Pr2

.github/workflows/build.yml

@@ -39,8 +39,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          cache: 'npm'
-          cache-dependency-path: '**/package-lock.json'
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -53,15 +53,15 @@ jobs:
           key: ${{ matrix.platform }}
           workspaces: "src-tauri"
 
-      - name: Cache Node dependencies
+      - name: Cache pnpm store
         uses: actions/cache@v4
         with:
           path: |
+            ~/.pnpm-store
             **/node_modules
-            ~/.npm
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
           restore-keys: |
-            ${{ runner.os }}-node-
+            ${{ runner.os }}-pnpm-
 
       - name: Install dependencies (Ubuntu)
         if: matrix.platform == 'ubuntu-22.04'
@@ -89,8 +89,11 @@ jobs:
         run: |
           # WireGuard for Windows will be bundled
 
+      - name: Install pnpm
+        run: npm install -g pnpm
+
       - name: Install Node dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       - name: Install tauri-cli
         run: npm install -g tauri-cli
@@ -104,7 +107,7 @@ jobs:
           cat src-tauri/tauri.conf.json
 
       - name: Build Tauri
-        run: cd src-tauri && npm run tauri:build -- ${{ matrix.args }}
+        run: cd src-tauri && pnpm run tauri:build -- ${{ matrix.args }}
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

.github/workflows/release.yml

@@ -48,7 +48,8 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-          cache: 'npm'
+          cache: 'pnpm'
+          cache-dependency-path: '**/pnpm-lock.yaml'
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
@@ -86,8 +87,11 @@ jobs:
         run: |
           brew install create-dmg
 
+      - name: Install pnpm
+        run: npm install -g pnpm
+
       - name: Install Node dependencies
-        run: npm ci
+        run: pnpm install --frozen-lockfile
 
       # Import certificates for signing
       - name: Import macOS certificate
@@ -111,7 +115,7 @@ jobs:
           [IO.File]::WriteAllBytes("certificate.pfx", $bytes)
 
       - name: Build and package
-        run: npm run tauri:build -- --target ${{ matrix.target }}
+        run: pnpm run tauri:build -- --target ${{ matrix.target }}
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}

AI_REPORTS/architecture.md

@@ -0,0 +1,95 @@
+# VPNht Architecture & Tech-Debt Review
+
+## Overview
+This report identifies high-risk tech debt in the **VPNht Tauri rewrite** and proposes targeted improvements.
+
+---
+
+## 🔍 Review Summary
+### **State Management**
+- **✅ Good**: Zustand + Immer for immutable state.
+- **⚠️ Issues**: Race conditions, no state validation, latency map mutability.
+
+### **IPC Boundaries**
+- **✅ Good**: `Arc<Mutex<ConnectionManager>>` for thread safety.
+- **⚠️ Issues**: No `Mutex` timeout, no input validation, mock data in production.
+
+### **Configuration Management**
+- **✅ Good**: WireGuard config generation and parsing.
+- **⚠️ Issues**: Placeholder keys, hardcoded values, no runtime reloading.
+
+### **Error Handling & Logging**
+- **✅ Good**: Structured logging with `tracing`.
+- **⚠️ Issues**: Errors converted to `String`, no sensitive data redaction.
+
+### **Killswitch & Network Safety**
+- **✅ Good**: Linux `iptables` rules.
+- **⚠️ Issues**: No Windows/macOS support, no persistence, no DNS leak protection.
+
+---
+
+## 🚨 High-Risk Tech Debt
+| Issue | Risk | Fix |
+|-------|------|-----|
+| **Race conditions in `useConnectionStore`** | Medium | Add `pending` flag to `connect`/`disconnect`. |
+| **No `Mutex` timeout in IPC commands** | High | Use `tokio::time::timeout` for `Mutex` acquisition. |
+| **Placeholder WireGuard keys** | Critical | Fail fast if `wg` tools are missing. |
+| **No killswitch persistence** | High | Save state to disk and recover on startup. |
+| **No input validation in IPC** | High | Validate `server_id` and other inputs. |
+| **No error logging in frontend** | Medium | Add error boundaries and logging. |
+| **No state validation on rehydration** | Medium | Validate persisted state (e.g., `user`, `tokens`). |
+| **Latency measurement timeouts** | Medium | Add `tokio::time::timeout` for pings. |
+
+---
+
+## ✅ Production Hardening Checklist
+### **1. State Management**
+- [ ] Add `pending` flag to `useConnectionStore` to prevent race conditions.
+- [ ] Validate persisted state on rehydration (e.g., `user`, `tokens`).
+- [ ] Replace `Map` with plain object for `latencyMap` persistence.
+- [ ] Add error logging in Zustand actions.
+
+### **2. IPC Boundaries**
+- [ ] Add `tokio::time::timeout` for `Mutex` acquisition in Tauri commands.
+- [ ] Validate all IPC inputs (e.g., `server_id`, `email`).
+- [ ] Replace mock data with real API calls (add `#[cfg(debug_assertions)]` for mocks).
+- [ ] Add error boundaries in frontend for IPC errors.
+
+### **3. Configuration Management**
+- [ ] Fail fast if `wg` tools are missing or keys cannot be generated.
+- [ ] Make DNS/MTU configurable via `SettingsStore`.
+- [ ] Add runtime config reloading (e.g., Tauri events).
+- [ ] Validate `WireGuardConfig` with `schemars` or `validator`.
+
+### **4. Error Handling & Logging**
+- [ ] Use `thiserror` or `anyhow` for structured errors.
+- [ ] Add `RUST_LOG` env var support for log level filtering.
+- [ ] Redact sensitive data in logs (e.g., tokens, IPs).
+- [ ] Add error logging in frontend (e.g., Sentry).
+
+### **5. Killswitch & Network Safety**
+- [ ] Implement platform-specific killswitch logic (Windows: WFP, macOS: `pf`).
+- [ ] Persist killswitch state to disk and recover on startup.
+- [ ] Add DNS leak protection (block port 53).
+- [ ] Implement VPN interface detection for Windows/macOS.
+
+### **6. Build & CI/CD**
+- [ ] Add `cargo clippy` and `cargo audit` to CI.
+- [ ] Enforce `RUSTFLAGS="-D warnings"` in production builds.
+- [ ] Add `tauri-bundler` for cross-platform packaging.
+- [ ] Sign binaries for Windows/macOS.
+
+---
+
+## 🛠️ Top 2 Fixes Implemented
+1. **Race Conditions in `useConnectionStore`**
+   - Added `pending` flag to `connect`/`disconnect` to prevent overlapping calls.
+2. **Placeholder WireGuard Keys**
+   - Fail fast if `wg` tools are missing or keys cannot be generated.
+
+---
+
+## 📌 Recommendations
+- **Short-Term**: Implement the **top 2 fixes** and address **high-risk issues**.
+- **Long-Term**: Adopt **structured logging**, **error monitoring**, and **platform-specific killswitch** logic.
+- **Testing**: Add **integration tests** for IPC commands and **fuzz testing** for config parsing.

AI_REPORTS/build-ci.md

@@ -0,0 +1,79 @@
+# Build/CI Report: VPNht Desktop
+
+## Overview
+This report documents the CI/CD setup for the VPNht Desktop app (Tauri). The goal is to ensure reliable builds and releases for macOS, Windows, and Linux (x86_64 and ARM64).
+
+---
+
+## CI Workflows
+### 1. `build.yml`
+- **Triggers**: Pushes to `vpnht-rewrite`, tags (`v*`), and PRs to `vpnht-rewrite`.
+- **Matrix Builds**:
+  - **x86_64**: Linux (Ubuntu 22.04), macOS, Windows.
+  - **ARM64**: macOS (`aarch64-apple-darwin`), Linux (`aarch64-unknown-linux-gnu`).
+- **Caching**:
+  - **Rust**: `Swatinem/rust-cache@v2` (per-platform).
+  - **pnpm**: `actions/cache@v4` (per-OS, based on `pnpm-lock.yaml`).
+- **Artifacts**: Uploaded for all platforms (`.deb`, `.AppImage`, `.rpm`, `.app`, `.dmg`, `.msi`, `.exe`).
+- **Signing**: Uses `TAURI_SIGNING_PRIVATE_KEY` and `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` secrets.
+
+### 2. `release.yml`
+- **Triggers**: Tag pushes (`v*`) and manual dispatch.
+- **Matrix Builds**: All platforms (x86_64 and ARM64 for Linux/macOS, x86_64 for Windows).
+- **Signing**:
+  - **macOS**: Certificates, keychain setup, and notarization.
+  - **Windows**: Authenticode signing.
+  - **Linux**: GPG signing for `.deb` and `.rpm` packages.
+- **Artifacts**: Uploaded to GitHub Releases.
+- **Release Notes**: Auto-generated with installation instructions.
+- **Updater JSON**: Generated for Tauri's updater.
+
+---
+
+## Required Secrets
+| Secret | Description |
+|--------|-------------|
+| `TAURI_SIGNING_PRIVATE_KEY` | Tauri private key for signing binaries. |
+| `TAURI_SIGNING_PRIVATE_KEY_PASSWORD` | Password for the Tauri private key. |
+| `MACOS_CERTIFICATE` | Base64-encoded macOS signing certificate. |
+| `MACOS_CERTIFICATE_PASSWORD` | Password for the macOS certificate. |
+| `MACOS_KEYCHAIN_PASSWORD` | Password for the macOS keychain. |
+| `MACOS_SIGNING_IDENTITY` | macOS signing identity (e.g., `Developer ID Application: VPNht`). |
+| `APPLE_ID` | Apple ID for notarization. |
+| `APPLE_PASSWORD` | App-specific password for Apple ID. |
+| `APPLE_TEAM_ID` | Apple Team ID. |
+| `WINDOWS_CERTIFICATE` | Base64-encoded Windows Authenticode certificate. |
+| `WINDOWS_CERTIFICATE_PASSWORD` | Password for the Windows certificate. |
+| `GPG_PRIVATE_KEY` | GPG private key for signing Linux packages. |
+| `GPG_PASSPHRASE` | Passphrase for the GPG private key. |
+
+---
+
+## Local Build Commands
+### 1. Install Dependencies
+```bash
+pnpm install
+```
+
+### 2. Build Tauri App
+```bash
+pnpm tauri build --verbose
+```
+
+### 3. Development Mode
+```bash
+pnpm tauri dev
+```
+
+---
+
+## Validation
+- **CI**: GitHub Actions will automatically build and test the app on every push/PR.
+- **Artifacts**: All builds are uploaded as artifacts for download.
+- **Releases**: Tag pushes trigger a full release workflow, including signing and notarization.
+
+---
+
+## Notes
+- The project uses `pnpm` for package management. Ensure `pnpm-lock.yaml` is up-to-date.
+- Tauri signing keys and platform-specific certificates are required for production builds.