ZTUNNEL // ENGINEERING REPORT

// app/engine split · build layout · front-end surface · roadmap

Home Engine

ztunnel is in active development. This page describes the repository as it stands: the two-layer app/engine split, the build layout and the front-end surface. The roadmap column lists work not yet implemented — it is a plan, not a claim of coverage. Nothing here claims a working capability that is not yet in the codebase.

Two-layer split

layerrepositoryresponsibility
desktop appztunnel (this repo)Tauri v2 shell, cyberpunk HUD front-end, action-to-engine wiring, embedded terminal
VPN engineztunnel-coreconfig parsing, connection manager, OpenVPN/WireGuard backends, logs, stats — decoupled from any GUI

Build layout

pathrole
app/src-tauriTauri host: registers ztn_invoke + terminal, prefs, licence, powerline and file-browser commands; setup mounts the engine
app/src-tauri/src/net_diag.rsapp-local host-OS diagnostics: DNS lookup, TCP check, port scan, ping, traceroute, interfaces, routes, public IP
app/src-tauri/src/net_tools.rsapp-local probe bench: TLS cert inspect, DNS-over-HTTPS, path-MTU discovery, speedtest, HTTP headers, VPN config parse
app/src-tauri/src/net_scan.rsapp-local LAN/registry recon: subnet calc, ping sweep, ARP table, reverse DNS, RDAP, TCP port knock
app/src-tauri/src/net_mon.rsapp-local monitor & audit: netstat socket table, firewall ruleset, HTTP benchmark, TLS cipher scan, DNS record dump, AXFR test
app/src-tauri/src/ssh_tunnel.rsapp-local SSH port-forwarding manager: profiles, sessions, reachability, keys, ~/.ssh/config import/export
app/src-tauri/src/impact.rsConnect Impact Preview host collector — composes the sibling probes into the HostSnapshot the engine correlates
crates/ztunnel-corethe embeddable VPN engine (submodule, tauri + wgprobe features)
crates/zgui-core · zgui-bridgeshared GUI toolkit + IPC bridge (submodules)
crates/zpwr-embed-terminalshared embedded PTY terminal (submodule)
crates/zpwr-i18nshared i18n runtime (submodule)
crates/zpwr-file-browser · zpwr-hooks-editorshared file browser + Monaco hooks editor (submodules)
crates/zwire-hostshared sysmon reader behind the powerline status bar (submodule)
frontendapp shell + the app-owned bench front-ends; webui/terminal/i18n assets synced from the submodules before each dev/build
scriptsclean · bust · rebuild · nuke · test · ship-check · deploy · localinstall · release-macos · i18n-sort/audit (cyberpunk-styled, ported from Audio-Haxor)

Front-end surface

The HUD (mounted from the engine's webui) renders a configuration list with live status dots, a connect/disconnect action, a status/throughput grid, per-connection options (route-all, tunnel DNS, auto-reconnect, connect-at-launch), a live log viewer, an import modal (paste .ovpn / WireGuard .conf), a ⌘K command palette, a native menu bar, and the shared embedded terminal. It drives the engine entirely through invoke('ztn_invoke', { cmd, args }) and listens for ztn-event; all wiring is CSP-safe (no inline handlers or styles).

Beside it the repository owns its own bench front-ends under frontend/, each a tabbed HUD modal on the ⌘K palette. Four drive the app-local Rust above — net-diag.js, net-tools.js, net-scan.js, net-mon.js — plus ssh-tunnels.js. Six add no Rust at all and wire the engine's analytical command surface directly: vpn-toolkit.js (WireGuard keypair, handshake probe, config security lint, tunnel MTU/MSS, path MTU, IP classify, range→CIDR, obfuscation catalog), config-lab.js (parse, migrate, redact, normalize, inline blocks, PUSH_REPLY, log analyze), routing-lab.js (subnet/VLSM/aggregate/contains, route conflicts & coverage, AllowedIPs dedup & build, ULA, EUI-64, NAT64), dns-lab.js (resolver classify, query wire, blocklist match, bootstrap plan, split-horizon), crypto-lab.js (Noise layout, handshake timers, cookie/MAC, IPsec proposal, TS narrowing, proxy plan, static key) and ops-lab.js (data budget, usage rollup, uptime/SLA, link quality, quality ranking, failover plan, port forward, MSS clamp, app policy, reconnect backoff, feature matrix, platform probe). impact-preview.js renders the Connect Impact Preview verdict sheet (⌘⇧I).

Roadmap

areastatus
App shell + HUD + engine wiringimplemented
Config import/parse (OpenVPN/.tblk/WireGuard)implemented in engine
Connection manager + logs + throughputimplemented in engine
Host-OS benches (diagnostics · tools · scan · monitor) + SSH tunnelsimplemented — app-local Tauri commands, engine-independent
Engine benches (VPN toolkit · config · routing · DNS · crypto · ops labs)implemented — front-end only, over ztn_invoke
WireGuard handshake probe (wg.probe / wg.probe_all)implemented in engine — wgprobe feature, device-free and unprivileged
Connect Impact Preview (pre-connect blast radius)implemented — host collector impact.rs + engine vpn.impact_preview
OpenVPN process supervision + WireGuard data pathimplemented in engine — the unprivileged half; device/route creation still gated on the helper
Privileged helper (utun/tun, routing, DNS)planned — macOS SMAppService / Linux polkit; until then connect reports needs_privilege
On-demand connect, full preferencesplanned