feat(proxy): single all-in-one binary by default (CLI + TUI + GUI + MCP)

Makefile

@@ -1,6 +1,6 @@
 SHELL := /bin/bash
 
-.PHONY: all engine engine-http3 engine-test proxy proxy-gui proxy-test platform-install python-check viz-test smoke docker clean help
+.PHONY: all engine engine-http3 engine-test proxy proxy-min proxy-test platform-install python-check viz-test smoke docker clean help
 
 all: engine ## Build the execution engine (default)
 
@@ -17,11 +17,11 @@ engine-http3: ## Build the engine with the HTTP/3 + QUIC transport enabled
 engine-test: ## Run the engine's unit tests
 	cd engine-rs && cargo test
 
-proxy: ## Build the intercepting proxy + MCP server -> proxy-rs/target/release/offat-proxy
+proxy: ## Build the all-in-one proxy binary (CLI + TUI + GUI + MCP) -> proxy-rs/target/release/offat-proxy
 	cd proxy-rs && cargo build --release
 
-proxy-gui: ## Build the intercepting proxy with the cross-platform desktop GUI (offat-proxy gui)
-	cd proxy-rs && cargo build --release --features gui
+proxy-min: ## Build a minimal proxy binary (no GUI/graphics or TLS-interception deps)
+	cd proxy-rs && cargo build --release --no-default-features
 
 proxy-test: ## Run the proxy's unit tests
 	cd proxy-rs && cargo test

docs/proxy.md

@@ -91,20 +91,19 @@ count. Press `/` to filter history with the same expression language the rules u
 `?` shows help, `q` quits. It reads the flow store read-only and never alters
 traffic.
 
-## Desktop GUI (cross-platform, opt-in)
+## Desktop GUI (cross-platform)
 
 ```bash
-cargo build --release --features gui
 offat-proxy gui --scope api.example.test
 ```
 
 A native window (egui/eframe) that runs on Linux, macOS and Windows, with the same
 live flow list, detail pane, scope/rule status and expression filter as the
-terminal UI, plus mouse selection. The GUI is an **opt-in build feature** so the
-default binary stays a lean, cross-platform CLI with no windowing dependencies —
-the CLI, the terminal UI (`tui`) and MCP all work everywhere without it. A build
-without the feature still recognises the `gui` command and tells you how to enable
-it.
+terminal UI, plus mouse selection. It ships in the default single binary alongside
+the CLI, terminal UI (`tui`) and MCP; the GUI's graphics libraries load only when
+you open the window, so the same binary still runs headless. For a minimal build
+without windowing/graphics dependencies, compile with `--no-default-features`; the
+`gui` command then explains how to re-enable it.
 
 ## Rules and filters (live block / allow / tag / match-replace)
 

proxy-rs/Cargo.toml

@@ -11,7 +11,10 @@ name = "offat-proxy"
 path = "src/main.rs"
 
 [features]
-default = ["mitm"]
+# The default build is the single, do-everything binary: CLI + terminal UI + GUI
+# + MCP. For a minimal headless binary with no TLS-interception or GUI/graphics
+# dependencies, build with `--no-default-features` (optionally `--features mitm`).
+default = ["mitm", "gui"]
 # TLS interception. Off by default at runtime (needs --mitm and an installed CA);
 # the feature only controls whether the rustls/rcgen code is compiled in.
 mitm = ["dep:rcgen", "dep:tokio-rustls", "dep:rustls", "dep:rustls-pemfile", "dep:ring", "dep:webpki-roots"]

proxy-rs/README.md

@@ -24,20 +24,21 @@ cargo build --release            # -> target/release/offat-proxy
 # or: make proxy   (from the repo root)
 ```
 
-The `mitm` feature (TLS interception) is on by default at build time but **off at
-runtime** until you pass `--mitm` and install the generated CA. Build without it
-(`--no-default-features`) for a capture-only proxy with a smaller surface.
+This produces **one binary with everything**: the CLI, the terminal UI (`tui`),
+the desktop GUI (`gui`) and the MCP server. It still runs fine on a headless
+server — the GUI's graphics libraries are only loaded if you actually open the
+window (`offat-proxy gui`).
 
-The desktop GUI is an **opt-in** feature so the default build stays a lean,
-cross-platform CLI with no windowing/graphics dependencies:
+Defaults enabled: `mitm` (TLS interception — compiled in, but **off at runtime**
+until you pass `--mitm` and install the CA) and `gui`. For a minimal binary with
+no TLS-interception or windowing/graphics dependencies:
 
 ```bash
-cargo build --release --features gui     # adds the `offat-proxy gui` window
+cargo build --release --no-default-features                 # CLI + tui + mcp only
+cargo build --release --no-default-features --features mitm # + TLS interception
+# or: make proxy-min
 ```
 
-Everything else — the CLI, the terminal UI, MCP — works the same on Linux, macOS
-and Windows without that feature.
-
 ## Use
 
 ### 1. Capture live traffic into a Bundle
@@ -173,18 +174,18 @@ rules engine (e.g. `status >= 500 && path contains "/api"`).
 Keys: `j`/`k` move, `Tab` switch focus, `/` filter, `c` clear, `g`/`G` first/last,
 `f`/`b` scroll detail, `?` help, `q` quit.
 
-### 6. Desktop GUI (cross-platform, opt-in)
+### 6. Desktop GUI (cross-platform)
 
 ```bash
-cargo build --release --features gui
 offat-proxy gui --scope api.example.test
 ```
 
 A native window (egui/eframe, runs on Linux, macOS and Windows) with the same live
 flow list, detail pane, scope/rule status and expression filter as the terminal
 UI, plus mouse selection. It reads the flow store read-only and never alters
-traffic. A build without the `gui` feature still accepts the `gui` command — it
-prints how to enable it and points you at `offat-proxy tui`.
+traffic. Included in the default build; a minimal build made with
+`--no-default-features` omits it, and then the `gui` command prints how to turn it
+back on and points you at `offat-proxy tui`.
 
 ### 7. TLS interception (optional)
 

proxy-rs/src/main.rs

@@ -304,8 +304,9 @@ async fn cmd_gui(cli: Cli) -> Result<()> {
     {
         let _ = cli;
         eprintln!(
-            "this build has no GUI. Rebuild with `cargo build --release --features gui`, \
-             or use `offat-proxy tui` for the cross-platform terminal UI."
+            "this is a minimal build without the GUI. The default build includes it \
+             (`cargo build --release`), or use `offat-proxy tui` for the cross-platform \
+             terminal UI."
         );
         Ok(())
     }