Detect interfaces per platform; add macOS and single-interface support (closes #2)

Linux runs exactly as before when both bridge interfaces exist. When they do
not, the lone default-route interface is monitored, and a single interface
draws a single UI pane instead of an empty second one.

macOS is newly supported: a running VPN tunnel (utun) is monitored as the
primary pane alongside the physical default-route interface, or the physical
interface alone when no VPN is up.

Detection lives in internal/netdetect: interface/route data types, pure
selection logic keyed on OS name, and route parsers, all unit-tested on Linux
for both platforms. Only the real route query and the per-platform TCP dial
binding are build-tagged. NewMonitor now takes a list of interfaces.

Not verified on a real mac: live netstat parsing, IP_BOUND_IF dialing, Mullvad leak protection.

Model: opus-4-8 (implementation); fable-5-1 (landing commit)

internal/monitor/monitor.go

@@ -1,8 +1,6 @@
-//go:build linux
-
-// Package monitor implements the dual-interface real-time network
-// monitoring dashboard: ICMP reachability, packet loss, TCP latency, and
-// the terminal UI that renders them.
+// Package monitor implements the real-time network monitoring dashboard:
+// ICMP reachability, packet loss, TCP latency, and the terminal UI that
+// renders them. It monitors one or two interfaces.
 package monitor
 
 import (
@@ -14,6 +12,7 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"runtime"
 	"strconv"
 	"strings"
 	"sync"
@@ -88,9 +87,8 @@ type Monitor struct {
 	packetLossHosts   []string
 	tcpHosts          []string
 
-	// Interfaces
-	interfaceA *InterfaceStatus
-	interfaceB *InterfaceStatus
+	// Interfaces to monitor (one or two)
+	interfaces []*InterfaceStatus
 
 	// Logging
 	logFile string
@@ -104,9 +102,16 @@ type Monitor struct {
 	mu sync.RWMutex
 }
 
-// NewMonitor creates a new Monitor instance with default settings.
-func NewMonitor(ifaceA, labelA, ifaceB, labelB, logFile string) *Monitor {
-	return &Monitor{
+// IfaceSpec names one interface to monitor and its display label.
+type IfaceSpec struct {
+	Name  string
+	Label string
+}
+
+// NewMonitor creates a new Monitor instance with default settings,
+// monitoring the given interfaces (one or two).
+func NewMonitor(ifaces []IfaceSpec, logFile string) *Monitor {
+	m := &Monitor{
 		ICMPTimeout:      defaultICMPTimeout,
 		TCPTimeout:       defaultTCPTimeout,
 		PacketLossPings:  defaultPacketLossPings,
@@ -127,13 +132,16 @@ func NewMonitor(ifaceA, labelA, ifaceB, labelB, logFile string) *Monitor {
 		packetLossHosts:   []string{},
 		tcpHosts:          []string{},
 
-		interfaceA: NewInterfaceStatus(ifaceA, labelA),
-		interfaceB: NewInterfaceStatus(ifaceB, labelB),
-
 		logFile:   logFile,
 		startTime: time.Now(),
 		uiUpdate:  make(chan struct{}, uiUpdateBuffer),
 	}
+
+	for _, spec := range ifaces {
+		m.interfaces = append(m.interfaces, NewInterfaceStatus(spec.Name, spec.Label))
+	}
+
+	return m
 }
 
 // AddReachabilityHost adds a host for reachability monitoring.
@@ -194,12 +202,11 @@ func (m *Monitor) Run(ctx context.Context) error {
 	tcpHosts := append([]string{}, m.tcpHosts...)
 	m.mu.RUnlock()
 
-	go m.reachLoop(ctx, m.interfaceA, reachHosts)
-	go m.reachLoop(ctx, m.interfaceB, reachHosts)
-	go m.lossLoop(ctx, m.interfaceA, lossHosts)
-	go m.lossLoop(ctx, m.interfaceB, lossHosts)
-	go m.tcpLoop(ctx, m.interfaceA, tcpHosts)
-	go m.tcpLoop(ctx, m.interfaceB, tcpHosts)
+	for _, st := range m.interfaces {
+		go m.reachLoop(ctx, st, reachHosts)
+		go m.lossLoop(ctx, st, lossHosts)
+		go m.tcpLoop(ctx, st, tcpHosts)
+	}
 
 	m.logf("Starting UI loop")
 	m.uiLoop(ctx)
@@ -306,13 +313,36 @@ func fetchIPInfo(iface string) string {
 	return fmt.Sprintf("%s [%s] %s", r.IP, r.Hostname, r.Org)
 }
 
+// pingArgs builds the arguments for a single reachability ping on the given
+// OS. Linux binds the interface with -I and takes -W in seconds; macOS binds
+// with -b and takes -W in milliseconds.
+func pingArgs(goos, iface, host string) []string {
+	if goos == "darwin" {
+		return []string{"-b", iface, "-c1", "-W1000", host}
+	}
+
+	return []string{"-I", iface, "-c1", "-W1", host}
+}
+
+// lossArgs builds the arguments for a packet-loss ping burst of count pings.
+func lossArgs(goos, iface, host string, count int) []string {
+	c := strconv.Itoa(count)
+	if goos == "darwin" {
+		return []string{"-q", "-i", "0.05", "-c", c, "-W1000", "-b", iface, host}
+	}
+
+	return []string{"-q", "-i", "0.05", "-c", c, "-W1", "-I", iface, host}
+}
+
 // pingOnce performs a single ping over the named interface.
 func (m *Monitor) pingOnce(ctx context.Context, iface, host string) bool {
 	ctx, cancel := context.WithTimeout(ctx, m.ICMPTimeout)
 	defer cancel()
 
+	args := pingArgs(runtime.GOOS, iface, host)
+
 	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
-		ctx, "ping", "-I", iface, "-c1", "-W1", host)
+		ctx, "ping", args...)
 
 	return cmd.Run() == nil
 }
@@ -322,9 +352,10 @@ func (m *Monitor) lossPercent(ctx context.Context, iface, host string) float64 {
 	ctx, cancel := context.WithTimeout(ctx, lossQueryTimeout)
 	defer cancel()
 
+	args := lossArgs(runtime.GOOS, iface, host, m.PacketLossPings)
+
 	cmd := exec.CommandContext( //nolint:gosec // G204: fixed argv, operator CLI input
-		ctx, "ping", "-q", "-i", "0.05",
-		"-c", strconv.Itoa(m.PacketLossPings), "-W1", "-I", iface, host)
+		ctx, "ping", args...)
 
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -375,7 +406,7 @@ func (m *Monitor) tcpDuration(iface, hp string) time.Duration {
 		return m.TCPTimeout
 	}
 
-	d := net.Dialer{Timeout: m.TCPTimeout, LocalAddr: la}
+	d := net.Dialer{Timeout: m.TCPTimeout, LocalAddr: la, Control: bindControl(iface)}
 	st := time.Now()
 
 	c, err := d.Dial("tcp", hp)