Localize daemon notifications via stable message keys

.github/workflows/pr-title-check.yml

@@ -16,8 +16,6 @@ jobs:
             const allowedTags = [
               'management',
               'client',
-              'android',
-              'ios',
               'signal',
               'proxy',
               'relay',

.goreleaser_ui.yaml

@@ -93,9 +93,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-4-1 (>= 4.14)
-      - libwebkitgtk-6.0-4
+      - netbird
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -116,9 +114,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird >= 0.75.0
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - netbird
 
     rpm:
       signature:

client/android/client.go

@@ -57,12 +57,6 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
-// TunSettings is a snapshot of the settings the TUN device is rebuilt with
-type TunSettings struct {
-	Routes        string
-	SearchDomains string
-}
-
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -82,8 +76,6 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
-	// Identifies the running profile for the SSO login hint; see profile_state.go.
-	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -104,12 +96,11 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
-	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -119,16 +110,6 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
-// authSnapshot returns the config together with the path it was loaded from, in
-// one lock: the path identifies the profile whose account email backs the login
-// hint, so reading it separately could pair one profile's config with another's
-// hint when a profile switch lands in between.
-func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
-	c.stateMu.RLock()
-	defer c.stateMu.RUnlock()
-	return c.config, c.cfgPath, c.connectClient
-}
-
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -181,7 +162,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
+	auth := NewAuthWithConfig(ctx, cfg)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -189,7 +170,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -230,7 +211,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -259,24 +240,6 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
-func (c *Client) GetTunSettings() (*TunSettings, error) {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return nil, fmt.Errorf("engine not running")
-	}
-
-	e := cc.Engine()
-	if e == nil {
-		return nil, fmt.Errorf("engine not initialized")
-	}
-
-	routes, searchDomains := e.TunSettings()
-	return &TunSettings{
-		Routes:        strings.Join(routes, ";"),
-		SearchDomains: strings.Join(searchDomains, ";"),
-	}, nil
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine.
 func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {

client/android/login.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -38,20 +36,12 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
-//
-// The configuration at cfgPath is reused when one is already there, and only created when it is
-// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
-// every call: the peer registers under that key, the key is written out, and any peer registered by
-// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
-// the persisted config, because the identity it registered is not the one it runs with — the
-// management stream rejects it with "no peer auth method provided".
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
@@ -63,14 +53,11 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
-// file the config was loaded from; it identifies the profile whose account email
-// backs the login_hint.
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
 	return &Auth{
-		ctx:     ctx,
-		config:  config,
-		cfgPath: cfgPath,
+		ctx:    ctx,
+		config: config,
 	}
 }
 
@@ -163,14 +150,12 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
-	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
-		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -178,42 +163,17 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Stored after Login, not before: a rejected token must not leave a hint
-	// pointing at an account that cannot be used.
-	if email != "" && a.cfgPath != "" {
-		if err := writeProfileEmail(a.cfgPath, email); err != nil {
-			log.Warnf("failed to store profile account email: %v", err)
-		}
-	}
-
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
-// loginHintSetter is implemented by both concrete flows (PKCE and device code)
-// but absent from the OAuthFlow interface, hence the assertion below — the same
-// way internal/auth wires it in authenticateWithPKCEFlow.
-type loginHintSetter interface {
-	SetLoginHint(hint string)
-}
-
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
-	// leaves the choice to the IdP, which is how accounts get switched.
-	if a.cfgPath != "" {
-		if hint := readProfileEmail(a.cfgPath); hint != "" {
-			if setter, ok := oAuthFlow.(loginHintSetter); ok {
-				setter.SetLoginHint(hint)
-			}
-		}
-	}
-
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/login_test.go

@@ -1,51 +0,0 @@
-package android
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
-//
-// Creating a new in-memory config on every call gives the client a new WireGuard private key each
-// time. The peer registers under that key and the key is written out, so a peer registered by an
-// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
-// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
-// the identity that registered is not the identity that runs, and the management stream rejects it
-// with "no peer auth method provided, please use a setup key or interactive SSO login".
-func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	first, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("first NewAuth: %v", err)
-	}
-	if first.config.PrivateKey == "" {
-		t.Fatal("first NewAuth produced no private key")
-	}
-
-	second, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("second NewAuth: %v", err)
-	}
-
-	if second.config.PrivateKey != first.config.PrivateKey {
-		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
-	}
-}
-
-// A missing configuration is still created, so a first enrolment works unchanged.
-func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("NewAuth: %v", err)
-	}
-	if auth.config == nil || auth.config.PrivateKey == "" {
-		t.Fatal("NewAuth did not create a usable configuration")
-	}
-	if auth.cfgPath != cfgPath {
-		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
-	}
-}

client/android/profile_manager.go

@@ -13,17 +13,18 @@ import (
 )
 
 const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID   string
-	Name string
-	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login or was logged out. See profile_state.go.
-	Email    string
+	ID       string
+	Name     string
 	IsActive bool
 }
 
@@ -100,7 +101,6 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
-			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,22 +123,7 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{
-		ID:       prof.ID.String(),
-		Name:     prof.Name,
-		Email:    pm.profileEmail(prof.ID.String()),
-		IsActive: true,
-	}, nil
-}
-
-// profileEmail returns the account email recorded for a profile. Display-only, so
-// an unresolvable path degrades to "" rather than an error.
-func (pm *ProfileManager) profileEmail(id string) string {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return ""
-	}
-	return readProfileEmail(configPath)
+	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
 }
 
 // SwitchProfile switches to a different profile
@@ -200,11 +185,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// Not fatal: a stale hint costs an account switch, not the logout itself.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -1,108 +0,0 @@
-package android
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/util"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// profileAccountSuffix names the file holding the profile's account email.
-	// Deliberately not ".state.json", which desktop uses for the same data:
-	// there the email and the engine's state manager live in different
-	// directories, but on Android both resolve under files/, so sharing the name
-	// would have the two overwrite each other — the state manager rewrites the
-	// whole file from its own keys (see statemanager.Manager.PersistState), and
-	// this package's writer does the same in reverse.
-	profileAccountSuffix = ".account.json"
-)
-
-// profileAccountPathFor derives the account file path from a profile's config
-// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
-//
-// Deriving from the config path rather than resolving the active profile keeps
-// the write on the profile the login actually ran for: Auth.login runs in a
-// goroutine, so the active profile can change under a flow already in flight.
-func profileAccountPathFor(configPath string) (string, error) {
-	if configPath == "" {
-		return "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	stem := strings.TrimSuffix(base, filepath.Ext(base))
-	if stem == "" || stem == "." {
-		return "", fmt.Errorf("config path %q has no filename stem", configPath)
-	}
-
-	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
-}
-
-// readProfileEmail returns the account email stored for the profile whose config
-// lives at configPath. A missing or unreadable file yields "", which leaves the
-// account choice to the IdP.
-func readProfileEmail(configPath string) string {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		log.Debugf("no profile account path for login hint: %v", err)
-		return ""
-	}
-
-	var state profilemanager.ProfileState
-	if _, err := util.ReadJson(accountPath, &state); err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("failed to read profile account for login hint: %v", err)
-		}
-		return ""
-	}
-
-	return state.Email
-}
-
-// writeProfileEmail records the account email for the profile whose config lives
-// at configPath, so later logins can pass it as an OIDC login_hint. An empty
-// email is ignored rather than blanking what is already stored.
-func writeProfileEmail(configPath string, email string) error {
-	if email == "" {
-		return nil
-	}
-
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	state := profilemanager.ProfileState{Email: email}
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
-		return fmt.Errorf("write profile account: %w", err)
-	}
-
-	return nil
-}
-
-// removeProfileEmail drops the stored account email. Called on logout: while the
-// email is on disk it goes out as a login_hint, which would steer the next login
-// straight back into the account just logged out of. Mirrors the desktop UI's
-// RemoveProfileState call.
-func removeProfileEmail(configPath string) error {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("remove profile account: %w", err)
-	}
-
-	return nil
-}

client/android/profile_state_test.go

@@ -1,161 +0,0 @@
-package android
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestProfileAccountPathFor(t *testing.T) {
-	tests := []struct {
-		name       string
-		configPath string
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "default profile",
-			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       "/data/data/io.netbird.client/files/netbird.account.json",
-		},
-		{
-			name:       "id profile",
-			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json",
-		},
-		{
-			name:       "legacy name-keyed profile is handled the same way",
-			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       "/data/data/io.netbird.client/files/profiles/work.account.json",
-		},
-		{
-			name:       "empty path is rejected",
-			configPath: "",
-			wantErr:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := profileAccountPathFor(tt.configPath)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected an error, got path %q", got)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-
-	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
-	if err != nil {
-		t.Fatalf("id profile: %v", err)
-	}
-
-	if defaultAccount == idAccount {
-		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
-	}
-}
-
-// The account file must never land on the engine state file: on Android both
-// resolve under files/, and the state manager rewrites the whole file from its
-// own keys, so sharing a path would have the two overwrite each other. The
-// expected names here mirror ProfileManager.GetStateFilePath.
-func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	cases := []struct {
-		configPath  string
-		engineState string
-	}{
-		{
-			configPath:  filepath.Join(root, defaultConfigFilename),
-			engineState: filepath.Join(root, "state.json"),
-		},
-		{
-			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
-			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
-		},
-	}
-
-	for _, c := range cases {
-		account, err := profileAccountPathFor(c.configPath)
-		if err != nil {
-			t.Fatalf("%s: %v", c.configPath, err)
-		}
-		if account == c.engineState {
-			t.Errorf("account file collides with the engine state file: %q", account)
-		}
-	}
-}
-
-func TestWriteThenReadProfileEmail(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email before a login, got %q", got)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("got %q, want %q", got, email)
-	}
-
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("remove: %v", err)
-	}
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after logout, got %q", got)
-	}
-
-	// Logout may run on a never-logged-in profile, so a second remove must pass.
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("second remove should be a no-op: %v", err)
-	}
-}
-
-func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if err := writeProfileEmail(configPath, ""); err != nil {
-		t.Fatalf("write empty: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
-	}
-}
-
-func ensureDirFor(t *testing.T, path string) error {
-	t.Helper()
-	return os.MkdirAll(filepath.Dir(path), 0o700)
-}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, cfgPath, cc := c.authSnapshot()
+	cfg, _, cc := c.stateSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,10 +293,7 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
-	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	a := &Auth{ctx: ctx, config: cfg}
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/cmd/agentnetwork.go

@@ -1,336 +0,0 @@
-package cmd
-
-import (
-	"fmt"
-	"strings"
-
-	"github.com/spf13/cobra"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-	"google.golang.org/protobuf/encoding/protojson"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// agentNetworkAuthToken is the placeholder credential exported for
-// AI-tool CLIs: the Agent Network proxy authenticates callers by tunnel
-// peer and injects the real upstream credentials itself, so the
-// client-side token only needs to satisfy the tool's non-empty check.
-const agentNetworkAuthToken = "netbird"
-
-var (
-	agentNetworkProviderFlag string
-	agentNetworkModelFlag    string
-	agentNetworkJSONFlag     bool
-)
-
-var agentNetworkCmd = &cobra.Command{
-	Use:   "agent-network",
-	Short: "Show the Agent Network setup available to this peer",
-	Long: `Commands to inspect the Agent Network (AI provider proxy) setup this peer's groups authorize:
-the proxy endpoint, the reachable providers, and the allowed models.`,
-}
-
-var agentNetworkLsCmd = &cobra.Command{
-	Use:     "ls",
-	Aliases: []string{"list"},
-	Short:   "List the Agent Network endpoint, providers, and allowed models",
-	Example: "  netbird agent-network ls",
-	RunE:    agentNetworkLs,
-}
-
-var agentNetworkEnvCmd = &cobra.Command{
-	Use:   "env",
-	Short: "Print shell export lines that point AI tools at the Agent Network",
-	Long: `Print POSIX shell export lines that configure AI tools to use the Agent Network proxy.
-The variables depend on the provider's API shape — Anthropic API, AWS Bedrock, Google Vertex AI,
-and OpenAI-compatible providers each get the environment their tools expect (for Claude Code,
-following its LLM-gateway configuration). Apply them to the current shell with:
-
-  eval "$(netbird agent-network env)"
-
-When several providers are authorized, pass --provider to pick one; when several models are
-allowed, pass --model to pin one — nothing is ever guessed.`,
-	Example: "  eval \"$(netbird agent-network env)\"\n  eval \"$(netbird agent-network env --provider 'Bedrock prod' --model anthropic.claude-sonnet-4-5)\"",
-	RunE:    agentNetworkEnv,
-}
-
-func init() {
-	agentNetworkLsCmd.PersistentFlags().BoolVar(&agentNetworkJSONFlag, "json", false, "output the setup as JSON")
-	agentNetworkEnvCmd.PersistentFlags().StringVar(&agentNetworkProviderFlag, "provider", "", "provider to configure, by name or catalog id (required when several are authorized)")
-	agentNetworkEnvCmd.PersistentFlags().StringVar(&agentNetworkModelFlag, "model", "", "model to export (required when several models are allowed)")
-}
-
-// fetchAgentNetworkSetup asks the daemon for the caller-scoped Agent
-// Network setup. The daemon relays the request to management over its
-// existing peer connection, so no elevated permissions are needed.
-func fetchAgentNetworkSetup(cmd *cobra.Command) (*proto.GetAgentNetworkSetupResponse, error) {
-	conn, err := getClient(cmd)
-	if err != nil {
-		return nil, err
-	}
-	defer conn.Close()
-
-	client := proto.NewDaemonServiceClient(conn)
-	setup, err := client.GetAgentNetworkSetup(cmd.Context(), &proto.GetAgentNetworkSetupRequest{})
-	if err != nil {
-		if s, ok := status.FromError(err); ok && s.Code() == codes.Unimplemented {
-			return nil, fmt.Errorf("the running daemon does not support agent-network commands — update the NetBird daemon and restart the service")
-		}
-		return nil, fmt.Errorf("get agent network setup: %v", status.Convert(err).Message())
-	}
-	return setup, nil
-}
-
-func agentNetworkLs(cmd *cobra.Command, _ []string) error {
-	setup, err := fetchAgentNetworkSetup(cmd)
-	if err != nil {
-		return err
-	}
-
-	if agentNetworkJSONFlag {
-		out, err := protojson.MarshalOptions{Multiline: true, Indent: "  "}.Marshal(setup)
-		if err != nil {
-			return fmt.Errorf("marshal setup: %v", err)
-		}
-		cmd.Println(string(out))
-		return nil
-	}
-
-	if !setup.Configured {
-		cmd.Println("Agent Network is not available for this peer. Ask your administrator.")
-		return nil
-	}
-
-	cmd.Printf("Agent Network endpoint: %s\n", setup.Endpoint)
-	cmd.Println("(reachable while connected to NetBird)")
-	for _, p := range setup.Providers {
-		cmd.Println()
-		cmd.Printf("%s (%s)\n", sanitizeOutput(p.Name), sanitizeOutput(providerFlavorLabel(p)))
-		switch {
-		case p.AllModelsAllowed && len(p.Models) == 0:
-			cmd.Println("  All models allowed")
-		case p.AllModelsAllowed:
-			cmd.Println("  All models allowed, including:")
-			printModels(cmd, p.Models)
-		default:
-			cmd.Println("  Allowed models:")
-			printModels(cmd, p.Models)
-		}
-	}
-	cmd.Println()
-	cmd.Println("To configure an AI tool in the current shell: eval \"$(netbird agent-network env)\"")
-	return nil
-}
-
-func printModels(cmd *cobra.Command, models []string) {
-	if len(models) == 0 {
-		cmd.Println("    (none)")
-		return
-	}
-	for _, m := range models {
-		cmd.Printf("    %s\n", sanitizeOutput(m))
-	}
-}
-
-func providerFlavorLabel(p *proto.AgentNetworkProvider) string {
-	if p.ApiFlavor == "" {
-		return p.CatalogId
-	}
-	return fmt.Sprintf("%s · %s-flavor API", p.CatalogId, p.ApiFlavor)
-}
-
-func agentNetworkEnv(cmd *cobra.Command, _ []string) error {
-	setup, err := fetchAgentNetworkSetup(cmd)
-	if err != nil {
-		return err
-	}
-
-	if !setup.Configured {
-		// An answer, not an error: print nothing eval-able and say why on
-		// stderr so `eval "$(...)"` stays a harmless no-op.
-		cmd.PrintErrln("Agent Network is not available for this peer. Ask your administrator.")
-		return nil
-	}
-
-	lines, err := buildAgentNetworkEnv(setup, agentNetworkProviderFlag, agentNetworkModelFlag)
-	if err != nil {
-		return err
-	}
-	for _, line := range lines {
-		cmd.Println(line)
-	}
-	return nil
-}
-
-// buildAgentNetworkEnv renders the export lines for one selected
-// provider. Nothing is guessed: an ambiguous provider or model choice
-// comes back as comment lines instead of exports, and an invalid
-// --provider/--model is an error.
-func buildAgentNetworkEnv(setup *proto.GetAgentNetworkSetupResponse, providerFlag, modelFlag string) ([]string, error) {
-	provider, choiceLines, err := selectAgentNetworkProvider(setup.Providers, providerFlag)
-	if err != nil {
-		return nil, err
-	}
-	if provider == nil {
-		return choiceLines, nil
-	}
-
-	model, modelNotes, err := resolveAgentNetworkModel(provider, modelFlag)
-	if err != nil {
-		return nil, err
-	}
-
-	var lines []string
-	switch {
-	case provider.CatalogId == "bedrock_api":
-		// Claude Code's Bedrock-format gateway configuration: the proxy
-		// routes native Bedrock paths and injects the AWS credentials, so
-		// client-side signing is skipped.
-		lines = append(lines,
-			exportLine("CLAUDE_CODE_USE_BEDROCK", "1"),
-			exportLine("ANTHROPIC_BEDROCK_BASE_URL", setup.Endpoint),
-			exportLine("CLAUDE_CODE_SKIP_BEDROCK_AUTH", "1"),
-		)
-		if model != "" {
-			lines = append(lines, exportLine("ANTHROPIC_MODEL", model))
-		}
-	case provider.CatalogId == "vertex_ai_api":
-		// Claude Code's Vertex-format gateway configuration. Vertex
-		// requests carry the GCP project and region in the URL path, which
-		// the proxy forwards to the upstream — those two values belong to
-		// the operator's GCP setup and must come from the administrator.
-		lines = append(lines,
-			exportLine("CLAUDE_CODE_USE_VERTEX", "1"),
-			exportLine("ANTHROPIC_VERTEX_BASE_URL", setup.Endpoint),
-			exportLine("CLAUDE_CODE_SKIP_VERTEX_AUTH", "1"),
-		)
-		if model != "" {
-			lines = append(lines, exportLine("ANTHROPIC_MODEL", model))
-		}
-		lines = append(lines,
-			comment("Vertex requests carry your operator's GCP project and region in the URL."),
-			comment("Ask your administrator for the values, then export:"),
-			comment("  export ANTHROPIC_VERTEX_PROJECT_ID=<project>"),
-			comment("  export CLOUD_ML_REGION=<region>"),
-		)
-	case provider.ApiFlavor == "anthropic":
-		lines = append(lines,
-			exportLine("ANTHROPIC_BASE_URL", setup.Endpoint),
-			exportLine("ANTHROPIC_AUTH_TOKEN", agentNetworkAuthToken),
-		)
-		if model != "" {
-			lines = append(lines, exportLine("ANTHROPIC_MODEL", model))
-		}
-	case provider.ApiFlavor == "openai":
-		lines = append(lines,
-			exportLine("OPENAI_BASE_URL", setup.Endpoint),
-			exportLine("OPENAI_API_KEY", agentNetworkAuthToken),
-		)
-		if model != "" {
-			lines = append(lines, comment(fmt.Sprintf("Configure your tool to use model %s.", model)))
-		}
-	default:
-		lines = append(lines,
-			comment(fmt.Sprintf("Provider %s (%s) is dispatched by URL path; no standard environment", provider.Name, provider.CatalogId)),
-			comment("variables apply. Point your tool at the endpoint below (auth token: netbird):"),
-			comment("  "+setup.Endpoint),
-		)
-	}
-
-	for _, note := range modelNotes {
-		lines = append(lines, comment(note))
-	}
-	return lines, nil
-}
-
-// selectAgentNetworkProvider picks the provider to configure. An
-// explicit --provider matches the operator label or catalog id
-// (case-insensitive); with no flag a single authorized provider is
-// used, and several come back as comment lines asking for the flag.
-func selectAgentNetworkProvider(providers []*proto.AgentNetworkProvider, providerFlag string) (*proto.AgentNetworkProvider, []string, error) {
-	if providerFlag != "" {
-		wanted := strings.ToLower(strings.TrimSpace(providerFlag))
-		for _, p := range providers {
-			if strings.ToLower(strings.TrimSpace(p.Name)) == wanted || strings.ToLower(p.CatalogId) == wanted {
-				return p, nil, nil
-			}
-		}
-		names := make([]string, 0, len(providers))
-		for _, p := range providers {
-			names = append(names, fmt.Sprintf("%s (%s)", p.Name, p.CatalogId))
-		}
-		return nil, nil, fmt.Errorf("provider %q is not authorized for this peer — available: %s", providerFlag, strings.Join(names, ", "))
-	}
-
-	if len(providers) == 1 {
-		return providers[0], nil, nil
-	}
-
-	lines := []string{comment("Multiple providers are authorized — none configured. Re-run with --provider to pick one:")}
-	for _, p := range providers {
-		lines = append(lines, comment(fmt.Sprintf("  netbird agent-network env --provider %q   (%s)", p.Name, providerFlavorLabel(p))))
-	}
-	return nil, lines, nil
-}
-
-// resolveAgentNetworkModel picks the model for the selected provider. A
-// model is never guessed: --model wins (validated against the allowed
-// set), a single allowed model is used, and anything ambiguous is
-// returned as note lines instead.
-func resolveAgentNetworkModel(provider *proto.AgentNetworkProvider, modelFlag string) (string, []string, error) {
-	if modelFlag != "" {
-		if provider.AllModelsAllowed {
-			return modelFlag, nil, nil
-		}
-		wanted := strings.ToLower(strings.TrimSpace(modelFlag))
-		for _, m := range provider.Models {
-			if strings.ToLower(strings.TrimSpace(m)) == wanted {
-				return modelFlag, nil, nil
-			}
-		}
-		return "", nil, fmt.Errorf("model %q is not allowed on provider %s — run 'netbird agent-network ls' to see the allowed models", modelFlag, provider.Name)
-	}
-
-	if len(provider.Models) == 1 && !provider.AllModelsAllowed {
-		return provider.Models[0], nil, nil
-	}
-	if len(provider.Models) == 0 && provider.AllModelsAllowed {
-		return "", []string{"Any model is allowed; pass --model to pin one."}, nil
-	}
-
-	notes := []string{"Multiple models are allowed — none exported. Re-run with --model to pin one:"}
-	for _, m := range provider.Models {
-		notes = append(notes, "  "+m)
-	}
-	if provider.AllModelsAllowed {
-		notes = append(notes, "  (any other model the provider serves)")
-	}
-	return "", notes, nil
-}
-
-func exportLine(name, value string) string {
-	return fmt.Sprintf("export %s=%s", name, shellQuote(value))
-}
-
-func comment(text string) string {
-	return "# " + sanitizeOutput(text)
-}
-
-// shellQuote single-quotes a value for safe use in an eval'd export
-// line, escaping embedded single quotes.
-func shellQuote(v string) string {
-	return "'" + strings.ReplaceAll(v, "'", `'\''`) + "'"
-}
-
-// sanitizeOutput strips control characters (including newlines) from
-// server-supplied strings so operator-typed values can't break the
-// line-oriented output or smuggle lines past a `# ` comment prefix.
-func sanitizeOutput(v string) string {
-	return strings.Map(func(r rune) rune {
-		if r < 0x20 || r == 0x7f {
-			return -1
-		}
-		return r
-	}, v)
-}

client/cmd/agentnetwork_test.go

@@ -1,165 +0,0 @@
-package cmd
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-func anTestSetup(providers ...*proto.AgentNetworkProvider) *proto.GetAgentNetworkSetupResponse {
-	return &proto.GetAgentNetworkSetupResponse{
-		Configured: true,
-		Endpoint:   "https://calm-otter.proxy.example.com",
-		Providers:  providers,
-	}
-}
-
-func TestBuildAgentNetworkEnv_AnthropicSingleModel(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Anthropic prod", CatalogId: "anthropic_api", ApiFlavor: "anthropic",
-		Models: []string{"claude-sonnet-4-5"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	assert.Equal(t, []string{
-		"export ANTHROPIC_BASE_URL='https://calm-otter.proxy.example.com'",
-		"export ANTHROPIC_AUTH_TOKEN='netbird'",
-		"export ANTHROPIC_MODEL='claude-sonnet-4-5'",
-	}, lines)
-}
-
-func TestBuildAgentNetworkEnv_MultipleModelsBecomeComments(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Anthropic prod", CatalogId: "anthropic_api", ApiFlavor: "anthropic",
-		Models: []string{"claude-sonnet-4-5", "claude-haiku-4-5"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	assert.Contains(t, lines, "export ANTHROPIC_BASE_URL='https://calm-otter.proxy.example.com'")
-	assert.NotContains(t, strings.Join(lines, "\n"), "ANTHROPIC_MODEL=", "no model is ever guessed")
-	assert.Contains(t, strings.Join(lines, "\n"), "# Multiple models are allowed")
-}
-
-func TestBuildAgentNetworkEnv_ModelFlagValidated(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Anthropic prod", CatalogId: "anthropic_api", ApiFlavor: "anthropic",
-		Models: []string{"claude-sonnet-4-5", "claude-haiku-4-5"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "Claude-Haiku-4-5")
-	require.NoError(t, err, "model match is case-insensitive")
-	assert.Contains(t, lines, "export ANTHROPIC_MODEL='Claude-Haiku-4-5'")
-
-	_, err = buildAgentNetworkEnv(setup, "", "gpt-4o")
-	require.Error(t, err, "a model outside the allowlist is rejected")
-}
-
-func TestBuildAgentNetworkEnv_BedrockFlavor(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Bedrock prod", CatalogId: "bedrock_api", ApiFlavor: "",
-		Models: []string{"anthropic.claude-sonnet-4-5"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	assert.Equal(t, []string{
-		"export CLAUDE_CODE_USE_BEDROCK='1'",
-		"export ANTHROPIC_BEDROCK_BASE_URL='https://calm-otter.proxy.example.com'",
-		"export CLAUDE_CODE_SKIP_BEDROCK_AUTH='1'",
-		"export ANTHROPIC_MODEL='anthropic.claude-sonnet-4-5'",
-	}, lines)
-}
-
-func TestBuildAgentNetworkEnv_VertexFlavorNotesProjectAndRegion(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Vertex prod", CatalogId: "vertex_ai_api", ApiFlavor: "",
-		Models: []string{"claude-sonnet-4-5"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	joined := strings.Join(lines, "\n")
-	assert.Contains(t, lines, "export CLAUDE_CODE_USE_VERTEX='1'")
-	assert.Contains(t, lines, "export ANTHROPIC_VERTEX_BASE_URL='https://calm-otter.proxy.example.com'")
-	assert.Contains(t, lines, "export CLAUDE_CODE_SKIP_VERTEX_AUTH='1'")
-	assert.Contains(t, lines, "export ANTHROPIC_MODEL='claude-sonnet-4-5'")
-	assert.Contains(t, joined, "ANTHROPIC_VERTEX_PROJECT_ID", "project id must be called out as admin-supplied")
-	assert.Contains(t, joined, "CLOUD_ML_REGION", "region must be called out as admin-supplied")
-}
-
-func TestBuildAgentNetworkEnv_OpenAIFlavor(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "OpenAI prod", CatalogId: "openai_api", ApiFlavor: "openai",
-		Models: []string{"gpt-5.4"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	assert.Contains(t, lines, "export OPENAI_BASE_URL='https://calm-otter.proxy.example.com'")
-	assert.Contains(t, lines, "export OPENAI_API_KEY='netbird'")
-	assert.NotContains(t, strings.Join(lines, "\n"), "ANTHROPIC_", "openai flavor must not emit anthropic variables")
-}
-
-func TestBuildAgentNetworkEnv_MultipleProvidersRequireFlag(t *testing.T) {
-	anthropic := &proto.AgentNetworkProvider{Name: "Anthropic prod", CatalogId: "anthropic_api", ApiFlavor: "anthropic", Models: []string{"claude-sonnet-4-5"}}
-	bedrock := &proto.AgentNetworkProvider{Name: "Bedrock prod", CatalogId: "bedrock_api", Models: []string{"anthropic.claude-sonnet-4-5"}}
-	setup := anTestSetup(anthropic, bedrock)
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	joined := strings.Join(lines, "\n")
-	assert.NotContains(t, joined, "export ", "ambiguous provider choice must export nothing")
-	assert.Contains(t, joined, "--provider")
-	assert.Contains(t, joined, "Bedrock prod")
-
-	// Selection by operator label, case-insensitive.
-	lines, err = buildAgentNetworkEnv(setup, "bedrock prod", "")
-	require.NoError(t, err)
-	assert.Contains(t, lines, "export CLAUDE_CODE_USE_BEDROCK='1'")
-
-	// Selection by catalog id.
-	lines, err = buildAgentNetworkEnv(setup, "anthropic_api", "")
-	require.NoError(t, err)
-	assert.Contains(t, lines, "export ANTHROPIC_AUTH_TOKEN='netbird'")
-
-	// Unknown provider is an error naming the available ones.
-	_, err = buildAgentNetworkEnv(setup, "vertex", "")
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "Anthropic prod")
-}
-
-func TestBuildAgentNetworkEnv_AllModelsAllowed(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Anthropic prod", CatalogId: "anthropic_api", ApiFlavor: "anthropic",
-		AllModelsAllowed: true, Models: []string{"claude-sonnet-4-5"},
-	})
-
-	// A courtesy-listed single model is still ambiguous when everything is allowed.
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	assert.NotContains(t, strings.Join(lines, "\n"), "ANTHROPIC_MODEL=")
-
-	// --model passes without allowlist validation.
-	lines, err = buildAgentNetworkEnv(setup, "", "claude-opus-4-8")
-	require.NoError(t, err)
-	assert.Contains(t, lines, "export ANTHROPIC_MODEL='claude-opus-4-8'")
-}
-
-func TestBuildAgentNetworkEnv_UnknownFlavorFallsBackToComments(t *testing.T) {
-	setup := anTestSetup(&proto.AgentNetworkProvider{
-		Name: "Kimi", CatalogId: "kimi_api", ApiFlavor: "",
-		Models: []string{"kimi-k3"},
-	})
-
-	lines, err := buildAgentNetworkEnv(setup, "", "")
-	require.NoError(t, err)
-	joined := strings.Join(lines, "\n")
-	assert.NotContains(t, joined, "export ", "unknown API shape must not guess variables")
-	assert.Contains(t, joined, "https://calm-otter.proxy.example.com")
-}

client/cmd/root.go

@@ -171,9 +171,6 @@ func init() {
 	rootCmd.AddCommand(debugCmd)
 	rootCmd.AddCommand(profileCmd)
 	rootCmd.AddCommand(exposeCmd)
-	rootCmd.AddCommand(agentNetworkCmd)
-	agentNetworkCmd.AddCommand(agentNetworkLsCmd)
-	agentNetworkCmd.AddCommand(agentNetworkEnvCmd)
 
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)

client/internal/auth/sessionwatch/event.go

@@ -11,10 +11,11 @@ import (
 // emits.
 
 // Metadata keys attached by the daemon to session-warning SystemEvents.
-// The UI tray reads these to build a locale-aware notification without
-// relying on the daemon's locale-less UserMessage string, and to
-// disambiguate the T-WarningLead notification from the T-FinalWarningLead
-// fallback that auto-opens the SessionAboutToExpire dialog.
+// The notification text itself travels as a message key (see
+// proto.UserMsgSessionExpiresIn); these keys carry the structured deadline
+// the UI needs for its own countdown label, and disambiguate the
+// T-WarningLead notification from the T-FinalWarningLead fallback that
+// auto-opens the SessionAboutToExpire dialog.
 const (
 	// MetaSessionWarning is set to "true" on both warning events (T-10 and
 	// T-2) so the UI can detect a session-warning SystemEvent without
@@ -36,10 +37,9 @@ const (
 	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
 	// SystemEvent the daemon emits when it discards a deadline from the
 	// management server (pre-epoch, too far in the future, or past the
-	// clock-skew tolerance). The value is the rejection reason string.
-	// userMessage is left empty; the UI detects the event via this key
-	// and builds a localized notification — same pattern as the session
-	// warnings above.
+	// clock-skew tolerance). The value is the rejection reason string,
+	// which is diagnostic only: the user-facing text travels as
+	// proto.UserMsgSessionDeadlineReject.
 	MetaSessionDeadlineRejected = "session_deadline_rejected"
 )
 

client/internal/auth/sessionwatch/watcher.go

@@ -21,6 +21,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	cProto "github.com/netbirdio/netbird/client/proto"
+	nbstatus "github.com/netbirdio/netbird/client/status"
 )
 
 const (
@@ -80,7 +81,7 @@ type StatusRecorder interface {
 		severity cProto.SystemEvent_Severity,
 		category cProto.SystemEvent_Category,
 		message string,
-		userMessage string,
+		userMessage *cProto.UserMessage,
 		metadata map[string]string,
 	)
 }
@@ -376,7 +377,22 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_AUTHENTICATION,
 		message,
-		"",
+		warningUserMessage(deadline),
 		meta,
 	)
 }
+
+// warningUserMessage builds the localizable body for a session warning. The
+// remaining time is rendered here rather than in the UI so every consumer of the
+// event agrees on it; a deadline that is already gone (a warning delivered late)
+// drops to the variant without a countdown.
+func warningUserMessage(deadline time.Time) *cProto.UserMessage {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return cProto.NewUserMessage(cProto.UserMsgSessionExpiresSoon).
+			WithTitle(cProto.TitleSessionWarning)
+	}
+	return cProto.NewUserMessage(cProto.UserMsgSessionExpiresIn,
+		cProto.ArgRemaining, nbstatus.HumaniseDuration(remaining)).
+		WithTitle(cProto.TitleSessionWarning)
+}

client/internal/auth/sessionwatch/watcher_test.go

@@ -34,6 +34,9 @@ type event struct {
 	severity cProto.SystemEvent_Severity
 	category cProto.SystemEvent_Category
 	message  string
+	msgKey   cProto.UserMessageKey
+	titleKey cProto.UserMessageKey
+	msgArgs  map[string]string
 	meta     map[string]string
 }
 
@@ -62,7 +65,7 @@ func (r *fakeRecorder) PublishEvent(
 	severity cProto.SystemEvent_Severity,
 	category cProto.SystemEvent_Category,
 	message string,
-	_ string,
+	userMessage *cProto.UserMessage,
 	metadata map[string]string,
 ) {
 	r.mu.Lock()
@@ -72,6 +75,9 @@ func (r *fakeRecorder) PublishEvent(
 		severity: severity,
 		category: category,
 		message:  message,
+		msgKey:   userMessage.Key(),
+		titleKey: userMessage.TitleKey(),
+		msgArgs:  userMessage.Args(),
 		meta:     metadata,
 	})
 }
@@ -186,6 +192,33 @@ func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
 	}
 }
 
+// The UI localizes the warning body from the key rather than from the daemon's
+// English text, so a warning that ships no key would silently regress to English.
+func TestWarningCarriesLocalizableMessage(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Now().Add(80 * time.Millisecond))
+
+	events := waitForEvents(t, r, 2)
+	warning := events[1]
+	if !warning.isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", warning)
+	}
+	if warning.msgKey != cProto.UserMsgSessionExpiresIn {
+		t.Errorf("warning message key = %q, want %q", warning.msgKey, cProto.UserMsgSessionExpiresIn)
+	}
+	if warning.titleKey != cProto.TitleSessionWarning {
+		t.Errorf("warning title key = %q, want %q", warning.titleKey, cProto.TitleSessionWarning)
+	}
+	// The remaining time is rendered at publish time so every consumer of the
+	// event agrees on it; the exact value depends on timer slack.
+	if remaining := warning.msgArgs[cProto.ArgRemaining]; remaining == "" {
+		t.Errorf("warning is missing the %q argument, args=%v", cProto.ArgRemaining, warning.msgArgs)
+	}
+}
+
 func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r) // lead > delta => fire immediately

client/internal/connect.go

@@ -113,14 +113,11 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
-	notifier := tunnelnotifier.New(networkChangeListener, nil)
-	defer notifier.Close()
-
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: notifier,
+		NetworkChangeListener: networkChangeListener,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
@@ -166,7 +163,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 				rec.PublishEvent(
 					cProto.SystemEvent_CRITICAL, cProto.SystemEvent_SYSTEM,
 					"panic occurred",
-					"The Netbird service panicked. Please restart the service and submit a bug report with the client logs.",
+					cProto.NewUserMessage(cProto.UserMsgPanic),
 					nil,
 				)
 			}

client/internal/dns/notifier.go

@@ -51,5 +51,7 @@ func (n *notifier) notify() {
 		return
 	}
 
-	n.listener.OnNetworkChanged("")
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged("")
+	}(n.listener)
 }

client/internal/dns/server.go

@@ -252,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -602,12 +602,6 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	return s.searchDomains()
-}
-
-func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -692,7 +686,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)
@@ -1140,7 +1134,7 @@ func (s *DefaultServer) projectHealthy(p *nsGroupProj, servers []netip.AddrPort)
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_DNS,
 		"Nameserver group recovered",
-		"DNS servers are reachable again.",
+		proto.NewUserMessage(proto.UserMsgDNSRecovered),
 		map[string]string{"upstreams": joinAddrPorts(servers)},
 	)
 	p.warningActive = false
@@ -1163,7 +1157,7 @@ func (s *DefaultServer) projectUnhealthy(p *nsGroupProj, servers []netip.AddrPor
 			proto.SystemEvent_WARNING,
 			proto.SystemEvent_DNS,
 			"Nameserver group unreachable",
-			"Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+			proto.NewUserMessage(proto.UserMsgDNSUnreachable),
 			map[string]string{"upstreams": joinAddrPorts(servers)},
 		)
 		p.warningActive = true

client/internal/engine.go

@@ -572,7 +572,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	dnsServer, err := e.newDnsServer()
+	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
+	if err != nil {
+		return fmt.Errorf("read initial settings: %w", err)
+	}
+
+	dnsServer, err := e.newDnsServer(dnsConfig)
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -590,8 +595,10 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
+		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
+		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -1067,7 +1074,7 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
-	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", "", nil)
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", nil, nil)
 
 	return nil
 }
@@ -2095,6 +2102,42 @@ func (e *Engine) close() {
 	}
 }
 
+func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
+	if runtime.GOOS != "android" {
+		// nolint:nilnil
+		return nil, nil, false, nil
+	}
+
+	info := system.GetInfo(e.ctx)
+	info.SetFlags(
+		e.config.RosenpassEnabled,
+		e.config.RosenpassPermissive,
+		&e.config.ServerSSHAllowed,
+		e.config.DisableClientRoutes,
+		e.config.DisableServerRoutes,
+		e.config.DisableDNS,
+		e.config.DisableFirewall,
+		e.config.BlockLANAccess,
+		e.config.BlockInbound,
+		e.config.DisableIPv6,
+		e.config.SyncMessageVersion,
+		e.config.EnableSSHRoot,
+		e.config.EnableSSHSFTP,
+		e.config.EnableSSHLocalPortForwarding,
+		e.config.EnableSSHRemotePortForwarding,
+		e.config.DisableSSHAuth,
+	)
+
+	netMap, err := e.mgmClient.GetNetworkMap(info)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	routes := toRoutes(netMap.GetRoutes())
+	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
+	dnsFeatureFlag := toDNSFeatureFlag(netMap)
+	return routes, &dnsCfg, dnsFeatureFlag, nil
+}
+
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
 	transportNet, err := e.newStdNet()
 	if err != nil {
@@ -2129,7 +2172,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2142,7 +2185,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer() (dns.Server, error) {
+func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2154,7 +2197,7 @@ func (e *Engine) newDnsServer() (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			nbdns.Config{},
+			*dnsConfig,
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,
@@ -2200,19 +2243,6 @@ func (e *Engine) GetExposeManager() *expose.Manager {
 	return e.exposeManager
 }
 
-// GetAgentNetworkSetup asks the management server for the Agent Network
-// connection info this peer's groups authorize, over the engine's
-// existing management connection.
-func (e *Engine) GetAgentNetworkSetup(ctx context.Context) (*mgmProto.AgentNetworkSetupResponse, error) {
-	e.syncMsgMux.Lock()
-	mgmClient := e.mgmClient
-	e.syncMsgMux.Unlock()
-	if mgmClient == nil {
-		return nil, errors.New("management client not available")
-	}
-	return mgmClient.GetAgentNetworkSetup(ctx)
-}
-
 // IsBlockInbound returns whether inbound connections are blocked.
 func (e *Engine) IsBlockInbound() bool {
 	return e.config.BlockInbound

client/internal/engine_authsession.go

@@ -57,7 +57,8 @@ func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_AUTHENTICATION,
 			"session deadline rejected",
-			"",
+			cProto.NewUserMessage(cProto.UserMsgSessionDeadlineReject).
+				WithTitle(cProto.TitleSessionDeadlineReject),
 			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
 		)
 	}

client/internal/engine_tunsettings.go

@@ -1,20 +0,0 @@
-package internal
-
-func (e *Engine) TunSettings() ([]string, []string) {
-	e.syncMsgMux.Lock()
-	routeManager := e.routeManager
-	dnsServer := e.dnsServer
-	e.syncMsgMux.Unlock()
-
-	var routes []string
-	if routeManager != nil {
-		routes = routeManager.CurrentRouteRange()
-	}
-
-	var searchDomains []string
-	if dnsServer != nil {
-		searchDomains = dnsServer.SearchDomains()
-	}
-
-	return routes, searchDomains
-}

client/internal/peer/status.go

@@ -1281,12 +1281,15 @@ func (d *Status) numOfPeers() int {
 	return len(d.peers) + len(d.offlinePeers)
 }
 
-// PublishEvent adds an event to the queue and distributes it to all subscribers
+// PublishEvent adds an event to the queue and distributes it to all subscribers.
+// msg is the English log-facing description; userMsg is the localizable
+// user-facing message, or nil for an internal control event that must not
+// surface as a notification.
 func (d *Status) PublishEvent(
 	severity proto.SystemEvent_Severity,
 	category proto.SystemEvent_Category,
 	msg string,
-	userMsg string,
+	userMsg *proto.UserMessage,
 	metadata map[string]string,
 ) {
 	event := &proto.SystemEvent{
@@ -1294,7 +1297,10 @@ func (d *Status) PublishEvent(
 		Severity:    severity,
 		Category:    category,
 		Message:     msg,
-		UserMessage: userMsg,
+		UserMessage: userMsg.Text(),
+		MessageKey:  string(userMsg.Key()),
+		MessageArgs: userMsg.Args(),
+		TitleKey:    string(userMsg.TitleKey()),
 		Metadata:    metadata,
 		Timestamp:   timestamppb.Now(),
 	}

client/internal/profilemanager/state.go

@@ -45,35 +45,12 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-// SetProfileState writes the state file of the profile identified by id. Prefer
-// it over SetActiveProfileState whenever the caller knows which profile the data
-// belongs to: an SSO login spans seconds of user interaction, and the active
-// profile can change during it, which would file the account email under
-// whichever profile happened to be active when the flow returned.
-func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
-	if id == "" {
-		return fmt.Errorf("empty profile ID")
-	}
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid profile ID: %q", id)
-	}
-
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
-		return fmt.Errorf("write profile state: %w", err)
-	}
-
-	return nil
-}
-
-// SetActiveProfileState writes the state file of whichever profile is active at
-// call time. Use SetProfileState when the target profile is known.
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -82,7 +59,18 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	return pm.SetProfileState(activeProf.ID, state)
+	id := activeProf.ID
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid active profile ID: %q", id)
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
+	if err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
 }
 
 // RemoveProfileState deletes the per-profile state file (which holds the

client/internal/routemanager/client/client.go

@@ -403,7 +403,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_NETWORK,
 		"Default route added",
-		"Exit node connected.",
+		proto.NewUserMessage(proto.UserMsgExitNodeConnected),
 		meta,
 	)
 }
@@ -423,7 +423,7 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 
 	var severity proto.SystemEvent_Severity
 	var message string
-	var userMessage string
+	var userMessage *proto.UserMessage
 	meta := make(map[string]string)
 
 	if route != nil {
@@ -435,22 +435,22 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 	case reasonShutdown:
 		severity = proto.SystemEvent_INFO
 		message = "Default route removed"
-		userMessage = "Exit node disconnected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnected)
 	case reasonRouteUpdate:
 		severity = proto.SystemEvent_INFO
 		message = "Default route updated due to configuration change"
 	case reasonPeerUpdate:
 		severity = proto.SystemEvent_WARNING
 		message = "Default route disconnected due to peer unreachability"
-		userMessage = "Exit node connection lost. Your internet access might be affected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeConnectionLost)
 	case reasonHA:
 		severity = proto.SystemEvent_INFO
 		message = "Default route disconnected due to high availability change"
-		userMessage = "Exit node disconnected due to high availability change."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeHAChange)
 	default:
 		severity = proto.SystemEvent_ERROR
 		message = "Default route disconnected for unknown reasons"
-		userMessage = "Exit node disconnected for unknown reasons."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnectedUnknown)
 	}
 
 	w.statusRecorder.PublishEvent(

client/internal/routemanager/dnsinterceptor/handler.go

@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)

client/internal/routemanager/manager.go

@@ -8,13 +8,14 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -61,7 +62,7 @@ type Manager interface {
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	CurrentRouteRange() []string
+	InitialRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
 	ReconcilePeerAllowedIPs(peerKey string) error
@@ -75,8 +76,10 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
+	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
+	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -146,12 +149,45 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
+	// don't proceed with client routes if it is disabled
+	if config.DisableClientRoutes {
+		return dm
+	}
+
+	if runtime.GOOS == "android" {
+		dm.setupAndroidRoutes(config)
+	}
 	return dm
 }
+func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
+	cr := m.initialClientRoutes(config.InitialRoutes)
 
-func (m *DefaultManager) enableFakeIPRoutes() {
-	m.fakeIPManager = fakeip.NewManager()
-	m.notifier.NotifyRouteChange()
+	routesForComparison := slices.Clone(cr)
+
+	if config.DNSFeatureFlag {
+		m.fakeIPManager = fakeip.NewManager()
+
+		v4ID := uuid.NewString()
+		fakeIPRoute := &route.Route{
+			ID:          route.ID(v4ID),
+			Network:     m.fakeIPManager.GetFakeIPBlock(),
+			NetID:       route.NetID(v4ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv4Network,
+		}
+		v6ID := uuid.NewString()
+		fakeIPv6Route := &route.Route{
+			ID:          route.ID(v6ID),
+			Network:     m.fakeIPManager.GetFakeIPv6Block(),
+			NetID:       route.NetID(v6ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv6Network,
+		}
+		cr = append(cr, fakeIPRoute, fakeIPv6Route)
+		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
+	}
+
+	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -428,9 +464,6 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
-		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
-			m.enableFakeIPRoutes()
-		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -467,32 +500,9 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
-func (m *DefaultManager) CurrentRouteRange() []string {
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	if m.disableClientRoutes {
-		return nil
-	}
-
-	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
-	var nets []string
-	for _, routes := range filtered {
-		for _, r := range routes {
-			if r.IsDynamic() {
-				continue
-			}
-			nets = append(nets, r.NetString())
-		}
-	}
-
-	if m.fakeIPManager != nil {
-		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
-	}
-
-	sort.Strings(nets)
-	return nets
+// InitialRouteRange return the list of initial routes. It used by mobile systems
+func (m *DefaultManager) InitialRouteRange() []string {
+	return m.notifier.GetInitialRouteRanges()
 }
 
 // GetRouteSelector returns the route selector
@@ -690,6 +700,16 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
+func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
+	_, crMap := m.ClassifyRoutes(initialRoutes)
+	rs := make([]*route.Route, 0, len(crMap))
+	for _, routes := range crMap {
+		rs = append(rs, routes...)
+	}
+
+	return rs
+}
+
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true

client/internal/routemanager/mock.go

@@ -30,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
-func (m *MockManager) CurrentRouteRange() []string {
+// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
+func (m *MockManager) InitialRouteRange() []string {
 	return nil
 }
 

client/internal/routemanager/notifier/notifier_android.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"slices"
 	"sort"
+	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -13,15 +14,12 @@ import (
 )
 
 type Notifier struct {
-	mu sync.Mutex
-
-	// currentRoutes is the last announced route set. It exists only to
-	// suppress noise: without it every network map sync would trigger the
-	// Java side, even when the routes did not change. The actual TUN route
-	// state is owned by the route manager and pulled from there.
+	initialRoutes []*route.Route
 	currentRoutes []*route.Route
+	fakeIPRoutes  []*route.Route
 
-	listener listener.NetworkChangeListener
+	listener    listener.NetworkChangeListener
+	listenerMux sync.Mutex
 }
 
 func NewNotifier() *Notifier {
@@ -29,15 +27,20 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.notifyLocked()
+// SetInitialClientRoutes stores the initial route sets for TUN configuration.
+func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
+	n.initialRoutes = filterStatic(initialRoutes)
+	n.currentRoutes = filterStatic(routesForComparison)
+}
+
+// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
+func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
+	n.fakeIPRoutes = routes
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -51,32 +54,46 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if !hasRouteDiff(n.currentRoutes, newRoutes) {
+	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notifyLocked()
+	n.notify()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notifyLocked() {
+func (n *Notifier) notify() {
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	if n.listener == nil {
 		return
 	}
-	n.listener.OnNetworkChanged("")
+
+	allRoutes := slices.Clone(n.currentRoutes)
+	allRoutes = append(allRoutes, n.fakeIPRoutes...)
+
+	routeStrings := n.routesToStrings(allRoutes)
+	sort.Strings(routeStrings)
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged(strings.Join(routeStrings, ","))
+	}(n.listener)
 }
 
-func (n *Notifier) Close() {
-	// unused
+func filterStatic(routes []*route.Route) []*route.Route {
+	out := make([]*route.Route, 0, len(routes))
+	for _, r := range routes {
+		if !r.IsDynamic() {
+			out = append(out, r)
+		}
+	}
+	return out
 }
 
-func routesToStrings(routes []*route.Route) []string {
+func (n *Notifier) routesToStrings(routes []*route.Route) []string {
 	nets := make([]string, 0, len(routes))
 	for _, r := range routes {
 		nets = append(nets, r.NetString())
@@ -84,10 +101,25 @@ func routesToStrings(routes []*route.Route) []string {
 	return nets
 }
 
-func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	as := routesToStrings(a)
-	bs := routesToStrings(b)
-	sort.Strings(as)
-	sort.Strings(bs)
-	return !slices.Equal(as, bs)
+func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	slices.SortFunc(a, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+	slices.SortFunc(b, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+
+	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
+		return x.NetString() == y.NetString()
+	})
+}
+
+func (n *Notifier) GetInitialRouteRanges() []string {
+	initialStrings := n.routesToStrings(n.initialRoutes)
+	sort.Strings(initialStrings)
+	return initialStrings
+}
+
+func (n *Notifier) Close() {
+	// unused
 }

client/internal/routemanager/notifier/notifier_ios.go

@@ -29,7 +29,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// iOS doesn't care about initial routes
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on iOS
 }
 

client/internal/routemanager/notifier/notifier_other.go

@@ -19,7 +19,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// Not used on non-mobile platforms
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on non-mobile platforms
 }
 
@@ -31,6 +35,10 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
+func (n *Notifier) GetInitialRouteRanges() []string {
+	return []string{}
+}
+
 func (n *Notifier) Close() {
 	// unused
 }

client/internal/updater/installer/installer_run_darwin.go

@@ -98,44 +98,47 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	username, err := consoleUser()
+	// Get the current console user
+	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
+	output, err := cmd.Output()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get console user: %w", err)
 	}
 
+	username := strings.TrimSpace(string(output))
+	if username == "" || username == "root" {
+		return fmt.Errorf("no active user session found")
+	}
+
+	log.Infof("starting UI for user: %s", username)
+
+	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("lookup user %s: %w", username, err)
+		return fmt.Errorf("failed to lookup user %s: %w", username, err)
 	}
 
-	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
-
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
+	// Start the UI process as the console user using launchctl
+	// This ensures the app runs in the user's context with proper GUI access
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
+	// Set the user's home directory for proper macOS app behavior
+	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
+	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Run(); err != nil {
-		return fmt.Errorf("run UI launch: %w", err)
+	if err := launchCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start UI process: %w", err)
+	}
+
+	// Release the process so it can run independently
+	if err := launchCmd.Process.Release(); err != nil {
+		log.Warnf("failed to release UI process: %v", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
-func consoleUser() (string, error) {
-	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
-	if err != nil {
-		return "", fmt.Errorf("get console user: %w", err)
-	}
-
-	username := strings.TrimSpace(string(output))
-	switch username {
-	case "", "root", "loginwindow", "_mbsetupuser":
-		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
-	}
-
-	return username, nil
-}
-
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 

client/internal/updater/manager.go

@@ -94,7 +94,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %s", reason),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, reason),
 			nil,
 		)
 	}
@@ -115,7 +115,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update completed",
-			fmt.Sprintf("Your NetBird Client was auto-updated to version %s", m.currentVersion),
+			cProto.NewUserMessage(cProto.UserMsgUpdateCompleted, cProto.ArgVersion, m.currentVersion),
 			nil,
 		)
 		return
@@ -272,7 +272,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": latestVersion.String()},
 		)
 		return
@@ -283,7 +283,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": pendingVersion.String(), "enforced": "true"},
 		)
 	}
@@ -384,7 +384,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": updateVersion.String()},
 		)
 		return
@@ -401,7 +401,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		cProto.SystemEvent_INFO,
 		cProto.SystemEvent_SYSTEM,
 		"New version available",
-		"",
+		nil,
 		map[string]string{"new_version_available": updateVersion.String(), "enforced": "true"},
 	)
 }
@@ -411,14 +411,14 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"Updating client",
-		"Installing update now.",
+		cProto.NewUserMessage(cProto.UserMsgUpdateInstalling),
 		nil,
 	)
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"",
-		"",
+		nil,
 		map[string]string{"progress_window": "show", "version": pendingVersion.String()},
 	)
 
@@ -441,7 +441,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %v", err),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, err.Error()),
 			nil,
 		)
 		return err

client/proto/daemon.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.6
-// 	protoc        v7.34.1
+// 	protoc        v6.33.1
 // source: daemon.proto
 
 package proto
@@ -3909,14 +3909,30 @@ func (*SubscribeRequest) Descriptor() ([]byte, []int) {
 }
 
 type SystemEvent struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Severity      SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
-	Category      SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
-	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
-	UserMessage   string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
-	Timestamp     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
-	Metadata      map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	Id       string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Severity SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
+	Category SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
+	Message  string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	// userMessage is the daemon's English rendering of messageKey, kept for the
+	// CLI and for UIs that predate messageKey. UIs that localise read messageKey
+	// and treat this as the fallback.
+	UserMessage string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
+	Timestamp   *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	Metadata    map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// messageKey names a user-facing message in a stable, locale-independent
+	// form. A UI resolves it against its own translation bundle and substitutes
+	// messageArgs; an unrecognised key falls back to userMessage. Empty on events
+	// that carry no user-facing text.
+	MessageKey string `protobuf:"bytes,8,opt,name=messageKey,proto3" json:"messageKey,omitempty"`
+	// messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+	// {"version": "0.60.1"} for a "{version}" template. Values are data the
+	// daemon cannot localise (versions, addresses, error text).
+	MessageArgs map[string]string `protobuf:"bytes,9,rep,name=messageArgs,proto3" json:"messageArgs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// titleKey names the notification title in the same way as messageKey. Empty
+	// when the event has no dedicated title, in which case a UI composes one from
+	// severity and category.
+	TitleKey      string `protobuf:"bytes,10,opt,name=titleKey,proto3" json:"titleKey,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4000,6 +4016,27 @@ func (x *SystemEvent) GetMetadata() map[string]string {
 	return nil
 }
 
+func (x *SystemEvent) GetMessageKey() string {
+	if x != nil {
+		return x.MessageKey
+	}
+	return ""
+}
+
+func (x *SystemEvent) GetMessageArgs() map[string]string {
+	if x != nil {
+		return x.MessageArgs
+	}
+	return nil
+}
+
+func (x *SystemEvent) GetTitleKey() string {
+	if x != nil {
+		return x.TitleKey
+	}
+	return ""
+}
+
 type GetEventsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -6941,190 +6978,6 @@ func (*StopBundleCaptureResponse) Descriptor() ([]byte, []int) {
 	return file_daemon_proto_rawDescGZIP(), []int{106}
 }
 
-type GetAgentNetworkSetupRequest struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetAgentNetworkSetupRequest) Reset() {
-	*x = GetAgentNetworkSetupRequest{}
-	mi := &file_daemon_proto_msgTypes[107]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetAgentNetworkSetupRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetAgentNetworkSetupRequest) ProtoMessage() {}
-
-func (x *GetAgentNetworkSetupRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[107]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetAgentNetworkSetupRequest.ProtoReflect.Descriptor instead.
-func (*GetAgentNetworkSetupRequest) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{107}
-}
-
-type GetAgentNetworkSetupResponse struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// configured is false when the account has no Agent Network set up or
-	// this peer's groups authorize none of it.
-	Configured bool `protobuf:"varint,1,opt,name=configured,proto3" json:"configured,omitempty"`
-	// endpoint is the account's proxy base URL, reachable over the NetBird
-	// tunnel only. Empty when configured is false.
-	Endpoint      string                  `protobuf:"bytes,2,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
-	Providers     []*AgentNetworkProvider `protobuf:"bytes,3,rep,name=providers,proto3" json:"providers,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *GetAgentNetworkSetupResponse) Reset() {
-	*x = GetAgentNetworkSetupResponse{}
-	mi := &file_daemon_proto_msgTypes[108]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *GetAgentNetworkSetupResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetAgentNetworkSetupResponse) ProtoMessage() {}
-
-func (x *GetAgentNetworkSetupResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[108]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetAgentNetworkSetupResponse.ProtoReflect.Descriptor instead.
-func (*GetAgentNetworkSetupResponse) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{108}
-}
-
-func (x *GetAgentNetworkSetupResponse) GetConfigured() bool {
-	if x != nil {
-		return x.Configured
-	}
-	return false
-}
-
-func (x *GetAgentNetworkSetupResponse) GetEndpoint() string {
-	if x != nil {
-		return x.Endpoint
-	}
-	return ""
-}
-
-func (x *GetAgentNetworkSetupResponse) GetProviders() []*AgentNetworkProvider {
-	if x != nil {
-		return x.Providers
-	}
-	return nil
-}
-
-type AgentNetworkProvider struct {
-	state protoimpl.MessageState `protogen:"open.v1"`
-	// name is the operator-assigned provider label, e.g. "Bedrock prod".
-	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	// catalog_id names the provider type, e.g. "anthropic_api", "bedrock_api".
-	CatalogId string `protobuf:"bytes,2,opt,name=catalog_id,json=catalogId,proto3" json:"catalog_id,omitempty"`
-	// api_flavor is the request-body shape the provider speaks ("anthropic",
-	// "openai"); empty when the proxy dispatches it by URL path instead.
-	ApiFlavor string `protobuf:"bytes,3,opt,name=api_flavor,json=apiFlavor,proto3" json:"api_flavor,omitempty"`
-	// all_models_allowed is true when no model allowlist restricts this
-	// provider for the caller.
-	AllModelsAllowed bool `protobuf:"varint,4,opt,name=all_models_allowed,json=allModelsAllowed,proto3" json:"all_models_allowed,omitempty"`
-	// models is the effective model allowlist (or the declared/catalog models
-	// when all_models_allowed is true).
-	Models        []string `protobuf:"bytes,5,rep,name=models,proto3" json:"models,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
-}
-
-func (x *AgentNetworkProvider) Reset() {
-	*x = AgentNetworkProvider{}
-	mi := &file_daemon_proto_msgTypes[109]
-	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-	ms.StoreMessageInfo(mi)
-}
-
-func (x *AgentNetworkProvider) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*AgentNetworkProvider) ProtoMessage() {}
-
-func (x *AgentNetworkProvider) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[109]
-	if x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use AgentNetworkProvider.ProtoReflect.Descriptor instead.
-func (*AgentNetworkProvider) Descriptor() ([]byte, []int) {
-	return file_daemon_proto_rawDescGZIP(), []int{109}
-}
-
-func (x *AgentNetworkProvider) GetName() string {
-	if x != nil {
-		return x.Name
-	}
-	return ""
-}
-
-func (x *AgentNetworkProvider) GetCatalogId() string {
-	if x != nil {
-		return x.CatalogId
-	}
-	return ""
-}
-
-func (x *AgentNetworkProvider) GetApiFlavor() string {
-	if x != nil {
-		return x.ApiFlavor
-	}
-	return ""
-}
-
-func (x *AgentNetworkProvider) GetAllModelsAllowed() bool {
-	if x != nil {
-		return x.AllModelsAllowed
-	}
-	return false
-}
-
-func (x *AgentNetworkProvider) GetModels() []string {
-	if x != nil {
-		return x.Models
-	}
-	return nil
-}
-
 type PortInfo_Range struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Start         uint32                 `protobuf:"varint,1,opt,name=start,proto3" json:"start,omitempty"`
@@ -7135,7 +6988,7 @@ type PortInfo_Range struct {
 
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
-	mi := &file_daemon_proto_msgTypes[111]
+	mi := &file_daemon_proto_msgTypes[108]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -7147,7 +7000,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_daemon_proto_msgTypes[111]
+	mi := &file_daemon_proto_msgTypes[108]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -7516,7 +7369,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x13TracePacketResponse\x12*\n" +
 	"\x06stages\x18\x01 \x03(\v2\x12.daemon.TraceStageR\x06stages\x12+\n" +
 	"\x11final_disposition\x18\x02 \x01(\bR\x10finalDisposition\"\x12\n" +
-	"\x10SubscribeRequest\"\x93\x04\n" +
+	"\x10SubscribeRequest\"\xd7\x05\n" +
 	"\vSystemEvent\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x128\n" +
 	"\bseverity\x18\x02 \x01(\x0e2\x1c.daemon.SystemEvent.SeverityR\bseverity\x128\n" +
@@ -7524,9 +7377,18 @@ const file_daemon_proto_rawDesc = "" +
 	"\amessage\x18\x04 \x01(\tR\amessage\x12 \n" +
 	"\vuserMessage\x18\x05 \x01(\tR\vuserMessage\x128\n" +
 	"\ttimestamp\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12=\n" +
-	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x1a;\n" +
+	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x12\x1e\n" +
+	"\n" +
+	"messageKey\x18\b \x01(\tR\n" +
+	"messageKey\x12F\n" +
+	"\vmessageArgs\x18\t \x03(\v2$.daemon.SystemEvent.MessageArgsEntryR\vmessageArgs\x12\x1a\n" +
+	"\btitleKey\x18\n" +
+	" \x01(\tR\btitleKey\x1a;\n" +
 	"\rMetadataEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10MessageArgsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\":\n" +
 	"\bSeverity\x12\b\n" +
 	"\x04INFO\x10\x00\x12\v\n" +
@@ -7761,22 +7623,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\atimeout\x18\x01 \x01(\v2\x19.google.protobuf.DurationR\atimeout\"\x1c\n" +
 	"\x1aStartBundleCaptureResponse\"\x1a\n" +
 	"\x18StopBundleCaptureRequest\"\x1b\n" +
-	"\x19StopBundleCaptureResponse\"\x1d\n" +
-	"\x1bGetAgentNetworkSetupRequest\"\x96\x01\n" +
-	"\x1cGetAgentNetworkSetupResponse\x12\x1e\n" +
-	"\n" +
-	"configured\x18\x01 \x01(\bR\n" +
-	"configured\x12\x1a\n" +
-	"\bendpoint\x18\x02 \x01(\tR\bendpoint\x12:\n" +
-	"\tproviders\x18\x03 \x03(\v2\x1c.daemon.AgentNetworkProviderR\tproviders\"\xae\x01\n" +
-	"\x14AgentNetworkProvider\x12\x12\n" +
-	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1d\n" +
-	"\n" +
-	"catalog_id\x18\x02 \x01(\tR\tcatalogId\x12\x1d\n" +
-	"\n" +
-	"api_flavor\x18\x03 \x01(\tR\tapiFlavor\x12,\n" +
-	"\x12all_models_allowed\x18\x04 \x01(\bR\x10allModelsAllowed\x12\x16\n" +
-	"\x06models\x18\x05 \x03(\tR\x06models*b\n" +
+	"\x19StopBundleCaptureResponse*b\n" +
 	"\bLogLevel\x12\v\n" +
 	"\aUNKNOWN\x10\x00\x12\t\n" +
 	"\x05PANIC\x10\x01\x12\t\n" +
@@ -7794,7 +7641,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"EXPOSE_UDP\x10\x03\x12\x0e\n" +
 	"\n" +
-	"EXPOSE_TLS\x10\x042\x88\x1d\n" +
+	"EXPOSE_TLS\x10\x042\xa3\x1c\n" +
 	"\rDaemonService\x126\n" +
 	"\x05Login\x12\x14.daemon.LoginRequest\x1a\x15.daemon.LoginResponse\"\x00\x12K\n" +
 	"\fWaitSSOLogin\x12\x1b.daemon.WaitSSOLoginRequest\x1a\x1c.daemon.WaitSSOLoginResponse\"\x00\x12-\n" +
@@ -7844,8 +7691,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x0eStopCPUProfile\x12\x1d.daemon.StopCPUProfileRequest\x1a\x1e.daemon.StopCPUProfileResponse\"\x00\x12W\n" +
 	"\x12GetInstallerResult\x12\x1e.daemon.InstallerResultRequest\x1a\x1f.daemon.InstallerResultResponse\"\x00\x12M\n" +
 	"\rExposeService\x12\x1c.daemon.ExposeServiceRequest\x1a\x1a.daemon.ExposeServiceEvent\"\x000\x01\x12K\n" +
-	"\fWailsUIReady\x12\x1b.daemon.WailsUIReadyRequest\x1a\x1c.daemon.WailsUIReadyResponse\"\x00\x12c\n" +
-	"\x14GetAgentNetworkSetup\x12#.daemon.GetAgentNetworkSetupRequest\x1a$.daemon.GetAgentNetworkSetupResponse\"\x00B\bZ\x06/protob\x06proto3"
+	"\fWailsUIReady\x12\x1b.daemon.WailsUIReadyRequest\x1a\x1c.daemon.WailsUIReadyResponse\"\x00B\bZ\x06/protob\x06proto3"
 
 var (
 	file_daemon_proto_rawDescOnce sync.Once
@@ -7860,7 +7706,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 113)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 111)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7973,22 +7819,20 @@ var file_daemon_proto_goTypes = []any{
 	(*StartBundleCaptureResponse)(nil),         // 108: daemon.StartBundleCaptureResponse
 	(*StopBundleCaptureRequest)(nil),           // 109: daemon.StopBundleCaptureRequest
 	(*StopBundleCaptureResponse)(nil),          // 110: daemon.StopBundleCaptureResponse
-	(*GetAgentNetworkSetupRequest)(nil),        // 111: daemon.GetAgentNetworkSetupRequest
-	(*GetAgentNetworkSetupResponse)(nil),       // 112: daemon.GetAgentNetworkSetupResponse
-	(*AgentNetworkProvider)(nil),               // 113: daemon.AgentNetworkProvider
-	nil,                                        // 114: daemon.Network.ResolvedIPsEntry
-	(*PortInfo_Range)(nil),                     // 115: daemon.PortInfo.Range
-	nil,                                        // 116: daemon.SystemEvent.MetadataEntry
-	(*durationpb.Duration)(nil),                // 117: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 118: google.protobuf.Timestamp
+	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
+	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
+	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
+	nil,                                        // 114: daemon.SystemEvent.MessageArgsEntry
+	(*durationpb.Duration)(nil),                // 115: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 116: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	117, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	115, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	118, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	118, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	118, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	117, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	116, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	116, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	116, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	115, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
 	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
 	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
 	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
@@ -7999,8 +7843,8 @@ var file_daemon_proto_depIdxs = []int32{
 	57,  // 13: daemon.FullStatus.events:type_name -> daemon.SystemEvent
 	24,  // 14: daemon.FullStatus.sshServerState:type_name -> daemon.SSHServerState
 	31,  // 15: daemon.ListNetworksResponse.routes:type_name -> daemon.Network
-	114, // 16: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
-	115, // 17: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
+	111, // 16: daemon.Network.resolvedIPs:type_name -> daemon.Network.ResolvedIPsEntry
+	112, // 17: daemon.PortInfo.range:type_name -> daemon.PortInfo.Range
 	32,  // 18: daemon.ForwardingRule.destinationPort:type_name -> daemon.PortInfo
 	32,  // 19: daemon.ForwardingRule.translatedPort:type_name -> daemon.PortInfo
 	33,  // 20: daemon.ForwardingRulesResponse.rules:type_name -> daemon.ForwardingRule
@@ -8011,17 +7855,17 @@ var file_daemon_proto_depIdxs = []int32{
 	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
 	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
 	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	118, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
-	116, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	117, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	118, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	117, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	117, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	113, // 38: daemon.GetAgentNetworkSetupResponse.providers:type_name -> daemon.AgentNetworkProvider
+	116, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
+	114, // 30: daemon.SystemEvent.messageArgs:type_name -> daemon.SystemEvent.MessageArgsEntry
+	57,  // 31: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	115, // 32: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 33: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	116, // 34: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 35: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 36: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	115, // 37: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	115, // 38: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
 	30,  // 39: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
 	5,   // 40: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
 	7,   // 41: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
@@ -8069,56 +7913,54 @@ var file_daemon_proto_depIdxs = []int32{
 	100, // 83: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
 	102, // 84: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
 	77,  // 85: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
-	111, // 86: daemon.DaemonService.GetAgentNetworkSetup:input_type -> daemon.GetAgentNetworkSetupRequest
-	6,   // 87: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 88: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 89: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 90: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	12,  // 91: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
-	14,  // 92: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 93: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 94: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 95: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 96: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 97: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 98: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 99: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 100: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	45,  // 101: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	47,  // 102: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	49,  // 103: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	51,  // 104: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	55,  // 105: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	106, // 106: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	108, // 107: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	110, // 108: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	57,  // 109: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	59,  // 110: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	42,  // 111: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
-	61,  // 112: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	63,  // 113: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	65,  // 114: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	67,  // 115: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	69,  // 116: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	71,  // 117: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	74,  // 118: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	76,  // 119: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	80,  // 120: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	83,  // 121: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	85,  // 122: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	87,  // 123: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	89,  // 124: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	91,  // 125: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
-	93,  // 126: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
-	95,  // 127: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
-	97,  // 128: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	99,  // 129: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	101, // 130: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	103, // 131: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	78,  // 132: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
-	112, // 133: daemon.DaemonService.GetAgentNetworkSetup:output_type -> daemon.GetAgentNetworkSetupResponse
-	87,  // [87:134] is the sub-list for method output_type
-	40,  // [40:87] is the sub-list for method input_type
+	6,   // 86: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 87: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 88: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 89: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 90: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 91: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 92: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 93: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 94: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 95: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 96: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 97: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 98: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 99: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 100: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 101: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 102: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 103: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 104: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 105: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 106: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 107: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 108: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 109: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 110: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 111: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 112: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 113: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 114: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 115: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 116: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 117: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 118: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 119: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 120: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 121: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 122: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 123: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 124: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 125: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 126: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 127: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 128: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 129: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 130: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 131: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	86,  // [86:132] is the sub-list for method output_type
+	40,  // [40:86] is the sub-list for method input_type
 	40,  // [40:40] is the sub-list for extension type_name
 	40,  // [40:40] is the sub-list for extension extendee
 	0,   // [0:40] is the sub-list for field type_name
@@ -8153,7 +7995,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   113,
+			NumMessages:   111,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

client/proto/daemon.pb.gw.go

@@ -1123,30 +1123,6 @@ func local_request_DaemonService_WailsUIReady_0(ctx context.Context, marshaler r
 	return msg, metadata, err
 }
 
-func request_DaemonService_GetAgentNetworkSetup_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq GetAgentNetworkSetupRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := client.GetAgentNetworkSetup(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
-	return msg, metadata, err
-}
-
-func local_request_DaemonService_GetAgentNetworkSetup_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
-	var (
-		protoReq GetAgentNetworkSetupRequest
-		metadata runtime.ServerMetadata
-	)
-	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
-		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
-	}
-	msg, err := server.GetAgentNetworkSetup(ctx, &protoReq)
-	return msg, metadata, err
-}
-
 // RegisterDaemonServiceHandlerServer registers the http handlers for service DaemonService to "mux".
 // UnaryRPC     :call DaemonServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
@@ -2021,26 +1997,6 @@ func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_GetAgentNetworkSetup_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		var stream runtime.ServerTransportStream
-		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/GetAgentNetworkSetup", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetAgentNetworkSetup"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := local_request_DaemonService_GetAgentNetworkSetup_0(annotatedContext, inboundMarshaler, server, req, pathParams)
-		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_GetAgentNetworkSetup_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
 
 	return nil
 }
@@ -2863,23 +2819,6 @@ func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_WailsUIReady_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
 	})
-	mux.Handle(http.MethodPost, pattern_DaemonService_GetAgentNetworkSetup_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
-		ctx, cancel := context.WithCancel(req.Context())
-		defer cancel()
-		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
-		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/GetAgentNetworkSetup", runtime.WithHTTPPathPattern("/daemon.DaemonService/GetAgentNetworkSetup"))
-		if err != nil {
-			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		resp, md, err := request_DaemonService_GetAgentNetworkSetup_0(annotatedContext, inboundMarshaler, client, req, pathParams)
-		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
-		if err != nil {
-			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
-			return
-		}
-		forward_DaemonService_GetAgentNetworkSetup_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
-	})
 	return nil
 }
 
@@ -2930,7 +2869,6 @@ var (
 	pattern_DaemonService_GetInstallerResult_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetInstallerResult"}, ""))
 	pattern_DaemonService_ExposeService_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ExposeService"}, ""))
 	pattern_DaemonService_WailsUIReady_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WailsUIReady"}, ""))
-	pattern_DaemonService_GetAgentNetworkSetup_0       = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetAgentNetworkSetup"}, ""))
 )
 
 var (
@@ -2980,5 +2918,4 @@ var (
 	forward_DaemonService_GetInstallerResult_0         = runtime.ForwardResponseMessage
 	forward_DaemonService_ExposeService_0              = runtime.ForwardResponseStream
 	forward_DaemonService_WailsUIReady_0               = runtime.ForwardResponseMessage
-	forward_DaemonService_GetAgentNetworkSetup_0       = runtime.ForwardResponseMessage
 )

client/proto/daemon.proto

@@ -156,12 +156,6 @@ service DaemonService {
   // only cares whether the daemon implements it: an Unimplemented response
   // means the daemon predates this UI and is too old to drive it.
   rpc WailsUIReady(WailsUIReadyRequest) returns (WailsUIReadyResponse) {}
-
-  // GetAgentNetworkSetup returns the Agent Network connection info this
-  // peer's groups authorize: proxy endpoint plus effective providers and
-  // models. The daemon relays the request to management over its existing
-  // peer connection, so unprivileged CLI callers get a caller-scoped answer.
-  rpc GetAgentNetworkSetup(GetAgentNetworkSetupRequest) returns (GetAgentNetworkSetupResponse) {}
 }
 
 
@@ -683,9 +677,25 @@ message SystemEvent {
   Severity severity = 2;
   Category category = 3;
   string message = 4;
+  // userMessage is the daemon's English rendering of messageKey, kept for the
+  // CLI and for UIs that predate messageKey. UIs that localise read messageKey
+  // and treat this as the fallback.
   string userMessage = 5;
   google.protobuf.Timestamp timestamp = 6;
   map<string, string> metadata = 7;
+  // messageKey names a user-facing message in a stable, locale-independent
+  // form. A UI resolves it against its own translation bundle and substitutes
+  // messageArgs; an unrecognised key falls back to userMessage. Empty on events
+  // that carry no user-facing text.
+  string messageKey = 8;
+  // messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+  // {"version": "0.60.1"} for a "{version}" template. Values are data the
+  // daemon cannot localise (versions, addresses, error text).
+  map<string, string> messageArgs = 9;
+  // titleKey names the notification title in the same way as messageKey. Empty
+  // when the event has no dedicated title, in which case a UI composes one from
+  // severity and category.
+  string titleKey = 10;
 }
 
 message GetEventsRequest {}
@@ -1056,31 +1066,3 @@ message StartBundleCaptureRequest {
 message StartBundleCaptureResponse {}
 message StopBundleCaptureRequest {}
 message StopBundleCaptureResponse {}
-
-message GetAgentNetworkSetupRequest {}
-
-message GetAgentNetworkSetupResponse {
-  // configured is false when the account has no Agent Network set up or
-  // this peer's groups authorize none of it.
-  bool configured = 1;
-  // endpoint is the account's proxy base URL, reachable over the NetBird
-  // tunnel only. Empty when configured is false.
-  string endpoint = 2;
-  repeated AgentNetworkProvider providers = 3;
-}
-
-message AgentNetworkProvider {
-  // name is the operator-assigned provider label, e.g. "Bedrock prod".
-  string name = 1;
-  // catalog_id names the provider type, e.g. "anthropic_api", "bedrock_api".
-  string catalog_id = 2;
-  // api_flavor is the request-body shape the provider speaks ("anthropic",
-  // "openai"); empty when the proxy dispatches it by URL path instead.
-  string api_flavor = 3;
-  // all_models_allowed is true when no model allowlist restricts this
-  // provider for the caller.
-  bool all_models_allowed = 4;
-  // models is the effective model allowlist (or the declared/catalog models
-  // when all_models_allowed is true).
-  repeated string models = 5;
-}

client/proto/daemon_grpc.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.1
+// - protoc             v6.33.1
 // source: daemon.proto
 
 package proto
@@ -65,7 +65,6 @@ const (
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
 	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
-	DaemonService_GetAgentNetworkSetup_FullMethodName       = "/daemon.DaemonService/GetAgentNetworkSetup"
 )
 
 // DaemonServiceClient is the client API for DaemonService service.
@@ -172,11 +171,6 @@ type DaemonServiceClient interface {
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
 	WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error)
-	// GetAgentNetworkSetup returns the Agent Network connection info this
-	// peer's groups authorize: proxy endpoint plus effective providers and
-	// models. The daemon relays the request to management over its existing
-	// peer connection, so unprivileged CLI callers get a caller-scoped answer.
-	GetAgentNetworkSetup(ctx context.Context, in *GetAgentNetworkSetupRequest, opts ...grpc.CallOption) (*GetAgentNetworkSetupResponse, error)
 }
 
 type daemonServiceClient struct {
@@ -683,16 +677,6 @@ func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReady
 	return out, nil
 }
 
-func (c *daemonServiceClient) GetAgentNetworkSetup(ctx context.Context, in *GetAgentNetworkSetupRequest, opts ...grpc.CallOption) (*GetAgentNetworkSetupResponse, error) {
-	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
-	out := new(GetAgentNetworkSetupResponse)
-	err := c.cc.Invoke(ctx, DaemonService_GetAgentNetworkSetup_FullMethodName, in, out, cOpts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
 // DaemonServiceServer is the server API for DaemonService service.
 // All implementations must embed UnimplementedDaemonServiceServer
 // for forward compatibility.
@@ -797,11 +781,6 @@ type DaemonServiceServer interface {
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
 	WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error)
-	// GetAgentNetworkSetup returns the Agent Network connection info this
-	// peer's groups authorize: proxy endpoint plus effective providers and
-	// models. The daemon relays the request to management over its existing
-	// peer connection, so unprivileged CLI callers get a caller-scoped answer.
-	GetAgentNetworkSetup(context.Context, *GetAgentNetworkSetupRequest) (*GetAgentNetworkSetupResponse, error)
 	mustEmbedUnimplementedDaemonServiceServer()
 }
 
@@ -950,9 +929,6 @@ func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grp
 func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
 }
-func (UnimplementedDaemonServiceServer) GetAgentNetworkSetup(context.Context, *GetAgentNetworkSetupRequest) (*GetAgentNetworkSetupResponse, error) {
-	return nil, status.Error(codes.Unimplemented, "method GetAgentNetworkSetup not implemented")
-}
 func (UnimplementedDaemonServiceServer) mustEmbedUnimplementedDaemonServiceServer() {}
 func (UnimplementedDaemonServiceServer) testEmbeddedByValue()                       {}
 
@@ -1774,24 +1750,6 @@ func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, d
 	return interceptor(ctx, in, info, handler)
 }
 
-func _DaemonService_GetAgentNetworkSetup_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetAgentNetworkSetupRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(DaemonServiceServer).GetAgentNetworkSetup(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: DaemonService_GetAgentNetworkSetup_FullMethodName,
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServiceServer).GetAgentNetworkSetup(ctx, req.(*GetAgentNetworkSetupRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
 // DaemonService_ServiceDesc is the grpc.ServiceDesc for DaemonService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -1967,10 +1925,6 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "WailsUIReady",
 			Handler:    _DaemonService_WailsUIReady_Handler,
 		},
-		{
-			MethodName: "GetAgentNetworkSetup",
-			Handler:    _DaemonService_GetAgentNetworkSetup_Handler,
-		},
 	},
 	Streams: []grpc.StreamDesc{
 		{

client/proto/metadata.go

@@ -43,10 +43,10 @@ const (
 	// UIs to re-fetch their cached config + features. UserMessage is empty so
 	// the change is silent; the source is carried in MetadataSourceKey.
 	MetadataTypeConfigChanged = "config_changed"
-	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
-	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
-	// that and builds its own localised toast off the paired config_changed
-	// event instead.
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. It is
+	// the user-facing half of the pair: the daemon stamps it with the message
+	// and title keys a UI localises, while the paired config_changed event stays
+	// silent and only drives the cache refresh.
 	MetadataTypePolicyApplied = "policy_applied"
 
 	// MetadataSourceKey is the SystemEvent.metadata key carrying what

client/proto/usermsg.go

@@ -0,0 +1,183 @@
+package proto
+
+import (
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// UserMessageKey names a piece of user-facing SystemEvent text in a
+// locale-independent form. The daemon has no notion of the user's language, so it
+// publishes the key and lets each UI resolve it.
+//
+// The value doubles as the lookup key in the desktop UI's translation bundles
+// (client/ui/i18n/locales/<code>/common.json), so renaming a constant here means
+// renaming the key in every bundle. The tests in client/ui/i18n lock the two
+// sides together. Keys that predate this mechanism keep their original bundle
+// names so the shipped translations still apply.
+type UserMessageKey string
+
+// Message-body keys published by the daemon. Every key needs an entry in
+// UserMessageTexts below and a translation in the UI bundles.
+const (
+	// UserMsgPanic is the CRITICAL event published from the recover() guard in
+	// the connect loop.
+	UserMsgPanic UserMessageKey = "event.panic"
+
+	// UserMsgDNSRecovered and UserMsgDNSUnreachable bracket a nameserver
+	// group's health transitions.
+	UserMsgDNSRecovered   UserMessageKey = "event.dns.recovered"
+	UserMsgDNSUnreachable UserMessageKey = "event.dns.unreachable"
+
+	// Exit-node (default route) transitions.
+	UserMsgExitNodeConnected           UserMessageKey = "event.exitNode.connected"
+	UserMsgExitNodeDisconnected        UserMessageKey = "event.exitNode.disconnected"
+	UserMsgExitNodeConnectionLost      UserMessageKey = "event.exitNode.connectionLost"
+	UserMsgExitNodeHAChange            UserMessageKey = "event.exitNode.haChange"
+	UserMsgExitNodeDisconnectedUnknown UserMessageKey = "event.exitNode.disconnectedUnknown"
+
+	// Auto-update lifecycle. UserMsgUpdateFailed takes a {reason} argument and
+	// UserMsgUpdateCompleted a {version}.
+	UserMsgUpdateInstalling UserMessageKey = "event.update.installing"
+	UserMsgUpdateCompleted  UserMessageKey = "event.update.completed"
+	UserMsgUpdateFailed     UserMessageKey = "event.update.failed"
+
+	// UserMsgMDMPolicyApplied reports that an MDM policy replaced the config.
+	UserMsgMDMPolicyApplied UserMessageKey = "notify.mdm.policyApplied.body"
+
+	// Session-expiry events. UserMsgSessionExpiresIn takes a {remaining}
+	// argument; the "soon" variant is published when the deadline has already
+	// passed by the time the warning fires.
+	UserMsgSessionExpiresIn      UserMessageKey = "notify.sessionWarning.body"
+	UserMsgSessionExpiresSoon    UserMessageKey = "notify.sessionWarning.bodyGeneric"
+	UserMsgSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.body"
+)
+
+// Notification-title keys. An event without one leaves titleKey empty and the UI
+// composes a title from severity and category, which is what every event did
+// before message keys existed. These carry no English fallback: a UI old enough
+// to ignore titleKey already builds its own title.
+const (
+	TitleMDMPolicyApplied      UserMessageKey = "notify.mdm.policyApplied.title"
+	TitleSessionWarning        UserMessageKey = "notify.sessionWarning.title"
+	TitleSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.title"
+)
+
+// UserMessageTitleKeys lists every title key a daemon can publish. It sits next
+// to the constants above because the two must grow together: a title key missing
+// from this slice ships untranslated, and the i18n test that would have caught it
+// reads this list.
+var UserMessageTitleKeys = []UserMessageKey{
+	TitleMDMPolicyApplied,
+	TitleSessionWarning,
+	TitleSessionDeadlineReject,
+}
+
+// ArgReason, ArgVersion and ArgRemaining are the placeholder names used by the
+// templates below. Producers pass them to NewUserMessage; the UI bundles use the
+// same names inside {}.
+const (
+	ArgReason    = "reason"
+	ArgVersion   = "version"
+	ArgRemaining = "remaining"
+)
+
+// UserMessageTexts is the English rendering of every body key, and the source of
+// the SystemEvent.userMessage fallback that the CLI and pre-messageKey UIs read.
+// It must match the en bundle, which the i18n test enforces.
+var UserMessageTexts = map[UserMessageKey]string{
+	UserMsgPanic:                       "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+	UserMsgDNSRecovered:                "DNS servers are reachable again.",
+	UserMsgDNSUnreachable:              "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+	UserMsgExitNodeConnected:           "Exit node connected.",
+	UserMsgExitNodeDisconnected:        "Exit node disconnected.",
+	UserMsgExitNodeConnectionLost:      "Exit node connection lost. Your internet access might be affected.",
+	UserMsgExitNodeHAChange:            "Exit node disconnected due to high availability change.",
+	UserMsgExitNodeDisconnectedUnknown: "Exit node disconnected for unknown reasons.",
+	UserMsgUpdateInstalling:            "Installing update now.",
+	UserMsgUpdateCompleted:             "Your NetBird client was auto-updated to version {version}.",
+	UserMsgUpdateFailed:                "Auto-update failed: {reason}",
+	UserMsgMDMPolicyApplied:            "Your NetBird configuration was updated by your IT policy.",
+	UserMsgSessionExpiresIn:            "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+	UserMsgSessionExpiresSoon:          "Your NetBird session is about to expire. Click Extend now to renew.",
+	UserMsgSessionDeadlineReject:       "The server sent an invalid session deadline. Please sign in again.",
+}
+
+// UserMessage is a localizable user-facing event message: a stable body key, an
+// optional title key, and the placeholder values to substitute. A nil
+// *UserMessage carries no user-facing text, which is how internal control events
+// are published.
+type UserMessage struct {
+	key   UserMessageKey
+	title UserMessageKey
+	args  map[string]string
+}
+
+// NewUserMessage builds a UserMessage from key and flat placeholder name/value
+// pairs, e.g. NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"). An
+// unpaired trailing argument is dropped.
+func NewUserMessage(key UserMessageKey, args ...string) *UserMessage {
+	m := &UserMessage{key: key}
+	if len(args)%2 != 0 {
+		log.Debugf("user message %q: placeholder args not paired: %d items, last dropped", key, len(args))
+		args = args[:len(args)-1]
+	}
+	if len(args) > 0 {
+		m.args = make(map[string]string, len(args)/2)
+		for i := 0; i < len(args); i += 2 {
+			m.args[args[i]] = args[i+1]
+		}
+	}
+	return m
+}
+
+// WithTitle attaches a notification title key and returns m, so it chains onto
+// NewUserMessage.
+func (m *UserMessage) WithTitle(key UserMessageKey) *UserMessage {
+	m.title = key
+	return m
+}
+
+// Key returns the body key, or the empty key for a nil message.
+func (m *UserMessage) Key() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.key
+}
+
+// TitleKey returns the title key, which is empty unless WithTitle was called.
+func (m *UserMessage) TitleKey() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.title
+}
+
+// Args returns the placeholder values, or nil for a nil message. The map is the
+// message's own and must not be mutated by the caller; it is handed straight to
+// SystemEvent.messageArgs.
+func (m *UserMessage) Args() map[string]string {
+	if m == nil {
+		return nil
+	}
+	return m.args
+}
+
+// Text renders the English fallback for m, with placeholders substituted. A nil
+// message, or a key with no registered template, renders empty so a UI treats
+// the event as carrying no user-facing text.
+func (m *UserMessage) Text() string {
+	if m == nil {
+		return ""
+	}
+	tmpl, ok := UserMessageTexts[m.key]
+	if !ok {
+		log.Warnf("no English template for user message key %q", m.key)
+		return ""
+	}
+	for name, value := range m.args {
+		tmpl = strings.ReplaceAll(tmpl, "{"+name+"}", value)
+	}
+	return tmpl
+}

client/proto/usermsg_test.go

@@ -0,0 +1,91 @@
+package proto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUserMessageText(t *testing.T) {
+	tests := []struct {
+		name string
+		msg  *UserMessage
+		want string
+	}{
+		{
+			name: "no placeholders",
+			msg:  NewUserMessage(UserMsgExitNodeConnected),
+			want: "Exit node connected.",
+		},
+		{
+			name: "placeholder substituted",
+			msg:  NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"),
+			want: "Your NetBird client was auto-updated to version 0.60.1.",
+		},
+		{
+			// A dangling arg is a caller mistake; dropping it must still yield a
+			// readable sentence rather than panicking on the wire path.
+			name: "unpaired trailing arg dropped",
+			msg:  NewUserMessage(UserMsgUpdateFailed, ArgReason, "disk full", "extra"),
+			want: "Auto-update failed: disk full",
+		},
+		{
+			name: "unknown key renders empty so the UI treats the event as silent",
+			msg:  NewUserMessage("event.notRegistered"),
+			want: "",
+		},
+		{
+			name: "nil message carries no text",
+			msg:  nil,
+			want: "",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.msg.Text())
+		})
+	}
+}
+
+// A nil *UserMessage is how every internal control event is published, so the
+// accessors must stay usable without a nil check at each of the ~25 call sites.
+func TestNilUserMessageAccessors(t *testing.T) {
+	var msg *UserMessage
+
+	assert.Empty(t, msg.Key(), "nil message must have no body key")
+	assert.Empty(t, msg.TitleKey(), "nil message must have no title key")
+	assert.Nil(t, msg.Args(), "nil message must have no args")
+	assert.Empty(t, msg.Text(), "nil message must render empty")
+}
+
+func TestUserMessageArgsAndTitle(t *testing.T) {
+	msg := NewUserMessage(UserMsgSessionExpiresIn, ArgRemaining, "10m").
+		WithTitle(TitleSessionWarning)
+
+	assert.Equal(t, UserMsgSessionExpiresIn, msg.Key())
+	assert.Equal(t, TitleSessionWarning, msg.TitleKey())
+	assert.Equal(t, map[string]string{ArgRemaining: "10m"}, msg.Args())
+	assert.Equal(t, "Your NetBird session expires in 10m. Click Extend now to renew.", msg.Text())
+}
+
+// Every registered template must be reachable: a key whose text is empty would
+// publish an event with a key but no fallback for the CLI and older UIs.
+func TestUserMessageTextsAreNonEmpty(t *testing.T) {
+	texts := UserMessageTexts
+	assert.NotEmpty(t, texts, "the catalog must not be empty")
+
+	for key, text := range texts {
+		assert.NotEmpty(t, text, "message key %q has an empty template", key)
+		assert.NotEmpty(t, key, "the catalog must not contain an empty key")
+	}
+}
+
+func TestUserMessageTitleKeysAreUnique(t *testing.T) {
+	seen := make(map[UserMessageKey]struct{})
+	for _, key := range UserMessageTitleKeys {
+		assert.NotEmpty(t, key, "title keys must not be empty")
+		_, dup := seen[key]
+		assert.False(t, dup, "title key %q listed twice", key)
+		seen[key] = struct{}{}
+	}
+}

client/server/agentnetwork.go

@@ -1,59 +0,0 @@
-package server
-
-import (
-	"context"
-	"time"
-
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/proto"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// GetAgentNetworkSetup relays the peer's Agent Network setup request to the
-// management server over the engine's existing connection. Running through
-// the daemon keeps the WireGuard key inside the daemon — unprivileged CLI
-// callers get a caller-scoped answer without reading the profile config.
-func (s *Server) GetAgentNetworkSetup(ctx context.Context, _ *proto.GetAgentNetworkSetupRequest) (*proto.GetAgentNetworkSetupResponse, error) {
-	s.mutex.Lock()
-	clientRunning := s.clientRunning
-	connectClient := s.connectClient
-	s.mutex.Unlock()
-
-	if !clientRunning || connectClient == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running, run 'netbird up' first")
-	}
-	engine := connectClient.Engine()
-	if engine == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine not initialized")
-	}
-
-	setupCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
-	defer cancel()
-
-	setup, err := engine.GetAgentNetworkSetup(setupCtx)
-	if err != nil {
-		return nil, gstatus.Errorf(codes.Internal, "get agent network setup: %v", err)
-	}
-
-	return toDaemonAgentNetworkSetup(setup), nil
-}
-
-func toDaemonAgentNetworkSetup(setup *mgmProto.AgentNetworkSetupResponse) *proto.GetAgentNetworkSetupResponse {
-	resp := &proto.GetAgentNetworkSetupResponse{
-		Configured: setup.Configured,
-		Endpoint:   setup.Endpoint,
-		Providers:  make([]*proto.AgentNetworkProvider, 0, len(setup.Providers)),
-	}
-	for _, p := range setup.Providers {
-		resp.Providers = append(resp.Providers, &proto.AgentNetworkProvider{
-			Name:             p.Name,
-			CatalogId:        p.CatalogId,
-			ApiFlavor:        p.ApiFlavor,
-			AllModelsAllowed: p.AllModelsAllowed,
-			Models:           p.Models,
-		})
-	}
-	return resp
-}

client/server/login_outcome_test.go

@@ -1,89 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A login that never reached Management is not a decision about the peer's
-// credentials, so it must come back as a retryable error rather than an SSO
-// prompt: the user cannot finish a browser login while Management is down, and
-// the CLI's own backoff resolves the outage on its own once the daemon reports
-// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
-// because Management happened to be restarting when the daemon dialed it.
-func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	unreachable := errors.New("create connection: dial context: context deadline exceeded")
-	attempts := 0
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		attempts++
-		return internal.StatusLoginFailed, unreachable
-	}
-
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
-	require.Nil(t, resp, "a failed login must not answer with a login response")
-	require.Equal(t, 1, attempts)
-	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"a peer that could not reach Management is not waiting on a login")
-}
-
-// The counterpart: Management refusing the peer's credentials is a decision, and
-// the SSO flow still has to start for it. The profile carries an unusable
-// private key so the flow setup fails immediately instead of dialing, which is
-// enough to show the branch was entered — the refusal itself is never what comes
-// back out.
-func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
-	s, _, _, username, cfgPath := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-	breakProfilePrivateKey(t, cfgPath)
-
-	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		return internal.StatusNeedsLogin, refused
-	}
-
-	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.NotErrorIs(t, err, refused,
-		"the refusal was handed back to the caller instead of starting the SSO flow")
-
-	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, stateErr)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"the SSO flow setup was never reached with the broken key")
-}
-
-// breakProfilePrivateKey replaces the profile's private key with an unparseable
-// one, which makes any attempt to build a Management client fail on the spot.
-func breakProfilePrivateKey(t *testing.T, cfgPath string) {
-	t.Helper()
-
-	raw, err := os.ReadFile(cfgPath)
-	require.NoError(t, err)
-
-	var cfg map[string]any
-	require.NoError(t, json.Unmarshal(raw, &cfg))
-	cfg["PrivateKey"] = "not-a-key"
-
-	patched, err := json.Marshal(cfg)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
-}

client/server/mdm.go

@@ -94,12 +94,12 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 	// publishConfigChangedEvent has already fired inside
 	// restartEngineForMDMLocked with source="mdm". Emit an MDM-specific
 	// user-visible toast so the operator knows their IT policy was
-	// applied (UserMessage != "" triggers the GUI notifier).
+	// applied; the message and title keys let the GUI localise it.
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
-		"NetBird configuration was updated by your IT policy.",
+		proto.NewUserMessage(proto.UserMsgMDMPolicyApplied).WithTitle(proto.TitleMDMPolicyApplied),
 		map[string]string{
 			proto.MetadataSourceKey: proto.MetadataSourceMDM,
 			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
@@ -126,7 +126,7 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		fmt.Sprintf("daemon config changed (source=%s)", source),
-		"",
+		nil,
 		map[string]string{
 			proto.MetadataSourceKey: source,
 			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,

client/server/network.go

@@ -170,7 +170,7 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network selection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -214,7 +214,7 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network deselection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -232,4 +232,3 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
-

client/server/server.go

@@ -135,11 +135,6 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
-
-	// loginAttemptFn stands in for the Management login round trip. Tests set
-	// it to drive the login outcomes that need a server on the other end;
-	// production leaves it nil, and every login goes through loginAttempt.
-	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
 }
 
 type oauthAuthFlow struct {
@@ -375,19 +370,7 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// attemptLogin runs a login round trip against Management, or the stand-in a
-// test installed in place of it.
-func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
-	if s.loginAttemptFn != nil {
-		return s.loginAttemptFn(ctx, setupKey, jwtToken)
-	}
-	return s.loginAttempt(ctx, setupKey, jwtToken)
-}
-
-// loginAttempt attempts to login using the provided information. It returns
-// StatusNeedsLogin when Management refused the peer's credentials and
-// StatusLoginFailed for every other failure, so callers can tell an
-// authentication decision apart from a login that never got made.
+// loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -640,23 +623,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	loginStatus, err := s.attemptLogin(ctx, "", "")
-	if err == nil {
+	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
 
-	// Only an authentication refusal means the peer has to (re-)authenticate.
-	// Any other failure leaves the login undecided: Management unreachable, a
-	// restart mid-request, an internal error. Those are returned for the caller
-	// to retry, because turning them into an SSO prompt asks the user to solve
-	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway.
-	if loginStatus != internal.StatusNeedsLogin {
-		state.Set(loginStatus)
-		return nil, err
-	}
-
 	if msg.SetupKey == "" {
 		hint := ""
 		if msg.Hint != nil {
@@ -713,7 +684,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -868,7 +839,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -2210,7 +2181,7 @@ func (s *Server) publishProfileListChanged(profileName string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Profile list changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
 	)
 }
@@ -2229,7 +2200,7 @@ func (s *Server) publishLogLevelChanged(level string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Log level changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
 	)
 }

client/ui/build/linux/nfpm/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1 (>= 4.14)
+  - libgtk-4-1
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
   rpm:
     depends:
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - gtk4
+      - webkitgtk6.0
       - xdg-utils
 
   # Arch Linux packages

client/ui/frontend/src/lib/connection.ts

@@ -43,12 +43,7 @@ function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<v
 }
 
 async function runSsoLogin(
-    result: {
-        verificationUri: string;
-        verificationUriComplete: string;
-        userCode: string;
-        profileId: string;
-    },
+    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
     state: SsoState,
     signal?: AbortSignal,
 ): Promise<void> {
@@ -61,7 +56,7 @@ async function runSsoLogin(
     // suspended, so a frontend-driven Up (a promise continuation) would not
     // fire until the user woke the window (e.g. hovering the tray icon).
     const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "", profileId: result.profileId },
+        { userCode: result.userCode, hostname: "" },
         { profileName: "", username: "" },
     );
 

client/ui/i18n/TRANSLATING.md

@@ -40,6 +40,12 @@ i18n/locales/<code>/common.json  a target — message only
 
 Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
 
+The `event.*` keys are a special group: the background service names them when it
+publishes a notification, and the app looks them up here. Their names are part of
+a Go↔JSON contract (`client/proto/usermsg.go`), so they are even less renameable
+than the rest — and a missing one shows the user English. Tests fail the build if
+any locale drops one.
+
 | ✅ Do | ❌ Don't |
 |---|---|
 | Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |

client/ui/i18n/bundle.go

@@ -126,18 +126,29 @@ func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
 // pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
 // the default language, then to the key itself so a miss is visible in the UI.
 func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
+	if v, ok := b.Lookup(lang, key, args...); ok {
+		return v
+	}
+	return key
+}
+
+// Lookup resolves key like Translate but reports whether it was found in the
+// requested or the default bundle. Callers holding a better fallback than the
+// raw key — a daemon-supplied English string for a key this build predates —
+// use this to tell a miss from a hit.
+func (b *Bundle) Lookup(lang LanguageCode, key string, args ...string) (string, bool) {
 	b.mu.RLock()
 	defer b.mu.RUnlock()
 
 	if v, ok := b.bundles[lang][key]; ok {
-		return applyPlaceholders(v, args)
+		return applyPlaceholders(v, args), true
 	}
 	if lang != DefaultLanguage {
 		if v, ok := b.bundles[DefaultLanguage][key]; ok {
-			return applyPlaceholders(v, args)
+			return applyPlaceholders(v, args), true
 		}
 	}
-	return key
+	return "", false
 }
 
 // applyPlaceholders substitutes {name} in s using args as flat name/value

client/ui/i18n/eventkeys_test.go

@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package i18n
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// shippedBundle loads the real locale tree rather than the fstest fixture the
+// other tests use: these checks exist to catch a key the daemon publishes but no
+// bundle translates, which only the shipped files can prove.
+func shippedBundle(t *testing.T) *Bundle {
+	t.Helper()
+	b, err := NewBundle(os.DirFS("locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return b
+}
+
+// The daemon publishes a message key and each UI resolves it locally, so a key
+// with no en entry degrades to the daemon's English fallback and silently stops
+// being translatable. Fail the build instead.
+func TestUserMessageKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for key, text := range proto.UserMessageTexts {
+		got, ok := b.Lookup(DefaultLanguage, string(key))
+		if !assert.True(t, ok, "message key %q has no en translation", key) {
+			continue
+		}
+		assert.Equal(t, text, got,
+			"en translation of %q must match the daemon's English fallback", key)
+	}
+}
+
+func TestUserMessageTitleKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for _, key := range proto.UserMessageTitleKeys {
+		_, ok := b.Lookup(DefaultLanguage, string(key))
+		assert.True(t, ok, "title key %q has no en translation", key)
+	}
+}
+
+// Every shipped locale must translate the daemon's keys, not just en. A missing
+// one still renders (Lookup falls back to en) but the notification would show up
+// in English for that user, which is the bug this whole mechanism exists to fix.
+func TestUserMessageKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := make([]proto.UserMessageKey, 0, len(proto.UserMessageTexts))
+	for key := range proto.UserMessageTexts {
+		keys = append(keys, key)
+	}
+	keys = append(keys, proto.UserMessageTitleKeys...)
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[string(key)]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+}
+
+// The tray composes a title from these when an event carries no title key, so a
+// gap here would render "event.severity.warning: DNS" to the user.
+func TestEventTitleKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := []string{
+		"event.title",
+		"event.severity.info", "event.severity.warning",
+		"event.severity.error", "event.severity.critical",
+		"event.category.network", "event.category.dns",
+		"event.category.authentication", "event.category.connectivity",
+		"event.category.system",
+	}
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[key]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+
+	// The composed title is useless without both slots.
+	title, ok := b.Lookup(DefaultLanguage, "event.title", "severity", "Warning", "category", "DNS")
+	require.True(t, ok)
+	assert.Equal(t, "Warning: DNS", title, "event.title must substitute both placeholders")
+}
+
+func TestBundleLookupReportsMisses(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	got, ok := b.Lookup("en", "tray.menu.connect")
+	assert.True(t, ok)
+	assert.Equal(t, "Connect", got)
+
+	// An absent key must report a miss rather than echo the key, so callers can
+	// substitute their own fallback.
+	got, ok = b.Lookup("en", "tray.missing")
+	assert.False(t, ok, "unknown key must report a miss")
+	assert.Empty(t, got, "a miss must not return the key")
+
+	// Empty keys reach Lookup from events that carry no title key at all.
+	_, ok = b.Lookup("en", "")
+	assert.False(t, ok, "empty key must report a miss")
+}

client/ui/i18n/locales/de/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Warnung"
+    },
+    "event.severity.error": {
+        "message": "Fehler"
+    },
+    "event.severity.critical": {
+        "message": "Kritisch"
+    },
+    "event.category.network": {
+        "message": "Netzwerk"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentifizierung"
+    },
+    "event.category.connectivity": {
+        "message": "Konnektivität"
+    },
+    "event.category.system": {
+        "message": "System"
+    },
+    "event.panic": {
+        "message": "Der NetBird-Dienst ist abgestürzt. Bitte starten Sie den Dienst neu und senden Sie einen Fehlerbericht mit den Client-Protokollen."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-Server sind wieder erreichbar."
+    },
+    "event.dns.unreachable": {
+        "message": "Ein oder mehrere DNS-Server sind nicht erreichbar. Das kann die Verbindung zu einigen Diensten beeinträchtigen."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node verbunden."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node getrennt."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Verbindung zum Exit Node verloren. Ihr Internetzugang kann beeinträchtigt sein."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit Node aufgrund einer Änderung der Hochverfügbarkeit getrennt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit Node aus unbekannten Gründen getrennt."
+    },
+    "event.update.installing": {
+        "message": "Update wird jetzt installiert."
+    },
+    "event.update.completed": {
+        "message": "Ihr NetBird-Client wurde automatisch auf Version {version} aktualisiert."
+    },
+    "event.update.failed": {
+        "message": "Automatisches Update fehlgeschlagen: {reason}"
+    },
     "common.cancel": {
         "message": "Abbrechen"
     },

client/ui/i18n/locales/en/common.json

@@ -239,6 +239,90 @@
         "message": "Your NetBird configuration was updated by your IT policy.",
         "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
     },
+    "event.title": {
+        "message": "{severity}: {category}",
+        "description": "Notification title for a daemon event, composed from severity and category, e.g. \"Warning: DNS\". Keep both placeholders; use your locale's colon spacing."
+    },
+    "event.severity.info": {
+        "message": "Info",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.warning": {
+        "message": "Warning",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.error": {
+        "message": "Error",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.critical": {
+        "message": "Critical",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.category.network": {
+        "message": "Network",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the overlay network."
+    },
+    "event.category.dns": {
+        "message": "DNS",
+        "description": "Event category label used in the {category} slot of event.title. Acronym, do not translate."
+    },
+    "event.category.authentication": {
+        "message": "Authentication",
+        "description": "Event category label used in the {category} slot of event.title. Refers to signing in to the management server."
+    },
+    "event.category.connectivity": {
+        "message": "Connectivity",
+        "description": "Event category label used in the {category} slot of event.title. Refers to reaching peers."
+    },
+    "event.category.system": {
+        "message": "System",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the local machine and the NetBird service."
+    },
+    "event.panic": {
+        "message": "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+        "description": "Notification body after the NetBird background service crashed. \"Service\" is the daemon, not a remote service."
+    },
+    "event.dns.recovered": {
+        "message": "DNS servers are reachable again.",
+        "description": "Notification body when previously unreachable upstream DNS servers respond again."
+    },
+    "event.dns.unreachable": {
+        "message": "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+        "description": "Notification body when one or more upstream DNS servers stop responding."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit node connected.",
+        "description": "Notification body when a full-tunnel exit node becomes active."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit node disconnected.",
+        "description": "Notification body when the user or the client shuts the exit node down deliberately."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Exit node connection lost. Your internet access might be affected.",
+        "description": "Notification body when the exit node peer became unreachable. \"Internet access\" means the user's own browsing."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit node disconnected due to high availability change.",
+        "description": "Notification body when a high-availability group switched away from this exit node. High availability is the standard IT term."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit node disconnected for unknown reasons.",
+        "description": "Notification body when the exit node dropped for a reason the client could not classify."
+    },
+    "event.update.installing": {
+        "message": "Installing update now.",
+        "description": "Notification body shown as an automatic client update starts installing."
+    },
+    "event.update.completed": {
+        "message": "Your NetBird client was auto-updated to version {version}.",
+        "description": "Notification body after an automatic client update succeeded. {version} is a version number, keep verbatim."
+    },
+    "event.update.failed": {
+        "message": "Auto-update failed: {reason}",
+        "description": "Notification body when an automatic client update failed. {reason} is an untranslated technical error string; keep your locale's colon spacing."
+    },
     "common.cancel": {
         "message": "Cancel",
         "description": "Generic Cancel button label, reused across dialogs. Keep short."

client/ui/i18n/locales/es/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Su configuración de NetBird fue actualizada por su política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Información"
+    },
+    "event.severity.warning": {
+        "message": "Advertencia"
+    },
+    "event.severity.error": {
+        "message": "Error"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Red"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticación"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividad"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "El servicio de NetBird falló de forma inesperada. Reinicie el servicio y envíe un informe de error con los registros del cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Los servidores DNS vuelven a estar accesibles."
+    },
+    "event.dns.unreachable": {
+        "message": "No se puede acceder a uno o más servidores DNS. Esto puede afectar la conexión a algunos servicios."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo de salida conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo de salida desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Se perdió la conexión con el nodo de salida. Su acceso a Internet puede verse afectado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo de salida desconectado por un cambio de alta disponibilidad."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo de salida desconectado por motivos desconocidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando la actualización ahora."
+    },
+    "event.update.completed": {
+        "message": "Su cliente de NetBird se actualizó automáticamente a la versión {version}."
+    },
+    "event.update.failed": {
+        "message": "La actualización automática falló: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/fr/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
     },
+    "event.title": {
+        "message": "{severity} : {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avertissement"
+    },
+    "event.severity.error": {
+        "message": "Erreur"
+    },
+    "event.severity.critical": {
+        "message": "Critique"
+    },
+    "event.category.network": {
+        "message": "Réseau"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentification"
+    },
+    "event.category.connectivity": {
+        "message": "Connectivité"
+    },
+    "event.category.system": {
+        "message": "Système"
+    },
+    "event.panic": {
+        "message": "Le service NetBird s'est arrêté brutalement. Veuillez redémarrer le service et envoyer un rapport de bug avec les journaux du client."
+    },
+    "event.dns.recovered": {
+        "message": "Les serveurs DNS sont de nouveau joignables."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossible de joindre un ou plusieurs serveurs DNS. Cela peut affecter la connexion à certains services."
+    },
+    "event.exitNode.connected": {
+        "message": "Nœud de sortie connecté."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nœud de sortie déconnecté."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connexion au nœud de sortie perdue. Votre accès à Internet peut être affecté."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nœud de sortie déconnecté suite à un changement de haute disponibilité."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nœud de sortie déconnecté pour une raison inconnue."
+    },
+    "event.update.installing": {
+        "message": "Installation de la mise à jour en cours."
+    },
+    "event.update.completed": {
+        "message": "Votre client NetBird a été mis à jour automatiquement vers la version {version}."
+    },
+    "event.update.failed": {
+        "message": "Échec de la mise à jour automatique : {reason}"
+    },
     "common.cancel": {
         "message": "Annuler"
     },

client/ui/i18n/locales/hu/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Információ"
+    },
+    "event.severity.warning": {
+        "message": "Figyelmeztetés"
+    },
+    "event.severity.error": {
+        "message": "Hiba"
+    },
+    "event.severity.critical": {
+        "message": "Kritikus"
+    },
+    "event.category.network": {
+        "message": "Hálózat"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Hitelesítés"
+    },
+    "event.category.connectivity": {
+        "message": "Kapcsolat"
+    },
+    "event.category.system": {
+        "message": "Rendszer"
+    },
+    "event.panic": {
+        "message": "A NetBird szolgáltatás összeomlott. Kérjük, indítsa újra a szolgáltatást, és küldjön hibajelentést a kliens naplóival."
+    },
+    "event.dns.recovered": {
+        "message": "A DNS-kiszolgálók ismét elérhetők."
+    },
+    "event.dns.unreachable": {
+        "message": "Egy vagy több DNS-kiszolgáló nem érhető el. Ez befolyásolhatja egyes szolgáltatások elérését."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node csatlakoztatva."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node leválasztva."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Megszakadt a kapcsolat az Exit Node-dal. Ez érintheti az internetelérést."
+    },
+    "event.exitNode.haChange": {
+        "message": "Az Exit Node leválasztva a magas rendelkezésre állás változása miatt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Az Exit Node ismeretlen okból leválasztva."
+    },
+    "event.update.installing": {
+        "message": "A frissítés telepítése folyamatban."
+    },
+    "event.update.completed": {
+        "message": "A NetBird kliens automatikusan a {version} verzióra frissült."
+    },
+    "event.update.failed": {
+        "message": "Az automatikus frissítés sikertelen: {reason}"
+    },
     "common.cancel": {
         "message": "Mégse"
     },

client/ui/i18n/locales/it/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avviso"
+    },
+    "event.severity.error": {
+        "message": "Errore"
+    },
+    "event.severity.critical": {
+        "message": "Critico"
+    },
+    "event.category.network": {
+        "message": "Rete"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticazione"
+    },
+    "event.category.connectivity": {
+        "message": "Connettività"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "Il servizio NetBird si è arrestato in modo anomalo. Riavvii il servizio e invii una segnalazione di bug con i log del client."
+    },
+    "event.dns.recovered": {
+        "message": "I server DNS sono di nuovo raggiungibili."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossibile raggiungere uno o più server DNS. Questo potrebbe influire sulla connessione ad alcuni servizi."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo di uscita connesso."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo di uscita disconnesso."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connessione al nodo di uscita perduta. L'accesso a Internet potrebbe essere compromesso."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo di uscita disconnesso a causa di una modifica dell'alta disponibilità."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo di uscita disconnesso per motivi sconosciuti."
+    },
+    "event.update.installing": {
+        "message": "Installazione dell'aggiornamento in corso."
+    },
+    "event.update.completed": {
+        "message": "Il client NetBird è stato aggiornato automaticamente alla versione {version}."
+    },
+    "event.update.failed": {
+        "message": "Aggiornamento automatico non riuscito: {reason}"
+    },
     "common.cancel": {
         "message": "Annulla"
     },

client/ui/i18n/locales/ja/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "NetBird の構成が IT ポリシーによって更新されました。"
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "情報"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "エラー"
+    },
+    "event.severity.critical": {
+        "message": "重大"
+    },
+    "event.category.network": {
+        "message": "ネットワーク"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "認証"
+    },
+    "event.category.connectivity": {
+        "message": "接続"
+    },
+    "event.category.system": {
+        "message": "システム"
+    },
+    "event.panic": {
+        "message": "NetBird サービスがクラッシュしました。サービスを再起動し、クライアントログを添えてバグを報告してください。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS サーバーに再び到達できるようになりました。"
+    },
+    "event.dns.unreachable": {
+        "message": "1 つ以上の DNS サーバーに到達できません。一部のサービスへの接続に影響する可能性があります。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口ノードに接続しました。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口ノードの接続を解除しました。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "出口ノードとの接続が失われました。インターネット接続に影響する可能性があります。"
+    },
+    "event.exitNode.haChange": {
+        "message": "高可用性の変更により出口ノードの接続が解除されました。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "不明な理由により出口ノードの接続が解除されました。"
+    },
+    "event.update.installing": {
+        "message": "更新をインストールしています。"
+    },
+    "event.update.completed": {
+        "message": "NetBird クライアントがバージョン {version} に自動更新されました。"
+    },
+    "event.update.failed": {
+        "message": "自動更新に失敗しました: {reason}"
+    },
     "common.cancel": {
         "message": "キャンセル"
     },

client/ui/i18n/locales/pt/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A sua configuração do NetBird foi atualizada pela política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Informação"
+    },
+    "event.severity.warning": {
+        "message": "Aviso"
+    },
+    "event.severity.error": {
+        "message": "Erro"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Rede"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticação"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividade"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "O serviço NetBird falhou de forma inesperada. Reinicie o serviço e envie um relatório de erro com os registros do cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Os servidores DNS estão novamente acessíveis."
+    },
+    "event.dns.unreachable": {
+        "message": "Não é possível acessar um ou mais servidores DNS. Isto pode afetar a conexão a alguns serviços."
+    },
+    "event.exitNode.connected": {
+        "message": "Nó de saída conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nó de saída desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Conexão com o nó de saída perdida. O seu acesso à Internet pode ser afetado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nó de saída desconectado devido a uma alteração de alta disponibilidade."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nó de saída desconectado por motivos desconhecidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando a atualização agora."
+    },
+    "event.update.completed": {
+        "message": "O seu cliente NetBird foi atualizado automaticamente para a versão {version}."
+    },
+    "event.update.failed": {
+        "message": "Falha na atualização automática: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/ru/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Информация"
+    },
+    "event.severity.warning": {
+        "message": "Предупреждение"
+    },
+    "event.severity.error": {
+        "message": "Ошибка"
+    },
+    "event.severity.critical": {
+        "message": "Критично"
+    },
+    "event.category.network": {
+        "message": "Сеть"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Аутентификация"
+    },
+    "event.category.connectivity": {
+        "message": "Связь"
+    },
+    "event.category.system": {
+        "message": "Система"
+    },
+    "event.panic": {
+        "message": "Служба NetBird аварийно завершилась. Перезапустите службу и отправьте отчёт об ошибке с журналами клиента."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-серверы снова доступны."
+    },
+    "event.dns.unreachable": {
+        "message": "Не удалось связаться с одним или несколькими DNS-серверами. Это может повлиять на подключение к некоторым сервисам."
+    },
+    "event.exitNode.connected": {
+        "message": "Выходной узел подключён."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Выходной узел отключён."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Соединение с выходным узлом потеряно. Доступ в интернет может быть нарушен."
+    },
+    "event.exitNode.haChange": {
+        "message": "Выходной узел отключён из-за изменения конфигурации высокой доступности."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Выходной узел отключён по неизвестной причине."
+    },
+    "event.update.installing": {
+        "message": "Устанавливается обновление."
+    },
+    "event.update.completed": {
+        "message": "Клиент NetBird автоматически обновлён до версии {version}."
+    },
+    "event.update.failed": {
+        "message": "Не удалось выполнить автоматическое обновление: {reason}"
+    },
     "common.cancel": {
         "message": "Отмена"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "您的 NetBird 配置已根据 IT 策略更新。"
     },
+    "event.title": {
+        "message": "{severity}：{category}"
+    },
+    "event.severity.info": {
+        "message": "信息"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "错误"
+    },
+    "event.severity.critical": {
+        "message": "严重"
+    },
+    "event.category.network": {
+        "message": "网络"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "身份验证"
+    },
+    "event.category.connectivity": {
+        "message": "连接"
+    },
+    "event.category.system": {
+        "message": "系统"
+    },
+    "event.panic": {
+        "message": "NetBird 服务发生崩溃。请重启该服务，并附上客户端日志提交错误报告。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS 服务器已恢复可访问。"
+    },
+    "event.dns.unreachable": {
+        "message": "无法访问一个或多个 DNS 服务器。这可能影响您连接部分服务。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口节点已连接。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口节点已断开。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "与出口节点的连接已丢失。您的互联网访问可能受到影响。"
+    },
+    "event.exitNode.haChange": {
+        "message": "由于高可用性变更，出口节点已断开。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "出口节点因未知原因已断开。"
+    },
+    "event.update.installing": {
+        "message": "正在安装更新。"
+    },
+    "event.update.completed": {
+        "message": "NetBird 客户端已自动更新到版本 {version}。"
+    },
+    "event.update.failed": {
+        "message": "自动更新失败：{reason}"
+    },
     "common.cancel": {
         "message": "取消"
     },

client/ui/localizer.go

@@ -63,6 +63,20 @@ func (l *Localizer) T(key string, args ...string) string {
 	return l.bundle.Translate(lang, key, args...)
 }
 
+// Lookup resolves a key supplied at runtime by the daemon, substituting args as
+// {placeholder}/value pairs. It reports false when the key is in no bundle, so
+// the caller can fall back to the daemon's own English text instead of showing a
+// bare key. An empty key never resolves.
+func (l *Localizer) Lookup(key string, args map[string]string) (string, bool) {
+	if l == nil || l.bundle == nil || key == "" {
+		return "", false
+	}
+	l.mu.RLock()
+	lang := l.lang
+	l.mu.RUnlock()
+	return l.bundle.Lookup(lang, key, flattenArgs(args)...)
+}
+
 // Watch invokes cb on each language change, after the cached language is
 // updated so cb may call l.T with the new locale. Replaces any prior subscription.
 func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
@@ -128,3 +142,17 @@ func (l *Localizer) StatusLabel(status string) string {
 	}
 	return status
 }
+
+// flattenArgs turns a placeholder map into the flat name/value slice the bundle
+// takes. Iteration order is irrelevant: each pair substitutes an independent
+// {name}.
+func flattenArgs(args map[string]string) []string {
+	if len(args) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(args)*2)
+	for name, value := range args {
+		out = append(out, name, value)
+	}
+	return out
+}

client/ui/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -62,7 +63,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *Notifier
+	notifier        *notifications.NotificationService
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -101,7 +102,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := newNotifier()
+	notifier := notifications.New()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -209,7 +210,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *Notifier) {
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/notifier.go

@@ -1,101 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
-)
-
-var errNotificationsUnavailable = errors.New("notifications unavailable")
-
-// Notifier wraps the Wails notification service so an unavailable backend
-// disables notifications instead of aborting the app. Startup fails for
-// environment reasons (a bare unbundled binary on macOS has no bundle
-// identifier, a headless Linux session has no D-Bus session bus), and Wails
-// treats a service startup error as fatal. After a failed startup every call
-// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
-// identifier raises an Objective-C exception that recover() cannot catch.
-type Notifier struct {
-	inner     *notifications.NotificationService
-	available atomic.Bool
-}
-
-func newNotifier() *Notifier {
-	return &Notifier{inner: notifications.New()}
-}
-
-// ServiceName implements the Wails service-name hook for startup logs.
-func (n *Notifier) ServiceName() string {
-	return n.inner.ServiceName()
-}
-
-// ServiceStartup starts the platform notifier, downgrading failure to a
-// warning so the app keeps running without notifications.
-func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
-	if err := n.inner.ServiceStartup(ctx, options); err != nil {
-		log.Warnf("notifications disabled: %v", err)
-		return nil
-	}
-	n.available.Store(true)
-	return nil
-}
-
-func (n *Notifier) ServiceShutdown() error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.ServiceShutdown()
-}
-
-func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.CheckNotificationAuthorization()
-}
-
-func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.RequestNotificationAuthorization()
-}
-
-// SendNotification delivers a notification, silently dropping it when the
-// backend never started (notifications are best-effort everywhere).
-func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotification(options)
-}
-
-func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotificationWithActions(options)
-}
-
-func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RegisterNotificationCategory(category)
-}
-
-// OnNotificationResponse registers the response callback. Pure Go state, so
-// it is safe (and simply inert) when the backend never started.
-//
-//wails:ignore
-func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
-	n.inner.OnNotificationResponse(callback)
-}

client/ui/preferences/store.go

@@ -246,7 +246,6 @@ func (s *Store) ExistedAtLoad() bool {
 func (s *Store) load() error {
 	if _, err := os.Stat(s.path); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			log.Infof("no ui preferences file at %s; using defaults", s.path)
 			return nil
 		}
 		return fmt.Errorf("stat preferences: %w", err)

client/ui/services/connection.go

@@ -33,21 +33,12 @@ type LoginResult struct {
 	UserCode                string `json:"userCode"`
 	VerificationURI         string `json:"verificationUri"`
 	VerificationURIComplete string `json:"verificationUriComplete"`
-	// ProfileID is the ID of the profile this login ran against, or "" when the
-	// caller named the profile itself and no ID was resolved. Pass it back in
-	// WaitSSOParams so the account email lands on this profile even if the
-	// active one changes during SSO.
-	ProfileID string `json:"profileId"`
 }
 
 // WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
-	// ProfileID is the profile the login was started for, used to file the
-	// account email against it rather than against whichever profile is active
-	// when the flow returns. Optional: empty falls back to the active profile.
-	ProfileID string `json:"profileId"`
 }
 
 // UpParams selects the profile to bring up.
@@ -86,16 +77,11 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	// Fall back to the daemon's active profile and the current OS user.
 	profileName := p.ProfileName
 	username := p.Username
-	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
-	// a handle — a display name or an ID prefix resolve too — and the state file
-	// is named after the ID, so passing a handle on would name the wrong file.
-	profileID := ""
 	if profileName == "" {
 		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
 			// Address the active profile by ID (the daemon resolves it as a
 			// handle); names can collide, the ID cannot.
 			profileName = active.GetId()
-			profileID = profileName
 			if username == "" {
 				username = active.GetUsername()
 			}
@@ -136,7 +122,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 		UserCode:                resp.GetUserCode(),
 		VerificationURI:         resp.GetVerificationURI(),
 		VerificationURIComplete: resp.GetVerificationURIComplete(),
-		ProfileID:               profileID,
 	}, nil
 }
 
@@ -257,31 +242,6 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		return "", s.classifyDaemonError(err)
 	}
 	log.Infof("SSO login completed, daemon reported success")
-
-	// Persist the account email the same way the CLI does after its own
-	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Logout below).
-	// Without this the profile has no email, so Profiles.List shows no account
-	// and later logins and session extends go out without a login_hint —
-	// leaving the IdP to guess which account was meant.
-	if email := resp.GetEmail(); email != "" {
-		state := &profilemanager.ProfileState{Email: email}
-		pm := profilemanager.NewProfileManager()
-
-		// Against the profile the login was started for: SSO spans seconds of
-		// user interaction, and a profile switch in that window would otherwise
-		// file the email under the wrong profile.
-		if p.ProfileID != "" {
-			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
-		} else {
-			err = pm.SetActiveProfileState(state)
-		}
-		if err != nil {
-			// Non-fatal: the login itself succeeded.
-			log.Warnf("failed to store account email: %v", err)
-		}
-	}
-
 	return resp.GetEmail(), nil
 }
 

client/ui/services/daemon_feed.go

@@ -59,13 +59,21 @@ type Emitter interface {
 
 // SystemEvent is the frontend-facing shape of a daemon SystemEvent.
 type SystemEvent struct {
-	ID          string            `json:"id"`
-	Severity    string            `json:"severity"`
-	Category    string            `json:"category"`
-	Message     string            `json:"message"`
-	UserMessage string            `json:"userMessage"`
-	Timestamp   int64             `json:"timestamp"`
-	Metadata    map[string]string `json:"metadata"`
+	ID          string `json:"id"`
+	Severity    string `json:"severity"`
+	Category    string `json:"category"`
+	Message     string `json:"message"`
+	UserMessage string `json:"userMessage"`
+	// MessageKey names the localizable body for this event; empty on control
+	// events and on events from a daemon that predates the field. Resolve it
+	// against the UI bundle and fall back to UserMessage on a miss.
+	MessageKey  string            `json:"messageKey"`
+	MessageArgs map[string]string `json:"messageArgs"`
+	// TitleKey names the localizable notification title, empty when the event
+	// has none and the consumer should compose one from severity and category.
+	TitleKey  string            `json:"titleKey"`
+	Timestamp int64             `json:"timestamp"`
+	Metadata  map[string]string `json:"metadata"`
 }
 
 // PeerStatus is the frontend-facing shape of a daemon PeerState.
@@ -563,6 +571,9 @@ func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
 		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
 		Message:     e.GetMessage(),
 		UserMessage: e.GetUserMessage(),
+		MessageKey:  e.GetMessageKey(),
+		MessageArgs: e.GetMessageArgs(),
+		TitleKey:    e.GetTitleKey(),
 		Metadata:    map[string]string{},
 	}
 	if ts := e.GetTimestamp(); ts != nil {

client/ui/services/profile.go

@@ -6,8 +6,6 @@ import (
 	"context"
 	"os/user"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -153,31 +151,11 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	if err != nil {
 		return err
 	}
-	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
 		ProfileName: p.ProfileName,
 		Username:    p.Username,
 	})
-	if err != nil {
-		return err
-	}
-
-	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind (same split as
-	// Connection.Logout). Legacy profiles are keyed by name rather than by a
-	// generated ID, so a recreated profile of the same name would inherit the
-	// deleted one's email and offer it as the login_hint.
-	//
-	// Keyed on the ID the daemon resolved, not on the request handle: that may
-	// have been a display name or an ID prefix, which would name a different
-	// file (or none).
-	if id := resp.GetId(); id != "" {
-		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
-			// Non-fatal: the profile itself is gone.
-			log.Warnf("failed to remove profile state for %s: %v", id, err)
-		}
-	}
-
-	return nil
+	return err
 }
 
 // Rename changes a profile's display name. The on-disk ID is unaffected, so

client/ui/tray.go

@@ -26,7 +26,6 @@ const (
 	notifyIDUpdatePrefix = "netbird-update-"
 	notifyIDEvent        = "netbird-event-"
 	notifyIDTrayError    = "netbird-tray-error"
-	notifyIDMDMPolicy    = "netbird-mdm-policy"
 
 	statusError = "Error"
 
@@ -44,7 +43,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *Notifier
+	Notifier        *notifications.NotificationService
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager

client/ui/tray_events.go

@@ -21,32 +21,14 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	if !ok {
 		return
 	}
-	// config_changed carries no UserMessage, so handle it before the message gate below.
+	// config_changed carries no user-facing message, so handle it before the gate below.
 	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
 		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
 		go t.refreshRestrictions()
 		go t.loadConfig()
-		// MDM gets a localised toast here; the daemon's English "policy_applied"
-		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
-		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
-			t.profileMu.Lock()
-			enabled := t.notificationsEnabled
-			t.profileMu.Unlock()
-			if enabled {
-				t.notify(
-					t.loc.T("notify.mdm.policyApplied.title"),
-					t.loc.T("notify.mdm.policyApplied.body"),
-					notifyIDMDMPolicy,
-				)
-			}
-		}
 		return
 	}
-	// Session-warning and deadline-rejected events build their body locally from
-	// metadata; every other event needs a UserMessage.
-	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
-	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
-	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
+	if se.MessageKey == "" && se.UserMessage == "" {
 		return
 	}
 	if shouldSkipSystemEvent(se) {
@@ -61,56 +43,56 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		return
 	}
 
-	// Session-warning events route via stable metadata flags rather than
-	// category/severity so a daemon-side reword still lands here. Final warning
-	// auto-opens the SessionExpiration dialog with no notification (the dialog is
-	// the last-chance reminder; doubling up would be noise).
-	if isDeadlineRejected {
-		t.notify(
-			t.loc.T("notify.sessionDeadlineRejected.title"),
-			t.loc.T("notify.sessionDeadlineRejected.body"),
-			notifyIDSessionExpired,
-		)
-		return
-	}
+	body := t.localizedEventMessage(se)
 
-	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+	// The final session warning auto-opens the SessionExpiration dialog instead of
+	// toasting: the dialog is the last-chance reminder and doubling up would be
+	// noise. This routes on metadata rather than the message key because it is a
+	// behavioural distinction, not a wording one.
+	if se.Metadata[authsession.MetaWarning] == "true" {
 		if se.Metadata[authsession.MetaFinal] == "true" {
 			t.openSessionExpiration()
 			return
 		}
-		t.notifySessionWarning(
-			t.loc.T("notify.sessionWarning.title"),
-			t.buildSessionWarningBody(se.Metadata),
-		)
+		t.notifySessionWarning(t.eventTitle(se), body)
 		return
 	}
 
-	body := se.UserMessage
 	if id := se.Metadata["id"]; id != "" {
 		body += fmt.Sprintf(" ID: %s", id)
 	}
-	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
+	t.notify(t.eventTitle(se), body, notifyIDEvent+se.ID)
 }
 
-// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
-func eventTitle(e services.SystemEvent) string {
-	prefix := titleCase(e.Severity)
-	if prefix == "" {
-		prefix = "Info"
+// localizedEventMessage resolves the daemon's message key against the active
+// locale. A key this build does not ship — a daemon newer than the UI — falls
+// back to the daemon's own English rendering rather than showing a bare key.
+func (t *Tray) localizedEventMessage(se services.SystemEvent) string {
+	if body, ok := t.loc.Lookup(se.MessageKey, se.MessageArgs); ok {
+		return body
 	}
-	category := titleCase(e.Category)
-	if category == "" {
-		category = "System"
+	if se.MessageKey != "" {
+		log.Debugf("no translation for event message key %q, using the daemon's text", se.MessageKey)
 	}
-	return prefix + ": " + category
+	return se.UserMessage
 }
 
-func titleCase(s string) string {
-	if s == "" {
-		return ""
+// eventTitle resolves the event's own title key, falling back to a title
+// composed from severity and category, e.g. "Critical: DNS" in English. An enum
+// value this build does not know falls back to the Info and System labels.
+func (t *Tray) eventTitle(se services.SystemEvent) string {
+	if title, ok := t.loc.Lookup(se.TitleKey, nil); ok {
+		return title
 	}
-	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+	severity, ok := t.loc.Lookup("event.severity."+strings.ToLower(se.Severity), nil)
+	if !ok {
+		severity = t.loc.T("event.severity.info")
+	}
+	category, ok := t.loc.Lookup("event.category."+strings.ToLower(se.Category), nil)
+	if !ok {
+		category = t.loc.T("event.category.system")
+	}
+	return t.loc.T("event.title", "severity", severity, "category", category)
 }
 
 // shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
@@ -119,11 +101,6 @@ func titleCase(s string) string {
 //   - install-progress signals (consumed by the install-progress window)
 //   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
 func shouldSkipSystemEvent(se services.SystemEvent) bool {
-	// "policy_applied" carries a hardcoded English message; the localised toast
-	// fires on the paired config_changed (source=mdm) event instead.
-	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
-		return true
-	}
 	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
 		return true
 	}

client/ui/tray_events_test.go

@@ -0,0 +1,150 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// trayWithLocalizer builds the minimum Tray the message/title resolvers touch:
+// they read t.loc and nothing else, so no app, window or daemon connection is
+// needed. The shipped locale tree is used so the assertions below exercise the
+// real bundles rather than a fixture.
+func trayWithLocalizer(t *testing.T) *Tray {
+	t.Helper()
+	bundle, err := i18n.NewBundle(os.DirFS("i18n/locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return &Tray{loc: NewLocalizer(bundle, nil)}
+}
+
+func TestLocalizedEventMessageResolvesKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey: string(proto.UserMsgExitNodeConnected),
+		// A daemon always ships its English rendering too; the key must win.
+		UserMessage: "should not be used",
+	})
+	assert.Equal(t, "Exit node connected.", got)
+}
+
+func TestLocalizedEventMessageSubstitutesArgs(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  string(proto.UserMsgUpdateCompleted),
+		MessageArgs: map[string]string{proto.ArgVersion: "0.60.1"},
+	})
+	assert.Equal(t, "Your NetBird client was auto-updated to version 0.60.1.", got)
+}
+
+// A daemon newer than the UI can publish a key this build has never heard of.
+// Showing the raw key would be a visible regression, so the daemon's own English
+// text has to win instead.
+func TestLocalizedEventMessageFallsBackToDaemonText(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  "event.somethingThisBuildNeverHeardOf",
+		UserMessage: "A message from a newer daemon.",
+	})
+	assert.Equal(t, "A message from a newer daemon.", got)
+}
+
+// An old daemon sends no key at all, only userMessage.
+func TestLocalizedEventMessageWithoutKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{UserMessage: "Legacy English text."})
+	assert.Equal(t, "Legacy English text.", got)
+}
+
+func TestEventTitlePrefersTitleKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.eventTitle(services.SystemEvent{
+		Severity: "critical",
+		Category: "authentication",
+		TitleKey: string(proto.TitleSessionWarning),
+	})
+	assert.Equal(t, "Session expires soon", got, "a title key must beat the composed title")
+}
+
+func TestEventTitleComposesFromSeverityAndCategory(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	tests := []struct {
+		name     string
+		severity string
+		category string
+		want     string
+	}{
+		{"warning dns", "warning", "dns", "Warning: DNS"},
+		{"critical system", "critical", "system", "Critical: System"},
+		{"info network", "info", "network", "Info: Network"},
+		{"error authentication", "error", "authentication", "Error: Authentication"},
+		// Enum values this build does not know, and the empty severity/category
+		// an event carries before the daemon fills them in.
+		{"unknown severity", "apocalyptic", "dns", "Info: DNS"},
+		{"unknown category", "warning", "quantum", "Warning: System"},
+		{"empty", "", "", "Info: System"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tray.eventTitle(services.SystemEvent{Severity: tc.severity, Category: tc.category})
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestShouldSkipSystemEvent(t *testing.T) {
+	tests := []struct {
+		name string
+		ev   services.SystemEvent
+		want bool
+	}{
+		{
+			name: "update announcement handled by the tray updater",
+			ev:   services.SystemEvent{Metadata: map[string]string{"new_version_available": "0.60.1"}},
+			want: true,
+		},
+		{
+			name: "install progress belongs to the progress window",
+			ev:   services.SystemEvent{Metadata: map[string]string{"progress_window": "show"}},
+			want: true,
+		},
+		{
+			name: "the v6 half of a dual-stack default route is already toasted as v4",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "::/0"}},
+			want: true,
+		},
+		{
+			name: "the v4 default route is the one that toasts",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "0.0.0.0/0"}},
+			want: false,
+		},
+		{
+			// policy_applied used to be suppressed here while the tray toasted
+			// off the paired config_changed event; it now carries its own keys.
+			name: "mdm policy applied surfaces normally",
+			ev: services.SystemEvent{
+				MessageKey: string(proto.UserMsgMDMPolicyApplied),
+				Metadata:   map[string]string{proto.MetadataTypeKey: proto.MetadataTypePolicyApplied},
+			},
+			want: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, shouldSkipSystemEvent(tc.ev))
+		})
+	}
+}

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_session.go

@@ -10,8 +10,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
-	nbstatus "github.com/netbirdio/netbird/client/status"
-	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/services"
 )
 
@@ -196,25 +194,6 @@ func (t *Tray) registerSessionWarningCategory() {
 	})
 }
 
-// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
-// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
-// Falls back to a generic string when metadata is missing or unparsable.
-func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
-	if meta == nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	raw := meta[authsession.MetaExpiresAt]
-	if raw == "" {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	deadline, err := authsession.ParseExpiresAt(raw)
-	if err != nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
-	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
-}
-
 // notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
 // with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
 func (t *Tray) notifySessionWarning(title, body string) {

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *Notifier
+	notifier     *notifications.NotificationService
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

e2e/agentnetwork/management_test.go

@@ -160,19 +160,8 @@ func TestSettingsRoundTrip(t *testing.T) {
 	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
 	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
-	// A cluster different from the pinned one must be rejected; echoing the
-	// pinned one back is valid.
-	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr("attacker.cluster.invalid"),
-		EnableLogCollection:    before.EnableLogCollection,
-		EnablePromptCollection: before.EnablePromptCollection,
-		RedactPii:              before.RedactPii,
-	})
-	requireClientError(t, err)
-
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,

e2e/agentnetwork/settings_bootstrap_test.go

@@ -1,114 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// harnessStartFresh boots a dedicated combined server with its own fresh
-// account and registers its teardown on t.
-func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
-	t.Helper()
-	fresh, err := harness.StartCombined(ctx)
-	if err != nil {
-		return nil, err
-	}
-	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
-	if _, err := fresh.Bootstrap(ctx); err != nil {
-		return nil, err
-	}
-	return fresh, nil
-}
-
-// TestSettingsBootstrapViaPut covers the settings-first bootstrap path on an
-// account that has never been bootstrapped: the GET reads as the defaults
-// with an empty cluster/subdomain/endpoint, a PUT without a cluster has
-// nothing to pin and fails, and a PUT carrying a cluster creates the row and
-// pins it immutably. The shared srv cannot provide that starting state (any
-// provider-creating test bootstraps it, and test order is deliberately not
-// relied on), so this boots a dedicated combined server — the image is
-// already built and cached by TestMain's StartCombined, so the extra cost is
-// one container start.
-func TestSettingsBootstrapViaPut(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	// Before agent-network bootstrap the settings read as the defaults, not
-	// as an error and not as a null body.
-	before, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings on a fresh account must succeed")
-	assert.Empty(t, before.Cluster, "cluster must be empty before bootstrap")
-	assert.Empty(t, before.Subdomain, "subdomain must be empty before bootstrap")
-	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap, not a bare dot")
-	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
-
-	// A PUT without a cluster has nothing to pin the account to.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection: true,
-	})
-	requireClientError(t, err)
-
-	// A PUT carrying a cluster bootstraps the account and applies the
-	// mutable fields from the same request. Every toggle is set away from
-	// its bootstrap default so each assertion can actually fail.
-	const cluster = "e2e.bootstrap.netbird.selfhosted"
-	bootstrapped, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(cluster),
-		EnableLogCollection:    false,
-		EnablePromptCollection: true,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "bootstrap settings via PUT must succeed")
-	assert.Equal(t, cluster, bootstrapped.Cluster, "cluster must be pinned from the request")
-	require.NotEmpty(t, bootstrapped.Subdomain, "subdomain must be assigned at bootstrap")
-	assert.Equal(t, bootstrapped.Subdomain+"."+cluster, bootstrapped.Endpoint, "endpoint must combine subdomain and cluster")
-	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
-	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
-	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
-
-	// The row is persisted: an independent read agrees on every field.
-	after, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after bootstrap must succeed")
-	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
-	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
-	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
-	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
-
-	// Once bootstrapped, later updates may omit the cluster entirely.
-	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection:    true,
-		EnablePromptCollection: false,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "post-bootstrap update without cluster must succeed")
-	assert.Equal(t, cluster, persisted.Cluster, "omitted cluster must keep the pinned value")
-	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
-	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
-
-	// The cluster is immutable: a different value is rejected rather than
-	// silently ignored, and the rejected update must not disturb anything.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:             ptr("other.cluster.invalid"),
-		EnableLogCollection: false,
-	})
-	requireClientError(t, err)
-
-	final, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after the rejected cluster change must succeed")
-	assert.Equal(t, persisted.Cluster, final.Cluster, "rejected update must not change the cluster")
-	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected update must not change the endpoint")
-	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected update must not apply its toggles")
-}

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-beta.3
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0

go.sum

@@ -660,8 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-beta.3 h1:BrcZunEBVucncRx+xgkk9TzlXU4qc0ygJuEhKAAGaeA=
-github.com/wailsapp/wails/v3 v3.0.0-beta.3/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

management/internals/modules/agentnetwork/handlers/handlers_test.go

@@ -17,7 +17,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -62,23 +61,10 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 		Return(true, context.Background(), nil).
 		AnyTimes()
 
-	// Swallow activity events so the mutation paths (create/update/delete)
-	// are exercisable through the HTTP layer.
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().
-		StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-	accounts.EXPECT().
-		UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-
-	manager := agentnetwork.NewManager(st, perms, accounts, nil)
+	manager := agentnetwork.NewManager(st, perms, nil, nil)
 	h := &handler{manager: manager}
 
 	router := mux.NewRouter()
-	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT")
 	h.addPolicyEndpoints(router)
 	h.addConsumptionEndpoints(router)
 	h.addBudgetRuleEndpoints(router)

management/internals/modules/agentnetwork/handlers/providers_handler_test.go

@@ -1,9 +1,7 @@
 package handlers
 
 import (
-	"encoding/json"
 	"math"
-	nethttp "net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -53,50 +51,3 @@ func TestValidate_ModelRates(t *testing.T) {
 		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
 	}
 }
-
-// TestProviderHandler_UpdateReplacesFullState pins the update contract shared
-// with the other PUT endpoints: the request replaces the provider's mutable
-// state, so optional fields absent from the JSON land as their zero values.
-// The two exceptions are server-side: the api_key (a secret — omitted means
-// "not rotated") and the session keypair, both preserved by the manager. The
-// identity headers stay on the wire as explicit empty strings so a cleared
-// value round-trips.
-func TestProviderHandler_UpdateReplacesFullState(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	create := `{
-        "provider_id": "openai_api",
-        "name": "openai",
-        "upstream_url": "https://api.openai.com",
-        "api_key": "sk-test",
-        "enabled": true,
-        "metadata_disabled": true,
-        "skip_tls_verification": true,
-        "extra_values": {"x-portkey-config": "pc-prod-3f2a"},
-        "identity_header_user_id": "x-bf-dim-netbird_user_id",
-        "models": [{"id": "gpt-4o", "input_per_1k": 0.0025, "output_per_1k": 0.01}]
-    }`
-	rec := f.do(t, nethttp.MethodPost, "/agent-network/providers", create)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "create must succeed: %s", rec.Body.String())
-
-	var created api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
-
-	// Minimal update: only the required fields, no api_key. Everything
-	// optional must land as its zero value.
-	update := `{"provider_id": "openai_api", "name": "openai-renamed", "upstream_url": "https://api.openai.com", "enabled": true}`
-	rec = f.do(t, nethttp.MethodPut, "/agent-network/providers/"+created.Id, update)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "update without api_key must succeed (key is preserved): %s", rec.Body.String())
-
-	var updated api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &updated))
-	assert.Equal(t, "openai-renamed", updated.Name, "sent field must apply")
-	assert.True(t, updated.Enabled, "sent field must apply")
-	assert.False(t, updated.MetadataDisabled, "omitted metadata_disabled must land as false — PUT replaces the full state")
-	assert.False(t, updated.SkipTlsVerification, "omitted skip_tls_verification must land as false")
-	assert.Nil(t, updated.ExtraValues, "omitted extra_values must be cleared")
-	assert.Equal(t, "", updated.IdentityHeaderUserId, "omitted identity header must be cleared yet stay on the wire")
-	assert.Empty(t, updated.Models, "omitted models must be cleared")
-	assert.Contains(t, rec.Body.String(), `"identity_header_user_id":""`,
-		"cleared identity header must round-trip as an explicit empty string")
-}

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -10,20 +11,19 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 // addSettingsEndpoints registers the Agent Network settings routes. The
-// settings row is bootstrapped server-side on first provider create or on the
-// first PUT carrying a cluster; GET reads it and PUT applies a partial update
-// of the mutable collection toggles (cluster/subdomain stay immutable).
+// settings row is bootstrapped server-side on first provider create; GET reads
+// it and PUT updates the mutable collection toggles (cluster/subdomain stay
+// immutable).
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
 }
 
-// updateSettings replaces the mutable settings fields on the account's row.
-// A request carrying a cluster bootstraps the row when the account doesn't
-// have one yet.
+// updateSettings applies the collection toggles to the account's settings row.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -48,9 +48,11 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// getSettings returns the account's agent-network settings. Accounts that
-// haven't been bootstrapped yet read as the defaults with an empty cluster,
-// subdomain and endpoint; the manager synthesises that view.
+// getSettings returns the account's agent-network settings. The settings
+// row is bootstrapped on first provider create, so freshly-onboarded
+// accounts have nothing to read. Rather than 404-ing in that case (which
+// the dashboard would have to special-case), return a JSON null with 200
+// so consumers can branch on the body alone.
 func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -60,6 +62,11 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
 	if err != nil {
+		var sErr *status.Error
+		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+			util.WriteJSONObject(r.Context(), w, nil)
+			return
+		}
 		util.WriteError(r.Context(), err, w)
 		return
 	}

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -1,137 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
-// convention shared with the account and DNS settings endpoints: settings
-// always read as a JSON object. Before bootstrap that object carries the
-// defaults with an empty cluster/subdomain/endpoint (the "not bootstrapped"
-// signal) and no timestamps — never a 404 and never the legacy null body.
-func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code,
-		"unbootstrapped account must read as 200 with defaults: got %d body=%s", rec.Code, rec.Body.String())
-	require.NotEqual(t, "null", trimSpace(rec.Body.String()),
-		"the legacy 200+null shape must not come back")
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Empty(t, got.Cluster, "cluster must be empty until bootstrapped")
-	assert.Empty(t, got.Subdomain, "subdomain must be empty until bootstrapped")
-	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped, not a bare dot")
-	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
-	assert.False(t, got.RedactPii, "defaults must show redaction off")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 30, *got.AccessLogRetentionDays, "defaults must show the bootstrap retention")
-	assert.Nil(t, got.CreatedAt, "no timestamps before a row exists")
-	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
-}
-
-// TestSettingsHandler_PutBootstrapsWithCluster covers the settings-first
-// bootstrap path: a PUT carrying a cluster on an unbootstrapped account
-// creates the row (cluster pinned, subdomain assigned) and applies the
-// mutable fields from the same request.
-func TestSettingsHandler_PutBootstrapsWithCluster(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be pinned from the request")
-	assert.NotEmpty(t, got.Subdomain, "subdomain must be assigned at bootstrap")
-	assert.Equal(t, got.Subdomain+".eu.proxy.netbird.io", got.Endpoint, "endpoint must combine subdomain and cluster")
-	assert.True(t, got.EnableLogCollection, "toggle from the bootstrap request must apply")
-	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 30, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
-
-	// The row is now readable via GET.
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
-}
-
-// TestSettingsHandler_PutWithoutClusterOnUnbootstrapped pins that a PUT
-// without a cluster cannot conjure a settings row out of nothing — there is
-// no cluster to pin — and surfaces as 404 like the GET.
-func TestSettingsHandler_PutWithoutClusterOnUnbootstrapped(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
-	assert.Equal(t, http.StatusNotFound, rec.Code,
-		"cluster-less PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "cluster",
-		"the error must point the caller at the bootstrap paths: %s", rec.Body.String())
-}
-
-// TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
-// with the other PUT endpoints: the request replaces every mutable field, so a
-// toggle absent from the JSON lands as its zero value rather than being
-// preserved. Cluster and subdomain survive untouched.
-func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.True(t, got.EnableLogCollection, "sent toggle must apply")
-	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
-	assert.False(t, got.RedactPii, "sent toggle must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 0, *got.AccessLogRetentionDays,
-		"retention absent from the request must land as the zero value — PUT replaces all mutable fields")
-	assert.Equal(t, before.Cluster, got.Cluster, "cluster must survive updates untouched")
-	assert.Equal(t, before.Subdomain, got.Subdomain, "subdomain must survive updates untouched")
-}
-
-// TestSettingsHandler_PutRejectsClusterChange pins cluster immutability: once
-// assigned, a differing cluster is rejected as a validation error instead of
-// being silently ignored, so callers never observe a value other than the one
-// they sent. Echoing the assigned cluster back stays valid, which lets
-// declarative clients send their full desired state idempotently.
-func TestSettingsHandler_PutRejectsClusterChange(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "us.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"cluster change must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": true}`)
-	require.Equal(t, http.StatusOK, rec.Code, "echoing the assigned cluster must stay valid: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be unchanged")
-	assert.True(t, got.RedactPii, "toggle sent alongside the echoed cluster must apply")
-}

management/internals/modules/agentnetwork/manager.go

@@ -82,11 +82,6 @@ type Manager interface {
 	RecordAccountBudgetUsage(ctx context.Context, accountID, userID string, groupIDs []string, tokensIn, tokensOut int64, costUSD float64) error
 	RecordUsage(ctx context.Context, in RecordUsageInput) error
 	SelectPolicyForRequest(ctx context.Context, in PolicySelectionInput) (*PolicySelectionResult, error)
-
-	// GetSetupForPeer returns the Agent Network connection info the peer's
-	// groups authorize (endpoint, providers, effective models). Caller-scoped
-	// by design — no user permission gate; see the implementation.
-	GetSetupForPeer(ctx context.Context, accountID, peerID string) (*types.EffectiveSetup, error)
 }
 
 // PolicySelectionInput is the per-request selection envelope. The
@@ -162,14 +157,14 @@ func NewManager(
 }
 
 func (m *managerImpl) GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
@@ -180,14 +175,9 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 // been created yet; otherwise it is ignored (the cluster is pinned on
 // Settings and every provider in the account routes through it).
 func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
-	if strings.TrimSpace(bootstrapCluster) != "" {
-		if err := m.requireSettingsBootstrapPermission(ctx, provider.AccountID, userID); err != nil {
-			return nil, err
-		}
-	}
 
 	// An empty api_key would silently produce a synthesised service
 	// that 401s on every upstream request. Surface the misconfiguration
@@ -212,7 +202,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 	}
 
 	if strings.TrimSpace(bootstrapCluster) != "" {
-		if _, err := m.bootstrapSettingsIfNeeded(ctx, m.store, provider.AccountID, bootstrapCluster); err != nil {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
 			// The provider create has already succeeded; logging the
 			// bootstrap miss matches the plan's PoC behaviour. The synth
 			// path treats a missing settings row as a no-op, and the next
@@ -228,7 +218,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -267,7 +257,7 @@ func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) DeleteProvider(ctx context.Context, accountID, userID, providerID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -316,21 +306,21 @@ func pluralize(n int, singular, plural string) string {
 }
 
 func (m *managerImpl) GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthNone, accountID, policyID)
 }
 
 func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -356,7 +346,7 @@ func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -383,7 +373,7 @@ func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, policyID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -403,21 +393,21 @@ func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, polic
 }
 
 func (m *managerImpl) GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthNone, accountID, guardrailID)
 }
 
 func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -439,7 +429,7 @@ func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -462,7 +452,7 @@ func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -483,7 +473,7 @@ func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, gu
 
 // GetAllBudgetRules returns every account-level budget rule for the account.
 func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
@@ -491,7 +481,7 @@ func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID s
 
 // GetBudgetRule returns a single account-level budget rule.
 func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthNone, accountID, ruleID)
@@ -501,7 +491,7 @@ func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, rule
 // enforced at request time (CheckLLMPolicyLimits), not baked into the synth
 // proxy config, so no reconcile is needed.
 func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -523,7 +513,7 @@ func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule
 
 // UpdateBudgetRule updates an existing account-level budget rule.
 func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -546,7 +536,7 @@ func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule
 
 // DeleteBudgetRule removes an account-level budget rule.
 func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -564,83 +554,40 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
-// UpdateSettings replaces the mutable account-level settings — the collection
-// toggles and retention — on the account's row. When the account has no
-// settings row yet, a non-empty settings.Cluster bootstraps one (same path as
-// first provider create); without it the update fails with NotFound. On an
-// existing row the cluster and subdomain are immutable: a differing
-// settings.Cluster is rejected rather than silently ignored so callers never
-// observe a value other than what they sent. Because the collection toggles
-// change the synthesised service config (prompt-capture gating, access-log
-// emission), a reconcile is triggered so the proxy and peer network maps
-// converge on the new state.
+// UpdateSettings applies the mutable account-level settings — the collection
+// toggles — onto the existing row. Cluster and Subdomain are immutable and are
+// preserved from the persisted row regardless of the input. Because the
+// collection toggles change the synthesised service config (prompt-capture
+// gating, access-log emission), a reconcile is triggered so the proxy and peer
+// network maps converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, settings.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
-	requestedCluster := strings.TrimSpace(settings.Cluster)
-
-	// The row lock from LockingStrengthUpdate only holds for the duration of
-	// the surrounding transaction, so the read, the cluster-immutability
-	// check, and the save must share one — otherwise concurrent PUTs could
-	// interleave between them.
-	var updated *types.Settings
-	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
-		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
-		switch {
-		case err == nil:
-			if requestedCluster != "" && requestedCluster != existing.Cluster {
-				return status.Errorf(status.InvalidArgument, "cluster is immutable once assigned (current: %s)", existing.Cluster)
-			}
-		case isNotFound(err):
-			if requestedCluster == "" {
-				return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; pass cluster to bootstrap them, or create a provider with bootstrap_cluster set")
-			}
-			// Bootstrapping pins the cluster and subdomain — a settings
-			// create on top of the update the caller already passed, matching
-			// the gate on the provider-create bootstrap path.
-			if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
-				return err
-			}
-			existing, err = m.bootstrapSettingsIfNeeded(ctx, tx, settings.AccountID, requestedCluster)
-			if err != nil {
-				return err
-			}
-		default:
-			return fmt.Errorf("get agent network settings: %w", err)
-		}
-
-		existing.EnableLogCollection = settings.EnableLogCollection
-		existing.EnablePromptCollection = settings.EnablePromptCollection
-		existing.RedactPii = settings.RedactPii
-		existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
-		existing.UpdatedAt = time.Now().UTC()
-
-		if err := tx.SaveAgentNetworkSettings(ctx, existing); err != nil {
-			return fmt.Errorf("save agent network settings: %w", err)
-		}
-		updated = existing
-		return nil
-	})
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+
+	existing.EnableLogCollection = settings.EnableLogCollection
+	existing.EnablePromptCollection = settings.EnablePromptCollection
+	existing.RedactPii = settings.RedactPii
+	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+	existing.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"log_collection":    updated.EnableLogCollection,
-		"prompt_collection": updated.EnablePromptCollection,
-		"redact_pii":        updated.RedactPii,
+		"log_collection":    existing.EnableLogCollection,
+		"prompt_collection": existing.EnablePromptCollection,
+		"redact_pii":        existing.RedactPii,
 	})
 	m.reconcile(ctx, settings.AccountID)
 
-	return updated, nil
-}
-
-// isNotFound reports whether err is a status.NotFound error.
-func isNotFound(err error) bool {
-	var sErr *status.Error
-	return errors.As(err, &sErr) && sErr.Type() == status.NotFound
+	return existing, nil
 }
 
 // validateProviderRefs ensures every destination provider id refers to a
@@ -664,38 +611,14 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 	return nil
 }
 
-// GetSettings returns the agent-network settings row for the account. When no
-// row has been bootstrapped yet, the defaults are returned (without
-// persisting) with cluster and subdomain empty — settings always read as an
-// object, like the account and DNS settings endpoints.
+// GetSettings returns the agent-network settings row for the account.
+// Returns the underlying status.NotFound when no row has been
+// bootstrapped yet (i.e. the account has no providers).
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-		return settings, nil
-	case isNotFound(err):
-		return types.DefaultSettings(accountID), nil
-	default:
-		return nil, err
-	}
-}
-
-// requireSettingsBootstrapPermission gates the one-time settings bootstrap a
-// first provider create performs. Pinning the account's cluster and subdomain
-// is a settings write, so it needs the settings permission on top of the
-// provider one. No-op once the settings row exists.
-func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, accountID, userID string) error {
-	_, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	if err == nil {
-		return nil
-	}
-	if !isNotFound(err) {
-		return fmt.Errorf("get agent network settings: %w", err)
-	}
-	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
+	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 }
 
 // bootstrapSettingsIfNeeded creates the per-account agent-network
@@ -703,9 +626,8 @@ func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, ac
 // hint the dashboard sends (auto-picked from the active cluster list);
 // the subdomain is picked from the curated wordlist avoiding
 // collisions on the same cluster. Idempotent: if a row already exists
-// it is returned untouched and the hint is ignored. st is the store to
-// operate on — pass the transaction store when calling from within one.
-func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.Store, accountID, providerCluster string) (*types.Settings, error) {
+// it is returned untouched and the hint is ignored.
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
 	if accountID == "" {
 		return nil, fmt.Errorf("bootstrap settings: account id is required")
 	}
@@ -713,15 +635,16 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.St
 		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
 	}
 
-	existing, err := st.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	if err == nil {
 		return existing, nil
 	}
-	if !isNotFound(err) {
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
-	siblings, err := st.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -740,12 +663,18 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.St
 	m.labelRngMu.Unlock()
 
 	now := time.Now().UTC()
-	settings := types.DefaultSettings(accountID)
-	settings.Cluster = providerCluster
-	settings.Subdomain = subdomain
-	settings.CreatedAt = now
-	settings.UpdatedAt = now
-	if err := st.SaveAgentNetworkSettings(ctx, settings); err != nil {
+	settings := &types.Settings{
+		AccountID: accountID,
+		Cluster:   providerCluster,
+		Subdomain: subdomain,
+		// Logs on by default; usage is collected regardless. Retention bounds
+		// how long full log rows are kept.
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
+		CreatedAt:              now,
+		UpdatedAt:              now,
+	}
+	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
 		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 	return settings, nil
@@ -756,7 +685,7 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.St
 // counter view; permission gate is the same Read role that gates
 // every other agent-network surface.
 func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
@@ -765,7 +694,7 @@ func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID str
 // ListAccessLogs returns a paginated, server-side-filtered page of
 // agent-network access logs plus the total count matching the filter.
 func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
@@ -775,7 +704,7 @@ func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID stri
 // agent-network access logs grouped by session, plus the total number of
 // sessions matching the filter.
 func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
@@ -784,7 +713,7 @@ func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, user
 // GetUsageOverview returns the filtered usage rows aggregated into time buckets
 // at the requested granularity, oldest-first.
 func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
@@ -858,8 +787,8 @@ func (m *managerImpl) RecordConsumption(ctx context.Context, accountID string, k
 	return m.store.IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
 }
 
-func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, module modules.Module, op operations.Operation) error {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, op)
+func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, op operations.Operation) error {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetwork, op)
 	if err != nil {
 		return status.NewPermissionValidationError(err)
 	}
@@ -948,8 +877,8 @@ func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.Accou
 
 func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
 
-func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.Settings, error) {
-	return types.DefaultSettings(accountID), nil
+func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
+	return nil, status.Errorf(status.NotFound, "agent network settings not found")
 }
 
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {

management/internals/modules/agentnetwork/provider_bootstrap_test.go

@@ -1,134 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"runtime"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// bootstrapFixture wires a real sqlite store to a gomock permissions manager
-// so tests can grant the provider permission while denying (or never
-// expecting) the settings one.
-type bootstrapFixture struct {
-	manager Manager
-	store   store.Store
-	perms   *permissions.MockManager
-}
-
-func newBootstrapFixture(t *testing.T) *bootstrapFixture {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("sqlite store not properly supported on Windows yet")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
-
-	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err, "test store setup must succeed")
-	t.Cleanup(cleanUp)
-
-	ctrl := gomock.NewController(t)
-	perms := permissions.NewMockManager(ctrl)
-
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-
-	return &bootstrapFixture{
-		manager: NewManager(st, perms, accounts, nil),
-		store:   st,
-		perms:   perms,
-	}
-}
-
-func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
-	f.perms.EXPECT().
-		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
-		Return(allowed, context.Background(), nil)
-}
-
-func newBootstrapProvider(accountID string) *types.Provider {
-	p := types.NewProvider(accountID)
-	p.Name = "openai"
-	p.UpstreamURL = "https://api.openai.com"
-	p.APIKey = "sk-test"
-	p.Enabled = true
-	return p
-}
-
-// TestCreateProviderBootstrapRequiresSettingsPermission pins the gate on the
-// one-time settings bootstrap: creating the first provider with a
-// bootstrap_cluster pins the account's cluster and subdomain, which is a
-// settings write and must not ride on the providers permission alone.
-func TestCreateProviderBootstrapRequiresSettingsPermission(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("denied without settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.Error(t, err, "bootstrap without settings permission must fail")
-		var sErr *status.Error
-		require.ErrorAs(t, err, &sErr)
-		assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
-
-		providers, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
-		require.NoError(t, err)
-		assert.Empty(t, providers, "provider must not be persisted when bootstrap is denied")
-		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-		assert.Error(t, err, "settings row must not be created when bootstrap is denied")
-	})
-
-	t.Run("allowed with settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-		created, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.NoError(t, err, "bootstrap with both permissions must succeed")
-		require.NotNil(t, created)
-
-		settings, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-		require.NoError(t, err, "bootstrap must create the settings row")
-		assert.Equal(t, "cluster1.example.com", settings.Cluster, "settings should pin the bootstrap cluster")
-	})
-
-	t.Run("existing settings need no settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		require.NoError(t, f.store.SaveAgentNetworkSettings(ctx, &types.Settings{
-			AccountID: "account1",
-			Cluster:   "cluster1.example.com",
-			Subdomain: "existing",
-		}), "pre-existing settings row setup must succeed")
-
-		// Only the providers permission may be consulted: gomock fails the
-		// test on any unexpected settings-permission call.
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.NoError(t, err, "create with existing settings must not require the settings permission")
-	})
-
-	t.Run("no bootstrap cluster needs no settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "")
-		require.NoError(t, err, "create without bootstrap must not require the settings permission")
-	})
-}

management/internals/modules/agentnetwork/setup.go

@@ -1,240 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"fmt"
-	"sort"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/catalog"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// GetSetupForPeer returns the Agent Network setup the calling peer's
-// groups authorize. It deliberately performs no user-permission check:
-// peer RPCs carry no user identity — WireGuard key possession is the
-// credential (same trust model as SelectPolicyForRequest) — and the
-// result is caller-scoped, which is strictly tighter than any role gate.
-// Setup-key/machine peers (no user attached) are fully supported since
-// the computation runs on peer groups, which is what the proxy enforces.
-func (m *managerImpl) GetSetupForPeer(ctx context.Context, accountID, peerID string) (*types.EffectiveSetup, error) {
-	groupIDs, err := m.store.GetPeerGroupIDs(ctx, store.LockingStrengthNone, accountID, peerID)
-	if err != nil {
-		return nil, fmt.Errorf("get peer groups: %w", err)
-	}
-	return m.effectiveSetupForGroups(ctx, accountID, groupIDs)
-}
-
-// effectiveSetupForGroups computes the effective Agent Network setup for
-// a set of caller groups: the account endpoint plus, per authorized
-// provider, the effective model set. It mirrors what the proxy enforces
-// at request time — the policy filter matches filterApplicablePolicies,
-// the model logic matches policyPermitsModel, and orphan providers
-// (enabled but referenced by no applicable policy) are omitted just like
-// the router synthesizer omits them — so the answer never advertises
-// anything the proxy would refuse.
-//
-// Every "nothing available" shape returns Configured=false rather than
-// an error, and "account not set up" is indistinguishable from "caller
-// has no access" by design: the response must not leak what exists for
-// others.
-func (m *managerImpl) effectiveSetupForGroups(ctx context.Context, accountID string, groupIDs []string) (*types.EffectiveSetup, error) {
-	notConfigured := &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}
-
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-	case isNotFound(err):
-		return notConfigured, nil
-	default:
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings.Endpoint() == "" {
-		return notConfigured, nil
-	}
-
-	policies, err := m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account policies: %w", err)
-	}
-	applicable := filterPoliciesByGroups(policies, groupIDs)
-	if len(applicable) == 0 {
-		return notConfigured, nil
-	}
-
-	providers, err := m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		return nil, fmt.Errorf("list account providers: %w", err)
-	}
-
-	var guardrailsByID map[string]*types.Guardrail
-	if anyPolicyHasGuardrails(applicable) {
-		guardrailsByID, err = m.loadGuardrailsByID(ctx, accountID)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	authorized := make([]*types.Provider, 0, len(providers))
-	for _, p := range providers {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if len(policiesForProvider(applicable, p.ID)) == 0 {
-			continue
-		}
-		authorized = append(authorized, p)
-	}
-	if len(authorized) == 0 {
-		return notConfigured, nil
-	}
-	// created_at order, ID tiebreak — same deterministic order the router
-	// synthesizer presents.
-	sort.SliceStable(authorized, func(i, j int) bool {
-		if !authorized[i].CreatedAt.Equal(authorized[j].CreatedAt) {
-			return authorized[i].CreatedAt.Before(authorized[j].CreatedAt)
-		}
-		return authorized[i].ID < authorized[j].ID
-	})
-
-	out := &types.EffectiveSetup{
-		Configured: true,
-		Endpoint:   "https://" + settings.Endpoint(),
-		Providers:  make([]types.EffectiveProvider, 0, len(authorized)),
-	}
-	for _, p := range authorized {
-		allAllowed, models := effectiveModelsForProvider(p, policiesForProvider(applicable, p.ID), guardrailsByID)
-		flavor := ""
-		if entry, ok := catalog.Lookup(p.ProviderID); ok {
-			flavor = entry.ParserID
-		}
-		out.Providers = append(out.Providers, types.EffectiveProvider{
-			Name:             p.Name,
-			CatalogID:        p.ProviderID,
-			APIFlavor:        flavor,
-			AllModelsAllowed: allAllowed,
-			Models:           models,
-		})
-	}
-	return out, nil
-}
-
-// filterPoliciesByGroups returns the enabled policies whose SourceGroups
-// intersect the caller's groups. Same group matching as
-// filterApplicablePolicies, without the per-provider filter — the setup
-// answer spans every provider the caller can reach.
-func filterPoliciesByGroups(policies []*types.Policy, groupIDs []string) []*types.Policy {
-	groupSet := make(map[string]struct{}, len(groupIDs))
-	for _, g := range groupIDs {
-		if g != "" {
-			groupSet[g] = struct{}{}
-		}
-	}
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if p == nil || !p.Enabled {
-			continue
-		}
-		if !anyGroupMatches(p.SourceGroups, groupSet) {
-			continue
-		}
-		out = append(out, p)
-	}
-	return out
-}
-
-// policiesForProvider returns the subset of policies targeting the
-// provider, order preserved.
-func policiesForProvider(policies []*types.Policy, providerID string) []*types.Policy {
-	out := make([]*types.Policy, 0, len(policies))
-	for _, p := range policies {
-		if sliceContains(p.DestinationProviderIDs, providerID) {
-			out = append(out, p)
-		}
-	}
-	return out
-}
-
-// effectiveModelsForProvider derives the caller's effective model set for
-// one provider from the applicable policies that target it, mirroring
-// policyPermitsModel: a policy with no allowlist-enabled guardrail is
-// unrestricted, and one unrestricted policy makes the whole provider
-// unrestricted (the proxy would admit any model through it). Otherwise
-// the union of the policies' allowlists applies, intersected with the
-// provider's declared models when the operator declared any — the router
-// only claims declared models, so an allowlisted-but-undeclared model is
-// unreachable and must not be advertised. With no declared models the
-// router claims every model, so the allowlist union stands alone.
-func effectiveModelsForProvider(provider *types.Provider, policies []*types.Policy, guardrailsByID map[string]*types.Guardrail) (bool, []string) {
-	restricted := true
-	union := make([]string, 0)
-	seen := make(map[string]struct{})
-	for _, p := range policies {
-		policyRestricted := false
-		for _, gID := range p.GuardrailIDs {
-			g, ok := guardrailsByID[gID]
-			if !ok || g == nil || !g.Checks.ModelAllowlist.Enabled {
-				continue
-			}
-			policyRestricted = true
-			for _, model := range g.Checks.ModelAllowlist.Models {
-				key := normaliseModelID(model)
-				if key == "" {
-					continue
-				}
-				if _, dup := seen[key]; dup {
-					continue
-				}
-				seen[key] = struct{}{}
-				union = append(union, key)
-			}
-		}
-		if !policyRestricted {
-			restricted = false
-		}
-	}
-
-	declared := declaredModelIDs(provider)
-	if !restricted {
-		return true, declared
-	}
-	if len(provider.Models) == 0 {
-		// No operator declaration: the router claims every model, so the
-		// allowlist union is the effective set as-is.
-		return false, union
-	}
-	out := make([]string, 0, len(declared))
-	for _, id := range declared {
-		if _, ok := seen[normaliseModelID(id)]; ok {
-			out = append(out, id)
-		}
-	}
-	return false, out
-}
-
-// declaredModelIDs returns the models a provider exposes: the operator's
-// curated list when present, otherwise the catalog entry's models (an
-// empty operator list means "all catalog models"). Gateway/custom catalog
-// entries declare no models, so the result may be empty.
-func declaredModelIDs(provider *types.Provider) []string {
-	if ids := providerModelIDs(provider); len(ids) > 0 {
-		return ids
-	}
-	entry, ok := catalog.Lookup(provider.ProviderID)
-	if !ok {
-		return []string{}
-	}
-	out := make([]string, 0, len(entry.Models))
-	for _, m := range entry.Models {
-		if m.ID != "" {
-			out = append(out, m.ID)
-		}
-	}
-	return out
-}
-
-// GetSetupForPeer on the mock manager reports "not configured" so tests
-// that don't care about setup still compile.
-func (*mockManager) GetSetupForPeer(_ context.Context, _, _ string) (*types.EffectiveSetup, error) {
-	return &types.EffectiveSetup{Providers: []types.EffectiveProvider{}}, nil
-}

management/internals/modules/agentnetwork/setup_realstore_test.go

@@ -1,271 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/store"
-)
-
-// These tests drive the effective-setup computation through the real
-// sqlite store, mirroring the policyselect realstore suite: assert on
-// observable answers (configured / providers / models), not on which
-// store methods get called. The computation must agree with what the
-// proxy enforces — policy filtering matches filterApplicablePolicies,
-// model logic matches policyPermitsModel, and orphan providers are
-// omitted like the router synthesizer omits them.
-
-func newSetupTestMgr(t *testing.T) (*managerImpl, store.Store) {
-	t.Helper()
-	ctx := context.Background()
-	s, cleanup, err := store.NewTestStoreFromSQL(ctx, "", t.TempDir())
-	require.NoError(t, err, "real sqlite test store must come up")
-	t.Cleanup(cleanup)
-	return &managerImpl{store: s}, s
-}
-
-// newSetupTestGuardrail returns an allowlist-enabled guardrail.
-func newSetupTestGuardrail(id string, models ...string) *types.Guardrail {
-	return &types.Guardrail{
-		ID:        id,
-		AccountID: testAccountID,
-		Name:      "allowlist " + id,
-		Checks: types.GuardrailChecks{
-			ModelAllowlist: types.GuardrailModelAllowlist{Enabled: true, Models: models},
-		},
-	}
-}
-
-func TestEffectiveSetup_RealStore_NoSettingsRow(t *testing.T) {
-	mgr, _ := newSetupTestMgr(t)
-
-	setup, err := mgr.effectiveSetupForGroups(context.Background(), testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "account without settings must read as not configured")
-	assert.Empty(t, setup.Endpoint)
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_NoApplicablePolicy(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-other"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "caller outside every policy's source groups must read as not configured")
-	assert.Empty(t, setup.Endpoint, "no-access answer must not leak the endpoint")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyListsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.True(t, setup.Configured)
-	assert.Equal(t, "https://"+testEndpoint, setup.Endpoint)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.Equal(t, "OpenAI", p.Name)
-	assert.Equal(t, "openai_api", p.CatalogID)
-	assert.Equal(t, "openai", p.APIFlavor)
-	assert.True(t, p.AllModelsAllowed, "policy without allowlist guardrail is unrestricted")
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "declared models listed as a courtesy")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistIntersectsDeclaredModels(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	// Allowlist admits gpt-5.4 (declared, odd casing/spacing) and gpt-4.1
-	// (NOT declared — the router would never route it, so it must not be
-	// advertised).
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", " GPT-5.4 ", "gpt-4.1")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"gpt-5.4"}, p.Models, "allowlist ∩ declared, in declared order and casing")
-}
-
-func TestEffectiveSetup_RealStore_UnrestrictedPolicyWinsOverRestricted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	restricted := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, restricted))
-	open := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	open.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, open))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	assert.True(t, setup.Providers[0].AllModelsAllowed,
-		"one applicable policy without an allowlist makes the provider unrestricted — the proxy would admit any model through it")
-}
-
-func TestEffectiveSetup_RealStore_AllowlistUnionAcrossPolicies(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	provider.Models = []types.ProviderModel{{ID: "gpt-5.4"}, {ID: "gpt-4o"}, {ID: "o4-mini"}}
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "gpt-5.4")))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-2", "gpt-4o")))
-	p1 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p1))
-	p2 := newSynthTestPolicy(provider.ID, "grp-eng", "guard-2")
-	p2.ID = "pol-2"
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, p2))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.ElementsMatch(t, []string{"gpt-5.4", "gpt-4o"}, p.Models, "union of allowlists across applicable policies")
-}
-
-func TestEffectiveSetup_RealStore_OrphanAndDisabledProvidersOmitted(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Orphan: enabled but referenced by no policy.
-	orphan := newSynthTestProvider()
-	orphan.ID = "prov-orphan"
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, orphan))
-	// Disabled but referenced by an applicable policy.
-	disabled := newSynthTestProvider()
-	disabled.ID = "prov-disabled"
-	disabled.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, disabled))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(disabled.ID, "grp-eng", "")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured, "neither an orphan nor a disabled provider is reachable, so nothing is configured for the caller")
-	assert.Empty(t, setup.Providers)
-}
-
-func TestEffectiveSetup_RealStore_DisabledPolicyIgnored(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
-	policy.Enabled = false
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	assert.False(t, setup.Configured)
-}
-
-func TestEffectiveSetup_RealStore_UndeclaredModelsUseAllowlistAsIs(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	// Gateway-style provider: no declared models — the router claims every
-	// model, so the allowlist union is the effective set on its own.
-	provider := newSynthTestProvider()
-	provider.ProviderID = "litellm_proxy"
-	provider.Name = "LiteLLM"
-	provider.Models = nil
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkGuardrail(ctx, newSetupTestGuardrail("guard-1", "claude-sonnet-4-5")))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "guard-1")))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 1)
-	p := setup.Providers[0]
-	assert.False(t, p.AllModelsAllowed)
-	assert.Equal(t, []string{"claude-sonnet-4-5"}, p.Models)
-}
-
-func TestEffectiveSetup_RealStore_ProvidersInCreatedAtOrder(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	newer := newSynthTestProvider()
-	newer.ID = "prov-newer"
-	newer.Name = "Newer"
-	newer.CreatedAt = time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, newer))
-	older := newSynthTestProvider()
-	older.ID = "prov-older"
-	older.Name = "Older"
-	older.CreatedAt = time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, older))
-
-	policy := newSynthTestPolicy(newer.ID, "grp-eng", "")
-	policy.DestinationProviderIDs = []string{newer.ID, older.ID}
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, policy))
-
-	setup, err := mgr.effectiveSetupForGroups(ctx, testAccountID, []string{"grp-eng"})
-	require.NoError(t, err)
-	require.Len(t, setup.Providers, 2)
-	assert.Equal(t, "Older", setup.Providers[0].Name)
-	assert.Equal(t, "Newer", setup.Providers[1].Name)
-}
-
-// TestGetSetupForPeer_RealStore pins the peer entry point: the peer's
-// group memberships (not any user identity) scope the answer, which is
-// exactly what the proxy enforces via AllowedGroupIDs — including for
-// setup-key/machine peers that have no user attached.
-func TestGetSetupForPeer_RealStore(t *testing.T) {
-	mgr, s := newSetupTestMgr(t)
-	ctx := context.Background()
-
-	require.NoError(t, s.SaveAgentNetworkSettings(ctx, newSynthTestSettings()))
-	provider := newSynthTestProvider()
-	require.NoError(t, s.SaveAgentNetworkProvider(ctx, provider))
-	require.NoError(t, s.SaveAgentNetworkPolicy(ctx, newSynthTestPolicy(provider.ID, "grp-eng", "")))
-
-	require.NoError(t, s.AddPeerToGroup(ctx, testAccountID, "peer-in", "grp-eng"))
-	require.NoError(t, s.AddPeerToGroup(ctx, testAccountID, "peer-out", "grp-other"))
-
-	setupIn, err := mgr.GetSetupForPeer(ctx, testAccountID, "peer-in")
-	require.NoError(t, err)
-	assert.True(t, setupIn.Configured)
-	require.Len(t, setupIn.Providers, 1)
-
-	setupOut, err := mgr.GetSetupForPeer(ctx, testAccountID, "peer-out")
-	require.NoError(t, err)
-	assert.False(t, setupOut.Configured, "peer outside the policy's source groups gets the not-configured answer")
-}

management/internals/modules/agentnetwork/types/provider.go

@@ -164,7 +164,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 		p.MetadataDisabled = *req.MetadataDisabled
 	}
 	// Identity-header overrides for catalogs flagged Customizable.
-	// Empty or omitted disables stamping for this dimension.
+	// nil pointer = "field omitted on the wire" → leave the stored
+	// value untouched (per the openapi description). Empty string is
+	// an explicit clear that disables stamping for this dimension.
 	if req.IdentityHeaderUserId != nil {
 		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
 	}
@@ -190,20 +192,16 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:          p.ID,
-		ProviderId:  p.ProviderID,
-		Name:        p.Name,
-		UpstreamUrl: p.UpstreamURL,
-		Models:      models,
-		// Always present on the wire so an explicitly cleared header
-		// round-trips as "" instead of vanishing from the response.
-		IdentityHeaderUserId: p.IdentityHeaderUserID,
-		IdentityHeaderGroups: p.IdentityHeaderGroups,
-		Enabled:              p.Enabled,
-		SkipTlsVerification:  p.SkipTLSVerification,
-		MetadataDisabled:     p.MetadataDisabled,
-		CreatedAt:            &created,
-		UpdatedAt:            &updated,
+		Id:                  p.ID,
+		ProviderId:          p.ProviderID,
+		Name:                p.Name,
+		UpstreamUrl:         p.UpstreamURL,
+		Models:              models,
+		Enabled:             p.Enabled,
+		SkipTlsVerification: p.SkipTLSVerification,
+		MetadataDisabled:    p.MetadataDisabled,
+		CreatedAt:           &created,
+		UpdatedAt:           &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
@@ -212,6 +210,14 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		}
 		resp.ExtraValues = &out
 	}
+	if p.IdentityHeaderUserID != "" {
+		v := p.IdentityHeaderUserID
+		resp.IdentityHeaderUserId = &v
+	}
+	if p.IdentityHeaderGroups != "" {
+		v := p.IdentityHeaderGroups
+		resp.IdentityHeaderGroups = &v
+	}
 	return resp
 }
 

management/internals/modules/agentnetwork/types/provider_test.go

@@ -77,41 +77,3 @@ func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
 	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
 	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
 }
-
-// TestProvider_IdentityHeaders_AlwaysOnWire pins that the identity header
-// fields are always present in the API response — an explicitly cleared
-// ("") header must round-trip as "" rather than vanish, so API consumers
-// (e.g. the Terraform provider) never observe a value other than the one
-// they wrote.
-func TestProvider_IdentityHeaders_AlwaysOnWire(t *testing.T) {
-	set := "x-bf-dim-netbird_user_id"
-	empty := ""
-
-	base := func() *api.AgentNetworkProviderRequest {
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "custom",
-			Name:        "bifrost",
-			UpstreamUrl: "https://bifrost.internal",
-		}
-	}
-
-	p := NewProvider("acc-1")
-	resp := p.ToAPIResponse()
-	assert.Equal(t, "", resp.IdentityHeaderUserId, "unset header must surface as empty string, not be omitted")
-	assert.Equal(t, "", resp.IdentityHeaderGroups, "unset header must surface as empty string, not be omitted")
-
-	req := base()
-	req.IdentityHeaderUserId = &set
-	p.FromAPIRequest(req)
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "configured header must round-trip")
-
-	// Omitting the field preserves it.
-	p.FromAPIRequest(base())
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "omitted header must preserve the stored value")
-
-	// An explicit "" clears it AND stays visible on the wire.
-	req = base()
-	req.IdentityHeaderUserId = &empty
-	p.FromAPIRequest(req)
-	assert.Equal(t, "", p.ToAPIResponse().IdentityHeaderUserId, "cleared header must round-trip as empty string")
-}

management/internals/modules/agentnetwork/types/settings.go

@@ -1,7 +1,6 @@
 package types
 
 import (
-	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -43,34 +42,18 @@ type Settings struct {
 // schema cohesive.
 func (Settings) TableName() string { return "agent_network_settings" }
 
-// DefaultSettings returns the settings an account observes before its row is
-// bootstrapped: log collection on with the default retention, everything else
-// off, and no cluster/subdomain assigned yet. Bootstrap persists exactly these
-// values plus the assigned cluster and subdomain, so the pre-bootstrap read
-// and the freshly bootstrapped row agree.
-func DefaultSettings(accountID string) *Settings {
-	return &Settings{
-		AccountID:              accountID,
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: DefaultAccessLogRetentionDays,
-	}
-}
-
 // Endpoint returns the bare hostname agents reach this account at:
-// `<subdomain>.<cluster>`. Empty until both halves are assigned at bootstrap.
+// `<subdomain>.<cluster>`.
 func (s *Settings) Endpoint() string {
-	if s.Cluster == "" || s.Subdomain == "" {
-		return ""
-	}
 	return s.Subdomain + "." + s.Cluster
 }
 
-// ToAPIResponse renders the settings as the API representation. The
-// timestamps are omitted while zero — a default (not yet bootstrapped) view
-// has no persisted row to date.
+// ToAPIResponse renders the settings as the API representation.
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
+	created := s.CreatedAt
+	updated := s.UpdatedAt
 	retention := s.AccessLogRetentionDays
-	resp := &api.AgentNetworkSettings{
+	return &api.AgentNetworkSettings{
 		Cluster:                s.Cluster,
 		Subdomain:              s.Subdomain,
 		Endpoint:               s.Endpoint(),
@@ -78,27 +61,14 @@ func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
 		AccessLogRetentionDays: &retention,
+		CreatedAt:              &created,
+		UpdatedAt:              &updated,
 	}
-	if !s.CreatedAt.IsZero() {
-		created := s.CreatedAt
-		resp.CreatedAt = &created
-	}
-	if !s.UpdatedAt.IsZero() {
-		updated := s.UpdatedAt
-		resp.UpdatedAt = &updated
-	}
-	return resp
 }
 
-// FromAPIRequest applies the request onto the receiver. The mutable
-// collection fields are always replaced with the request values. Cluster
-// participates only in bootstrap and the immutability check (see
-// Manager.UpdateSettings); Subdomain is server-assigned and never taken
-// from a request.
+// FromAPIRequest applies the mutable settings fields from the request. Cluster
+// and Subdomain are immutable and intentionally not touched here.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
-	if req.Cluster != nil {
-		s.Cluster = strings.TrimSpace(*req.Cluster)
-	}
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
 	s.RedactPii = req.RedactPii

management/internals/modules/agentnetwork/types/setup.go

@@ -1,40 +0,0 @@
-package types
-
-// EffectiveSetup is the caller-scoped answer to "what may this caller
-// use on the Agent Network?" — the account's proxy endpoint plus the
-// providers and models the caller's groups authorize. It intentionally
-// carries display metadata only: no keys, no upstream URLs, no policy or
-// guardrail structure, and no hint of providers the caller cannot reach.
-type EffectiveSetup struct {
-	// Configured is false when the account has no Agent Network set up or
-	// when nothing is authorized for the caller's groups — the two cases
-	// are deliberately indistinguishable so the response leaks nothing
-	// about what exists for others.
-	Configured bool
-	// Endpoint is the account's proxy base URL
-	// ("https://<subdomain>.<cluster>"), reachable over the NetBird tunnel
-	// only. Empty when Configured is false.
-	Endpoint string
-	// Providers lists the providers at least one applicable policy
-	// authorizes for the caller, in the account's created_at order.
-	Providers []EffectiveProvider
-}
-
-// EffectiveProvider is one authorized provider in an EffectiveSetup.
-type EffectiveProvider struct {
-	// Name is the operator-assigned label, e.g. "Bedrock prod".
-	Name string
-	// CatalogID names the catalog entry, e.g. "anthropic_api".
-	CatalogID string
-	// APIFlavor is the request-body shape the provider speaks — the
-	// catalog entry's parser id ("anthropic", "openai"); empty when the
-	// proxy dispatches the provider by URL path instead.
-	APIFlavor string
-	// AllModelsAllowed is true when no model allowlist restricts this
-	// provider for the caller. Models then lists the declared/catalog
-	// models as a courtesy (possibly none for gateway-style providers).
-	AllModelsAllowed bool
-	// Models is the effective model allowlist for the caller, or the
-	// declared/catalog models when AllModelsAllowed is true.
-	Models []string
-}

management/internals/server/boot.go

@@ -24,13 +24,13 @@ import (
 
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -184,10 +184,6 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 			grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(realipOpts...), streamInterceptor, proxyStream),
 		}
 
-		// Append interceptors contributed by registered gRPC extensions. These
-		// run after the built-in chain (ChainUnaryInterceptor is additive).
-		gRPCOpts = appendExtensionInterceptors(gRPCOpts, s.grpcExtensions)
-
 		if s.Config.HttpConfig.LetsEncryptDomain != "" {
 			certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
 			if err != nil {
@@ -211,19 +207,14 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 		}
 		serviceMgr := s.ServiceManager()
 		srv.SetReverseProxyManager(serviceMgr)
-		srv.SetAgentNetworkSetupService(s.AgentNetworkManager())
 		if serviceMgr != nil {
 			serviceMgr.StartExposeReaper(context.Background())
 		}
 		mgmtProto.RegisterManagementServiceServer(gRPCAPIHandler, srv)
-		log.Info("ManagementService registered on gRPC server (agent-network setup RPC available)")
 
 		mgmtProto.RegisterProxyServiceServer(gRPCAPIHandler, s.ReverseProxyGRPCServer())
 		log.Info("ProxyService registered on gRPC server")
 
-		// Register services contributed by external modules via the extension seam.
-		registerExtensions(gRPCAPIHandler, s.grpcExtensions)
-
 		return gRPCAPIHandler
 	})
 }

management/internals/server/grpc_extension.go

@@ -1,74 +0,0 @@
-package server
-
-import (
-	"context"
-
-	"google.golang.org/grpc"
-)
-
-// GRPCExtension bundles an external module's contribution to the management
-// gRPC server: the registration of one or more services onto the shared
-// grpc.Server, any server-wide interceptors those services require, and an
-// optional shutdown hook. It is a generic extension point with no knowledge of
-// any specific service.
-type GRPCExtension struct {
-	// Register is invoked with the shared grpc.Server (as a ServiceRegistrar)
-	// after the built-in services are registered. It may register any number of
-	// services. May be nil.
-	Register func(grpc.ServiceRegistrar)
-	// UnaryInterceptors are appended to the server's unary interceptor chain,
-	// running after the built-in interceptors. May be empty.
-	UnaryInterceptors []grpc.UnaryServerInterceptor
-	// StreamInterceptors are appended to the server's stream interceptor chain,
-	// running after the built-in interceptors. May be empty.
-	StreamInterceptors []grpc.StreamServerInterceptor
-	// Shutdown, if non-nil, is called once during Stop() with the context
-	// governing server shutdown, which carries a deadline. The hook MUST
-	// return promptly and MUST abandon its work once that context is
-	// cancelled or expires: it runs before the rest of Stop()'s cleanup
-	// (store, event store, embedded IdP) and before Stop() itself checks the
-	// context's deadline, so a hook that ignores the context will delay all
-	// of that cleanup and prevent Stop() from returning on time. May be nil.
-	Shutdown func(ctx context.Context)
-}
-
-// RegisterGRPCExtension registers a gRPC extension. Call before the gRPC server
-// is first built (i.e. before Start); registrations after that have no effect.
-func (s *BaseServer) RegisterGRPCExtension(ext GRPCExtension) {
-	s.grpcExtensions = append(s.grpcExtensions, ext)
-}
-
-// appendExtensionInterceptors appends each extension's interceptors to the gRPC
-// server options as additional chained interceptors. grpc.ChainUnaryInterceptor
-// and grpc.ChainStreamInterceptor are additive, so the returned options run the
-// extension interceptors after any interceptors already present in opts.
-func appendExtensionInterceptors(opts []grpc.ServerOption, exts []GRPCExtension) []grpc.ServerOption {
-	for _, ext := range exts {
-		if len(ext.UnaryInterceptors) > 0 {
-			opts = append(opts, grpc.ChainUnaryInterceptor(ext.UnaryInterceptors...))
-		}
-		if len(ext.StreamInterceptors) > 0 {
-			opts = append(opts, grpc.ChainStreamInterceptor(ext.StreamInterceptors...))
-		}
-	}
-	return opts
-}
-
-// registerExtensions registers each extension's services onto reg.
-func registerExtensions(reg grpc.ServiceRegistrar, exts []GRPCExtension) {
-	for _, ext := range exts {
-		if ext.Register != nil {
-			ext.Register(reg)
-		}
-	}
-}
-
-// runExtensionShutdownHooks calls each extension's shutdown hook, if set,
-// passing ctx through so hooks can honor its deadline/cancellation.
-func runExtensionShutdownHooks(ctx context.Context, exts []GRPCExtension) {
-	for _, ext := range exts {
-		if ext.Shutdown != nil {
-			ext.Shutdown(ctx)
-		}
-	}
-}

management/internals/server/grpc_extension_test.go

@@ -1,160 +0,0 @@
-package server
-
-import (
-	"context"
-	"net"
-	"sync/atomic"
-	"testing"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/health"
-	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
-	"google.golang.org/grpc/test/bufconn"
-)
-
-// Test that an extension's interceptors and service registration are actually
-// wired onto a real in-process gRPC server via the helpers, and that shutdown
-// hooks run. This validates the load-bearing assumption that
-// grpc.ChainUnaryInterceptor is additive (extension interceptors run in
-// addition to any base chain).
-func TestGRPCExtensionAppliedToServer(t *testing.T) {
-	var unaryCalls atomic.Int32
-	var streamShutdownCalled atomic.Bool
-
-	ext := GRPCExtension{
-		Register: func(reg grpc.ServiceRegistrar) {
-			healthgrpc.RegisterHealthServer(reg, health.NewServer())
-		},
-		UnaryInterceptors: []grpc.UnaryServerInterceptor{
-			func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
-				unaryCalls.Add(1)
-				return handler(ctx, req)
-			},
-		},
-		Shutdown: func(ctx context.Context) { streamShutdownCalled.Store(true) },
-	}
-	exts := []GRPCExtension{ext}
-
-	// Base options mimic GRPCServer(): a pre-existing chain the extension appends to.
-	var baseUnaryCalls atomic.Int32
-	opts := []grpc.ServerOption{
-		grpc.ChainUnaryInterceptor(func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
-			baseUnaryCalls.Add(1)
-			return handler(ctx, req)
-		}),
-	}
-	opts = appendExtensionInterceptors(opts, exts)
-
-	srv := grpc.NewServer(opts...)
-	registerExtensions(srv, exts)
-
-	lis := bufconn.Listen(1024 * 1024)
-	go func() { _ = srv.Serve(lis) }()
-	t.Cleanup(srv.Stop)
-
-	conn, err := grpc.NewClient("passthrough:///bufnet",
-		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return lis.DialContext(ctx) }),
-		grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = conn.Close() })
-
-	_, err = healthgrpc.NewHealthClient(conn).Check(context.Background(), &healthgrpc.HealthCheckRequest{})
-	if err != nil {
-		t.Fatalf("health check via extension-registered service failed: %v", err)
-	}
-	if baseUnaryCalls.Load() != 1 {
-		t.Errorf("base interceptor calls = %d, want 1 (base chain must be preserved)", baseUnaryCalls.Load())
-	}
-	if unaryCalls.Load() != 1 {
-		t.Errorf("extension interceptor calls = %d, want 1", unaryCalls.Load())
-	}
-
-	runExtensionShutdownHooks(context.Background(), exts)
-	if !streamShutdownCalled.Load() {
-		t.Error("extension shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookReceivesCallerContext asserts that each hook receives
-// a non-nil context and that it is the very same context the caller passed
-// in, so hooks can rely on values/deadlines placed on it by Stop().
-func TestGRPCExtensionShutdownHookReceivesCallerContext(t *testing.T) {
-	type sentinelKey struct{}
-	want := "shutdown-ctx-sentinel"
-	ctx := context.WithValue(context.Background(), sentinelKey{}, want)
-
-	var called bool
-	ext := GRPCExtension{
-		Shutdown: func(hookCtx context.Context) {
-			called = true
-			if hookCtx == nil {
-				t.Fatal("hook received a nil context")
-			}
-			got, _ := hookCtx.Value(sentinelKey{}).(string)
-			if got != want {
-				t.Errorf("hook context sentinel = %q, want %q (not the caller's context)", got, want)
-			}
-		},
-	}
-
-	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
-	if !called {
-		t.Fatal("shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookObservesCancellation documents, by test, that
-// hooks can honor cancellation/deadlines: a hook given an already-cancelled
-// context must see ctx.Err() != nil and a closed Done() channel.
-func TestGRPCExtensionShutdownHookObservesCancellation(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	var called bool
-	ext := GRPCExtension{
-		Shutdown: func(hookCtx context.Context) {
-			called = true
-			if hookCtx.Err() == nil {
-				t.Error("hook context Err() = nil, want non-nil for a cancelled context")
-			}
-			select {
-			case <-hookCtx.Done():
-			default:
-				t.Error("hook context Done() channel is not closed for a cancelled context")
-			}
-		},
-	}
-
-	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
-	if !called {
-		t.Fatal("shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookNilSkipped asserts that an extension
-// with a nil Shutdown hook is skipped without panicking, and that hooks for
-// other extensions still run.
-func TestGRPCExtensionShutdownHookNilSkipped(t *testing.T) {
-	var called atomic.Bool
-	exts := []GRPCExtension{
-		{Shutdown: nil},
-		{Shutdown: func(context.Context) { called.Store(true) }},
-	}
-
-	runExtensionShutdownHooks(context.Background(), exts)
-	if !called.Load() {
-		t.Error("shutdown hook for non-nil extension was not called")
-	}
-}
-
-func TestRegisterGRPCExtensionAccumulates(t *testing.T) {
-	s := &BaseServer{}
-	s.RegisterGRPCExtension(GRPCExtension{})
-	s.RegisterGRPCExtension(GRPCExtension{})
-	if len(s.grpcExtensions) != 2 {
-		t.Fatalf("grpcExtensions len = %d, want 2", len(s.grpcExtensions))
-	}
-}

management/internals/server/server.go

@@ -68,11 +68,6 @@ type BaseServer struct {
 
 	proxyAuthClose func()
 
-	// grpcExtensions holds additional gRPC services, interceptors, and shutdown
-	// hooks registered by external modules via RegisterGRPCExtension. Populated
-	// during boot (single-threaded), consumed by GRPCServer() and Stop().
-	grpcExtensions []GRPCExtension
-
 	listener    net.Listener
 	certManager *autocert.Manager
 	update      *version.Update
@@ -262,7 +257,6 @@ func (s *BaseServer) Stop() error {
 		s.proxyAuthClose()
 		s.proxyAuthClose = nil
 	}
-	runExtensionShutdownHooks(ctx, s.grpcExtensions)
 	_ = s.Store().Close(ctx)
 	_ = s.EventStore().Close(ctx)
 	if s.update != nil {

management/internals/shared/grpc/agentnetwork_service.go

@@ -1,81 +0,0 @@
-package grpc
-
-import (
-	"context"
-
-	log "github.com/sirupsen/logrus"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
-
-	antypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// AgentNetworkSetupService is the minimal slice of agentnetwork.Manager
-// the peer-facing setup RPC needs. Narrow on purpose so the gRPC server
-// never sees the manager's operator-facing surface.
-type AgentNetworkSetupService interface {
-	GetSetupForPeer(ctx context.Context, accountID, peerID string) (*antypes.EffectiveSetup, error)
-}
-
-// GetAgentNetworkSetup handles a peer request for its Agent Network
-// connection info. The WireGuard key is the credential (same trust model
-// as the Expose RPCs); the response is scoped to what the calling peer's
-// own groups authorize and carries display metadata only.
-func (s *Server) GetAgentNetworkSetup(ctx context.Context, req *proto.EncryptedMessage) (*proto.EncryptedMessage, error) {
-	setupReq := &proto.AgentNetworkSetupRequest{}
-	peerKey, err := s.parseRequest(ctx, req, setupReq)
-	if err != nil {
-		return nil, err
-	}
-
-	accountID, peer, err := s.authenticateExposePeer(ctx, peerKey)
-	if err != nil {
-		return nil, err
-	}
-
-	setupSvc := s.getAgentNetworkSetupService()
-	if setupSvc == nil {
-		return nil, status.Errorf(codes.Internal, "agent network manager not available")
-	}
-
-	setup, err := setupSvc.GetSetupForPeer(ctx, accountID, peer.ID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("get agent network setup for peer %s: %v", peer.ID, err)
-		return nil, status.Errorf(codes.Internal, "internal error")
-	}
-
-	return s.encryptResponse(peerKey, toProtoAgentNetworkSetup(setup))
-}
-
-func toProtoAgentNetworkSetup(setup *antypes.EffectiveSetup) *proto.AgentNetworkSetupResponse {
-	resp := &proto.AgentNetworkSetupResponse{
-		Configured: setup.Configured,
-		Endpoint:   setup.Endpoint,
-		Providers:  make([]*proto.AgentNetworkProviderInfo, 0, len(setup.Providers)),
-	}
-	for _, p := range setup.Providers {
-		resp.Providers = append(resp.Providers, &proto.AgentNetworkProviderInfo{
-			Name:             p.Name,
-			CatalogId:        p.CatalogID,
-			ApiFlavor:        p.APIFlavor,
-			AllModelsAllowed: p.AllModelsAllowed,
-			Models:           p.Models,
-		})
-	}
-	return resp
-}
-
-func (s *Server) getAgentNetworkSetupService() AgentNetworkSetupService {
-	s.agentNetworkSetupMu.RLock()
-	defer s.agentNetworkSetupMu.RUnlock()
-	return s.agentNetworkSetup
-}
-
-// SetAgentNetworkSetupService wires the agent-network setup service on
-// the server.
-func (s *Server) SetAgentNetworkSetupService(svc AgentNetworkSetupService) {
-	s.agentNetworkSetupMu.Lock()
-	defer s.agentNetworkSetupMu.Unlock()
-	s.agentNetworkSetup = svc
-}

management/internals/shared/grpc/components_encoder.go

@@ -61,8 +61,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
-					Serial:     networkSerial(c.Network),
-					Network:    toAccountNetwork(c.Network),
 					PeerConfig: in.PeerConfig,
 					// components.Peers always contains the target peer
 					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},

management/internals/shared/grpc/components_encoder_test.go

@@ -758,9 +758,6 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	assert.Equal(t, "netbird.cloud", full.DnsDomain)
 	assert.Len(t, full.Peers, 1)
 	assert.Empty(t, full.Policies)
-	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
-	assert.Equal(t, "net-empty", full.Network.Identifier)
-	assert.Equal(t, uint64(9), full.Serial)
 }
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
@@ -779,12 +776,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}},
-			Network: &types.Network{
-				Identifier: "net-empty",
-				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
-				Serial:     9,
-			},
-		},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
 	)
 }

management/internals/shared/grpc/server.go

@@ -87,9 +87,6 @@ type Server struct {
 
 	reverseProxyManager rpservice.Manager
 	reverseProxyMu      sync.RWMutex
-
-	agentNetworkSetup   AgentNetworkSetupService
-	agentNetworkSetupMu sync.RWMutex
 }
 
 // NewServer creates a new Management server

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -102,20 +102,11 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
 	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
 
-	// A cluster different from the one pinned at bootstrap must be rejected
-	// outright — never silently swapped or ignored.
-	_, err = mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
-		AccountID:           accountID,
-		Cluster:             "attacker.cluster",
-		EnableLogCollection: true,
-	})
-	require.Error(t, err, "UpdateSettings with a mismatched cluster must fail")
-
-	// Flipping the toggles works with the pinned cluster echoed back (and
-	// with it omitted); the subdomain is never taken from the request.
+	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
+	// immutable fields must be ignored.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Cluster:                clusterAddr,
+		Cluster:                "attacker.cluster",
 		Subdomain:              "evil",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,

management/server/permissions/manager.go

@@ -82,9 +82,6 @@ func (m *managerImpl) ValidateUserPermissions(
 	return m.ValidateRoleModuleAccess(ctx, accountID, role, module, operation), ctxEnriched, nil
 }
 
-// ValidateRoleModuleAccess resolves an operation against the role's explicit
-// grant for the module, then the grant for its parent module when the module
-// is a dotted submodule, and finally the role's AutoAllowNew default.
 func (m *managerImpl) ValidateRoleModuleAccess(
 	ctx context.Context,
 	accountID string,
@@ -92,7 +89,7 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	module modules.Module,
 	operation operations.Operation,
 ) bool {
-	if permissions, ok := lookupModulePermissions(role, module); ok {
+	if permissions, ok := role.Permissions[module]; ok {
 		if allowed, exists := permissions[operation]; exists {
 			return allowed
 		}
@@ -103,21 +100,6 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	return role.AutoAllowNew[operation]
 }
 
-// lookupModulePermissions returns the role's explicit permission set for the
-// module, falling back to the parent module's set for dotted submodules. The
-// second return reports whether any explicit set was found.
-func lookupModulePermissions(role roles.RolePermissions, module modules.Module) (map[operations.Operation]bool, bool) {
-	if permissions, ok := role.Permissions[module]; ok {
-		return permissions, true
-	}
-	if parent, hasParent := module.Parent(); hasParent {
-		if permissions, ok := role.Permissions[parent]; ok {
-			return permissions, true
-		}
-	}
-	return nil, false
-}
-
 func (m *managerImpl) ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) (context.Context, error) {
 	if user.AccountID != accountID {
 		return ctx, status.NewUserNotPartOfAccountError()
@@ -137,7 +119,7 @@ func (m *managerImpl) GetPermissionsByRole(ctx context.Context, role types.UserR
 	permissions := roles.Permissions{}
 
 	for k := range modules.All {
-		if rolePermissions, ok := lookupModulePermissions(roleMap, k); ok {
+		if rolePermissions, ok := roleMap.Permissions[k]; ok {
 			permissions[k] = rolePermissions
 			continue
 		}

management/server/permissions/manager_test.go

@@ -1,139 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/permissions/roles"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-func TestValidateRoleModuleAccessSubmoduleCascade(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	fullAccess := map[operations.Operation]bool{
-		operations.Read:   true,
-		operations.Create: true,
-		operations.Update: true,
-		operations.Delete: true,
-	}
-	readOnly := map[operations.Operation]bool{
-		operations.Read:   true,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	}
-	denyAll := map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	}
-
-	t.Run("parent grant covers submodules", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions:  roles.Permissions{modules.AgentNetwork: fullAccess},
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Create),
-			"parent full grant should allow create on a submodule")
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
-			"parent full grant should allow read on a submodule")
-	})
-
-	t.Run("submodule grant does not leak to parent or siblings", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions:  roles.Permissions{modules.AgentNetworkUsage: readOnly},
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-			"explicit submodule read should be allowed")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Create),
-			"read-only submodule grant should not allow create")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetwork, operations.Read),
-			"submodule grant should not grant the parent module")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
-			"submodule grant should not grant a sibling submodule")
-	})
-
-	t.Run("explicit submodule entry wins over parent grant", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions: roles.Permissions{
-				modules.AgentNetwork:     fullAccess,
-				modules.AgentNetworkLogs: denyAll,
-			},
-		}
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
-			"explicit submodule deny should override the parent grant")
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-			"sibling submodules should still resolve through the parent grant")
-	})
-
-	t.Run("auto allow applies when neither submodule nor parent is granted", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: readOnly,
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
-			"auto-allow read should apply to submodules")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Delete),
-			"auto-allow should not grant unlisted operations")
-	})
-}
-
-// TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules pins the behavior the
-// submodule split must not change: every built-in role resolves the new
-// submodules exactly as it resolved the agent_network module before.
-func TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	submodules := []modules.Module{
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-	}
-	allOperations := []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
-
-	for _, role := range []types.UserRole{types.UserRoleOwner, types.UserRoleAdmin, types.UserRoleAuditor, types.UserRoleNetworkAdmin, types.UserRoleUser} {
-		rolePermissions, ok := roles.RolesMap[role]
-		require.True(t, ok, "role %s must exist in RolesMap", role)
-
-		for _, sub := range submodules {
-			for _, op := range allOperations {
-				expected := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, modules.AgentNetwork, op)
-				actual := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, sub, op)
-				assert.Equal(t, expected, actual, "role %s: %s on %s should match the agent_network module", role, op, sub)
-			}
-		}
-	}
-}
-
-func TestGetPermissionsByRoleIncludesSubmodules(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAuditor)
-	require.NoError(t, err, "auditor role must resolve")
-
-	usage, ok := permissions[modules.AgentNetworkUsage]
-	require.True(t, ok, "permissions map should contain the usage submodule")
-	assert.True(t, usage[operations.Read], "auditor should read the usage submodule")
-	assert.False(t, usage[operations.Update], "auditor should not update the usage submodule")
-
-	adminPermissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAdmin)
-	require.NoError(t, err, "admin role must resolve")
-	providers, ok := adminPermissions[modules.AgentNetworkProviders]
-	require.True(t, ok, "permissions map should contain the providers submodule")
-	assert.True(t, providers[operations.Delete], "admin should delete on the providers submodule")
-}

management/server/permissions/modules/module.go

@@ -1,7 +1,5 @@
 package modules
 
-import "strings"
-
 type Module string
 
 const (
@@ -22,17 +20,6 @@ const (
 	IdentityProviders Module = "identity_providers"
 	Services          Module = "services"
 	AgentNetwork      Module = "agent_network"
-
-	// Agent Network submodules. A role may grant one of these directly
-	// or grant the AgentNetwork parent, which covers all of them (see
-	// permissions.Manager cascade resolution).
-	AgentNetworkProviders  Module = "agent_network.providers"
-	AgentNetworkPolicies   Module = "agent_network.policies"
-	AgentNetworkGuardrails Module = "agent_network.guardrails"
-	AgentNetworkBudgets    Module = "agent_network.budgets"
-	AgentNetworkUsage      Module = "agent_network.usage"
-	AgentNetworkLogs       Module = "agent_network.logs"
-	AgentNetworkSettings   Module = "agent_network.settings"
 )
 
 var All = map[Module]struct{}{
@@ -53,21 +40,4 @@ var All = map[Module]struct{}{
 	IdentityProviders: {},
 	Services:          {},
 	AgentNetwork:      {},
-
-	AgentNetworkProviders:  {},
-	AgentNetworkPolicies:   {},
-	AgentNetworkGuardrails: {},
-	AgentNetworkBudgets:    {},
-	AgentNetworkUsage:      {},
-	AgentNetworkLogs:       {},
-	AgentNetworkSettings:   {},
-}
-
-// Parent returns the module owning a dotted submodule name and true, or the
-// module itself and false when it has no parent.
-func (m Module) Parent() (Module, bool) {
-	if i := strings.IndexByte(string(m), '.'); i > 0 {
-		return Module(string(m)[:i]), true
-	}
-	return m, false
 }