classify daemon login errors and surface localised dialogs

The daemon returns gRPC errors whose message is a wrapped mgm + JWT
stack (e.g. "invalid jwt token, err: token could not be parsed: ...").
Showing that in a native dialog is unreadable. Connection now maps the
substrings it recognises to a ClientError{code, short, long} so the UI
can render a localised summary plus a Details: block carrying the raw
daemon text. formatErrorMessage on the TS side reads the structured
payload from Wails' Error.cause (or the JSON-stringified Error.message)
and falls back to plain Error.message for callers not yet migrated.

Also bumps Wails to v3.0.0-alpha.95.

client/ui/frontend/src/components/ProfileDropdown.tsx

@@ -11,6 +11,7 @@ import { NewProfileModal } from "@/components/NewProfileModal";
 import { Tooltip } from "@/components/Tooltip";
 import { useProfile } from "@/modules/profile/ProfileContext";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 type ProfileDropdownProps = {
     onManageProfiles?: () => void;
@@ -40,7 +41,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
         } catch (e) {
             await Dialogs.Error({
                 Title: title,
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);
@@ -70,7 +71,7 @@ export const ProfileDropdown = ({ onManageProfiles }: ProfileDropdownProps) => {
         } catch (e) {
             await Dialogs.Error({
                 Title: t("profile.error.createTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         }
     };

client/ui/frontend/src/i18n/locales/de/common.json

@@ -293,5 +293,14 @@
 
     "daemon.unavailable.title": "NetBird-Dienst läuft nicht",
     "daemon.unavailable.description": "Die App stellt automatisch die Verbindung wieder her, sobald der Dienst läuft.",
-    "daemon.unavailable.docsLink": "Dokumentation"
+    "daemon.unavailable.docsLink": "Dokumentation",
+
+    "error.jwt_clock_skew": "Anmeldung fehlgeschlagen: Die Uhr dieses Geräts ist nicht mit dem Server synchron. Bitte synchronisieren Sie die Systemuhr und versuchen Sie es erneut.",
+    "error.jwt_expired": "Ihr Anmeldetoken ist abgelaufen. Bitte melden Sie sich erneut an.",
+    "error.jwt_signature_invalid": "Anmeldung fehlgeschlagen: Die Token-Signatur ist ungültig. Bitte wenden Sie sich an Ihren Administrator.",
+    "error.session_expired": "Ihre Sitzung ist abgelaufen. Bitte melden Sie sich erneut an.",
+    "error.invalid_setup_key": "Der Setup-Schlüssel fehlt oder ist ungültig.",
+    "error.permission_denied": "Die Anmeldung wurde vom Server abgelehnt.",
+    "error.daemon_unreachable": "Der NetBird-Dienst antwortet nicht. Bitte prüfen Sie, ob der Dienst läuft.",
+    "error.unknown": "Vorgang fehlgeschlagen. Technische Details siehe unten."
 }

client/ui/frontend/src/i18n/locales/en/common.json

@@ -314,5 +314,14 @@
 
     "daemon.unavailable.title": "NetBird Service Is Not Running",
     "daemon.unavailable.description": "The app will reconnect automatically once the service is running.",
-    "daemon.unavailable.docsLink": "Documentation"
+    "daemon.unavailable.docsLink": "Documentation",
+
+    "error.jwt_clock_skew": "Sign-in failed: this device's clock is out of sync with the server. Please sync your system clock and try again.",
+    "error.jwt_expired": "Your sign-in token has expired. Please sign in again.",
+    "error.jwt_signature_invalid": "Sign-in failed: the token signature is invalid. Please contact your administrator.",
+    "error.session_expired": "Your session has expired. Please sign in again.",
+    "error.invalid_setup_key": "The setup key is missing or invalid.",
+    "error.permission_denied": "Sign-in was rejected by the server.",
+    "error.daemon_unreachable": "The NetBird daemon is not responding. Please check that the service is running.",
+    "error.unknown": "Operation failed. See details for the technical message."
 }

client/ui/frontend/src/i18n/locales/hu/common.json

@@ -293,5 +293,14 @@
 
     "daemon.unavailable.title": "A NetBird szolgáltatás nem fut",
     "daemon.unavailable.description": "Az alkalmazás automatikusan újracsatlakozik, amint a szolgáltatás újra elérhető.",
-    "daemon.unavailable.docsLink": "Dokumentáció"
+    "daemon.unavailable.docsLink": "Dokumentáció",
+
+    "error.jwt_clock_skew": "A bejelentkezés sikertelen: az eszköz órája eltér a szerverétől. Kérjük, szinkronizálja a rendszer óráját, majd próbálja újra.",
+    "error.jwt_expired": "A bejelentkezési token lejárt. Kérjük, jelentkezzen be újra.",
+    "error.jwt_signature_invalid": "A bejelentkezés sikertelen: a token aláírása érvénytelen. Kérjük, lépjen kapcsolatba a rendszergazdával.",
+    "error.session_expired": "A munkamenet lejárt. Kérjük, jelentkezzen be újra.",
+    "error.invalid_setup_key": "A telepítési kulcs hiányzik vagy érvénytelen.",
+    "error.permission_denied": "A szerver elutasította a bejelentkezést.",
+    "error.daemon_unreachable": "A NetBird szolgáltatás nem válaszol. Kérjük, ellenőrizze, hogy fut-e a szolgáltatás.",
+    "error.unknown": "A művelet meghiúsult. A technikai részleteket a Details mezőben találja."
 }

client/ui/frontend/src/layouts/ConnectionStatusSwitch.tsx

@@ -7,6 +7,7 @@ import { ToggleSwitch } from "@/components/ToggleSwitch.tsx";
 import { useStatus } from "@/modules/daemon-status/StatusContext.tsx";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 import { cn } from "@/lib/cn.ts";
+import { formatErrorMessage } from "@/lib/errors.ts";
 import netbirdFullLogo from "@/assets/logos/netbird-full.svg";
 
 enum ConnectionState {
@@ -38,8 +39,7 @@ const NEEDS_LOGIN_STATES = new Set([
     "LoginFailed",
 ]);
 
-const errorMessage = (e: unknown) =>
-    e instanceof Error ? e.message : String(e);
+const errorMessage = formatErrorMessage;
 
 // startLogin drives the daemon's SSO login end-to-end. The BrowserLogin
 // popup window is the only login UI; errors surface as a native

client/ui/frontend/src/lib/errors.ts

@@ -0,0 +1,52 @@
+// Shared error formatter for native dialog bodies.
+//
+// The Go service layer (client/ui/services/connection.go classifyDaemonError)
+// wraps daemon errors in a ClientError struct exposed to the TS side as
+// {code, short, long}. Short is already localised (Go reads the current
+// preferences.Store language and resolves "error.<code>" via i18n.Bundle).
+// Long always carries the unwrapped raw daemon message so the operator can
+// see the JWT / mgm stack when the short text is too generic.
+//
+// Wails wraps Go-returned errors as Error({message, cause, kind}) where
+// .message holds the JSON-stringified payload and the structured object
+// lives on .cause — Object.keys(err) is empty in that case. We therefore
+// probe .cause first, then fall back to parsing .message as JSON, then
+// to plain .message text for callers that still hand us a raw Error.
+const extractClientError = (e: unknown): { short?: string; long?: string } | null => {
+    if (!e || typeof e !== "object") return null;
+    const withCause = e as { cause?: unknown; message?: unknown };
+    if (withCause.cause && typeof withCause.cause === "object") {
+        return withCause.cause as { short?: string; long?: string };
+    }
+    if (typeof withCause.message === "string") {
+        const m = withCause.message.trim();
+        if (m.startsWith("{") && m.endsWith("}")) {
+            try {
+                const parsed = JSON.parse(m);
+                if (parsed && typeof parsed === "object") {
+                    if ("cause" in parsed && parsed.cause && typeof parsed.cause === "object") {
+                        return parsed.cause as { short?: string; long?: string };
+                    }
+                    return parsed as { short?: string; long?: string };
+                }
+            } catch {
+                // not JSON — fall through to plain-message handling
+            }
+        }
+    }
+    return null;
+};
+
+export const formatErrorMessage = (e: unknown): string => {
+    const ce = extractClientError(e);
+    if (ce) {
+        const short = typeof ce.short === "string" ? ce.short : "";
+        const long = typeof ce.long === "string" ? ce.long : "";
+        if (short && long && long !== short) {
+            return `${short}\n\nDetails: ${long}`;
+        }
+        if (short) return short;
+    }
+    if (e instanceof Error) return e.message;
+    return String(e);
+};

client/ui/frontend/src/modules/authentication/SessionAboutToExpireDialog.tsx

@@ -16,6 +16,7 @@ import {
     WindowManager,
 } from "@bindings/services";
 import { useAutoSizeWindow } from "@/lib/useAutoSizeWindow";
+import { formatErrorMessage } from "@/lib/errors.ts";
 
 const DEFAULT_SECONDS = 360;
 const WINDOW_WIDTH = 360;
@@ -63,7 +64,7 @@ export default function SessionAboutToExpireDialog() {
         if (busy) return;
         setBusy(true);
         try {
-            const start = await Session.RequestExtend({});
+            const start = await Session.RequestExtend({ hint: "" });
             const uri = start.verificationUriComplete || start.verificationUri;
             if (uri) {
                 try {
@@ -80,7 +81,7 @@ export default function SessionAboutToExpireDialog() {
         } catch (e) {
             await Dialogs.Error({
                 Title: t("sessionAboutToExpire.extendFailedTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);

client/ui/frontend/src/modules/debug-bundle/useDebugBundle.ts

@@ -6,6 +6,7 @@ import {
 } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
 import i18next from "@/lib/i18n";
+import { formatErrorMessage } from "@/lib/errors.ts";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 
 const NETBIRD_UPLOAD_URL = "https://upload.debug.netbird.io/upload-url";
@@ -158,7 +159,7 @@ export const useDebugBundle = () => {
             setStage({ kind: "idle" });
             await Dialogs.Error({
                 Title: i18next.t("settings.error.debugBundleTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             if (abortRef.current === ctrl) abortRef.current = null;

client/ui/frontend/src/modules/settings/LanguagePicker.tsx

@@ -11,6 +11,7 @@ import { HelpText } from "@/components/HelpText";
 import { Label } from "@/components/Label";
 import { loadLanguages } from "@/lib/i18n";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 // Flags live alongside the rest of the SVG flag library under
 // assets/flags/1x1 and are filename-matched to the language code
@@ -91,7 +92,7 @@ export function LanguagePicker() {
         } catch (e) {
             await Dialogs.Error({
                 Title: t("settings.error.saveTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);

client/ui/frontend/src/modules/settings/SettingsContext.tsx

@@ -13,9 +13,7 @@ import type { Config } from "@bindings/services/models.js";
 import i18next from "@/lib/i18n";
 import { useProfile } from "@/modules/profile/ProfileContext.tsx";
 import { SkeletonSettings } from "@/modules/skeletons/SkeletonSettings.tsx";
-
-const errorMessage = (e: unknown) =>
-    e instanceof Error ? e.message : String(e);
+import { formatErrorMessage as errorMessage } from "@/lib/errors.ts";
 
 const SAVE_DEBOUNCE_MS = 400;
 

client/ui/frontend/src/modules/settings/SettingsProfiles.tsx

@@ -13,6 +13,7 @@ import i18next from "@/lib/i18n";
 import { useProfile } from "@/modules/profile/ProfileContext";
 import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
 import { cn } from "@/lib/cn";
+import { formatErrorMessage } from "@/lib/errors";
 
 const DEFAULT_PROFILE = "default";
 
@@ -45,7 +46,7 @@ export function SettingsProfiles() {
         } catch (e) {
             await Dialogs.Error({
                 Title: title,
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         } finally {
             setBusy(false);
@@ -90,7 +91,7 @@ export function SettingsProfiles() {
         } catch (e) {
             await Dialogs.Error({
                 Title: i18next.t("profile.error.createTitle"),
-                Message: e instanceof Error ? e.message : String(e),
+                Message: formatErrorMessage(e),
             });
         }
     };

client/ui/frontend/src/screens/Update.tsx

@@ -4,6 +4,7 @@ import { Loader2 } from "lucide-react";
 import { Dialogs } from "@wailsio/runtime";
 import { Update as UpdateSvc } from "@bindings/services";
 import i18next from "@/lib/i18n";
+import { formatErrorMessage } from "@/lib/errors";
 
 const TIMEOUT_MS = 15 * 60 * 1000;
 
@@ -20,7 +21,7 @@ export default function Update() {
     UpdateSvc.Trigger().catch((e) => {
       if (cancelled) return;
       setFailed(true);
-      void showError(e instanceof Error ? e.message : String(e));
+      void showError(formatErrorMessage(e));
     });
 
     const start = Date.now();