Every click shows its commands#

A GUI that hides the configuration model asks you to trust it. This one shows you what it is about to do, in the language the router actually speaks, and lets you copy it.

In every editor#

Each editor keeps a live block of the operations it will stage, updating as you fill in the form. Here is the QoS editor, staging a CAKE policy at 70 Mbit/s with dual-source-host flow isolation and a 100 ms RTT, attached as egress on eth1:

What the QoS editor will run

set qos policy cake WAN-OUT bandwidth 70mbit
set qos policy cake WAN-OUT flow-isolation dual-src-host
set qos policy cake WAN-OUT rtt 100
set qos interface eth1 egress WAN-OUT

The block has a copy button. Nothing has been sent anywhere yet.

In the configuration tree#

System → Config tree browses the running configuration and renders any subtree the way the CLI would print it, through the router's own show configuration commands. So the commands are not the interface's opinion of your configuration; they are the router's.

There is a search over it, and the ⌘K palette indexes configuration objects as well as pages — a firewall rule, a DHCP reservation, a WireGuard peer, an interface, a route — so any object is reachable from anywhere in about two interactions.

In the working diff#

The Commit Bar's diff is not a rendering of the change; it is the commands. That is the same list the agent sends to /configure, spelled the way the CLI spells it.

The spelling is load-bearing and it is tested. A value containing a space is one argument only once it is quoted, so description WAN "primary" shown bare and committed quoted would mean the preview and the commit were different things. The renderer in the browser and the renderer in the agent are held to the same rule, with the reasoning written into both files (agent/staging.go, ui/src/lib/format.ts).

Where a command is all we can honestly give you#

Transparency also means saying here is the command, run it yourself when that is the truth.

Packet capture is not implemented. POST /api/capture answers 501, and the Diagnostics page shows the monitor traffic command instead of pretending to have started something. Until 2026-09-01 it claimed a capture had started; that was a bug, and fixing it meant removing the feature rather than the message.
Creating an app's volume directories off-router is impossible from another machine, so the Apps page hands back the exact mkdir -p line.
Building an OpenVPN instance waits on a generate pki flow that is not built. The page shows the commands and does not offer a form that would half-work.

The point#

The interface teaches the CLI rather than replacing it. An operator who reads Wheelhouse for a month can drive the console, and an operator who already drives the console can read Wheelhouse and know it is not lying. Both of those are worth more than a form that saves four keystrokes.

Read on#

The configuration model.
The wiki: CLI transparency and the Config tree page.