.key_entry = tk.Entry(
            key_wrap,
            textvariable=self.variables["key_file"],
            bg=SURFACE_ALT,
            fg=TEXT,
            insertbackground=TEXT,
            relief="flat",
            highlightthickness=1,
            highlightbackground=LINE,
            highlightcolor=ACCENT,
            font=(FONT, 10),
        )
        self.key_entry.grid(row=1, column=0, sticky="ew", ipady=8)
        self.key_button = HoverButton(
            key_wrap,
            text="浏览",
            compact=True,
            command=self._browse_key,
        )
        self.key_button.grid(row=1, column=1, padx=(8, 0))

        proxy_group = self._group(
            form, "远程代理配置", "控制应用是否维护远程 ~/.bashrc"
        )
        proxy_group.pack(fill="x", pady=(0, 6))
        proxy_inner = proxy_group.winfo_children()[0]
        check = tk.Checkbutton(
            proxy_inner,
            text="远程代理已由我配置，应用不要修改 ~/.bashrc",
            variable=self.variables["remote_proxy_user_configured"],
            bg=SURFACE,
            activebackground=SURFACE,
            fg=TEXT,
            activeforeground=TEXT,
            selectcolor=SURFACE,
            font=(FONT, 10),
            cursor="hand2",
            padx=0,
            pady=4,
            highlightthickness=0,
        )
        check.grid(row=2, column=0, columnspan=2, sticky="w", pady=(12, 0))
        tk.Label(
            proxy_inner,
            text="取消勾选后，应用会在启动隧道前安全同步 5 个代理变量，并先创建备份。",
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 8),
            wraplength=535,
            justify="left",
        ).grid(row=3, column=0, columnspan=2, sticky="w", pady=(3, 0))

        footer = tk.Frame(self, bg=SURFACE, padx=28, pady=16)
        footer.pack(fill="x")
        HoverButton(
            footer, text="保存服务器", variant="primary", command=self._save
        ).pack(side="right")
        HoverButton(footer, text="取消", command=self.destroy).pack(
            side="right", padx=(0, 10)
        )
        self.bind("<Control-Return>", lambda _event: self._save())

    def _group(
        self, parent: tk.Misc, title: str, subtitle: str
    ) -> tk.Frame:
        shell = tk.Frame(parent, bg=LINE, padx=1, pady=1)
        inner = tk.Frame(shell, bg=SURFACE, padx=18, pady=16)
        inner.pack(fill="both", expand=True)
        inner.grid_columnconfigure(0, weight=3)
        inner.grid_columnconfigure(1, weight=2)
        tk.Label(
            inner,
            text=title,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 11, "bold"),
        ).grid(row=0, column=0, sticky="w")
        tk.Label(
            inner,
            text=subtitle,
            bg=SURFACE,
            fg=TEXT_TERTIARY,
            font=(FONT, 8),
        ).grid(row=0, column=1, sticky="e")
        # Leave row 1 as visual breathing room; fields start at row 2.
        return shell

    def _field(
        self,
        group_shell: tk.Frame,
        label: str,
        variable: tk.Variable,
        row: int,
        column: int,
        *,
        columnspan: int = 1,
        show: str = "",
    ) -> tk.Entry:
        parent = group_shell.winfo_children()[0]
        grid_row = row * 2 + 2
        tk.Label(
            parent,
            text=label,
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).grid(
            row=grid_row,
            column=column,
            columnspan=columnspan,
            sticky="w",
            padx=(0, 10 if column == 0 and columnspan == 1 else 0),
            pady=(10 if row else 14, 6),
        )
        entry = tk.Entry(
            parent,
            textvariable=variable,
            show=show,
            bg=SURFACE_ALT,
            fg=TEXT,
            insertbackground=TEXT,
            relief="flat",
            highlightthickness=1,
            highlightbackground=LINE,
            highlightcolor=ACCENT,
            font=(FONT, 10),
        )
        entry.grid(
            row=grid_row + 1,
            column=column,
            columnspan=columnspan,
            sticky="ew",
            padx=(0, 10 if column == 0 and columnspan == 1 else 0),
            ipady=8,
        )
        return entry

    def _browse_key(self) -> None:
        path = filedialog.askopenfilename(
            parent=self,
            title="选择 SSH 私钥",
            filetypes=(("所有文件", "*.*"),),
        )
        if path:
            self.variables["key_file"].set(path)

    def _update_auth_fields(self) -> None:
        mode = self.variables["auth_mode"].get()
        for value, button in self.auth_buttons.items():
            selected = value == mode
            button.configure(
                bg=SURFACE if selected else "#EEF1F6",
                fg=ACCENT if selected else TEXT_SECONDARY,
            )
        self.password_entry.configure(
            state="normal" if mode == "password" else "disabled",
            disabledbackground="#F1F3F6",
        )
        key_state = "normal" if mode == "key" else "disabled"
        self.key_entry.configure(state=key_state, disabledbackground="#F1F3F6")
        self.key_button.configure(state=key_state)

    def _save(self) -> None:
        try:
            result = ServerConfig(
                name=self.variables["name"].get(),
                ssh_host=self.variables["ssh_host"].get(),
                ssh_port=int(self.variables["ssh_port"].get()),
                username=self.variables["username"].get(),
                proxy_jump=self.variables["proxy_jump"].get(),
                remote_port=int(self.variables["remote_port"].get()),
                local_host=self.variables["local_host"].get(),
                local_port=int(self.variables["local_port"].get()),
                auth_mode=self.variables["auth_mode"].get(),
                key_file=self.variables["key_file"].get(),
                encrypted_password=(
                    self.existing.encrypted_password if self.existing else ""
                ),
                manage_remote_proxy=not self.variables[
                    "remote_proxy_user_configured"
                ].get(),
                id=self.existing.id if self.existing else "",
            )
            if result.auth_mode == "password":
                password = self.variables["password"].get()
                if not password:
                    raise ValueError("密码认证必须填写登录密码")
                result.set_password(password)
            else:
                result.clear_password()
            self.result = result
        except (OSError, ValueError, TypeError) as exc:
            messagebox.showerror("配置无效", str(exc), parent=self)
            return
        self.destroy()


class PreviewStore:
    def __init__(self) -> None:
        self.items = [
            ServerConfig(
                "GPU Lab",
                "gpu-lab.example.com",
                57897,
                ssh_port=22,
                username="developer",
                id="preview-running",
            ),
            ServerConfig(
                "Staging",
                "staging.example.com",
                57898,
                ssh_port=2222,
                username="deploy",
                proxy_jump="jump-c500",
                auth_mode="key",
                key_file=r"C:\Users\demo\.ssh\id_ed25519",
                id="preview-stopped",
            ),
            ServerConfig(
                "Research Node",
                "10.24.6.18",
                57901,
                username="researcher",
                manage_remote_proxy=True,
                id="preview-warning",
            ),
        ]

    def load(self) -> list[ServerConfig]:
        return self.items

    def save(self, servers: list[ServerConfig]) -> None:
        self.items = servers


class MainWindow:
    def __init__(self, root: tk.Tk, *, preview: bool = False) -> None:
        self.root = root
        self.preview = preview
        self.root.title(f"{APP_NAME} · Light v{APP_VERSION}")
        self.root.geometry("1120x720")
        self.root.minsize(930, 600)
        self.root.configure(bg=BG)

        self.store = PreviewStore() if preview else ConfigStore()
        self.servers: Dict[str, ServerConfig] = {}
        self.events: queue.Queue = queue.Queue()
        self.manager = TunnelManager(self._post_tunnel_event)
        self.tunnel_states: Dict[str, tuple[str, str]] = {}
        self.test_states: Dict[str, tuple[str, str]] = {}
        if preview:
            self.tunnel_states = {
                "preview-running": ("running", "SSH 隧道稳定运行中"),
                "preview-stopped": ("stopped", "已停止"),
                "preview-warning": ("retrying", "连接中断；5 秒后重连"),
            }
            self.test_states = {
                "preview-running": ("success", "Google 连通，HTTP 200"),
                "preview-stopped": ("untested", "尚未检测"),
                "preview-warning": ("failed", "连接超时"),
            }
        self.selected_id: Optional[str] = None
        self.filter_mode = "all"
        self.search_var = tk.StringVar()
        self.search_var.trace_add("write", lambda *_args: self._render_cards())
        self.tray_icon: Optional[pystray.Icon] = None
        self._exiting = False

        self._configure_styles()
        self._set_window_icon()
        self._build_ui()
        self._load()
        if not preview:
            self._start_tray()
            self.root.protocol("WM_DELETE_WINDOW", self._hide_to_tray)
        else:
            self.root.protocol("WM_DELETE_WINDOW", self._exit_application)
        if sys.platform == "darwin":
            try:
                self.root.createcommand("::tk::mac::Quit", self._exit_application)
            except tk.TclError:
                pass
        self.root.after(150, self._drain_events)

    def _configure_styles(self) -> None:
        style = ttk.Style(self.root)
        try:
            style.theme_use("clam")
        except tk.TclError:
            pass
        style.configure(
            "Light.Vertical.TScrollbar",
            background=LINE_STRONG,
            troughcolor=SURFACE,
            bordercolor=SURFACE,
            arrowcolor=SURFACE,
            width=8,
        )
        style.configure(
            "Vertical.TScrollbar",
            background=LINE_STRONG,
            troughcolor=SURFACE,
            bordercolor=SURFACE,
            arrowcolor=SURFACE,
            width=8,
        )

    def _set_window_icon(self) -> None:
        image = self._app_icon_image(64)
        self._icon_photo = ImageTk.PhotoImage(image)
        self.root.iconphoto(True, self._icon_photo)

    def _build_ui(self) -> None:
        self.root.grid_rowconfigure(2, weight=1)
        self.root.grid_columnconfigure(0, weight=1)

        header = tk.Frame(self.root, bg=SURFACE, padx=28, pady=19)
        header.grid(row=0, column=0, sticky="ew")
        header.grid_columnconfigure(0, weight=1)

        brand = tk.Frame(header, bg=SURFACE)
        brand.grid(row=0, column=0, sticky="w")
        mark = tk.Canvas(
            brand,
            width=42,
            height=42,
            bg=SURFACE,
            highlightthickness=0,
        )
        mark.pack(side="left", padx=(0, 13))
        mark.create_oval(2, 2, 40, 40, fill=ACCENT, outline="")
        mark.create_line(12, 17, 28, 17, fill="white", width=3)
        mark.create_polygon(27, 12, 34, 17, 27, 22, fill="white", outline="")
        mark.create_line(30, 28, 14, 28, fill="white", width=3)
        mark.create_polygon(15, 23, 8, 28, 15, 33, fill="white", outline="")

        title_wrap = tk.Frame(brand, bg=SURFACE)
        title_wrap.pack(side="left")
        tk.Label(
            title_wrap,
            text="SSH 隧道",
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 17, "bold"),
        ).pack(anchor="w")
        tk.Label(
            title_wrap,
            text="轻量、安全的反向代理控制台",
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).pack(anchor="w", pady=(3, 0))

        actions = tk.Frame(header, bg=SURFACE)
        actions.grid(row=0, column=1, sticky="e")
        self.ssh_indicator = tk.Label(
            actions,
            text="●  OpenSSH 就绪",
            bg=SURFACE,
            fg=GREEN,
            font=(FONT, 9),
        )
        self.ssh_indicator.pack(side="left", padx=(0, 20))
        HoverButton(
            actions,
            text="＋  添加服务器",
            variant="primary",
            command=self._add,
        ).pack(side="left")

        metrics = tk.Frame(self.root, bg=BG, padx=28, pady=18)
        metrics.grid(row=1, column=0, sticky="ew")
        for column in range(3):
            metrics.grid_columnconfigure(column, weight=1, uniform="metrics")
        self.total_var = tk.StringVar(value="0")
        self.running_var = tk.StringVar(value="0")
        self.healthy_var = tk.StringVar(value="0")
        self._metric_card(
            metrics, 0, "服", "服务器", self.total_var, ACCENT, ACCENT_SOFT
        )
        self._metric_card(
            metrics, 1, "连", "正在运行", self.running_var, GREEN, GREEN_SOFT
        )
        self._metric_card(
            metrics, 2, "检", "网络可用", self.healthy_var, PURPLE, PURPLE_SOFT
        )

        content = tk.Frame(self.root, bg=BG)
        content.grid(
            row=2, column=0, sticky="nsew", padx=28, pady=(0, 18)
        )
        content.grid_rowconfigure(0, weight=1)
        content.grid_columnconfigure(0, weight=5)
        content.grid_columnconfigure(1, weight=3)

        self._build_list_panel(content)
        self._build_detail_panel(content)

        footer = tk.Frame(self.root, bg=SURFACE, padx=28, pady=10)
        footer.grid(row=3, column=0, sticky="ew")
        footer.grid_columnconfigure(0, weight=1)
        self.footer = tk.StringVar(
            value="预览模式 · 未连接真实服务器" if self.preview else "就绪"
        )
        tk.Label(
            footer,
            textvariable=self.footer,
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
            anchor="w",
        ).grid(row=0, column=0, sticky="ew")
        tk.Label(
            footer,
            text="关闭窗口后继续在后台运行" if not self.preview else "界面预览",
            bg=SURFACE,
            fg=TEXT_TERTIARY,
            font=(FONT, 8),
        ).grid(row=0, column=1, sticky="e")

    def _metric_card(
        self,
        parent: tk.Misc,
        column: int,
        symbol: str,
        label: str,
        variable: tk.StringVar,
        color: str,
        soft_color: str,
    ) -> None:
        shell = tk.Frame(parent, bg=LINE, padx=1, pady=1)
        shell.grid(
            row=0,
            column=column,
            sticky="ew",
            padx=(0 if column == 0 else 7, 0 if column == 2 else 7),
        )
        card = tk.Frame(shell, bg=SURFACE, padx=16, pady=13)
        card.pack(fill="both", expand=True)
        icon = tk.Canvas(
            card, width=36, height=36, bg=SURFACE, highlightthickness=0
        )
        icon.pack(side="left", padx=(0, 12))
        icon.create_oval(1, 1, 35, 35, fill=soft_color, outline="")
        icon.create_text(
            18, 18, text=symbol, fill=color, font=(FONT, 10, "bold")
        )
        text = tk.Frame(card, bg=SURFACE)
        text.pack(side="left")
        tk.Label(
            text,
            textvariable=variable,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 16, "bold"),
        ).pack(anchor="w")
        tk.Label(
            text,
            text=label,
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 8),
        ).pack(anchor="w")

    def _build_list_panel(self, parent: tk.Misc) -> None:
        shell = tk.Frame(parent, bg=LINE, padx=1, pady=1)
        shell.grid(row=0, column=0, sticky="nsew", padx=(0, 9))
        panel = tk.Frame(shell, bg=SURFACE)
        panel.pack(fill="both", expand=True)
        panel.grid_rowconfigure(2, weight=1)
        panel.grid_columnconfigure(0, weight=1)

        heading = tk.Frame(panel, bg=SURFACE, padx=20, pady=16)
        heading.grid(row=0, column=0, sticky="ew")
        heading.grid_columnconfigure(0, weight=1)
        tk.Label(
            heading,
            text="服务器",
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 13, "bold"),
        ).grid(row=0, column=0, sticky="w")
        batch = tk.Frame(heading, bg=SURFACE)
        batch.grid(row=0, column=1, sticky="e")
        HoverButton(
            batch,
            text="全部启动",
            variant="ghost",
            compact=True,
            command=self._start_all,
        ).pack(side="left")
        HoverButton(
            batch,
            text="全部停止",
            variant="ghost",
            compact=True,
            command=self._stop_all,
        ).pack(side="left", padx=(5, 0))

        controls = tk.Frame(panel, bg=SURFACE, padx=20)
        controls.grid(row=1, column=0, sticky="ew", pady=(0, 13))
        controls.grid_columnconfigure(1, weight=1)
        self.filter_buttons: Dict[str, tk.Button] = {}
        filters = tk.Frame(controls, bg="#EEF1F6", padx=3, pady=3)
        filters.grid(row=0, column=0, sticky="w")
        for value, label in (
            ("all", "全部"),
            ("running", "运行中"),
            ("stopped", "已停止"),
        ):
            button = tk.Button(
                filters,
                text=label,
                command=lambda mode=value: self._set_filter(mode),
                bg=SURFACE if value == "all" else "#EEF1F6",
                activebackground=SURFACE,
                fg=ACCENT if value == "all" else TEXT_SECONDARY,
                activeforeground=ACCENT,
                relief="flat",
                borderwidth=0,
                highlightthickness=0,
                font=(FONT, 8, "bold"),
                padx=12,
                pady=5,
                cursor="hand2",
            )
            button.pack(side="left")
            self.filter_buttons[value] = button

        search_shell = tk.Frame(
            controls,
            bg=SURFACE_ALT,
            highlightthickness=1,
            highlightbackground=LINE,
            padx=10,
        )
        search_shell.grid(row=0, column=1, sticky="e", padx=(10, 0))
        tk.Label(
            search_shell,
            text="⌕",
            bg=SURFACE_ALT,
            fg=TEXT_TERTIARY,
            font=("Segoe UI Symbol", 12),
        ).pack(side="left")
        self.search_entry = tk.Entry(
            search_shell,
            textvariable=self.search_var,
            width=16,
            bg=SURFACE_ALT,
            fg=TEXT,
            insertbackground=TEXT,
            relief="flat",
            borderwidth=0,
            highlightthickness=0,
            font=(FONT, 9),
        )
        self.search_entry.pack(side="left", ipady=6, padx=(6, 0))

        self.server_list = ScrollableFrame(panel, bg=SURFACE)
        self.server_list.grid(row=2, column=0, sticky="nsew", padx=20, pady=(0, 14))

    def _build_detail_panel(self, parent: tk.Misc) -> None:
        shell = tk.Frame(parent, bg=LINE, padx=1, pady=1)
        shell.grid(row=0, column=1, sticky="nsew", padx=(9, 0))
        self.detail_panel = tk.Frame(shell, bg=SURFACE)
        self.detail_panel.pack(fill="both", expand=True)
        self.detail_panel.grid_rowconfigure(1, weight=1)
        self.detail_panel.grid_columnconfigure(0, weight=1)

        header = tk.Frame(self.detail_panel, bg=SURFACE, padx=20, pady=17)
        header.grid(row=0, column=0, sticky="ew")
        tk.Label(
            header,
            text="连接详情",
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 13, "bold"),
        ).pack(anchor="w")
        self.detail_body = ScrollableFrame(self.detail_panel, bg=SURFACE)
        self.detail_body.grid(row=1, column=0, sticky="nsew")

    def _load(self) -> None:
        try:
            loaded = self.store.load()
        except ValueError as exc:
            messagebox.showerror("配置读取失败", str(exc), parent=self.root)
            loaded = []
        self.servers = {item.id: item for item in loaded}
        self.selected_id = next(iter(self.servers), None)
        self._refresh()
        if self.preview:
            return
        if ensure_ssh_available():
            self.ssh_indicator.configure(text="●  OpenSSH 就绪", fg=GREEN)
        else:
            self.ssh_indicator.configure(text="●  未找到 OpenSSH", fg=RED)
            self.footer.set(ssh_not_found_message())

    def _save(self) -> None:
        try:
            self.store.save(list(self.servers.values()))
        except OSError as exc:
            messagebox.showerror("保存失败", str(exc), parent=self.root)

    def _refresh(self) -> None:
        running = sum(
            1
            for server_id in self.servers
            if self.tunnel_states.get(server_id, ("stopped", ""))[0] == "running"
        )
        healthy = sum(
            1
            for server_id in self.servers
            if self.test_states.get(server_id, ("untested", ""))[0] == "success"
        )
        self.total_var.set(str(len(self.servers)))
        self.running_var.set(str(running))
        self.healthy_var.set(str(healthy))
        self._render_cards()
        self._render_detail()

    def _visible_servers(self) -> list[ServerConfig]:
        query = self.search_var.get().strip().lower()
        result = []
        for item in self.servers.values():
            state = self.tunnel_states.get(item.id, ("stopped", ""))[0]
            if self.filter_mode == "running" and state not in ACTIVE_STATES:
                continue
            if self.filter_mode == "stopped" and state in ACTIVE_STATES:
                continue
            searchable = " ".join(
                (item.name, item.ssh_host, item.username, item.proxy_jump)
            ).lower()
            if query and query not in searchable:
                continue
            result.append(item)
        return result

    def _render_cards(self) -> None:
        if not hasattr(self, "server_list"):
            return
        for child in self.server_list.inner.winfo_children():
            child.destroy()
        visible = self._visible_servers()
        if not visible:
            self._render_empty_state()
            return
        for item in visible:
            self._server_card(item)

    def _render_empty_state(self) -> None:
        empty = tk.Frame(self.server_list.inner, bg=SURFACE, pady=46)
        empty.pack(fill="both", expand=True)
        art = tk.Canvas(
            empty, width=74, height=74, bg=SURFACE, highlightthickness=0
        )
        art.pack()
        art.create_oval(2, 2, 72, 72, fill=ACCENT_SOFT, outline="")
        art.create_line(22, 30, 48, 30, fill=ACCENT, width=4)
        art.create_polygon(47, 23, 57, 30, 47, 37, fill=ACCENT, outline="")
        art.create_line(52, 46, 26, 46, fill=ACCENT, width=4)
        art.create_polygon(27, 39, 17, 46, 27, 53, fill=ACCENT, outline="")
        label = "还没有服务器" if not self.servers else "没有匹配的服务器"
        tk.Label(
            empty,
            text=label,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 12, "bold"),
        ).pack(pady=(12, 4))
        tk.Label(
            empty,
            text=(
                "添加第一台服务器，开始建立反向隧道"
                if not self.servers
                else "试试切换筛选条件或清空搜索"
            ),
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).pack()
        if not self.servers:
            HoverButton(
                empty,
                text="添加服务器",
                variant="primary",
                compact=True,
                command=self._add,
            ).pack(pady=(16, 0))

    def _server_card(self, item: ServerConfig) -> None:
        selected = item.id == self.selected_id
        border = ACCENT if selected else LINE
        shell = tk.Frame(
            self.server_list.inner,
            bg=border,
            padx=1 if not selected else 2,
            pady=1 if not selected else 2,
            cursor="hand2",
        )
        shell.pack(fill="x", pady=(0, 10))
        card = tk.Frame(shell, bg=SURFACE, padx=14, pady=13, cursor="hand2")
        card.pack(fill="both", expand=True)
        card.grid_columnconfigure(1, weight=1)

        tunnel_status, tunnel_detail = self.tunnel_states.get(
            item.id, ("stopped", "已停止")
        )
        test_status, _test_detail = self.test_states.get(
            item.id, ("untested", "尚未检测")
        )
        status_color, status_soft = self._tunnel_colors(tunnel_status)

        dot = tk.Canvas(
            card, width=22, height=22, bg=SURFACE, highlightthickness=0
        )
        dot.grid(row=0, column=0, rowspan=2, sticky="n", padx=(0, 9), pady=(2, 0))
        dot.create_oval(5, 5, 17, 17, fill=status_soft, outline="")
        dot.create_oval(8, 8, 14, 14, fill=status_color, outline="")

        top = tk.Frame(card, bg=SURFACE, cursor="hand2")
        top.grid(row=0, column=1, sticky="ew")
        tk.Label(
            top,
            text=item.name,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 11, "bold"),
            cursor="hand2",
        ).pack(side="left")
        self._badge(
            top,
            TUNNEL_LABELS.get(tunnel_status, tunnel_status),
            status_color,
            status_soft,
        ).pack(side="left", padx=(8, 0))
        test_color, test_soft = self._test_colors(test_status)
        self._badge(
            top,
            TEST_LABELS.get(test_status, test_status),
            test_color,
            test_soft,
        ).pack(side="left", padx=(6, 0))

        host = tk.Frame(card, bg=SURFACE, cursor="hand2")
        host.grid(row=1, column=1, sticky="ew", pady=(6, 0))
        host_text = f"{item.ssh_host}:{item.ssh_port}"
        if item.proxy_jump:
            host_text += f"  ·  经 {item.proxy_jump}"
        tk.Label(
            host,
            text=host_text,
            bg=SURFACE,
            fg=TEXT_TERTIARY,
            font=(FONT, 8),
            cursor="hand2",
        ).pack(side="left")

        route = tk.Frame(card, bg=SURFACE, cursor="hand2")
        route.grid(row=2, column=1, sticky="ew", pady=(7, 0))
        tk.Label(
            route,
            text=f"远端 :{item.remote_port}",
            bg=SURFACE_ALT,
            fg=TEXT_SECONDARY,
            font=(FONT, 8, "bold"),
            padx=7,
            pady=3,
            cursor="hand2",
        ).pack(side="left")
        tk.Label(
            route,
            text="→",
            bg=SURFACE,
            fg=TEXT_TERTIARY,
            font=("Segoe UI Symbol", 9),
            cursor="hand2",
        ).pack(side="left", padx=5)
        tk.Label(
            route,
            text=f"本地 {item.local_host}:{item.local_port}",
            bg=SURFACE_ALT,
            fg=TEXT_SECONDARY,
            font=(FONT, 8, "bold"),
            padx=7,
            pady=3,
            cursor="hand2",
        ).pack(side="left")
        action_wrap = tk.Frame(card, bg=SURFACE)
        action_wrap.grid(row=0, column=2, rowspan=3, sticky="e", padx=(12, 0))
        is_active = tunnel_status in ACTIVE_STATES
        HoverButton(
            action_wrap,
            text="停止" if is_active else "启动",
            variant="secondary" if is_active else "primary",
            compact=True,
            command=(
                (lambda server_id=item.id: self._stop(server_id))
                if is_active
                else (lambda server_id=item.id: self._start(server_id))
            ),
        ).pack(side="left")
        HoverButton(
            action_wrap,
            text="检测",
            variant="ghost",
            compact=True,
            command=lambda server_id=item.id: self._test(server_id),
        ).pack(side="left", padx=(5, 0))

        click_targets = [shell, card, dot, top, host, route]
        click_targets.extend(top.winfo_children())
        click_targets.extend(host.winfo_children())
        click_targets.extend(route.winfo_children())
        for widget in click_targets:
            widget.bind(
                "<Button-1>",
                lambda _event, server_id=item.id: self._select(server_id),
                add="+",
            )
        shell.bind(
            "<Double-1>",
            lambda _event, server_id=item.id: self._edit(server_id),
            add="+",
        )

        if tunnel_detail and tunnel_status in {"error", "retrying"}:
            warning = tk.Label(
                card,
                text=tunnel_detail,
                bg=ORANGE_SOFT if tunnel_status == "retrying" else RED_SOFT,
                fg=ORANGE if tunnel_status == "retrying" else RED,
                font=(FONT, 8),
                anchor="w",
                padx=9,
                pady=5,
                cursor="hand2",
            )
            warning.grid(row=3, column=1, columnspan=2, sticky="ew", pady=(9, 0))
            warning.bind(
                "<Button-1>",
                lambda _event, server_id=item.id: self._select(server_id),
            )

    def _render_detail(self) -> None:
        for child in self.detail_body.inner.winfo_children():
            child.destroy()
        if not self.selected_id or self.selected_id not in self.servers:
            empty = tk.Frame(self.detail_body.inner, bg=SURFACE, pady=80)
            empty.pack(fill="both", expand=True)
            tk.Label(
                empty,
                text="选择一台服务器",
                bg=SURFACE,
                fg=TEXT,
                font=(FONT, 11, "bold"),
            ).pack()
            tk.Label(
                empty,
                text="查看隧道路径与连接详情",
                bg=SURFACE,
                fg=TEXT_SECONDARY,
                font=(FONT, 9),
            ).pack(pady=(5, 0))
            return

        item = self.servers[self.selected_id]
        body = self.detail_body.inner
        body.configure(padx=20, pady=20)
        tunnel_status, tunnel_detail = self.tunnel_states.get(
            item.id, ("stopped", "已停止")
        )
        test_status, test_detail = self.test_states.get(
            item.id, ("untested", "尚未检测")
        )
        status_color, status_soft = self._tunnel_colors(tunnel_status)

        identity = tk.Frame(body, bg=SURFACE)
        identity.pack(fill="x", pady=(0, 16))
        tk.Label(
            identity,
            text=item.name,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 17, "bold"),
        ).pack(anchor="w")
        tk.Label(
            identity,
            text=f"{item.ssh_host}:{item.ssh_port}",
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).pack(anchor="w", pady=(4, 0))
        self._badge(
            identity,
            TUNNEL_LABELS.get(tunnel_status, tunnel_status),
            status_color,
            status_soft,
        ).pack(anchor="w", pady=(10, 0))

        route_shell = tk.Frame(body, bg=LINE, padx=1, pady=1)
        route_shell.pack(fill="x", pady=(0, 15))
        route = tk.Frame(route_shell, bg=SURFACE_ALT, padx=14, pady=14)
        route.pack(fill="both", expand=True)
        tk.Label(
            route,
            text="隧道路由",
            bg=SURFACE_ALT,
            fg=TEXT_SECONDARY,
            font=(FONT, 8, "bold"),
        ).pack(anchor="w", pady=(0, 12))
        self._route_node(
            route,
            "远程服务器",
            f"127.0.0.1:{item.remote_port}",
            ACCENT,
            ACCENT_SOFT,
        )
        tk.Label(
            route,
            text="↓  SSH RemoteForward",
            bg=SURFACE_ALT,
            fg=TEXT_TERTIARY,
            font=(FONT, 8),
        ).pack(anchor="w", padx=13, pady=5)
        self._route_node(
            route,
            "本地代理",
            f"{item.local_host}:{item.local_port}",
            GREEN,
            GREEN_SOFT,
        )

        info_shell = tk.Frame(body, bg=LINE, padx=1, pady=1)
        info_shell.pack(fill="x", pady=(0, 15))
        info = tk.Frame(info_shell, bg=SURFACE, padx=14, pady=8)
        info.pack(fill="both", expand=True)
        self._info_row(info, "登录用户", item.username or "SSH Config 默认")
        self._info_row(info, "认证", AUTH_LABELS.get(item.auth_mode, item.auth_mode))
        self._info_row(info, "跳板机", item.proxy_jump or "未使用")
        self._info_row(
            info,
            "远程代理",
            "应用自动维护" if item.manage_remote_proxy else "由用户维护",
            last=True,
        )

        activity_color = status_color
        activity_soft = status_soft
        if test_status == "failed":
            activity_color, activity_soft = RED, RED_SOFT
        activity = tk.Frame(body, bg=activity_soft, padx=13, pady=11)
        activity.pack(fill="x", pady=(0, 15))
        tk.Label(
            activity,
            text="最新状态",
            bg=activity_soft,
            fg=activity_color,
            font=(FONT, 8, "bold"),
        ).pack(anchor="w")
        tk.Label(
            activity,
            text=tunnel_detail or TUNNEL_LABELS.get(tunnel_status, tunnel_status),
            bg=activity_soft,
            fg=TEXT,
            font=(FONT, 9),
            wraplength=290,
            justify="left",
        ).pack(anchor="w", pady=(4, 0))
        if test_status != "untested":
            tk.Label(
                activity,
                text=f"联网检测 · {test_detail}",
                bg=activity_soft,
                fg=TEXT_SECONDARY,
                font=(FONT, 8),
                wraplength=290,
                justify="left",
            ).pack(anchor="w", pady=(5, 0))

        primary = tk.Frame(body, bg=SURFACE)
        primary.pack(fill="x")
        primary.grid_columnconfigure(0, weight=1)
        primary.grid_columnconfigure(1, weight=1)
        is_active = tunnel_status in ACTIVE_STATES
        HoverButton(
            primary,
            text="停止隧道" if is_active else "启动隧道",
            variant="secondary" if is_active else "primary",
            command=(
                (lambda: self._stop(item.id))
                if is_active
                else (lambda: self._start(item.id))
            ),
        ).grid(row=0, column=0, sticky="ew", padx=(0, 5))
        HoverButton(
            primary,
            text="检测网络",
            variant="ghost",
            command=lambda: self._test(item.id),
        ).grid(row=0, column=1, sticky="ew", padx=(5, 0))

        secondary = tk.Frame(body, bg=SURFACE)
        secondary.pack(fill="x", pady=(9, 0))
        HoverButton(
            secondary,
            text="编辑配置",
            variant="secondary",
            compact=True,
            command=lambda: self._edit(item.id),
        ).pack(side="left")
        HoverButton(
            secondary,
            text="删除",
            variant="danger",
            compact=True,
            command=lambda: self._delete(item.id),
        ).pack(side="right")

    def _route_node(
        self,
        parent: tk.Misc,
        label: str,
        value: str,
        color: str,
        soft: str,
    ) -> None:
        row = tk.Frame(parent, bg=SURFACE_ALT)
        row.pack(fill="x")
        icon = tk.Canvas(
            row, width=28, height=28, bg=SURFACE_ALT, highlightthickness=0
        )
        icon.pack(side="left", padx=(0, 9))
        icon.create_oval(1, 1, 27, 27, fill=soft, outline="")
        icon.create_oval(11, 11, 17, 17, fill=color, outline="")
        text = tk.Frame(row, bg=SURFACE_ALT)
        text.pack(side="left")
        tk.Label(
            text,
            text=label,
            bg=SURFACE_ALT,
            fg=TEXT_TERTIARY,
            font=(FONT, 8),
        ).pack(anchor="w")
        tk.Label(
            text,
            text=value,
            bg=SURFACE_ALT,
            fg=TEXT,
            font=(FONT, 9, "bold"),
        ).pack(anchor="w", pady=(1, 0))

    def _info_row(
        self, parent: tk.Misc, label: str, value: str, *, last: bool = False
    ) -> None:
        row = tk.Frame(parent, bg=SURFACE, pady=8)
        row.pack(fill="x")
        tk.Label(
            row,
            text=label,
            bg=SURFACE,
            fg=TEXT_SECONDARY,
            font=(FONT, 9),
        ).pack(side="left")
        tk.Label(
            row,
            text=value,
            bg=SURFACE,
            fg=TEXT,
            font=(FONT, 9, "bold"),
        ).pack(side="right")
        if not last:
            tk.Frame(parent, bg=LINE, height=1).pack(fill="x")

    @staticmethod
    def _badge(
        parent: tk.Misc, text: str, color: str, soft: str
    ) -> tk.Label:
        return tk.Label(
            parent,
            text=text,
            bg=soft,
            fg=color,
            font=(FONT, 8, "bold"),
            padx=7,
            pady=3,
        )

    @staticmethod
    def _tunnel_colors(status: str) -> tuple[str, str]:
        if status == "running":
            return GREEN, GREEN_SOFT
        if status in {"connecting", "configuring", "retrying"}:
            return ORANGE, ORANGE_SOFT
        if status == "error":
            return RED, RED_SOFT
        return TEXT_TERTIARY, "#F0F2F5"

    @staticmethod
    def _test_colors(status: str) -> tuple[str, str]:
        if status == "success":
            return GREEN, GREEN_SOFT
        if status == "failed":
            return RED, RED_SOFT
        if status == "testing":
            return ORANGE, ORANGE_SOFT
        return TEXT_TERTIARY, "#F0F2F5"

    def _set_filter(self, mode: str) -> None:
        self.filter_mode = mode
        for value, button in self.filter_buttons.items():
            selected = value == mode
            button.configure(
                bg=SURFACE if selected else "#EEF1F6",
                fg=ACCENT if selected else TEXT_SECONDARY,
            )
        self._render_cards()

    def _select(self, server_id: str) -> None:
        if server_id == self.selected_id:
            return
        self.selected_id = server_id
        self._render_cards()
        self._render_detail()

    def _resolve_server(self, server_id: Optional[str]) -> Optional[ServerConfig]:
        target_id = server_id or self.selected_id
        if not target_id or target_id not in self.servers:
            messagebox.showinfo(APP_NAME, "请先选择一台服务器", parent=self.root)
            return None
        return self.servers[target_id]

    def _add(self) -> None:
        dialog = ServerDialog(self.root)
        self.root.wait_window(dialog)
        if dialog.result:
            self.servers[dialog.result.id] = dialog.result
            self.selected_id = dialog.result.id
            self._save()
            self._refresh()
            self.footer.set(f"已添加服务器 · {dialog.result.name}")

    def _edit(self, server_id: Optional[str] = None) -> None:
        item = self._resolve_server(server_id)
        if not item:
            return
        if item.id in self.manager.workers:
            messagebox.showinfo(
                APP_NAME,
                "请先停止该服务器的隧道再编辑",
                parent=self.root,
            )
            return
        dialog = ServerDialog(self.root, item)
        self.root.wait_window(dialog)
        if dialog.result:
            self.servers[item.id] = dialog.result
            self._save()
            self._refresh()
            self.footer.set(f"已保存配置 · {dialog.result.name}")

    def _delete(self, server_id: Optional[str] = None) -> None:
        item = self._resolve_server(server_id)
        if not item:
            return
        if not messagebox.askyesno(
            "删除服务器",
            f"确定删除“{item.name}”吗？\n此操作不会修改远程服务器。",
            parent=self.root,
        ):
            return
        self.manager.stop(item.id)
        cleanup_error = ""
        try:
            item.clear_password()
        except OSError as exc:
            cleanup_error = str(exc)
        self.servers.pop(item.id, None)
        self.tunnel_states.pop(item.id, None)
        self.test_states.pop(item.id, None)
        self.selected_id = next(iter(self.servers), None)
        self._save()
        self._refresh()
        self.footer.set(f"已删除服务器 · {item.name}")
        if cleanup_error:
            messagebox.showwarning(
                "钥匙串清理失败",
                f"服务器配置已删除，但保存的密码未能清理：\n{cleanup_error}",
                parent=self.root,
            )

    def _start(self, server_id: Optional[str] = None) -> None:
        item = self._resolve_server(server_id)
        if item:
            self.manager.start(item)

    def _stop(self, server_id: Optional[str] = None) -> None:
        item = self._resolve_server(server_id)
        if item:
            self.manager.stop(item.id)

    def _start_all(self) -> None:
        for item in self.servers.values():
            self.manager.start(item)
        if self.servers:
            self.footer.set("正在启动全部隧道…")

    def _stop_all(self) -> None:
        self.manager.stop_all()
        if self.servers:
            self.footer.set("已停止全部隧道")

    def _test(self, server_id: Optional[str] = None) -> None:
        item = self._resolve_server(server_id)
        if not item:
            return
        self._post_test_event(item.id, "testing", "正在远程检测 Google…")

        def run() -> None:
            ok, detail = test_remote_connection(item)
            self._post_test_event(
                item.id, "success" if ok else "failed", detail
            )

        threading.Thread(target=run, daemon=True).start()

    def _post_tunnel_event(
        self, server_id: str, status: str, detail: str
    ) -> None:
        self.events.put(("tunnel", server_id, status, detail))

    def _post_test_event(
        self, server_id: str, status: str, detail: str
    ) -> None:
        self.events.put(("test", server_id, status, detail))

    def _drain_events(self) -> None:
        changed = False
        try:
            while True:
                event_type, server_id, status, detail = self.events.get_nowait()
                if server_id in self.servers:
                    if event_type == "tunnel":
                        self.tunnel_states[server_id] = (status, detail)
                        prefix = "隧道"
                    else:
                        self.test_states[server_id] = (status, detail)
                        prefix = "联网检测"
                    self.footer.set(
                        f"{self.servers[server_id].name} · {prefix}：{detail}"
                    )
                    changed = True
        except queue.Empty:
            pass
        if changed:
            self._refresh()
        if self.root.winfo_exists():
            self.root.after(150, self._drain_events)

    @staticmethod
    def _app_icon_image(size: int = 64) -> Image.Image:
        image = Image.new("RGBA", (size, size), (0, 0, 0, 0))
        draw = ImageDraw.Draw(image)
        for offset in range(5):
            color = (
                10,
                max(90, 132 - offset * 8),
                max(180, 255 - offset * 7),
                255,
            )
            draw.rounded_rectangle(
                (offset, offset, size - 1 - offset, size - 1 - offset),
                radius=max(8, size // 4 - offset),
                fill=color,
            )
        scale = size / 64
        width = max(2, int(5 * scale))
        draw.line(
            (15 * scale, 24 * scale, 42 * scale, 24 * scale),
            fill="white",
            width=width,
        )
        draw.polygon(
            (
                (41 * scale, 15 * scale),
                (55 * scale, 24 * scale),
                (41 * scale, 33 * scale),
            ),
            fill="white",
        )
        draw.line(
            (49 * scale, 41 * scale, 22 * scale, 41 * scale),
            fill="white",
            width=width,
        )
        draw.polygon(
            (
                (23 * scale, 32 * scale),
                (9 * scale, 41 * scale),
                (23 * scale, 50 * scale),
            ),
            fill="white",
        )
        return image

    @staticmethod
    def _tray_image() -> Image.Image:
        if sys.platform == "darwin":
            image = Image.new("RGBA", (64, 64), (0, 0, 0, 0))
            draw = ImageDraw.Draw(image)
            draw.line((12, 22, 42, 22), fill=(0, 0, 0, 255), width=7)
            draw.polygon(
                ((40, 12), (56, 22), (40, 32)), fill=(0, 0, 0, 255)
            )
            draw.line((52, 43, 22, 43), fill=(0, 0, 0, 255), width=7)
            draw.polygon(
                ((24, 33), (8, 43), (24, 53)), fill=(0, 0, 0, 255)
            )
            return image
        return MainWindow._app_icon_image(64)

    def _start_tray(self) -> None:
        menu = pystray.Menu(
            pystray.MenuItem("显示窗口", self._tray_show, default=True),
            pystray.MenuItem("退出程序", self._tray_exit),
        )
        self.tray_icon = pystray.Icon(
            "SshTunnelManagerLight", self._tray_image(), APP_NAME, menu
        )
        self.tray_icon.run_detached()

    def _hide_to_tray(self) -> None:
        self.root.withdraw()
        self.footer.set("应用正在后台运行，SSH 隧道保持连接")
        if self.tray_icon:
            try:
                self.tray_icon.notify(
                    "应用仍在后台运行，隧道不会断开。", APP_NAME
                )
            except (NotImplementedError, OSError):
                pass

    def _tray_show(
        self, _icon: pystray.Icon, _item: pystray.MenuItem
    ) -> None:
        self.root.after(0, self._show_window)

    def _show_window(self) -> None:
        self.root.deiconify()
        self.root.state("normal")
        self.root.lift()
        self.root.focus_force()

    def _tray_exit(
        self, _icon: pystray.Icon, _item: pystray.MenuItem
    ) -> None:
        self.root.after(0, self._exit_application)

    def _exit_application(self) -> None:
        if self._exiting:
            return
        self._exiting = True
        self.manager.stop_all()
        if self.tray_icon:
            self.tray_icon.stop()
            self.tray_icon = None
        self.root.destroy()


def main() -> None:
    # The packaged Windows executable doubles as SSH_ASKPASS. POSIX systems
    # normally use the small helper created by ssh_tunnel_manager instead.
    if os.environ.get(PASSWORD_ENV) is not None and len(sys.argv) > 1:
        password = os.environ.get(PASSWORD_ENV, "") + "\n"
        data = password.encode("utf-8")
        if os.name == "nt":
            written = ctypes.c_ulong()
            handle = ctypes.windll.kernel32.GetStdHandle(-11)
            ctypes.windll.kernel32.WriteFile(
                handle, data, len(data), ctypes.byref(written), None
            )
        else:
            os.write(1, data)
        return

    preview = "--preview" in sys.argv
    if os.name == "nt":
        try:
            ctypes.windll.shcore.SetProcessDpiAwareness(1)
        except (AttributeError, OSError):
            try:
                ctypes.windll.user32.SetProcessDPIAware()
            except (AttributeError, OSError):
                pass

    root = tk.Tk()
    guard = None if preview else SingleInstanceGuard()
    if guard:
        try:
            acquired = guard.acquire()
        except OSError as exc:
            root.withdraw()
            messagebox.showerror(APP_NAME, f"无法建立单实例锁：{exc}")
            root.destroy()
            return
        if not acquired:
            root.withdraw()
            messagebox.showinfo(APP_NAME, "新版应用已经在运行，请使用现有窗口。")
            root.destroy()
            return
    try:
        MainWindow(root, preview=preview)
        root.mainloop()
    finally:
        if guard:
            guard.release()


if __name__ == "__main__":
    main()