Sign up
View stargazersSign up

feat(settings): warn when no VPN is seen and the Egress is direct#1696

opened25d agobyMMatt Donovan

Push the Operator toward a VPN without blocking them. ADR-0032, "Birdbrain pushes the Operator toward a VPN, but only warns", rules 1 to 4.

Scope

  • Local VPN detection in the main process: does the default route run through a tunnel adapter (WireGuard, OpenVPN/TUN/TAP, a VPN client's adapter)? Per-platform reading of the routing table on Linux, Windows and macOS. No outside service is contacted.
  • A top-bar indicator showing the Egress and, when Direct, "VPN seen" or "no VPN seen". Never the words "no VPN".
  • A warning before the first contact with a site in each Case while the Egress is Direct and no VPN is seen (Recapture, add-URL, Wayback lookup), and when a Capture Session starts. Choices: continue, set up a proxy (opens the Egress setting), stop warning on this network. The Capture Session warning says Birdbrain sees the machine's network path, not the browser's.
  • "This network" is a hash of the network name and the router's hardware address, stored in settings. A different network warns again.
  • Nothing about detection is written to any Manifest Entry or capture row.

Acceptance criteria

  • With the detector stubbed to "no VPN seen" and Egress Direct, the first Recapture in a Case shows the warning; the second in the same Case does not; a new Case shows it again.
  • Choosing "stop warning on this network" suppresses the warning for that network hash and not for a different one.
  • With the detector stubbed to "VPN seen", or Egress set to Proxy or Tor, no warning appears.
  • No Manifest Entry or capture row gains a field from this ticket (test asserts entry bodies unchanged).
  • The detector's per-platform parsing has unit tests from captured route-table fixtures for all three platforms, including a macOS fixture with system utun adapters and no VPN.

Verification

pnpm lint, pnpm typecheck, BIRDBRAIN_REQUIRE_OPENSSL=1 pnpm test, pnpm build, pnpm test:e2e for the warning flow, then pnpm preflight at head.

Evidence-affecting

No: the result is deliberately not recorded and nothing on the acquisition path changes.

Sequencing

Blocked by #1695, the Egress setting ticket (the indicator and the "set up a proxy" choice need it).