refactor(gui-client): move change listeners to tunnel service

[thomaseizinger]

At present, listening for DNS server change and network change events is handled in the GUI client. Upon an event, a message is sent to the tunnel service which then applies the new state to connlib.

We can avoid some of this boilerplate by moving these listeners to the tunnel service as part of the handler. As a result, we get a few improvements:

• We don't need to ignore these events if we don't have a session because the lifetime of these listeners is tied to the IPC handler on the service side.
• We need fewer IPC messages
• We can retry the connection directly from within the tunnel service in case we have no Internet at the time of startup
• We can more easily model out the state machine of a connlib session in the tunnel service
• On Linux, this means we no longer shell out to resolvectl from the GUI process, unifying access to the "resolvers" from the tunnel service
• On Windows, we no longer need admin privileges on the GUI client for optimized network-change detection. This now happens in the Tunnel process which already runs as admin.

Resolves: #9465

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
firezone	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jun 9, 2025 6:18pm

[thomaseizinger]

Will need to test this thoroughly. Could run into all kinds of permission / platform issues.

[thomaseizinger]

Initial testing on Windows looks good.

[Copilot]

Pull Request Overview

This PR refactors the GUI client by moving change listeners for DNS and network events into the IPC service, reducing IPC overhead and centralizing session state management. Key changes include replacing the old Option‑based Session handling with a new Session enum, centralizing network change handling in the IPC service, and removing now‑unused event types and fields from multiple modules.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
rust/gui-client/src-tauri/src/service.rs	Refactors session handling, migrates DNS/network listeners to the handler, and updates connection logic accordingly.
rust/gui-client/src-tauri/src/gui/system_tray/builder.rs	Removes obsolete retry event and simplifies the tray menu setup.
rust/gui-client/src-tauri/src/gui/system_tray.rs	Updates connection state mappings in the tray menu, removing references to the retired connection retry state.
rust/gui-client/src-tauri/src/controller.rs	Removes DNS/network notifier handling and deprecated connection retry logic from the controller.
rust/bin-shared/src/lib.rs	Adjusts re-exports to align with the refactored DNS control API.
rust/bin-shared/src/dns_control.rs	Removes the public helper for GUI DNS resolution in line with internalizing DNS handling.

Comments suppressed due to low confidence (2)

rust/gui-client/src-tauri/src/service.rs:181

• [nitpick] The None variant in the Session enum may be ambiguous. Consider renaming it to something more descriptive such as NotConnected to improve code clarity.

    #[default]
    None,

rust/gui-client/src-tauri/src/service.rs:569

• [nitpick] Rather than using an assert! to ensure the session is in the expected state, consider returning an error to handle the situation gracefully in production.

assert!(self.session.is_none());

[thomaseizinger]

Clients for testing: https://github.com/firezone/firezone/actions/runs/15508628130

[thomaseizinger]

Needs rebase onto #9475 before it can be tested.

[thomaseizinger]

New clients for testing: https://github.com/firezone/firezone/actions/runs/15511322300

[thomaseizinger]

Clients for testing: https://github.com/firezone/firezone/actions/runs/15533968883

[thomaseizinger]

Tested and works on Windows and Ubuntu.

[jamilbk]

Think there might be a bug if the administrator has set upstream resolvers