The desktop workspace is redesigned, scan results carry richer status data, and interactive interfaces gain probe concurrency controls. Public docs are refreshed and packaging is fixed across release channels.
Added
- Richer port scan results across every interface. Port scans now report additive status and detail fields (
open, closed, filtered, error, latency, banners, HTTP metadata, TLS metadata, and raw previews where available) while keeping the older open, port, service, and error fields intact for compatibility. - GUI render automation. The desktop app now has Tauri/WebDriver render coverage for the diagnostic workspace, including tab layout, top menus, toolbar actions, filtering, row selection, detail panes, command preview, and status bar behavior.
- User-configurable probe concurrency. The CLI and MCP server already accepted concurrency limits; the desktop app settings and TUI settings now expose the same control so users can reduce simultaneous probes on fragile networks or raise them within the core safety cap.
- Address-family display preference in the desktop app. The status bar now prefers IPv4 by default and lets users choose IPv6-first display when that better matches their environment.
Changed
- Desktop app redesigned around a denser diagnostic workspace. NetsCLI Desktop moved from the earlier dashboard-style UI to a native-like shell with operation tabs, compact forms, sortable and filterable results, row details, CLI command previews, and status summaries. The GUI continues to use the same
netscli-core operations as the CLI, TUI, and MCP server, so desktop behavior stays aligned with the rest of the tool. - Desktop app icon refreshed to match the current brand. The Tauri icon generator now renders the ANSI-style
N using the same gradient direction as the website/favicon, and regenerates the Windows/Tauri icon assets from that source. - CLI and TUI scan output now reflects richer status data. Human output stays concise, but scanned ports can show closed, filtered, and error states with latency where available instead of only emphasizing open ports.
- Windows install guidance now prefers Winget for the desktop app. Release notes and install docs call out Winget's manifest review and installer hash verification as the recommended Windows path, while direct GitHub Windows installers remain unsigned and may show Windows warnings until code signing is added later.
- Website, docs, FAQ, 404 page, and changelog refreshed for the new release. The public site now uses a more consistent shell, unified code and table styling, clearer search behavior, release-note summaries, and a desktop-app screenshot captured from the real UI with representative demo data.
- Linux/macOS install docs clarified. mDNS is documented as the default pure-Rust capability in published builds, while packet capture remains the optional workflow that depends on libpcap/Npcap support.
- Website rebuilt for every screen width. The landing page and docs were swept across six widths and both themes, and the shell, navigation, contents list, colour and typography were reworked to hold up at all of them. The brand accent moved from a teal-green that read blue in small text to one that reads green at any size, and contrast improved with it. (#190–#209)
- Search, head metadata and page titles rewritten so the site describes what it is rather than repeating adjectives. (#204)
- Per-PR site previews on Cloudflare Pages, and GitHub Pages deploys are manual-only. (#165, #136)
netscli scan --json now reports every port, not just the open ones. Filtering to open ports made "all closed", "all filtered" and "every probe errored" the same empty array, so a script could not tell a clean scan from a host that refused every probe. Each entry carries open and status, so callers that want only open ports can filter for them.- The MCP server now scans only local networks by default. This is the one surface driven by a model rather than by the person at the keyboard, so the instruction to scan a third party can arrive from a web page or a file someone else wrote — and the packets leave from your machine and your IP. RFC1918, loopback, link-local and the carrier-grade NAT range overlay networks use are allowed; set
NETSCLI_MCP_ALLOW_PUBLIC_TARGETS=1 to reach past them. - Scan results returned to a model are capped. The full probe response (
raw) is no longer included and banners are truncated, both being bytes chosen by the scanned host. - Tool failures are returned as MCP
isError results rather than JSON-RPC errors, so a failed scan no longer reads to a client as a broken server. - The desktop app's CSV export escapes spreadsheet formulas. A cell beginning
= + - or @ is evaluated on open by Excel and LibreOffice, and exported cells carry banners and hostnames the scanned host chose. Values that parse as numbers are untouched, so a negative latency is still a number.
Changed (internal)
- The release pipeline verifies before it commits to anything. The three crates are now published in one command, so cargo packages and compiles all of them before uploading any -- previously an upload of
netscli-core could succeed and leave that version permanent on crates.io, which has no unpublish, while a later crate failed to package. CI runs the same command as a dry run on every push, so packaging is exercised long before a release rather than for the first time during one. Release Drafter also resolves its version from tags instead of from the last published release, which had it proposing v0.2.7 for a repo already tagged v0.3.0.
- The Tauri render suite can run. It had never passed: every run ended at session creation, because msedgedriver looks for the debug port in a
DevToolsActivePort file inside its own temporary profile while wry writes that file into Tauri's. The harness now starts the app itself and attaches to it, which skips the lookup entirely. It does not pass yet -- the remaining failures are assertions to triage -- but it drives the real app for the first time, and the throughput bug above is what it found.
- GUI architecture split into maintainable ownership modules.
App.tsx and the old single CSS file were decomposed into workspace state, tool presentation helpers, shell components, result/detail components, Tauri services, and layered style files. The UI behavior stays production-data driven; no mock/sample data is shipped in the app. - Core, CLI, TUI, MCP, and Tauri internals reduced from monolithic files into facades plus focused modules. The public Rust API, CLI syntax, MCP schema, Tauri command payloads, GUI data shape, and SQLite schema remain stable.
- CI tightened for future changes. PR CI now includes GUI unit tests before the GUI build, and a separate Tauri render workflow can run manually, nightly, or on GUI/Tauri-related pull requests.
- Packaging templates and release workflows audited. Release workflows use the pinned Rust toolchain, AUR templates include runtime dependencies and license installation, Winget/Scoop/Homebrew reference manifests were refreshed, and packaging validation commands were added to the release checklist.
- CI gates report unconditionally, so branch protection can require them, and both required checks were closed against a job that fails without failing the gate. (#161, #187)
- The end-to-end suite can now fail. Several scenarios were structurally incapable of it. (#199)
- The Tauri render suite is schedule-only and no longer gates releases. (#178)
- A dead-CSS budget runs in CI, holding the docs override stack at its current 126 provably shadowed declarations. (#207)
- Node 22, jsdom 30, ESLint 10, react-hooks 7, and three Rust dependency bumps. (#187–#189)
- Release pipeline hardened: tag validation on the AUR jobs, a checksum that could be contaminated by progress output, and the publish long tail. (#158, #200)
Fixed
- MCP server handled one request at a time. The read loop awaited each handler before parsing the next line, so a slow scan blocked every other request on the connection, including cancellation. Handlers now run concurrently under a semaphore. (#169)
- Reading the ARP table blocked a runtime worker. On Windows and macOS it shells out to
arp and waits on the child process; three callers invoked it straight from async code. With MCP handlers capped at 16 concurrent, sixteen of these could stall every worker — including the one reading stdin, so no further request could even be parsed. Moved to a blocking thread. (#196) - Safety limits were enforced in
Ops but not in the engines. The scan, sweep, discover and inspect engines are public API re-exported at the crate root, and called directly they applied no subnet, port or concurrency cap — 0.0.0.0/0 collected 4,294,967,294 addresses into a Vec before sending a packet. Every engine now enforces its own limits. (#198) - Port 0 was rejected only by the MCP surface. Now rejected everywhere. (#164)
- Panic paths in the core and silent corruption in the OUI generator. (#172)
- TUI mis-measured wide characters, so CJK and emoji in a remote-supplied hostname or banner pushed box borders out of alignment. (#173)
- The desktop app described work it had not done. The command preview claimed five ports while three were scanned, truncated captures were presented as complete, and the open-port count drifted from the rows below it. (#197)
- Packet Capture vanished on builds without capture support instead of explaining what was needed. (#193)
- The desktop app was not keyboard operable, and the result grid had incorrect ARIA. (#171)
- The website claimed packet capture in builds that do not ship it, and advertised a version that was never released. (#194, #208)
- Safety limits that only one caller was applying.
SweepEngine::sweep validates its port list instead of trusting the caller and silently returning "no open ports"; mDNS browse duration, ping -c and packet captures given a packet count but no duration all gained the core-side ceiling they were documented to have. netscli trace no longer prints router-supplied hostnames unsanitised. Hop names come from PTR records controlled by whoever runs those routers, and this was the last plain-text output path without the terminal-safety pass every other one had.- Four ways an MCP client could wedge or kill the server: no overall request deadline, permits acquired after spawning rather than before, a single invalid UTF-8 byte on stdin terminating the process, and client disconnect cancelling nothing.
- The concurrent packet-capture limit could be bypassed by calling the blocking capture tool, which never registered a job.
discover_network with no arguments failed on a host whose interface carries a /8, because the substituted default exceeded the /16 cap.- Workspace search jumped to the wrong row. The search dialog listed rows in backend order and the table renders them sorted and filtered, so the position it handed over meant a different row — which is every scan, since each tool has a default sort.
- A malformed result bundle blanked the window. Import validated only that array-backed kinds got an array, so a bad entry threw during render with nothing to catch it, taking every other tab's state with it.
- The desktop app stayed on "Detecting…" in silence when interface polling kept failing, leaving the capture form with no interfaces and no explanation.
- AUR packages are published against a re-hashed asset. Both AUR jobs took the published
.sha256 sidecar on trust rather than downloading the asset and hashing it, which is the circular check the release scripts exist to prevent; the other registries already did this correctly. - The Windows installer verifies Npcap before running it.
install.ps1 downloaded the Npcap installer from an overridable URL and launched it elevated with nothing checked; it now verifies the Authenticode signature and signer, and refuses to run an unsigned or unexpected binary. install.sh no longer claims success before installing libpcap. A user who asked for capture support could read "Installed successfully" and get a binary that cannot capture.- The desktop app's throughput reading no longer disappears on a VPN or tunnel interface. Traffic counters come from a different enumeration than the interface list, and the two disagree: on one Windows machine seven of twelve interfaces had no counterpart, including the Tailscale adapter that was up and was what the app selected by default. The status bar then dropped the whole reading -- numbers, unit and divider -- with nothing to explain it, permanently. Selection now prefers an interface whose throughput can actually be read, and where none can, the bar says "no traffic data" instead of showing nothing.