ztunnel is in active development. This page describes the repository as it stands: the two-layer app/engine split, the build layout and the front-end surface. The roadmap column lists work not yet implemented — it is a plan, not a claim of coverage. Nothing here claims a working capability that is not yet in the codebase.
Two-layer split
| layer | repository | responsibility |
|---|---|---|
| desktop app | ztunnel (this repo) | Tauri v2 shell, cyberpunk HUD front-end, action-to-engine wiring, embedded terminal |
| VPN engine | ztunnel-core | config parsing, connection manager, OpenVPN/WireGuard backends, logs, stats — decoupled from any GUI |
Build layout
| path | role |
|---|---|
| app/src-tauri | Tauri host: registers ztn_invoke + terminal, prefs, licence, powerline and file-browser commands; setup mounts the engine |
| app/src-tauri/src/net_diag.rs | app-local host-OS diagnostics: DNS lookup, TCP check, port scan, ping, traceroute, interfaces, routes, public IP |
| app/src-tauri/src/net_tools.rs | app-local probe bench: TLS cert inspect, DNS-over-HTTPS, path-MTU discovery, speedtest, HTTP headers, VPN config parse |
| app/src-tauri/src/net_scan.rs | app-local LAN/registry recon: subnet calc, ping sweep, ARP table, reverse DNS, RDAP, TCP port knock |
| app/src-tauri/src/net_mon.rs | app-local monitor & audit: netstat socket table, firewall ruleset, HTTP benchmark, TLS cipher scan, DNS record dump, AXFR test |
| app/src-tauri/src/ssh_tunnel.rs | app-local SSH port-forwarding manager: profiles, sessions, reachability, keys, ~/.ssh/config import/export |
| app/src-tauri/src/impact.rs | Connect Impact Preview host collector — composes the sibling probes into the HostSnapshot the engine correlates |
| crates/ztunnel-core | the embeddable VPN engine (submodule, tauri + wgprobe features) |
| crates/zgui-core · zgui-bridge | shared GUI toolkit + IPC bridge (submodules) |
| crates/zpwr-embed-terminal | shared embedded PTY terminal (submodule) |
| crates/zpwr-i18n | shared i18n runtime (submodule) |
| crates/zpwr-file-browser · zpwr-hooks-editor | shared file browser + Monaco hooks editor (submodules) |
| crates/zwire-host | shared sysmon reader behind the powerline status bar (submodule) |
| frontend | app shell + the app-owned bench front-ends; webui/terminal/i18n assets synced from the submodules before each dev/build |
| scripts | clean · bust · rebuild · nuke · test · ship-check · deploy · localinstall · release-macos · i18n-sort/audit (cyberpunk-styled, ported from Audio-Haxor) |
Front-end surface
The HUD (mounted from the engine's webui) renders a configuration list with live status dots, a connect/disconnect action, a status/throughput grid, per-connection options (route-all, tunnel DNS, auto-reconnect, connect-at-launch), a live log viewer, an import modal (paste .ovpn / WireGuard .conf), a ⌘K command palette, a native menu bar, and the shared embedded terminal. It drives the engine entirely through invoke('ztn_invoke', { cmd, args }) and listens for ztn-event; all wiring is CSP-safe (no inline handlers or styles).
Beside it the repository owns its own bench front-ends under frontend/, each a tabbed HUD modal on the ⌘K palette. Four drive the app-local Rust above — net-diag.js, net-tools.js, net-scan.js, net-mon.js — plus ssh-tunnels.js. Six add no Rust at all and wire the engine's analytical command surface directly: vpn-toolkit.js (WireGuard keypair, handshake probe, config security lint, tunnel MTU/MSS, path MTU, IP classify, range→CIDR, obfuscation catalog), config-lab.js (parse, migrate, redact, normalize, inline blocks, PUSH_REPLY, log analyze), routing-lab.js (subnet/VLSM/aggregate/contains, route conflicts & coverage, AllowedIPs dedup & build, ULA, EUI-64, NAT64), dns-lab.js (resolver classify, query wire, blocklist match, bootstrap plan, split-horizon), crypto-lab.js (Noise layout, handshake timers, cookie/MAC, IPsec proposal, TS narrowing, proxy plan, static key) and ops-lab.js (data budget, usage rollup, uptime/SLA, link quality, quality ranking, failover plan, port forward, MSS clamp, app policy, reconnect backoff, feature matrix, platform probe). impact-preview.js renders the Connect Impact Preview verdict sheet (⌘⇧I).
Roadmap
| area | status |
|---|---|
| App shell + HUD + engine wiring | implemented |
| Config import/parse (OpenVPN/.tblk/WireGuard) | implemented in engine |
| Connection manager + logs + throughput | implemented in engine |
| Host-OS benches (diagnostics · tools · scan · monitor) + SSH tunnels | implemented — app-local Tauri commands, engine-independent |
| Engine benches (VPN toolkit · config · routing · DNS · crypto · ops labs) | implemented — front-end only, over ztn_invoke |
WireGuard handshake probe (wg.probe / wg.probe_all) | implemented in engine — wgprobe feature, device-free and unprivileged |
| Connect Impact Preview (pre-connect blast radius) | implemented — host collector impact.rs + engine vpn.impact_preview |
| OpenVPN process supervision + WireGuard data path | implemented in engine — the unprivileged half; device/route creation still gated on the helper |
| Privileged helper (utun/tun, routing, DNS) | planned — macOS SMAppService / Linux polkit; until then connect reports needs_privilege |
| On-demand connect, full preferences | planned |