polaris-vpn 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.7.0] - 2026-07-12
+
+### Added
+
+- **AmneziaWG Stealth Mode**: Added full support for AmneziaWG obfuscated WireGuard tunnels. Use `--mode amneziawg` with `polaris deploy` and `polaris start` to bypass Deep Packet Inspection (DPI) with randomized junk packet sizes and headers.
+- **Automated Obfuscation Params**: The CLI now automatically generates and manages unique AmneziaWG obfuscation parameters (`Jc`, `Jmin`, `Jmax`, `S1`, `S2`, `H1`-`H4`) without requiring manual user configuration.
+
+## [0.6.0] - 2026-07-12
+
+### Added
+
+- **First-Class Windows Support**: Polaris now natively binds to `wireguard.exe` NT Services on Windows, bypassing the need for `wg-quick` and `sudo`. This makes Polaris fully cross-platform.
+- **TUI Dashboard**: Added the `polaris dashboard` command, which launches a rich Terminal UI utilizing `blessed` and `blessed-contrib` to render live Rx/Tx bandwidth graphs, GeoIP server maps, and real-time WireGuard peer data.
+
 ## [0.5.0] - 2026-07-12
 
 ### Added

package/README.md

@@ -2,12 +2,13 @@
 
 ![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
 
-Your True North in Digital Privacy. `polaris` is a production-quality, open-source, self-hosted VPN CLI tool. It wraps SSH dynamic port forwarding into a beautiful CLI experience.
+Your True North in Digital Privacy. `polaris` is a production-quality, open-source, self-hosted VPN CLI tool. It supports SSH dynamic port forwarding, WireGuard, and AmneziaWG (Stealth) tunnels.
+### Prerequisites
 
-## Prerequisites
-
-- SSH access to any VPS (Virtual Private Server).
-- Node.js >= 18
+- Node.js (v18+)
+- SSH access to a remote Linux VPS (Ubuntu/Debian recommended)
+- **Linux/macOS**: `sudo` privileges for configuring WireGuard and network routes locally.
+- **Windows**: The official [WireGuard for Windows](https://www.wireguard.com/install/) client must be installed, and `polaris` must be run from an Administrator prompt.
 
 We highly recommend **Oracle Cloud Free Tier** for your VPS.
 
@@ -43,8 +44,10 @@ polaris stop
 
 | Command | Description |
 | --- | --- |
-| `polaris start --server user@host [--port 1080]` | Start the encrypted SSH tunnel. |
+| `polaris deploy --server user@host --mode amneziawg` | Provision server with AmneziaWG (Stealth Mode) |
+| `polaris start --server user@host [--port 1080] [--mode <type>]` | Start the encrypted tunnel. |
 | `polaris stop` | Stop the active tunnel. |
+| `polaris dashboard` | Opens a rich Terminal User Interface (TUI) with real-time stats. |
 | `polaris status [--full]` | Show current tunnel status. `--full` shows GeoIP, ping latency, and WG stats. |
 | `polaris monitor` | Live bandwidth monitor for WireGuard tunnels. |
 | `polaris check` | Run a 3-point privacy check (IP, DNS leak, IPv6 leak). |
@@ -54,6 +57,18 @@ polaris stop
 | `polaris server start` | Start a local REST API on `127.0.0.1:7070`. |
 | `polaris update` | Update `polaris-vpn` to the latest version via npm. |
 
+#### `polaris dashboard`
+Opens a rich Terminal User Interface (TUI) with real-time graphs, server location maps, and live statistics (Rx/Tx, Ping).
+
+#### `polaris status [--full]`
+Displays the connection state, mode, current proxy IP, and active server. Use `--full` to query GeoIP and ping latency.
+
+#### `polaris monitor`
+Live bandwidth monitor that actively graphs the download and upload speeds of your tunnel.
+
+#### `polaris check`
+Checks if your IP matches the proxy, tests for DNS leaks via `ipleak.net`, and verifies IPv6 routing.
+
 > All commands support the `--json` flag for machine-readable output.
 
 ## Oracle Cloud Free Tier Setup
@@ -88,10 +103,11 @@ One Oracle VM can serve multiple people:
 
 ## Roadmap
 
-- **v0.1**: MVP — SSH SOCKS5 tunnel (Current)
-- **v0.2**: TLS tunnel + DNS-over-HTTPS + leak checker
+- **v0.1**: MVP — SSH SOCKS5 tunnel
 - **v0.5**: WireGuard full tunnel + server provisioning
-- **v1.0**: AmneziaWG stealth mode + multi-peer + QR codes + kill switch
+- **v0.6**: Windows NT Service bindings + Blessed TUI Dashboard
+- **v0.7**: AmneziaWG stealth mode (DPI bypass) (Current)
+- **v1.0**: Multi-peer management + QR codes + Kill switch
 
 ## Contributing
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polaris-vpn",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Your True North in Digital Privacy. A self-hosted VPN CLI.",
   "type": "module",
   "bin": {
@@ -32,6 +32,8 @@
     "oracle-cloud"
   ],
   "dependencies": {
+    "blessed": "^0.1.81",
+    "blessed-contrib": "^4.11.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
     "commander": "^15.0.0",

package/src/cli.js

@@ -41,10 +41,10 @@ program
 
 program
   .command('start')
-  .description('Start the encrypted SSH, TLS or WireGuard tunnel')
+  .description('Start the encrypted SSH, TLS, WireGuard or AmneziaWG tunnel')
   .option('-s, --server <user@host>', 'SSH/TLS/WireGuard server to connect to')
   .option('-p, --port <number>', 'Local SOCKS5 port to bind', '1080')
-  .option('-m, --mode <type>', 'Tunnel mode: ssh, tls, wireguard or auto', 'auto')
+  .option('-m, --mode <type>', 'Tunnel mode: ssh, tls, wireguard, amneziawg or auto', 'auto')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {
@@ -85,6 +85,19 @@ program
     }
   });
 
+program
+  .command('dashboard')
+  .description('Open the live TUI dashboard')
+  .action(async (options, cmd) => {
+    try {
+      const run = (await import('./commands/dashboard.js')).default;
+      await run(cmd.optsWithGlobals());
+    } catch (err) {
+      printError('Command failed', err);
+      process.exit(1);
+    }
+  });
+
 program
   .command('check')
   .description('Run a 3-point privacy check (IP, DNS leak, IPv6 leak)')
@@ -190,10 +203,11 @@ dnsCmd
 
 program
   .command('deploy')
-  .description('Provision a fresh Ubuntu server as a WireGuard server')
+  .description('Provision a remote server with WireGuard or AmneziaWG')
   .requiredOption('-s, --server <user@host>', 'SSH server to configure')
   .option('-i, --identity <path>', 'SSH private key file path')
   .option('-p, --password <password>', 'SSH password (alternative to identity)')
+  .option('-m, --mode <type>', 'Tunnel mode: wireguard or amneziawg', 'wireguard')
   .action(async (options, cmd) => {
     if (!cmd.optsWithGlobals().json) printBanner();
     try {

package/src/commands/dashboard.js

@@ -0,0 +1,229 @@
+import blessed from 'blessed';
+import contrib from 'blessed-contrib';
+import { getActiveTunnel } from '../core/tunnel-service.js';
+import { getProxiedIp } from '../net/ip-check.js';
+import fetch from 'node-fetch';
+import { spawnSync } from 'child_process';
+import os from 'os';
+
+const pingServer = (ip) => {
+  const isWin = os.platform() === 'win32';
+  const args = isWin ? ['-n', '1', '-w', '2000', ip] : ['-c', '1', '-W', '2', ip];
+  const res = spawnSync('ping', args, { encoding: 'utf-8' });
+  if (res.status === 0) {
+    if (isWin) {
+      const match = res.stdout.match(/Average = (\d+)ms/);
+      if (match) return `${match[1]} ms`;
+    } else {
+      const match = res.stdout.match(/time=([\d.]+)\s*ms/);
+      if (match) return `${match[1]} ms`;
+    }
+  }
+  return 'Timeout';
+};
+
+const getGeoIp = async (ip) => {
+  try {
+    const res = await fetch(`http://ip-api.com/json/${ip}`);
+    const data = await res.json();
+    if (data.status === 'success') {
+      return { 
+        text: `${data.city}, ${data.country}`,
+        lat: data.lat,
+        lon: data.lon,
+        isp: data.isp
+      };
+    }
+  } catch (err) {}
+  return null;
+};
+
+const formatBytes = (bytes) => {
+  if (bytes === 0) return '0 B';
+  const k = 1024;
+  const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
+};
+
+const getWgStats = () => {
+  const dumpRes = spawnSync('sudo', ['wg', 'show', 'all', 'dump'], { encoding: 'utf-8' });
+  if (dumpRes.status !== 0) return null;
+  const lines = dumpRes.stdout.trim().split('\n');
+  if (lines.length <= 1) return null;
+  
+  let totalRx = 0;
+  let totalTx = 0;
+  const peers = [];
+  for (let i = 1; i < lines.length; i++) {
+    const peerInfo = lines[i].split('\t');
+    const rx = parseInt(peerInfo[6], 10) || 0;
+    const tx = parseInt(peerInfo[7], 10) || 0;
+    totalRx += rx;
+    totalTx += tx;
+    peers.push({
+      pubKey: peerInfo[1].substring(0, 8) + '...',
+      endpoint: peerInfo[4],
+      rx,
+      tx
+    });
+  }
+  return { totalRx, totalTx, peers };
+};
+
+export default async () => {
+  const info = getActiveTunnel();
+  
+  if (!info) {
+    console.error('Tunnel is down. Start the tunnel first to use the dashboard.');
+    process.exit(1);
+  }
+
+  const screen = blessed.screen({
+    smartCSR: true,
+    title: 'Polaris VPN Dashboard'
+  });
+
+  const grid = new contrib.grid({ rows: 12, cols: 12, screen: screen });
+
+  // 1. Header Box (Status, IP, Uptime)
+  const headerBox = grid.set(0, 0, 3, 4, blessed.box, {
+    label: ' Tunnel Status ',
+    content: 'Loading...',
+    tags: true,
+    style: { fg: 'green', border: { fg: 'cyan' } }
+  });
+
+  // 2. Line Chart (Bandwidth)
+  const lineChart = grid.set(0, 4, 6, 8, contrib.line, {
+    label: ' Bandwidth (Bytes/s) ',
+    showLegend: true,
+    legend: { width: 12 },
+    style: { baseline: 'gray', line: 'yellow', text: 'green' },
+    xLabelPadding: 3,
+    xPadding: 5
+  });
+
+  // 3. Map (GeoIP)
+  const mapWidget = grid.set(3, 0, 9, 7, contrib.map, {
+    label: ' Server Location ',
+    style: { shapeColor: 'cyan' }
+  });
+
+  // 4. Peers Table
+  const peersTable = grid.set(6, 7, 6, 5, contrib.table, {
+    keys: true,
+    fg: 'white',
+    selectedFg: 'white',
+    selectedBg: 'blue',
+    interactive: false,
+    label: ' Active Peers ',
+    width: '100%',
+    height: '100%',
+    border: { type: 'line', fg: 'cyan' },
+    columnSpacing: 2,
+    columnWidth: [15, 20, 10, 10]
+  });
+
+  const rxData = { title: 'RX', x: [], y: [], style: { line: 'green' } };
+  const txData = { title: 'TX', x: [], y: [], style: { line: 'red' } };
+  
+  // Seed initial chart data
+  for (let i = 0; i < 20; i++) {
+    const t = new Date(Date.now() - (20 - i) * 1000).toLocaleTimeString().split(' ')[0];
+    rxData.x.push(t);
+    rxData.y.push(0);
+    txData.x.push(t);
+    txData.y.push(0);
+  }
+
+  let prevRx = 0;
+  let prevTx = 0;
+  let hasInitWg = false;
+  let currentIp = 'Loading...';
+  let geoData = null;
+  let latency = '...';
+  let geoFetched = false;
+
+  screen.key(['escape', 'q', 'C-c'], () => {
+    return process.exit(0);
+  });
+
+  const updateDashboard = async () => {
+    // 1. Fetch IP & GeoIP (runs once)
+    if (!geoFetched) {
+      geoFetched = true;
+      try {
+        currentIp = await getProxiedIp(info.port);
+        geoData = await getGeoIp(currentIp);
+        if (geoData) {
+          mapWidget.addMarker({ lat: geoData.lat, lon: geoData.lon, color: 'red', char: 'X' });
+        }
+      } catch (err) {}
+    }
+
+    // 2. Fetch Ping
+    const serverIp = info.server.split('@').pop();
+    latency = pingServer(serverIp);
+
+    // 3. Update Header
+    const uptimeMin = Math.floor((Date.now() - new Date(info.startTime).getTime()) / 60000);
+    headerBox.setContent(
+      `{bold}Status{/bold}:  {green-fg}UP{/green-fg}\n` +
+      `{bold}Server{/bold}:  ${info.server}\n` +
+      `{bold}Mode{/bold}:    ${(info.mode || 'ssh').toUpperCase()}\n` +
+      `{bold}IP{/bold}:      ${currentIp}\n` +
+      `{bold}Uptime{/bold}:  ${uptimeMin} min\n` +
+      `{bold}Ping{/bold}:    ${latency}\n` +
+      `{bold}GeoIP{/bold}:   ${geoData ? geoData.text : 'N/A'}`
+    );
+
+    // 4. Update WG Stats & Chart
+    if (info.mode === 'wireguard' || info.mode === 'amneziawg' || info.mode === 'auto') {
+      const stats = getWgStats();
+      if (stats) {
+        if (!hasInitWg) {
+          prevRx = stats.totalRx;
+          prevTx = stats.totalTx;
+          hasInitWg = true;
+        } else {
+          const rxSpeed = stats.totalRx - prevRx;
+          const txSpeed = stats.totalTx - prevTx;
+          prevRx = stats.totalRx;
+          prevTx = stats.totalTx;
+
+          const t = new Date().toLocaleTimeString().split(' ')[0];
+          rxData.x.shift();
+          rxData.x.push(t);
+          rxData.y.shift();
+          rxData.y.push(rxSpeed);
+
+          txData.x.shift();
+          txData.x.push(t);
+          txData.y.shift();
+          txData.y.push(txSpeed);
+
+          lineChart.setData([rxData, txData]);
+        }
+
+        const tableData = stats.peers.map(p => [
+          p.pubKey, 
+          p.endpoint || 'N/A', 
+          formatBytes(p.rx), 
+          formatBytes(p.tx)
+        ]);
+        
+        peersTable.setData({
+          headers: ['Peer', 'Endpoint', 'RX', 'TX'],
+          data: tableData.length ? tableData : [['No peers', '-', '-', '-']]
+        });
+      }
+    }
+
+    screen.render();
+  };
+
+  setInterval(updateDashboard, 1000);
+  updateDashboard();
+  screen.render();
+};

package/src/commands/start.js

@@ -88,8 +88,21 @@ export default async (options) => {
     const hostPart = server.includes('@') ? server.split('@')[1] : server;
     let actualMode = requestedMode;
 
+    const AWG_CONF = path.join(CONFIG_DIR, 'wg', 'awg0.conf');
+
+    const hasAwgQuick = () => {
+      try {
+        const res = spawnSync('which', ['awg-quick'], { encoding: 'utf-8' });
+        return res.status === 0;
+      } catch (e) {
+        return false;
+      }
+    };
+
     if (requestedMode === 'auto') {
-      if (fs.existsSync(WG_CONF) && hasWgQuick()) {
+      if (fs.existsSync(AWG_CONF) && hasAwgQuick()) {
+        actualMode = 'amneziawg';
+      } else if (fs.existsSync(WG_CONF) && hasWgQuick()) {
         actualMode = 'wireguard';
       } else {
         if (!isJson) {
@@ -115,7 +128,7 @@ export default async (options) => {
 
     const res = await startTunnel(server, port, actualMode, isJson);
     
-    if (actualMode === 'wireguard') {
+    if (actualMode === 'wireguard' || actualMode === 'amneziawg') {
       if (!isJson) {
         spinner.text = 'Waiting for interface to configure...';
       }
@@ -128,12 +141,12 @@ export default async (options) => {
       
       if (!isJson) {
         spinner.stop();
-        printSuccess(`WireGuard full tunnel established successfully to ${server}`);
+        printSuccess(`${actualMode === 'amneziawg' ? 'AmneziaWG (Stealth)' : 'WireGuard'} full tunnel established successfully to ${server}`);
         console.log(`\n  ${chalk.dim('Old IP:')} ${chalk.red(oldIp)}`);
         console.log(`  ${chalk.dim('New IP:')} ${chalk.green(newIp)}`);
         console.log(`  ${chalk.dim('Routing:')} System-wide (All OS traffic)`);
       } else {
-        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: 'wireguard', pid: res.pid }));
+        console.log(JSON.stringify({ success: true, oldIp, newIp, mode: actualMode, pid: res.pid }));
       }
     } else {
       if (!isJson) {

package/src/core/deploy-service.js

@@ -2,7 +2,7 @@ import { Client } from 'ssh2';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import { generateKeyPair } from '../tunnel/wg.js';
+import { generateKeyPair, generateAwgParams } from '../tunnel/wg.js';
 import { ensureDir, CONFIG_DIR } from '../utils/config.js';
 
 const getDefaultPrivateKey = () => {
@@ -37,6 +37,7 @@ export const deployServer = async (serverStr, options = {}) => {
   const parts = serverStr.split('@');
   const username = parts.length > 1 ? parts[0] : 'ubuntu';
   const host = parts.length > 1 ? parts[1] : parts[0];
+  const isAwg = options.mode === 'amneziawg';
   
   const privateKey = options.privateKey 
     ? fs.readFileSync(options.privateKey) 
@@ -49,6 +50,7 @@ export const deployServer = async (serverStr, options = {}) => {
   // 1. Generate local keys
   const serverKeys = generateKeyPair();
   const clientKeys = generateKeyPair();
+  const awgParams = isAwg ? generateAwgParams() : null;
 
   const conn = new Client();
 
@@ -56,10 +58,17 @@ export const deployServer = async (serverStr, options = {}) => {
     conn.on('ready', async () => {
       try {
         const onProgress = options.onProgress || (() => {});
+        const ifaceName = isAwg ? 'awg0' : 'wg0';
+        const configDir = isAwg ? '/etc/amnezia/amneziawg' : '/etc/wireguard';
+        const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
 
         // Step 1: Install packages
-        onProgress('Installing WireGuard and UFW on remote VPS...');
-        let res = await sshExec(conn, 'sudo apt-get update -y && sudo apt-get install -y wireguard ufw');
+        onProgress(`Installing ${isAwg ? 'AmneziaWG' : 'WireGuard'} and UFW on remote VPS...`);
+        let installCmd = 'sudo apt-get update -y && sudo apt-get install -y wireguard ufw';
+        if (isAwg) {
+          installCmd = 'sudo apt-get update -y && sudo apt-get install -y software-properties-common && sudo add-apt-repository -y ppa:amnezia/ppa && sudo apt-get update -y && sudo apt-get install -y amneziawg-dkms amneziawg-tools ufw';
+        }
+        let res = await sshExec(conn, installCmd);
         if (res.code !== 0) throw new Error(`Installation failed: ${res.stderr}`);
 
         // Step 2: Enable packet forwarding
@@ -73,26 +82,41 @@ export const deployServer = async (serverStr, options = {}) => {
         const ethInterface = res.stdout.trim() || 'eth0';
 
         // Step 4: Write server config
-        onProgress('Configuring WireGuard server wg0...');
+        onProgress(`Configuring server ${ifaceName}...`);
+        
+        let obfuscationBlock = '';
+        if (isAwg) {
+          obfuscationBlock = `Jc = ${awgParams.Jc}
+Jmin = ${awgParams.Jmin}
+Jmax = ${awgParams.Jmax}
+S1 = ${awgParams.S1}
+S2 = ${awgParams.S2}
+H1 = ${awgParams.H1}
+H2 = ${awgParams.H2}
+H3 = ${awgParams.H3}
+H4 = ${awgParams.H4}`;
+        }
+
         const serverConf = `[Interface]
 PrivateKey = ${serverKeys.privateKey}
 Address = 10.0.0.1/24
 ListenPort = 51820
-PostUp = ufw route allow in on wg0; iptables -t nat -A POSTROUTING -o ${ethInterface} -j MASQUERADE
-PostDown = ufw route delete allow in on wg0; iptables -t nat -D POSTROUTING -o ${ethInterface} -j MASQUERADE
+PostUp = ufw route allow in on ${ifaceName}; iptables -t nat -A POSTROUTING -o ${ethInterface} -j MASQUERADE
+PostDown = ufw route delete allow in on ${ifaceName}; iptables -t nat -D POSTROUTING -o ${ethInterface} -j MASQUERADE
+${obfuscationBlock}
 
 [Peer]
 PublicKey = ${clientKeys.publicKey}
 AllowedIPs = 10.0.0.2/32
 `;
 
-        res = await sshExec(conn, `cat << 'EOF' > /tmp/wg0.conf\n${serverConf}\nEOF\nsudo mv /tmp/wg0.conf /etc/wireguard/wg0.conf && sudo chmod 600 /etc/wireguard/wg0.conf`);
+        res = await sshExec(conn, `sudo mkdir -p ${configDir} && cat << 'EOF' > /tmp/${ifaceName}.conf\n${serverConf}\nEOF\nsudo mv /tmp/${ifaceName}.conf ${configDir}/${ifaceName}.conf && sudo chmod 600 ${configDir}/${ifaceName}.conf`);
         if (res.code !== 0) throw new Error(`Server config write failed: ${res.stderr}`);
 
         // Step 5: Start service
-        onProgress('Starting WireGuard interface...');
-        res = await sshExec(conn, 'sudo systemctl stop wg-quick@wg0 || true && sudo systemctl start wg-quick@wg0 && sudo systemctl enable wg-quick@wg0');
-        if (res.code !== 0) throw new Error(`Starting WireGuard failed: ${res.stderr}`);
+        onProgress(`Starting ${ifaceName} interface...`);
+        res = await sshExec(conn, `sudo systemctl stop ${quickCmd}@${ifaceName} || true && sudo systemctl start ${quickCmd}@${ifaceName} && sudo systemctl enable ${quickCmd}@${ifaceName}`);
+        if (res.code !== 0) throw new Error(`Starting tunnel failed: ${res.stderr}`);
 
         // Step 6: Configure UFW firewall
         onProgress('Configuring UFW firewall...');
@@ -105,6 +129,7 @@ AllowedIPs = 10.0.0.2/32
 PrivateKey = ${clientKeys.privateKey}
 Address = 10.0.0.2/24
 DNS = 1.1.1.1
+${obfuscationBlock}
 
 [Peer]
 PublicKey = ${serverKeys.publicKey}
@@ -117,12 +142,13 @@ PersistentKeepalive = 25
         ensureDir(wgDir);
         
         // Save client config
-        const clientConfPath = path.join(wgDir, 'wg0.conf');
+        const clientConfPath = path.join(wgDir, `${ifaceName}.conf`);
         fs.writeFileSync(clientConfPath, clientConf, 'utf-8');
 
         // Also save provisioning info to config
         fs.writeFileSync(path.join(wgDir, 'deploy.json'), JSON.stringify({
           server: serverStr,
+          mode: options.mode || 'wireguard',
           serverPublicKey: serverKeys.publicKey,
           clientPublicKey: clientKeys.publicKey,
           interface: ethInterface,

package/src/core/tunnel-service.js

@@ -9,15 +9,17 @@ import { loadDaemonState, clearDaemonState, killPid, saveDaemonState } from '../
 import { TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, CONFIG_DIR, ensureDir } from '../utils/config.js';
 
 const WG_CONF = path.join(CONFIG_DIR, 'wg', 'wg0.conf');
+const AWG_CONF = path.join(CONFIG_DIR, 'wg', 'awg0.conf');
 
 export const getActiveTunnel = () => {
   const info = loadDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
   if (!info) return null;
 
-  // For WireGuard, PID file tracks start process, but we verify interface status
-  if (info.mode === 'wireguard') {
+  // For WireGuard/AmneziaWG, PID file tracks start process, but we verify interface status
+  if (info.mode === 'wireguard' || info.mode === 'amneziawg') {
+    const showCmd = info.mode === 'amneziawg' ? 'awg' : 'wg';
     try {
-      const showRes = spawnSync('sudo', ['wg', 'show'], { encoding: 'utf-8' });
+      const showRes = spawnSync('sudo', [showCmd, 'show'], { encoding: 'utf-8' });
       if (showRes.status !== 0 || !showRes.stdout.includes('interface:')) {
         clearDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE);
         return null;
@@ -33,8 +35,9 @@ export const getActiveTunnel = () => {
 export const stopActiveTunnel = (isJson = false) => {
   const info = getActiveTunnel();
   if (info) {
-    if (info.mode === 'wireguard') {
-      stopWgTunnel(WG_CONF, isJson);
+    if (info.mode === 'wireguard' || info.mode === 'amneziawg') {
+      const confPath = info.mode === 'amneziawg' ? AWG_CONF : WG_CONF;
+      stopWgTunnel(confPath, isJson, info.mode === 'amneziawg');
       disableKillSwitch(info.server);
     } else {
       killPid(info.pid);
@@ -49,24 +52,26 @@ export const startTunnel = async (server, port, mode = 'ssh', isJson = false) =>
   ensureDir();
 
   let pid;
-  if (mode === 'wireguard') {
-    if (!fs.existsSync(WG_CONF)) {
-      throw new Error(`WireGuard client configuration not found at ${WG_CONF}. Please provision the server first with "polaris deploy".`);
+  if (mode === 'wireguard' || mode === 'amneziawg') {
+    const isAwg = mode === 'amneziawg';
+    const confPath = isAwg ? AWG_CONF : WG_CONF;
+    if (!fs.existsSync(confPath)) {
+      throw new Error(`${isAwg ? 'AmneziaWG' : 'WireGuard'} client configuration not found at ${confPath}. Please provision the server first with "polaris deploy".`);
     }
 
-    pid = startWgTunnel(WG_CONF, isJson);
+    pid = startWgTunnel(confPath, isJson, isAwg);
     
     // Save state before enableKillSwitch in case sudo prompt needs to block
     saveDaemonState(TUNNEL_PID_FILE, TUNNEL_CONFIG_FILE, {
       pid,
       server,
       port: 0,
-      mode: 'wireguard',
+      mode: mode,
       startTime: new Date().toISOString()
     });
 
     enableKillSwitch(server);
-    return { pid, server, port: 0, mode: 'wireguard' };
+    return { pid, server, port: 0, mode: mode };
   } 
   
   if (mode === 'tls') {

package/src/tunnel/wg.js

@@ -1,5 +1,7 @@
 import { spawnSync, spawn } from 'child_process';
 import crypto from 'crypto';
+import os from 'os';
+import path from 'path';
 
 // Pure JS Curve25519/X25519 key generator matching WireGuard format
 export const generateKeyPair = () => {
@@ -27,33 +29,80 @@ export const generateKeyPair = () => {
   };
 };
 
-export const startWgTunnel = (confPath, isJson = false) => {
-  const sudoCheck = spawnSync('sudo', ['-n', 'true']);
-  if (sudoCheck.status !== 0 && isJson) {
-    throw new Error('Sudo privileges required. Please run with "sudo polaris start ..." for JSON mode.');
+export const generateAwgParams = () => {
+  return {
+    Jc: crypto.randomInt(1, 100),
+    Jmin: crypto.randomInt(1, 50),
+    Jmax: crypto.randomInt(50, 1000),
+    S1: crypto.randomInt(15, 150),
+    S2: crypto.randomInt(15, 150),
+    H1: crypto.randomInt(1, 2147483647),
+    H2: crypto.randomInt(1, 2147483647),
+    H3: crypto.randomInt(1, 2147483647),
+    H4: crypto.randomInt(1, 2147483647)
+  };
+};
+
+export const startWgTunnel = (confPath, isJson = false, isAwg = false) => {
+  const isWin = os.platform() === 'win32';
+  const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
+  const serviceCmd = isAwg ? 'amneziawg' : 'wireguard';
+
+  if (!isWin) {
+    const sudoCheck = spawnSync('sudo', ['-n', 'true']);
+    if (sudoCheck.status !== 0 && isJson) {
+      throw new Error('Sudo privileges required. Please run with "sudo polaris start ..." for JSON mode.');
+    }
   }
 
-  const res = spawnSync('sudo', ['wg-quick', 'up', confPath], {
+  if (isWin) {
+    const res = spawnSync(serviceCmd, ['/installtunnelservice', confPath], {
+      stdio: isJson ? 'ignore' : 'inherit'
+    });
+    if (res.status !== 0) {
+      throw new Error(`${serviceCmd} /installtunnelservice failed (ensure Admin privileges) with code ${res.status}`);
+    }
+    return process.pid;
+  }
+
+  const res = spawnSync('sudo', [quickCmd, 'up', confPath], {
     stdio: isJson ? 'ignore' : 'inherit'
   });
   
   if (res.status !== 0) {
-    throw new Error(`wg-quick up failed with code ${res.status}`);
+    throw new Error(`${quickCmd} up failed with code ${res.status}`);
   }
   return process.pid;
 };
 
-export const stopWgTunnel = (confPath, isJson = false) => {
-  const sudoCheck = spawnSync('sudo', ['-n', 'true']);
-  if (sudoCheck.status !== 0 && isJson) {
-    throw new Error('Sudo privileges required. Please run with "sudo polaris stop" for JSON mode.');
+export const stopWgTunnel = (confPath, isJson = false, isAwg = false) => {
+  const isWin = os.platform() === 'win32';
+  const quickCmd = isAwg ? 'awg-quick' : 'wg-quick';
+  const serviceCmd = isAwg ? 'amneziawg' : 'wireguard';
+
+  if (!isWin) {
+    const sudoCheck = spawnSync('sudo', ['-n', 'true']);
+    if (sudoCheck.status !== 0 && isJson) {
+      throw new Error('Sudo privileges required. Please run with "sudo polaris stop" for JSON mode.');
+    }
+  }
+
+  if (isWin) {
+    const interfaceName = path.parse(confPath).name;
+    const res = spawnSync(serviceCmd, ['/uninstalltunnelservice', interfaceName], {
+      stdio: isJson ? 'ignore' : 'inherit'
+    });
+    if (res.status !== 0) {
+      throw new Error(`${serviceCmd} /uninstalltunnelservice failed with code ${res.status}`);
+    }
+    return;
   }
 
-  const res = spawnSync('sudo', ['wg-quick', 'down', confPath], {
+  const res = spawnSync('sudo', [quickCmd, 'down', confPath], {
     stdio: isJson ? 'ignore' : 'inherit'
   });
   
   if (res.status !== 0) {
-    throw new Error(`wg-quick down failed with code ${res.status}`);
+    throw new Error(`${quickCmd} down failed with code ${res.status}`);
   }
 };