How It Works

How It Works

Edge-based toggling

LanGuard acts only on transitions of the wired-link state:

wired link UP    ─▶  Wi-Fi OFF
wired link DOWN  ─▶  Wi-Fi ON
no transition    ─▶  leave Wi-Fi alone

Because it only reacts to plug/unplug edges, a manual Wi-Fi change you make between edges is respected — Wi-Fi stays however you set it until the next unplug/replug. There's no fragile "did the app or the user do this?" tracking; the edge model gives override-respect for free.

Wake handling

The last wired state is persisted. On wake, LanGuard re-evaluates: if the wired state changed while the Mac was asleep (e.g. you undocked and went home), that counts as an edge and Wi-Fi is corrected. Triggers come from SCDynamicStore (link/IP changes) plus NSWorkspace.didWakeNotification.

First launch

If you launch already docked (wired up) with no prior state, LanGuard enforces Wi-Fi off once.

Architecture

All logic lives in the LanGuardFeature Swift package — modular and unit-tested. The app target is a thin SwiftUI MenuBarExtra shell.

Component	Role
NetworkMonitor	SCDynamicStore link/IP callbacks + wake notification; per-interface link reads
WiFiController	CoreWLAN setPower / powerOn (no sudo, no shell)
ToggleEngine	Edge state machine; dependencies injected → unit-tested
InterfaceCatalog	Enumerate + classify Ethernet/Wi-Fi; flag virtual adapters
AppSettings	UserDefaults; opt-out physical / opt-in virtual
LoginItem	SMAppService login item (self-healing)
Notifier	UNUserNotificationCenter banners
MenuIcon	MenuState + MenuIconStyle + the menu-bar label view

Why no admin rights?

Wi-Fi power is set via CoreWLAN (CWInterface.setPower) and link state read via SystemConfiguration — both work for the logged-in user without sudo or shell scripts.