Merge branch 'main' into mdm_integration

# Conflicts:
#	client/cmd/up.go
#	client/embed/embed.go
#	client/ios/NetBirdSDK/client.go

client/ui/authsession/service.go

@@ -6,9 +6,11 @@ import (
 	"context"
 	"time"
 
+	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -58,10 +60,21 @@ func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (Exten
 		return ExtendStartResult{}, err
 	}
 
-	req := &proto.RequestExtendAuthSessionRequest{}
-	if p.Hint != "" {
-		h := p.Hint
-		req.Hint = &h
+	// a request from the UI implies a graphical session, which the daemon cannot detect itself
+	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
+	hint := p.Hint
+	if hint == "" {
+		pm := profilemanager.NewProfileManager()
+		if active, perr := pm.GetActiveProfile(); perr != nil {
+			log.Debugf("failed to get active profile for login hint: %v", perr)
+		} else if state, serr := pm.GetProfileState(active.ID); serr != nil {
+			log.Debugf("failed to get profile state for login hint: %v", serr)
+		} else {
+			hint = state.Email
+		}
+	}
+	if hint != "" {
+		req.Hint = &hint
 	}
 
 	resp, err := cli.RequestExtendAuthSession(ctx, req)

client/ui/frontend/package.json

@@ -15,7 +15,8 @@
     "lint": "eslint \"src/**/*.{ts,tsx}\"",
     "lint:fix": "eslint \"src/**/*.{ts,tsx}\" --fix",
     "check": "pnpm lint && pnpm typecheck && pnpm format:check",
-    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck"
+    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck",
+    "i18n:check": "node ../i18n/check-translations.mjs"
   },
   "dependencies": {
     "@radix-ui/react-dialog": "^1.1.15",

client/ui/frontend/src/components/ReadySignal.tsx

@@ -0,0 +1,18 @@
+import { useEffect, useRef } from "react";
+import { Events } from "@wailsio/runtime";
+import { useStatus } from "@/contexts/StatusContext.tsx";
+
+const EVENT_WINDOW_PAINTED = "netbird:window-painted";
+
+export const ReadySignal = () => {
+    const { isReady } = useStatus();
+    const sent = useRef(false);
+
+    useEffect(() => {
+        if (!isReady || sent.current) return;
+        sent.current = true;
+        void Events.Emit(EVENT_WINDOW_PAINTED);
+    }, [isReady]);
+
+    return null;
+};

client/ui/frontend/src/contexts/DebugBundleContext.tsx

@@ -71,10 +71,12 @@ type BundleOptions = {
     hasWindow: boolean;
     totalSec: number;
     uploadUrl: string;
-    anonymize: boolean;
+    anonymizeLevel: AnonymizeLevel;
     systemInfo: boolean;
 };
 
+export type AnonymizeLevel = "none" | "default" | "strict";
+
 const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
     try {
         // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
@@ -187,7 +189,10 @@ const runBundleFlow = async (
 
     if (opts.uploadUrl) setStage({ kind: "uploading" });
     const result = await DebugSvc.Bundle({
-        anonymize: opts.anonymize,
+        anonymize: opts.anonymizeLevel !== "none",
+        // The daemon only knows "default" and "strict"; "none" is expressed
+        // through the anonymize flag being off.
+        anonymizeLevel: opts.anonymizeLevel === "strict" ? "strict" : "default",
         systemInfo: opts.systemInfo,
         uploadUrl: opts.uploadUrl,
         logFileCount,
@@ -198,7 +203,7 @@ const runBundleFlow = async (
 };
 
 const useDebugBundle = () => {
-    const [anonymize, setAnonymize] = useState(false);
+    const [anonymizeLevel, setAnonymizeLevel] = useState<AnonymizeLevel>("none");
     const [systemInfo, setSystemInfo] = useState(true);
     const [upload, setUpload] = useState(true);
     const [trace, setTrace] = useState(true);
@@ -240,7 +245,7 @@ const useDebugBundle = () => {
             hasWindow: capture && totalSec > 0,
             totalSec,
             uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
-            anonymize,
+            anonymizeLevel,
             systemInfo,
         };
 
@@ -272,8 +277,8 @@ const useDebugBundle = () => {
     };
 
     return {
-        anonymize,
-        setAnonymize,
+        anonymizeLevel,
+        setAnonymizeLevel,
         systemInfo,
         setSystemInfo,
         upload,

client/ui/frontend/src/layouts/AppLayout.tsx

@@ -5,6 +5,7 @@ import { DebugBundleProvider } from "@/contexts/DebugBundleContext.tsx";
 import { ProfileProvider } from "@/contexts/ProfileContext.tsx";
 import { DialogProvider } from "@/contexts/DialogContext.tsx";
 import { RestrictionsProvider } from "@/contexts/RestrictionsContext.tsx";
+import { ReadySignal } from "@/components/ReadySignal.tsx";
 
 export const AppLayout = () => {
     return (
@@ -16,6 +17,7 @@ export const AppLayout = () => {
                             <DebugBundleProvider>
                                 <ClientVersionProvider>
                                     <Outlet />
+                                    <ReadySignal />
                                 </ClientVersionProvider>
                             </DebugBundleProvider>
                         </RestrictionsProvider>

client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx

@@ -1,6 +1,6 @@
 import { useId, type ReactNode } from "react";
 import { Trans, useTranslation } from "react-i18next";
-import { CircleCheckBig, FolderOpen, Loader2 } from "lucide-react";
+import { ChevronDown, CircleCheckBig, FolderOpen, Info, Loader2 } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
 import { Debug as DebugSvc } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
@@ -8,13 +8,22 @@ import { Button } from "@/components/buttons/Button";
 import { DialogActions } from "@/components/dialog/DialogActions";
 import { DialogDescription } from "@/components/dialog/DialogDescription";
 import { DialogHeading } from "@/components/dialog/DialogHeading";
+import {
+    DropdownMenu,
+    DropdownMenuContent,
+    DropdownMenuRadioGroup,
+    DropdownMenuRadioItem,
+    DropdownMenuTrigger,
+} from "@/components/DropdownMenu";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
 import HelpText from "@/components/typography/HelpText.tsx";
 import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { SquareIcon } from "@/components/SquareIcon";
+import { Tooltip } from "@/components/Tooltip";
+import { cn } from "@/lib/cn";
 import { formatRemaining } from "@/lib/formatters";
-import type { DebugStage } from "@/contexts/DebugBundleContext";
+import type { AnonymizeLevel, DebugStage } from "@/contexts/DebugBundleContext";
 import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
 import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
 
@@ -24,8 +33,8 @@ export function SettingsTroubleshooting() {
     const { t } = useTranslation();
     const durationId = useId();
     const {
-        anonymize,
-        setAnonymize,
+        anonymizeLevel,
+        setAnonymizeLevel,
         systemInfo,
         setSystemInfo,
         upload,
@@ -55,12 +64,71 @@ export function SettingsTroubleshooting() {
 
     return (
         <SectionGroup title={t("settings.troubleshooting.section.title")}>
-            <FancyToggleSwitch
-                value={anonymize}
-                onChange={setAnonymize}
-                label={t("settings.troubleshooting.anonymize.label")}
-                helpText={t("settings.troubleshooting.anonymize.help")}
-            />
+            <div className={"flex items-center justify-between gap-6"}>
+                <div className={"max-w-md flex-1"}>
+                    <Label as={"div"}>
+                        <span className={"inline-flex items-center gap-1.5"}>
+                            {t("settings.troubleshooting.anonymize.label")}
+                            <Tooltip
+                                content={
+                                    <div className={"max-w-xs whitespace-normal leading-relaxed"}>
+                                        {t("settings.troubleshooting.anonymize.info")}
+                                    </div>
+                                }
+                            >
+                                <Info
+                                    size={14}
+                                    aria-label={t("settings.troubleshooting.anonymize.label")}
+                                    className={"shrink-0 cursor-default text-nb-gray-400"}
+                                />
+                            </Tooltip>
+                        </span>
+                    </Label>
+                    <HelpText margin={false}>
+                        {t("settings.troubleshooting.anonymize.help")}
+                    </HelpText>
+                </div>
+                <div className={"shrink-0"}>
+                    <DropdownMenu>
+                        <DropdownMenuTrigger asChild>
+                            <button
+                                type={"button"}
+                                aria-label={t("settings.troubleshooting.anonymize.label")}
+                                className={cn(
+                                    "inline-flex h-[40px] min-w-[160px] items-center justify-between gap-2 px-3",
+                                    "rounded-md border bg-white dark:bg-nb-gray-900",
+                                    "border-neutral-200 dark:border-nb-gray-700",
+                                    "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                                    "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
+                                )}
+                            >
+                                {t(`settings.troubleshooting.anonymize.${anonymizeLevel}`)}
+                                <ChevronDown
+                                    size={16}
+                                    aria-hidden={"true"}
+                                    className={"shrink-0 text-nb-gray-200"}
+                                />
+                            </button>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent align={"end"} className={"min-w-[160px]"}>
+                            <DropdownMenuRadioGroup
+                                value={anonymizeLevel}
+                                onValueChange={(v) => setAnonymizeLevel(v as AnonymizeLevel)}
+                            >
+                                <DropdownMenuRadioItem value={"none"}>
+                                    {t("settings.troubleshooting.anonymize.none")}
+                                </DropdownMenuRadioItem>
+                                <DropdownMenuRadioItem value={"default"}>
+                                    {t("settings.troubleshooting.anonymize.default")}
+                                </DropdownMenuRadioItem>
+                                <DropdownMenuRadioItem value={"strict"}>
+                                    {t("settings.troubleshooting.anonymize.strict")}
+                                </DropdownMenuRadioItem>
+                            </DropdownMenuRadioGroup>
+                        </DropdownMenuContent>
+                    </DropdownMenu>
+                </div>
+            </div>
             <FancyToggleSwitch
                 value={systemInfo}
                 onChange={setSystemInfo}

client/ui/i18n/TRANSLATING.md

@@ -2,9 +2,24 @@
 
 A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
 
-**Drive an agent with:** *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* — or *"…and review the existing German translation."*
+**Translations are managed on Crowdin: <https://crowdin.com/project/netbird>.** Join the project, pick your language, and translate in the editor. Each string carries a context note (the `description` from the source file) telling you what it is and where it shows up, and the project's glossary, style guide, and QA checks mirror this document.
 
-> 💡 **The one habit that matters most:** read each key's `description` before translating it. Labels are terse and ambiguous on their own; the `description` tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+> 💡 **The one habit that matters most:** read each string's context before translating it. Labels are terse and ambiguous on their own; the context tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
+
+---
+
+## How contributions flow
+
+```text
+i18n/locales/en/common.json ──sync──▶ Crowdin ──service PR──▶ i18n/locales/<code>/common.json
+```
+
+- `i18n/locales/en/common.json` is the source of truth. New and changed strings sync to Crowdin automatically (see `crowdin.yml` in the repository root).
+- Crowdin opens and updates a service pull request with the translated bundles, keeping the source's file shape and key order. Keys nobody has translated yet are left out of the export; the app falls back to English for them at runtime. Maintainers review and merge that PR.
+- Don't hand-edit `i18n/locales/<code>/common.json` in your own PRs: the next sync would conflict with or overwrite your changes. Translate on Crowdin instead.
+- Missing your language? Request it on the Crowdin project page or in a [GitHub discussion](https://github.com/netbirdio/netbird/discussions). When a language first ships, a maintainer adds its row to `i18n/locales/_index.json` with `code`, `displayName` (the native name), and `englishName`, which puts it in the app's language picker.
+
+**Prefer translating with an AI agent?** That still works: drive it with *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* as before, but deliver the result to Crowdin instead of a pull request. Download your language's file from the Crowdin editor, let the agent translate it, and upload it back (the editor's offline translation flow). Crowdin runs its QA checks on upload, and the next service PR carries the strings into the repo.
 
 ---
 
@@ -30,25 +45,6 @@ A **business zero-trust VPN** — an encrypted **overlay mesh** between a compan
 
 ---
 
-## The files
-
-```
-i18n/locales/_index.json         shipped-language list
-i18n/locales/en/common.json      source of truth — message + description
-i18n/locales/<code>/common.json  a target — message only
-```
-
-Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
-
-| ✅ Do | ❌ Don't |
-|---|---|
-| Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |
-| Put **only `message`** in target bundles | Copy `description` into a target bundle |
-| Give every key a non-empty `message` | Leave keys missing or empty |
-| Save valid UTF-8 JSON, no BOM | Add trailing commas or break the JSON |
-
----
-
 ## Hard rules — get these exactly right
 
 These are the usual ways a translation *breaks the app*, not just reads oddly.
@@ -58,7 +54,7 @@ These are the usual ways a translation *breaks the app*, not just reads oddly.
 | Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
 | Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
 | Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
-| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the description flags |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the context flags |
 
 **Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
 
@@ -78,13 +74,15 @@ When a brand sits beside a common noun, keep its exact spelling but join them th
 
 > **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
 
-Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing bundles:** match how a term was already rendered for your language rather than re-deciding it.
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing translation:** match how a term was already rendered for your language rather than re-deciding it.
 
 Two checks before you commit a term:
 
 - **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
 - **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
 
+These tiers are mirrored in the Crowdin project glossary, so the editor highlights them inline. When you settle a new Tier C term for your language, add its translation to the glossary entry so it sticks for everyone who comes after you.
+
 ---
 
 ## Style
@@ -98,7 +96,7 @@ Two checks before you commit a term:
 
 Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
 
-A few habits that keep a bundle reading like one product rather than a word-for-word port:
+A few habits that keep a translation reading like one product rather than a word-for-word port:
 
 - **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
 - **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
@@ -107,27 +105,26 @@ A few habits that keep a bundle reading like one product rather than a word-for-
 
 ---
 
-## Procedure
+## Reviewing a language
 
-**New language** — read `en/common.json` *with* descriptions → settle your Tier C terms → write `i18n/locales/<code>/common.json` (same keys and order as `en`, `message` only, placeholders & brands preserved) → add a row to `_index.json` (`{"code","displayName"` = native name`,"englishName"}`) → run the QA list. Use the locale-code style the existing entries use (e.g. `fr`, `pt`, `zh-CN`).
+**On Crowdin:** proofread in the editor — context, glossary highlights, and QA flags sit inline next to each string.
 
-**Review (de / hu / …)** — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Fix in place, then report what you changed (especially term standardizations) so a native speaker can sanity-check.
+**In the repo** — e.g. driving an AI agent with *"Read `i18n/TRANSLATING.md` and review the existing German translation"* — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Report what you found, and apply the fixes **on Crowdin** — direct edits to the locale files are overwritten by the next sync.
 
 ---
 
 ## QA before you finish
 
-- [ ] Valid JSON · **every `en` key** present, same order · **no `description`** fields
 - [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
-- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing bundle for your language)
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing translation for your language)
 - [ ] Buttons & tray short · locale punctuation and capitalization applied
-- [ ] New language added to `_index.json`
+- [ ] Crowdin QA flags resolved (variables, glossary terms, punctuation)
 - [ ] **Tested in the running app** ↓
 
 ---
 
 ## Test it in the app
 
-A bundle can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+A translation can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
 
 How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.

client/ui/i18n/check-translations.mjs

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+// Validates that every shipped translation bundle carries exactly the same set
+// of keys as the English source of truth. English (en) defines the keys; every
+// other locale declared in _index.json must match it 1:1:
+//
+//   - no missing keys — a missing key silently falls back to English at runtime
+//     (see i18n bundle fallback), so the gap never surfaces to users or CI
+//     without this check;
+//   - no orphaned keys — keys left behind after an English key is renamed or
+//     removed are dead weight and a sign the locale is drifting.
+//
+// Pure Node, no dependencies, so it runs without installing the frontend
+// toolchain.
+//
+//   Local:  node client/ui/i18n/check-translations.mjs   (or: pnpm i18n:check)
+//   CI:     .github/workflows/ui-translations.yml
+
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SOURCE = "en";
+const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
+const isCI = Boolean(process.env.GITHUB_ACTIONS);
+
+function readJSON(path) {
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function keysOf(langCode) {
+    return Object.keys(readJSON(join(localesDir, langCode, "common.json")));
+}
+
+// Emit a GitHub Actions annotation so failures render inline on the PR diff.
+function annotate(file, message) {
+    if (isCI) console.log(`::error file=${file}::${message}`);
+}
+
+const index = readJSON(join(localesDir, "_index.json"));
+const declared = index.languages.map((l) => l.code);
+
+if (!declared.includes(SOURCE)) {
+    console.error(`FATAL: source language "${SOURCE}" is not declared in _index.json`);
+    process.exit(1);
+}
+
+const sourceKeys = keysOf(SOURCE);
+const sourceSet = new Set(sourceKeys);
+console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
+
+let failed = false;
+
+for (const code of declared) {
+    if (code === SOURCE) continue;
+    const file = `client/ui/i18n/locales/${code}/common.json`;
+
+    let keys;
+    try {
+        keys = keysOf(code);
+    } catch (e) {
+        failed = true;
+        const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
+        console.error(`✗ ${code}: ${msg}`);
+        annotate("client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
+        continue;
+    }
+
+    const set = new Set(keys);
+    const missing = sourceKeys.filter((k) => !set.has(k));
+    const extra = keys.filter((k) => !sourceSet.has(k));
+
+    if (missing.length === 0 && extra.length === 0) {
+        console.log(`✓ ${code}: ${keys.length} keys`);
+        continue;
+    }
+
+    failed = true;
+    console.error(`✗ ${code}: ${keys.length} keys (expected ${sourceKeys.length})`);
+    if (missing.length) {
+        console.error(`    missing ${missing.length}: ${missing.join(", ")}`);
+        annotate(file, `Missing ${missing.length} key(s) present in ${SOURCE}: ${missing.join(", ")}`);
+    }
+    if (extra.length) {
+        console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
+        annotate(file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
+    }
+}
+
+// Locale directories present on disk but not declared in _index.json are never
+// loaded by the app — surface them so dead translation files don't rot silently.
+const onDisk = readdirSync(localesDir, { withFileTypes: true })
+    .filter((e) => e.isDirectory())
+    .map((e) => e.name);
+const undeclared = onDisk.filter((d) => !declared.includes(d));
+if (undeclared.length) {
+    console.warn(`\n⚠ locale directories not declared in _index.json (not shipped): ${undeclared.join(", ")}`);
+}
+
+console.log();
+if (failed) {
+    console.error("Translation check FAILED — every locale must match the English key set.");
+    process.exit(1);
+}
+console.log("Translation check passed — all locales match the English key set.");

client/ui/i18n/locales/de/common.json

@@ -764,7 +764,19 @@
         "message": "Sensible Informationen anonymisieren"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Versteckt öffentliche IP-Adressen und nicht-NetBird-Domains in Logs."
+        "message": "Verbirgt IP-Adressen, Domains und andere sensible Werte."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Der Standardmodus lässt interne IPv4-Adressen und Peer-Namen für den Support lesbar. Der strikte Modus anonymisiert zusätzlich private (RFC 1918), CGNAT- und Link-Local-IP-Adressen, Peer-Namen und öffentliche WireGuard-Schlüssel. Wiederkehrende Werte erhalten denselben Platzhalter, sodass Peers unterscheidbar bleiben. Verwenden Sie den strikten Modus, wenn Sie das Debug-Paket außerhalb Ihrer Organisation weitergeben."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Keine"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Standard"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strikt"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Systeminformationen einschließen"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Vorgang fehlgeschlagen."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Erfordert {actor}. Führen Sie stattdessen dies aus:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Sie können dies deaktivieren, aber zum erneuten Aktivieren sind {actor} erforderlich:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Sie können dies aktivieren, aber zum erneuten Deaktivieren sind {actor} erforderlich:"
     }
 }

client/ui/i18n/locales/en/common.json

@@ -1013,11 +1013,27 @@
     },
     "settings.troubleshooting.anonymize.label": {
         "message": "Anonymize Sensitive Information",
-        "description": "Toggle label: anonymize sensitive information in the bundle."
+        "description": "Label for the anonymization level dropdown (None, Default, Strict)."
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Hides public IP addresses and non-NetBird domains from logs.",
-        "description": "Helper text for anonymizing logs (hides public IPs and non-NetBird domains)."
+        "message": "Hides IP addresses, domains, and other sensitive values.",
+        "description": "Helper text under the anonymization dropdown. The level details live in the info tooltip."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Default keeps internal IPv4 addresses and peer names readable for support. Strict additionally anonymizes private (RFC 1918), CGNAT, and link-local IP addresses, peer names, and WireGuard public keys. Recurring values map to the same placeholder, so peers stay distinguishable. Use Strict when sharing the bundle outside your organization.",
+        "description": "Info tooltip explaining the anonymization levels. 'RFC 1918', 'CGNAT', 'link-local', and 'WireGuard' are technical terms — keep them."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "None",
+        "description": "Dropdown option: no anonymization."
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Default",
+        "description": "Dropdown option: default anonymization level."
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strict",
+        "description": "Dropdown option: strict anonymization level."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Include System Information",

client/ui/i18n/locales/es/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizar información sensible"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta las direcciones IP públicas y los dominios ajenos a NetBird de los registros."
+        "message": "Oculta direcciones IP, dominios y otros valores sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "El modo predeterminado mantiene legibles las direcciones IPv4 internas y los nombres de los peers para el soporte. El modo estricto anonimiza además las direcciones IP privadas (RFC 1918), CGNAT y de enlace local, los nombres de los peers y las claves públicas de WireGuard. Los valores recurrentes se asignan al mismo marcador de posición, por lo que los peers siguen siendo distinguibles. Use el modo estricto cuando comparta el paquete de diagnóstico fuera de su organización."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Ninguno"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predeterminado"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estricto"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir información del sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "La operación falló."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requiere {actor}. Ejecute esto en su lugar:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Puede desactivarlo, pero volver a activarlo requiere {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Puede activarlo, pero volver a desactivarlo requiere {actor}:"
     }
 }

client/ui/i18n/locales/fr/common.json

@@ -764,7 +764,19 @@
         "message": "Anonymiser les informations sensibles"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Masque les adresses IP publiques et les domaines non-NetBird dans les journaux."
+        "message": "Masque les adresses IP, les domaines et d'autres valeurs sensibles."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Le mode par défaut garde les adresses IPv4 internes et les noms des pairs lisibles pour le support. Le mode strict anonymise en plus les adresses IP privées (RFC 1918), CGNAT et de lien local, les noms des pairs et les clés publiques WireGuard. Les valeurs récurrentes reçoivent le même espace réservé, les pairs restent donc distinguables. Utilisez le mode strict lorsque vous partagez le lot de diagnostic en dehors de votre organisation."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Aucune"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Par défaut"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Strict"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Inclure les informations système"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "L’opération a échoué."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Nécessite {actor}. Exécutez plutôt ceci :"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Vous pouvez le désactiver, mais le réactiver nécessite {actor} :"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Vous pouvez l’activer, mais le désactiver de nouveau nécessite {actor} :"
     }
 }

client/ui/i18n/locales/hu/common.json

@@ -764,7 +764,19 @@
         "message": "Érzékeny információk anonimizálása"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Elrejti a nyilvános IP-címeket és a nem-NetBird tartományokat a naplókban."
+        "message": "Elrejti az IP-címeket, a tartományokat és más érzékeny értékeket."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Az Alapértelmezett szint a belső IPv4-címeket és a peer-neveket olvashatóan hagyja a támogatás számára. A Szigorú ezen felül anonimizálja a privát (RFC 1918), CGNAT és link-local IP-címeket, a peer-neveket és a WireGuard nyilvános kulcsokat. Az ismétlődő értékek ugyanazt a helyettesítőt kapják, így a peerek megkülönböztethetők maradnak. Használja a Szigorú szintet, ha a hibakeresési csomagot a szervezetén kívül osztja meg."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nincs"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Alapértelmezett"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Szigorú"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Rendszerinformációk beillesztése"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "A művelet meghiúsult."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor} szükséges hozzá. Futtassa inkább ezt:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Kikapcsolhatja, de a visszakapcsolásához {actor} szükséges:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Bekapcsolhatja, de az ismételt kikapcsolásához {actor} szükséges:"
     }
 }

client/ui/i18n/locales/it/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizza informazioni sensibili"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Nasconde gli indirizzi IP pubblici e i domini non NetBird dai log."
+        "message": "Nasconde indirizzi IP, domini e altri valori sensibili."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "La modalità predefinita mantiene leggibili gli indirizzi IPv4 interni e i nomi dei peer per il supporto. La modalità rigorosa anonimizza inoltre gli indirizzi IP privati (RFC 1918), CGNAT e link-local, i nomi dei peer e le chiavi pubbliche WireGuard. I valori ricorrenti vengono associati allo stesso segnaposto, quindi i peer restano distinguibili. Usa la modalità rigorosa quando condividi il pacchetto di debug al di fuori della tua organizzazione."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nessuna"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Predefinito"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Rigoroso"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Includi informazioni di sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Operazione non riuscita."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Richiede {actor}. Esegua invece questo:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Può disabilitarlo, ma riabilitarlo richiede {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Può abilitarlo, ma disabilitarlo di nuovo richiede {actor}:"
     }
 }

client/ui/i18n/locales/ja/common.json

@@ -764,7 +764,19 @@
         "message": "機密情報を匿名化"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "ログからパブリック IP アドレスと NetBird 以外のドメインを隠します。"
+        "message": "IP アドレス、ドメイン、その他の機密性の高い値を隠します。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "「デフォルト」では、サポートのために内部 IPv4 アドレスとピア名は読める状態のまま残ります。「厳格」では、さらにプライベート (RFC 1918)、CGNAT、リンクローカルの IP アドレス、ピア名、WireGuard 公開鍵も匿名化されます。繰り返し現れる値は同じプレースホルダーに置き換えられるため、ピアは区別できます。デバッグバンドルを組織外に共有する場合は「厳格」を使用してください。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "なし"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "デフォルト"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "厳格"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "システム情報を含める"
@@ -1312,6 +1324,9 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
+    "daemon.outdated.download": {
+        "message": "最新版をダウンロード"
+    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },
@@ -1335,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "操作に失敗しました。"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "{actor}が必要です。代わりに次のコマンドを実行してください:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "無効にはできますが、再度有効にするには{actor}が必要です:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "有効にはできますが、再度無効にするには{actor}が必要です:"
     }
 }

client/ui/i18n/locales/pt/common.json

@@ -764,7 +764,19 @@
         "message": "Anonimizar informações sensíveis"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Oculta endereços IP públicos e domínios que não são do NetBird nos logs."
+        "message": "Oculta endereços IP, domínios e outros valores sensíveis."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "O modo padrão mantém os endereços IPv4 internos e os nomes dos peers legíveis para o suporte. O modo estrito anonimiza também os endereços IP privados (RFC 1918), CGNAT e link-local, os nomes dos peers e as chaves públicas do WireGuard. Valores recorrentes recebem o mesmo marcador, então os peers continuam distinguíveis. Use o modo estrito ao compartilhar o pacote de depuração fora da sua organização."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Nenhum"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "Padrão"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Estrito"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Incluir informações do sistema"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "A operação falhou."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Requer {actor}. Execute isto em vez disso:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Você pode desativar isto, mas ativar novamente requer {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Você pode ativar isto, mas desativar novamente requer {actor}:"
     }
 }

client/ui/i18n/locales/ru/common.json

@@ -764,7 +764,19 @@
         "message": "Анонимизировать конфиденциальную информацию"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Скрывает публичные IP-адреса и сторонние (не относящиеся к NetBird) домены в журналах."
+        "message": "Скрывает IP-адреса, домены и другие конфиденциальные значения."
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "Режим «По умолчанию» оставляет внутренние IPv4-адреса и имена пиров читаемыми для поддержки. Режим «Строгий» дополнительно анонимизирует частные (RFC 1918), CGNAT и link-local IP-адреса, имена пиров и публичные ключи WireGuard. Повторяющиеся значения заменяются одним и тем же заполнителем, поэтому пиры остаются различимыми. Используйте режим «Строгий», когда передаёте отладочный пакет за пределы вашей организации."
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "Нет"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "По умолчанию"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "Строгий"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Включить сведения о системе"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "Не удалось выполнить операцию."
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "Требуются {actor}. Выполните вместо этого:"
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "Отключить можно, но чтобы включить снова, нужны {actor}:"
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "Включить можно, но чтобы отключить снова, нужны {actor}:"
     }
 }

client/ui/i18n/locales/zh-CN/common.json

@@ -764,7 +764,19 @@
         "message": "匿名化敏感信息"
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "从日志中隐藏公共 IP 地址和非 NetBird 域名。"
+        "message": "隐藏 IP 地址、域名和其他敏感值。"
+    },
+    "settings.troubleshooting.anonymize.info": {
+        "message": "默认级别保留内部 IPv4 地址和对等节点名称，便于支持人员阅读。严格级别还会匿名化私有 (RFC 1918)、CGNAT 和链路本地 IP 地址、对等节点名称以及 WireGuard 公钥。相同的值会映射到相同的占位符，因此对等节点仍可区分。向组织外部分享调试包时请使用严格级别。"
+    },
+    "settings.troubleshooting.anonymize.none": {
+        "message": "无"
+    },
+    "settings.troubleshooting.anonymize.default": {
+        "message": "默认"
+    },
+    "settings.troubleshooting.anonymize.strict": {
+        "message": "严格"
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "包含系统信息"
@@ -1338,5 +1350,14 @@
     },
     "error.unknown": {
         "message": "操作失败。"
+    },
+    "settings.ssh.privilege.hint": {
+        "message": "需要{actor}。请改为运行："
+    },
+    "settings.ssh.privilege.oneWay": {
+        "message": "您可以关闭此项，但重新开启需要{actor}："
+    },
+    "settings.ssh.privilege.oneWayInverted": {
+        "message": "您可以开启此项，但再次关闭需要{actor}："
     }
 }

client/ui/main.go

@@ -139,13 +139,11 @@ func main() {
 		prefStore:       prefStore,
 	})
 
-	window := newMainWindow(app, prefStore)
-
-	// Settings is created eagerly (hidden) so the first gear click paints
-	// instantly and React keeps per-tab state across reopens. The other
-	// auxiliary windows stay lazy + destroy-on-close so Wails's macOS
-	// dock-reopen handler can't resurrect them.
-	windowManager := services.NewWindowManager(app, window, bundle, prefStore, iconWindow)
+	windowManager := services.NewWindowManager(app, nil, bundle, prefStore, iconWindow)
+	windowManager.SetMainFactory(func(startURL string) *application.WebviewWindow {
+		return newMainWindow(app, prefStore, windowManager, startURL)
+	})
+	registerDockReopenHook(app, windowManager)
 	// Minimal WMs (XEmbed-tray path) neither center small windows nor restore
 	// position across hide -> show, dropping them top-left. Gate Go-side
 	// re-centering on that environment; nil leaves placement to the WM on full
@@ -168,7 +166,7 @@ func main() {
 	// RegisterStatusNotifierItem hits a watcher we control.
 	startStatusNotifierWatcher()
 
-	tray = NewTray(app, window, TrayServices{
+	tray = NewTray(app, nil, TrayServices{
 		Connection:      connection,
 		Settings:        settings,
 		Profiles:        profiles,
@@ -279,10 +277,12 @@ func newApplication(onSecondInstance func()) *application.App {
 			ActivationPolicy: application.ActivationPolicyAccessory,
 		},
 		Linux: application.LinuxOptions{
-			ProgramName: "netbird",
+			ProgramName:                   "netbird",
+			DisableQuitOnLastWindowClosed: true,
 		},
 		Windows: application.WindowsOptions{
-			WndProcInterceptor: endSessionInterceptor(),
+			WndProcInterceptor:            endSessionInterceptor(),
+			DisableQuitOnLastWindowClosed: true,
 		},
 		SingleInstance: &application.SingleInstanceOptions{
 			UniqueID: "io.netbird.ui",
@@ -338,9 +338,7 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(s.compat))
 }
 
-// newMainWindow creates the hidden main window, sized to the user's last view
-// mode, and installs the hide-on-close and macOS dock-reopen hooks.
-func newMainWindow(app *application.App, prefStore *preferences.Store) *application.WebviewWindow {
+func newMainWindow(app *application.App, prefStore *preferences.Store, wm *services.WindowManager, startURL string) *application.WebviewWindow {
 	// Width matches the last view mode so Advanced-mode users don't see the
 	// window pop from 380px to 900px on launch. Height is mode-agnostic.
 	initialWidth := 380
@@ -357,7 +355,7 @@ func newMainWindow(app *application.App, prefStore *preferences.Store) *applicat
 		InitialPosition:     application.WindowCentered,
 		Hidden:              true,
 		BackgroundColour:    services.WindowBackgroundColour,
-		URL:                 "/",
+		URL:                 startURL,
 		DisableResize:       true,
 		MinimiseButtonState: application.ButtonHidden,
 		MaximiseButtonState: application.ButtonHidden,
@@ -368,29 +366,25 @@ func newMainWindow(app *application.App, prefStore *preferences.Store) *applicat
 		},
 	})
 
-	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
-	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+	window.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
 		if services.ShuttingDown() {
 			return
 		}
-		e.Cancel()
-		window.Hide()
+		wm.ForgetMain()
 	})
 
-	// On macOS, Wails' default applicationShouldHandleReopen handler Show()s
-	// every hidden window on dock-icon click, resurrecting hide-on-close
-	// surfaces like Settings. Cancel it in a hook (hooks run before listeners)
-	// and show only the main window. No-op elsewhere — the event never fires.
-	if runtime.GOOS == "darwin" {
-		app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
-			e.Cancel()
-			if e.Context().HasVisibleWindows() {
-				return
-			}
-			window.Show()
-			window.Focus()
-		})
-	}
-
 	return window
 }
+
+func registerDockReopenHook(app *application.App, wm *services.WindowManager) {
+	if runtime.GOOS != "darwin" {
+		return
+	}
+	app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
+		if e.Context().HasVisibleWindows() {
+			return
+		}
+		e.Cancel()
+		wm.ShowMain()
+	})
+}

client/ui/services/connection.go

@@ -108,10 +108,11 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}
 
 	req := &proto.LoginRequest{
-		ManagementUrl:       p.ManagementURL,
-		SetupKey:            p.SetupKey,
-		Hostname:            p.Hostname,
-		IsUnixDesktopClient: runtime.GOOS == "linux",
+		ManagementUrl: p.ManagementURL,
+		SetupKey:      p.SetupKey,
+		Hostname:      p.Hostname,
+		// a login driven by the UI always has a graphical session available
+		IsUnixDesktopClient: true,
 	}
 	if profileName != "" {
 		req.ProfileName = ptrStr(profileName)
@@ -122,8 +123,16 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	if p.PreSharedKey != "" {
 		req.OptionalPreSharedKey = ptrStr(p.PreSharedKey)
 	}
-	if p.Hint != "" {
-		req.Hint = ptrStr(p.Hint)
+	hint := p.Hint
+	if hint == "" && profileID != "" {
+		if state, serr := profilemanager.NewProfileManager().GetProfileState(profilemanager.ID(profileID)); serr == nil {
+			hint = state.Email
+		} else {
+			log.Debugf("failed to get profile state for login hint: %v", serr)
+		}
+	}
+	if hint != "" {
+		req.Hint = ptrStr(hint)
 	}
 
 	resp, err := cli.Login(ctx, req)
@@ -227,16 +236,6 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 		return s.classifyDaemonError(err)
 	}
 
-	// The daemon runs as root and can't reach the user-owned per-profile state
-	// file holding the account email (see Profiles.List), so clear the stale
-	// email here; the next SSO login recreates it.
-	if p.ProfileName != "" {
-		if err := profilemanager.NewProfileManager().RemoveProfileState(p.ProfileName); err != nil {
-			// Non-fatal: the logout itself succeeded.
-			log.Warnf("failed to remove profile state for %s: %v", p.ProfileName, err)
-		}
-	}
-
 	return nil
 }
 
@@ -260,7 +259,7 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 
 	// Persist the account email the same way the CLI does after its own
 	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Logout below).
+	// root and the per-profile state file is user-owned (see Profiles.List).
 	// Without this the profile has no email, so Profiles.List shows no account
 	// and later logins and session extends go out without a login_hint —
 	// leaving the IdP to guess which account was meant.

client/ui/services/debug.go

@@ -15,10 +15,13 @@ import (
 )
 
 type DebugBundleParams struct {
-	Anonymize    bool   `json:"anonymize"`
-	SystemInfo   bool   `json:"systemInfo"`
-	UploadURL    string `json:"uploadUrl"`
-	LogFileCount uint32 `json:"logFileCount"`
+	Anonymize bool `json:"anonymize"`
+	// AnonymizeLevel is "default" or "strict"; strict also anonymizes
+	// private IP ranges, peer names, and WireGuard public keys.
+	AnonymizeLevel string `json:"anonymizeLevel"`
+	SystemInfo     bool   `json:"systemInfo"`
+	UploadURL      string `json:"uploadUrl"`
+	LogFileCount   uint32 `json:"logFileCount"`
 }
 
 // DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
@@ -48,11 +51,12 @@ func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleRes
 		return DebugBundleResult{}, err
 	}
 	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
-		Anonymize:    p.Anonymize,
-		SystemInfo:   p.SystemInfo,
-		UploadURL:    p.UploadURL,
-		LogFileCount: p.LogFileCount,
-		CliVersion:   version.NetbirdVersion(),
+		Anonymize:      p.Anonymize,
+		AnonymizeLevel: p.AnonymizeLevel,
+		SystemInfo:     p.SystemInfo,
+		UploadURL:      p.UploadURL,
+		LogFileCount:   p.LogFileCount,
+		CliVersion:     version.NetbirdVersion(),
 	})
 	if err != nil {
 		return DebugBundleResult{}, err

client/ui/services/profile.go

@@ -162,8 +162,9 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	}
 
 	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind (same split as
-	// Connection.Logout). Legacy profiles are keyed by name rather than by a
+	// user-owned state file holding the account email behind. Logout keeps the
+	// email on purpose so later logins can pass it as the login_hint; profile
+	// removal is what deletes it. Legacy profiles are keyed by name rather than by a
 	// generated ID, so a recreated profile of the same name would inherit the
 	// deleted one's email and offer it as the login_hint.
 	//

client/ui/services/windowmanager.go

@@ -8,6 +8,7 @@ import (
 	"sync"
 	"time"
 
+	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
 
@@ -29,6 +30,12 @@ const EventBrowserLoginCancel = "browser-login:cancel"
 // EventSettingsOpen tells the mounted settings window which tab to show.
 const EventSettingsOpen = "netbird:settings:open"
 
+const EventWindowPainted = "netbird:window-painted"
+
+const paintedFallback = 2 * time.Second
+
+const headlessTeardownDelay = 2 * time.Second
+
 var WindowBackgroundColour = application.NewRGB(24, 26, 29) // bg-nb-gray-950
 
 // WindowHeight is shared by the main and Settings windows.
@@ -94,9 +101,6 @@ func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.
 	}
 }
 
-// WindowManager owns the auxiliary windows (main is created in main.go). Settings is created
-// eagerly and hidden on close to keep React state; the rest are created on open, destroyed on
-// close, so the macOS dock-reopen handler finds no hidden window to resurrect.
 type WindowManager struct {
 	app               *application.App
 	mainWindow        *application.WebviewWindow
@@ -112,15 +116,35 @@ type WindowManager struct {
 	// hiddenForLogin holds windows hidden while the BrowserLogin popup is open, restored on close.
 	hiddenForLogin []application.Window
 	mu             sync.Mutex
+	createMu       sync.Mutex
+	newMain        func(startURL string) *application.WebviewWindow
+	ready          map[uint]bool
+	showPending    map[uint]bool
+	pendingTab     map[uint]string
+	pendingEmits   map[uint][]string
+	fallbackTimers map[uint]*time.Timer
+	headlessMain   bool
+	headlessTimer  *time.Timer
 	// recenterOnShow is set only on the minimal-WM/XEmbed path, where the WM neither centers nor
 	// restores position; nil on full desktops so re-centering can't fight a user-moved window.
 	recenterOnShow func() bool
 }
 
-// NewWindowManager wires the manager to the main app; translator/prefs may be nil (tests). The
-// Settings window is created here (hidden) so the first OpenSettings is instant.
 func NewWindowManager(app *application.App, mainWindow *application.WebviewWindow, translator ErrorTranslator, prefs LanguagePreference, linuxIcon []byte) *WindowManager {
-	s := &WindowManager{app: app, mainWindow: mainWindow, translator: translator, prefs: prefs, linuxIcon: linuxIcon}
+	s := &WindowManager{
+		app:            app,
+		mainWindow:     mainWindow,
+		translator:     translator,
+		prefs:          prefs,
+		linuxIcon:      linuxIcon,
+		ready:          map[uint]bool{},
+		showPending:    map[uint]bool{},
+		pendingTab:     map[uint]string{},
+		pendingEmits:   map[uint][]string{},
+		fallbackTimers: map[uint]*time.Timer{},
+	}
+	s.watchPainted()
+	s.watchTriggerLogin()
 	// Re-title live windows on language flip. Wired internally so the binding generator
 	// doesn't try to expose the interface param.
 	if sub, ok := prefs.(LanguageSubscriber); ok && sub != nil {
@@ -136,7 +160,11 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 			}
 		}()
 	}
-	s.settings = app.Window.NewWithOptions(application.WebviewWindowOptions{
+	return s
+}
+
+func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
+	w := s.app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Name:                "settings",
 		Title:               s.title("window.title.settings"),
 		Width:               900,
@@ -150,18 +178,15 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 		URL:                 "/#/settings",
 		Mac:                 AppleMacOSAppearanceOptions(),
 		Windows:             MicrosoftWindowsAppearanceOptions(),
-		Linux:               LinuxAppearanceOptions(linuxIcon),
+		Linux:               LinuxAppearanceOptions(s.linuxIcon),
 	})
-	// Hide (not destroy) on close to keep React state; reset to General for a flash-free reopen.
-	s.settings.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
-		if ShuttingDown() {
-			return
-		}
-		e.Cancel()
-		s.app.Event.Emit(EventSettingsOpen, "general")
-		s.settings.Hide()
+	w.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+		s.mu.Lock()
+		s.settings = nil
+		s.forgetWindowLocked(w)
+		s.mu.Unlock()
 	})
-	return s
+	return w
 }
 
 // OpenSettings shows the settings window on tab (empty → General), switching tab via
@@ -171,11 +196,20 @@ func (s *WindowManager) OpenSettings(tab string) {
 	if target == "" {
 		target = "general"
 	}
-	s.app.Event.Emit(EventSettingsOpen, target)
-	s.settings.Show()
-	s.settings.Focus()
-	// Re-center (minimal-WM only; see centerWhenReady).
-	s.centerWhenReady(s.settings)
+
+	w, _ := s.ensureWindow(&s.settings, s.newSettingsWindow)
+
+	s.mu.Lock()
+	ready := s.ready[w.ID()]
+	if !ready {
+		s.pendingTab[w.ID()] = target
+	}
+	s.mu.Unlock()
+
+	if ready {
+		s.app.Event.Emit(EventSettingsOpen, target)
+	}
+	s.showWhenReady(w)
 }
 
 // OpenBrowserLogin shows the SSO popup, creating it on first use.
@@ -440,13 +474,295 @@ func (s *WindowManager) OpenMain() {
 // ShowMain brings the main window forward (re-centering on minimal WMs). The single entry
 // point every surface (tray, SIGUSR1, welcome) should use so centering applies uniformly.
 func (s *WindowManager) ShowMain() {
-	if s.mainWindow == nil {
+	s.showWhenReady(s.MainWindow())
+}
+
+// ShowMainAndEmit brings the main window forward and emits event once its frontend is ready.
+func (s *WindowManager) ShowMainAndEmit(event string) {
+	w := s.MainWindow()
+	if w == nil {
 		return
 	}
-	s.mainWindow.Show()
-	s.mainWindow.Focus()
-	// Re-center (minimal-WM only; see centerWhenReady).
-	s.centerWhenReady(s.mainWindow)
+
+	id := w.ID()
+	s.mu.Lock()
+	ready := s.ready[id]
+	if !ready {
+		s.pendingEmits[id] = append(s.pendingEmits[id], event)
+	}
+	s.mu.Unlock()
+
+	s.showWhenReady(w)
+	if ready {
+		s.app.Event.Emit(event)
+	}
+}
+
+func (s *WindowManager) MainWindow() *application.WebviewWindow {
+	w, _ := s.ensureMain("/")
+	return w
+}
+
+func (s *WindowManager) ensureMain(startURL string) (*application.WebviewWindow, bool) {
+	s.mu.Lock()
+	factory := s.newMain
+	s.mu.Unlock()
+	if factory == nil {
+		return s.ensureWindow(&s.mainWindow, nil)
+	}
+	return s.ensureWindow(&s.mainWindow, func() *application.WebviewWindow {
+		return factory(startURL)
+	})
+}
+
+func (s *WindowManager) ensureWindow(slot **application.WebviewWindow, factory func() *application.WebviewWindow) (*application.WebviewWindow, bool) {
+	s.createMu.Lock()
+	defer s.createMu.Unlock()
+
+	s.mu.Lock()
+	w := *slot
+	s.mu.Unlock()
+	if w != nil || factory == nil {
+		return w, false
+	}
+
+	w = factory()
+	s.armReady(w)
+
+	s.mu.Lock()
+	*slot = w
+	s.mu.Unlock()
+	return w, true
+}
+
+func (s *WindowManager) armReady(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+	w.RegisterHook(events.Common.WindowRuntimeReady, func(_ *application.WindowEvent) {
+		timer := time.AfterFunc(paintedFallback, func() {
+			log.Warnf("window %q never reported a first render, showing it anyway", w.Name())
+			s.markReady(w)
+		})
+		s.mu.Lock()
+		s.fallbackTimers[w.ID()] = timer
+		s.mu.Unlock()
+	})
+}
+
+func (s *WindowManager) watchPainted() {
+	s.app.Event.On(EventWindowPainted, func(e *application.CustomEvent) {
+		if w := s.windowByName(e.Sender); w != nil {
+			s.markReady(w)
+		}
+	})
+}
+
+func (s *WindowManager) watchTriggerLogin() {
+	s.app.Event.On(EventTriggerLogin, func(_ *application.CustomEvent) {
+		s.mu.Lock()
+		if s.headlessTimer != nil {
+			s.headlessTimer.Stop()
+			s.headlessTimer = nil
+		}
+		w := s.mainWindow
+		ready := w != nil && s.ready[w.ID()]
+		s.mu.Unlock()
+		if ready {
+			return
+		}
+
+		w, created := s.ensureMain("/")
+		if w == nil {
+			return
+		}
+
+		s.mu.Lock()
+		if created {
+			s.headlessMain = true
+		}
+		pending := !s.ready[w.ID()]
+		if pending {
+			s.pendingEmits[w.ID()] = append(s.pendingEmits[w.ID()], EventTriggerLogin)
+		}
+		s.mu.Unlock()
+
+		if !pending {
+			s.app.Event.Emit(EventTriggerLogin)
+		}
+	})
+
+	s.app.Event.On(EventBrowserLoginCancel, func(_ *application.CustomEvent) {
+		s.scheduleHeadlessTeardown()
+	})
+
+	s.app.Event.On(EventStatusSnapshot, func(e *application.CustomEvent) {
+		st, ok := e.Data.(Status)
+		if !ok {
+			return
+		}
+		switch st.Status {
+		case StatusConnected, StatusLoginFailed, StatusDaemonUnavailable:
+			s.scheduleHeadlessTeardown()
+		}
+	})
+}
+
+func (s *WindowManager) scheduleHeadlessTeardown() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if !s.headlessMain || s.mainWindow == nil {
+		return
+	}
+	if s.headlessTimer != nil {
+		s.headlessTimer.Stop()
+	}
+	s.headlessTimer = time.AfterFunc(headlessTeardownDelay, s.closeHeadlessMain)
+}
+
+func (s *WindowManager) closeHeadlessMain() {
+	s.mu.Lock()
+	w := s.mainWindow
+	headless := s.headlessMain
+	s.headlessTimer = nil
+	s.mu.Unlock()
+	if !headless || w == nil {
+		return
+	}
+	w.Close()
+}
+
+func (s *WindowManager) forgetWindowLocked(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+
+	id := w.ID()
+	if timer := s.fallbackTimers[id]; timer != nil {
+		timer.Stop()
+	}
+	delete(s.fallbackTimers, id)
+	delete(s.ready, id)
+	delete(s.showPending, id)
+	delete(s.pendingTab, id)
+	delete(s.pendingEmits, id)
+
+	kept := s.hiddenForLogin[:0]
+	for _, hidden := range s.hiddenForLogin {
+		if hidden != application.Window(w) {
+			kept = append(kept, hidden)
+		}
+	}
+	s.hiddenForLogin = kept
+}
+
+func (s *WindowManager) windowByName(name string) *application.WebviewWindow {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	switch name {
+	case "main":
+		return s.mainWindow
+	case "settings":
+		return s.settings
+	default:
+		return nil
+	}
+}
+
+func (s *WindowManager) markReady(w *application.WebviewWindow) {
+	id := w.ID()
+	s.mu.Lock()
+	already := s.ready[id]
+	s.ready[id] = true
+	wanted := s.showPending[id]
+	tab, hasTab := s.pendingTab[id]
+	emits := s.pendingEmits[id]
+	if timer := s.fallbackTimers[id]; timer != nil {
+		timer.Stop()
+		delete(s.fallbackTimers, id)
+	}
+	delete(s.showPending, id)
+	delete(s.pendingTab, id)
+	delete(s.pendingEmits, id)
+	s.mu.Unlock()
+
+	if already {
+		return
+	}
+
+	if hasTab {
+		s.app.Event.Emit(EventSettingsOpen, tab)
+	}
+
+	if wanted {
+		s.showNow(w)
+	}
+
+	for _, event := range emits {
+		s.app.Event.Emit(event)
+	}
+}
+
+func (s *WindowManager) showWhenReady(w *application.WebviewWindow) {
+	if w == nil {
+		return
+	}
+
+	id := w.ID()
+	s.mu.Lock()
+	ready := s.ready[id]
+	if !ready {
+		s.showPending[id] = true
+	}
+	s.mu.Unlock()
+
+	if ready {
+		s.showNow(w)
+	}
+}
+
+func (s *WindowManager) showNow(w *application.WebviewWindow) {
+	s.mu.Lock()
+	if w == s.mainWindow {
+		s.headlessMain = false
+		if s.headlessTimer != nil {
+			s.headlessTimer.Stop()
+			s.headlessTimer = nil
+		}
+	}
+	s.mu.Unlock()
+	w.Show()
+	w.Focus()
+	s.centerWhenReady(w)
+}
+
+func (s *WindowManager) ShowMainAt(url string) {
+	w, created := s.ensureMain(url)
+	if w == nil {
+		return
+	}
+	if !created {
+		w.SetURL(url)
+	}
+	s.showWhenReady(w)
+}
+
+func (s *WindowManager) SetMainFactory(f func(startURL string) *application.WebviewWindow) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.newMain = f
+}
+
+func (s *WindowManager) ForgetMain() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.forgetWindowLocked(s.mainWindow)
+	s.mainWindow = nil
+	s.headlessMain = false
+	if s.headlessTimer != nil {
+		s.headlessTimer.Stop()
+		s.headlessTimer = nil
+	}
 }
 
 // SetRecenterOnShow installs the recenterOnShow predicate (see the field).

client/ui/tray.go

@@ -174,7 +174,7 @@ func NewTray(app *application.App, window *application.WebviewWindow, svc TraySe
 		// in the right locale — no English flash then re-paint.
 		loc: svc.Localizer,
 	}
-	t.updater = newTrayUpdater(app, window, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
+	t.updater = newTrayUpdater(app, t.showMainAt, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
 	t.tray = app.SystemTray.New()
 	// Seed panel-theme detection before the first paint so the initial icon
 	// matches the panel's light/dark scheme (Linux only).
@@ -241,9 +241,6 @@ func (t *Tray) ShowWindow() {
 		w.Focus()
 		return
 	}
-	if t.window == nil {
-		return
-	}
 	// Route through WindowManager so the main window is centered on first
 	// show — minimal WMs (fluxbox, the XEmbed tray path) otherwise drop it in
 	// the top-left corner.
@@ -251,8 +248,49 @@ func (t *Tray) ShowWindow() {
 		t.svc.WindowManager.ShowMain()
 		return
 	}
-	t.window.Show()
-	t.window.Focus()
+	if w := t.mainWindow(); w != nil {
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) mainWindow() *application.WebviewWindow {
+	if t.svc.WindowManager == nil {
+		return t.window
+	}
+	return t.svc.WindowManager.MainWindow()
+}
+
+func (t *Tray) showMainAt(url string) {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMainAt(url)
+		return
+	}
+	if w := t.mainWindow(); w != nil {
+		w.SetURL(url)
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) showMain() {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMain()
+		return
+	}
+	if w := t.mainWindow(); w != nil {
+		w.Show()
+		w.Focus()
+	}
+}
+
+func (t *Tray) showMainAndEmit(event string) {
+	if t.svc.WindowManager != nil {
+		t.svc.WindowManager.ShowMainAndEmit(event)
+		return
+	}
+	t.showMain()
+	t.app.Event.Emit(event)
 }
 
 // applyLanguage re-renders every translated surface in the Localizer's current
@@ -479,7 +517,8 @@ func (t *Tray) handleConnect(upItem *application.MenuItem) {
 	// NeedsLogin/SessionExpired/LoginFailed won't honor a plain Up RPC — they
 	// need the Login → WaitSSOLogin → Up sequence. Emit EventTriggerLogin so
 	// the React startLogin() (which owns the BrowserLogin popup) drives it;
-	// the hidden main webview is alive and subscribed, so only the popup shows.
+	// the WindowManager materialises a hidden main webview when none is live,
+	// so only the popup shows.
 	t.statusMu.Lock()
 	needsLogin := strings.EqualFold(t.lastStatus, services.StatusNeedsLogin) ||
 		strings.EqualFold(t.lastStatus, services.StatusSessionExpired) ||

client/ui/tray_session.go

@@ -30,10 +30,7 @@ const (
 // handleSessionExpired notifies and brings the window forward so the user can reconnect.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
-	if t.window != nil {
-		t.window.Show()
-		t.window.Focus()
-	}
+	t.showMain()
 }
 
 // applySessionExpiry refreshes the cached SSO deadline and reports whether it changed.
@@ -307,7 +304,7 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		t.showMainAndEmit(services.EventTriggerLogin)
 		return
 	}
 	if t.svc.WindowManager == nil {

client/ui/tray_update.go

@@ -4,6 +4,7 @@ package main
 
 import (
 	"context"
+	neturl "net/url"
 	"sync"
 	"time"
 
@@ -19,7 +20,7 @@ import (
 // trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
 type trayUpdater struct {
 	app          *application.App
-	window       *application.WebviewWindow
+	showMainAt   func(url string)
 	update       *services.Update
 	notifier     *Notifier
 	loc          *Localizer
@@ -36,10 +37,10 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, showMainAt func(url string), update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
-		window:       window,
+		showMainAt:   showMainAt,
 		update:       update,
 		notifier:     notifier,
 		loc:          loc,
@@ -185,14 +186,12 @@ func (u *trayUpdater) sendUpdateNotification(st updater.State) {
 // openProgressWindow points the main window at the /update progress page and
 // brings it forward.
 func (u *trayUpdater) openProgressWindow(version string) {
-	if u.window == nil {
+	if u.showMainAt == nil {
 		return
 	}
 	url := "/#/update"
 	if version != "" {
-		url += "?version=" + version
+		url += "?version=" + neturl.QueryEscape(version)
 	}
-	u.window.SetURL(url)
-	u.window.Show()
-	u.window.Focus()
+	u.showMainAt(url)
 }