**Hide ring** checkbox, so you can show just the monthly ring, for example. The current-usage figures are also column-aligned now.
* `MasselGUARDcli help` **and** `version` **no longer need Administrator.** Informational commands run in any terminal; only commands that actually touch the tunnel driver require elevation.
* **Fixed: connecting a local tunnel from the CLI.** `MasselGUARDcli connect <name>` failed for local tunnels because the tunnel service was launched with the wrong host executable and exited immediately; it now starts correctly. Thanks to **Sven Grewe (**[**u/qoreQyaS**](
https://github.com/qoreQyaS)**)** for the fix ([\#47](
https://github.com/masselink/MasselGUARD/pull/47)).
# v3.9.5 — Selective Serval
This cycle is about **rules, portability, and languages**.
# Trusted-network rules now work in both directions
A *Trusted networks* rule used to do one fixed thing: connect on untrusted networks, disconnect on trusted ones. Now each trusted rule picks a **direction**:
* **When NOT on a trusted network** → activate its tunnel (protect on public WiFi — typically a **full tunnel**).
* **When on a trusted network** → activate its tunnel (bring something up only on known networks — e.g. a **split tunnel** at home or work).
A rule now acts **only on its own side**; the other side falls through to your other rules and the **Default action** (so the Default always still applies where a rule doesn't). Want both behaviours? Add two trusted rules against the one shared trusted-SSID list — one for on-list, one for off-list. Leaving a rule's tunnel blank disconnects on its side instead of connecting.
# Data-usage warnings (daily / weekly / monthly)
The per-tunnel data cap is now a proper **DATA-USAGE WARNINGS** section (in the tunnel editor's *Options*) with **daily, weekly, and monthly** thresholds — set any of them in MB, `0` = off.
When a tunnel's usage for a period crosses its threshold you get a **one-time notification**: a log entry, a tray toast, and the tunnel's row is **highlighted** (a subtle amber tint, with the usage figure turning amber and a tooltip breaking down today / this week / this month). Each warning re-arms at the next period boundary.
By default these are **warnings only** — nothing is disconnected. If you want a hard stop, tick **Kill at cap** (see *Enforce a cap* below) and MasselGUARD disconnects the tunnel when the period's limit is reached. Usage is measured from the connection history you already record (calendar day / week / month, UTC).
**Enforce a cap (disconnect at the limit).** Each period now has a **Kill at cap** checkbox next to its threshold. With it on, the tunnel is **disconnected** the moment its usage crosses that cap — with a log line, a **sticky toast** offering **Ignore & reconnect**, and a **🛑 marker** next to its Connect button (until you next start it) — and it won't auto-reconnect while over budget. The tunnel editor's usage section also shows each period's **current usage** (e.g. `· 320 MB used`) next to its threshold. Trying to (re)connect over the limit asks first:
* **Manually** (window open) → a *"Connect anyway and ignore the limit?"* confirmation.
* **Automatically** (a WiFi rule) → an interactive toast with the usage details and **Connect / Cancel** buttons; if you don't answer it defaults to **Cancel** (respecting the limit).
Choosing *Connect anyway* ignores that cap until the period rolls over, so you're not nagged every second. Enforcement is per-period and opt-in — leave it off for warning-only behaviour.
**See it on a chart.** The bottom info panel now has a **Timeline ⇄ Data usage** switch. In *Data usage*, it draws a **line chart (with dots) of data per tunnel** over the selected range — the same **24h / 7d / 31d** toggle you already use, with hourly points for 24h and daily points for 7d / 31d. The window grows a little in this view so the tunnel list keeps its size. The range doubles as the cap period, so where a tunnel's usage reaches its **daily / weekly / monthly** cap a **red limit-marker ring** appears on that point of its line
