Bastion
Run a router security scanner on your Wi-Fi

You are building "Bastion": a free, open-source desktop app for Windows and macOS that finds the backdoors in my home Wi-Fi router, shows where my traffic goes, speeds up my Wi-Fi, and lets AI agents watch my network. Work in this empty folder. Use Opus 5.5.

DESIGN FIRST, CODE SECOND
1. Before writing any code, design 4 different UI concepts as web pages (dark, premium, Apple-level polish, focus on speed + security). I'll pick one.
2. Then rebuild the chosen concept until it looks like Apple made it: real 3D (Three.js) router on the home screen, bloom + anamorphic lens flare, glass panels, Apple-style sliders with a glow that runs around the edge, a flowing ambient background behind every screen.

WHAT THE APP MUST REALLY DO (no fake data, ever)
- Find my router and probe it from inside the network: TR-069/CWMP (port 7547), UPnP port-forwards (read the actual mappings), Telnet, SSH, plain-HTTP admin page.
- Check whether my DNS lookups are encrypted and who resolves them.
- Read my Wi-Fi: channel, band, signal, security; survey neighbour networks and recommend a quieter channel.
- List devices on my network and which apps on this computer talk to the internet.
- Run a real speed test.
- Check if my Wi-Fi name ends with _nomap and if this computer uses a private MAC address.
- Score my network 0–100 and give plain-language, step-by-step fixes.
- If something can't be measured from inside my network, say "unknown" and explain why. Never guess.

AI AGENTS
- Let me plug in Claude, ChatGPT or Grok with my own API key (stored encrypted by the OS keychain).
- Also let me use my existing subscription without an API key: talk to Claude through my Claude Code login and to ChatGPT through my Codex login.
- Before anything leaves my computer, strip MAC addresses, device names, Wi-Fi names and the end of my public IP.
- Agents only suggest. They can never run commands, log in to my router or change a setting.

SAFETY RULES
- Never log in to my router and never try a password.
- Shell out only with fixed arguments; my text goes in through stdin, never into a command line.
- Any CLI an agent uses runs with zero tools, read-only, in an empty folder, with a timeout.

HOW TO BUILD IT
- One Electron codebase for macOS and Windows. Write a short internal contract first (IPC surface + data types) so modules can be built in parallel.
- Split the build across parallel agents: network scanner, Wi-Fi + speed test, AI agents, 3D hero, UI kit, screens, packaging. Give every agent a reviewer and every reviewer a fixer.
- Add a separate security agent that attacks every line that runs commands or sends data.
- Add a design-critic agent that screenshots every screen and asks: "would Apple ship this?" If not, it goes back.
- Run the scanner on my real machine and fix whatever real hardware breaks (localized OS output, OS permissions, rate limits).
- Before anything goes public, check that none of my IPs, MAC addresses or network names are in the code.

SHIP IT
- Push to a public GitHub repo with an English README (what it does, what it does NOT do, privacy, install).
- GitHub Actions builds the .dmg and .exe on every version tag.
- Build a launch site on Vercel in the same design, with download buttons that always point to the latest release.