[android] ask for an SSH password only when the server needs one

Connect() reports a password-required marker instead of a raw handshake
error when a regular SSH server turns down the NetBird key, so the caller
can prompt and retry as often as the user needs. NetBird servers are
excluded: they authenticate with a JWT or the NetBird key, so a failure
there is genuine. The marker is a string because gomobile flattens errors
to their message across the binding.

Errors that reach the terminal are unwrapped to their root cause, so a
dial failure reads "i/o timeout" rather than repeating every layer that
added context; the full chain still goes to the log. A normal shell exit
no longer surfaces as "EOF".

Reset() lets a closed client back a reconnect, which keeps the Java-side
session and its scrollback alive across a drop, and the JWT flow now
reports that it is waiting on the browser instead of blocking silently.

client/android/ssh_client.go

@@ -0,0 +1,521 @@
+//go:build android
+
+package android
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	gossh "golang.org/x/crypto/ssh"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/auth"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/client/ssh/detection"
+)
+
+const (
+	sshDialTimeout      = 30 * time.Second
+	sshDetectionTimeout = 5 * time.Second
+)
+
+// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
+// a string because gomobile flattens errors to their message, so a sentinel
+// value would not survive the binding.
+const PasswordRequiredMarker = "netbird-ssh-password-required"
+
+var errPasswordRequired = errors.New(PasswordRequiredMarker)
+
+// SSHTerminalListener receives SSH session events. It is implemented in Java.
+//
+// All callbacks are invoked from goroutines and may run concurrently with each
+// other; the implementation must be safe to call from any thread.
+type SSHTerminalListener interface {
+	OnConnected()
+	OnData(data []byte)
+	OnClose(reason string)
+	OnError(message string)
+}
+
+// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
+//
+// It dials through the running NetBird tunnel and runs a standard SSH session
+// on top with PTY enabled. Host-key verification uses the NetBird-provided
+// peer SSH host keys, identical to the desktop client.
+type SSHClient struct {
+	nb        *Client
+	mu        sync.Mutex
+	listener  SSHTerminalListener
+	urlOpener URLOpener
+
+	sshClient *gossh.Client
+	session   *gossh.Session
+	stdin     io.WriteCloser
+	closed    bool
+}
+
+// NewSSHClient creates a new SSH client bound to the running NetBird Client.
+func NewSSHClient(c *Client) *SSHClient {
+	return &SSHClient{nb: c}
+}
+
+// SetListener registers the Java listener. Must be called before Connect to
+// receive any events.
+func (s *SSHClient) SetListener(l SSHTerminalListener) {
+	s.mu.Lock()
+	s.listener = l
+	s.mu.Unlock()
+}
+
+// SetURLOpener registers the Java URL opener used to display the device-code
+// authorization page in a Custom Tabs window when the target peer requires
+// JWT authentication. Must be set before Connect to be effective.
+func (s *SSHClient) SetURLOpener(opener URLOpener) {
+	s.mu.Lock()
+	s.urlOpener = opener
+	s.mu.Unlock()
+}
+
+// Connect dials the SSH server through the NetBird tunnel and performs the
+// SSH handshake. It auto-detects the server type via SSH banner inspection
+// and selects the appropriate authentication path:
+//
+//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
+//     flow, opens the verification URL through the registered URLOpener, and
+//     uses the resulting token as the SSH password. Host-key verification
+//     uses the NetBird peer registry.
+//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
+//     private key. Host-key verification uses the NetBird peer registry.
+//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
+//     first (so a user-installed NetBird public key works), then falls back
+//     to the supplied password if non-empty. Host-key verification is
+//     disabled (TOFU pending).
+//
+// The password parameter is only consulted for regular SSH servers.
+func (s *SSHClient) Connect(host string, port int, user, password string) error {
+	cfg, _, cc := s.nb.stateSnapshot()
+	if cc == nil {
+		return errors.New("netbird client not running")
+	}
+	if cfg == nil {
+		return errors.New("netbird config not loaded")
+	}
+	engine := cc.Engine()
+	if engine == nil {
+		return errors.New("netbird engine not available")
+	}
+
+	serverType := detectServerType(host, port)
+	log.Infof("SSH server type for %s:%d: %s", host, port, serverType)
+
+	authMethods, hostKeyCallback, err := s.buildAuth(cfg, engine, serverType, password)
+	if err != nil {
+		return err
+	}
+
+	clientConfig := &gossh.ClientConfig{
+		User:            user,
+		Auth:            authMethods,
+		HostKeyCallback: hostKeyCallback,
+		Timeout:         sshDialTimeout,
+	}
+	err = s.dialAndHandshake(host, port, clientConfig)
+
+	// A regular server may still accept a password, so let the caller ask for
+	// one instead of failing. NetBird servers never use a password, so a
+	// failure there is genuine.
+	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
+		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) {
+		return errPasswordRequired
+	}
+	if err != nil {
+		log.Infof("SSH: connect to %s:%d failed: %v", host, port, err)
+		return rootCause(err)
+	}
+	return nil
+}
+
+// isAuthFailure distinguishes credential rejection from dial, timeout and
+// host-key errors, which retrying with a password would not fix.
+func isAuthFailure(err error) bool {
+	if errors.Is(err, errPasswordRequired) {
+		return true
+	}
+	var partial *gossh.PartialSuccessError
+	if errors.As(err, &partial) {
+		return true
+	}
+	return strings.Contains(err.Error(), "unable to authenticate")
+}
+
+// StartSession requests a PTY and starts an interactive shell. Output from
+// the session is forwarded to the listener via OnData.
+func (s *SSHClient) StartSession(cols, rows int) error {
+	err := s.startSession(cols, rows)
+	if err != nil {
+		log.Infof("SSH: start session failed: %v", err)
+		return rootCause(err)
+	}
+	return nil
+}
+
+func (s *SSHClient) startSession(cols, rows int) error {
+	log.Debugf("SSH: starting session %dx%d", cols, rows)
+	s.mu.Lock()
+	sshClient := s.sshClient
+	s.mu.Unlock()
+
+	if sshClient == nil {
+		return errors.New("ssh client not connected")
+	}
+
+	session, err := sshClient.NewSession()
+	if err != nil {
+		return fmt.Errorf("new session: %w", err)
+	}
+
+	modes := gossh.TerminalModes{
+		gossh.ECHO:          1,
+		gossh.TTY_OP_ISPEED: 14400,
+		gossh.TTY_OP_OSPEED: 14400,
+		gossh.VINTR:         3,
+		gossh.VQUIT:         28,
+		gossh.VERASE:        127,
+	}
+	if err := session.RequestPty("xterm-256color", rows, cols, modes); err != nil {
+		closeQuiet(session, "session after pty error")
+		return fmt.Errorf("request pty: %w", err)
+	}
+
+	stdin, err := session.StdinPipe()
+	if err != nil {
+		closeQuiet(session, "session after stdin error")
+		return fmt.Errorf("stdin pipe: %w", err)
+	}
+	stdout, err := session.StdoutPipe()
+	if err != nil {
+		closeQuiet(session, "session after stdout error")
+		return fmt.Errorf("stdout pipe: %w", err)
+	}
+	stderr, err := session.StderrPipe()
+	if err != nil {
+		closeQuiet(session, "session after stderr error")
+		return fmt.Errorf("stderr pipe: %w", err)
+	}
+
+	if err := session.Shell(); err != nil {
+		closeQuiet(session, "session after shell error")
+		return fmt.Errorf("start shell: %w", err)
+	}
+
+	s.mu.Lock()
+	s.session = session
+	s.stdin = stdin
+	s.mu.Unlock()
+
+	go s.readLoop(stdout, "stdout")
+	go s.readLoop(stderr, "stderr")
+	log.Debug("SSH: session started, shell running")
+	return nil
+}
+
+// Write sends data to the SSH session stdin.
+func (s *SSHClient) Write(data []byte) error {
+	s.mu.Lock()
+	stdin := s.stdin
+	s.mu.Unlock()
+	if stdin == nil {
+		return errors.New("ssh session not started")
+	}
+	if _, err := stdin.Write(data); err != nil {
+		return fmt.Errorf("write stdin: %w", err)
+	}
+	return nil
+}
+
+// Resize updates the PTY window size.
+func (s *SSHClient) Resize(cols, rows int) error {
+	s.mu.Lock()
+	session := s.session
+	s.mu.Unlock()
+	if session == nil {
+		return errors.New("ssh session not started")
+	}
+	return session.WindowChange(rows, cols)
+}
+
+// Close terminates the SSH session and underlying connection. Safe to call
+// multiple times.
+func (s *SSHClient) Close() error {
+	s.mu.Lock()
+	sshClient := s.sshClient
+	session := s.session
+	stdin := s.stdin
+	s.sshClient = nil
+	s.session = nil
+	s.stdin = nil
+	s.mu.Unlock()
+
+	if stdin != nil {
+		if err := stdin.Close(); err != nil {
+			log.Debugf("ssh: stdin close: %v", err)
+		}
+	}
+	if session != nil {
+		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
+			log.Debugf("ssh: session close: %v", err)
+		}
+	}
+	var firstErr error
+	if sshClient != nil {
+		if err := sshClient.Close(); err != nil {
+			firstErr = err
+		}
+	}
+	s.notifyClose("closed by client")
+	return firstErr
+}
+
+func (s *SSHClient) buildAuth(cfg *profilemanager.Config, engine *internal.Engine,
+	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
+
+	switch serverType {
+	case detection.ServerTypeNetBirdJWT:
+		token, err := s.requestJWTToken(cfg)
+		if err != nil {
+			return nil, nil, fmt.Errorf("jwt: %w", err)
+		}
+		auths := []gossh.AuthMethod{gossh.Password(token)}
+		return auths, nbssh.CreateHostKeyCallback(&engineHostKeyVerifier{engine: engine}), nil
+
+	case detection.ServerTypeNetBirdNoJWT:
+		if cfg.SSHKey == "" {
+			return nil, nil, errors.New("no NetBird SSH key available")
+		}
+		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
+		if err != nil {
+			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
+		}
+		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
+		return auths, nbssh.CreateHostKeyCallback(&engineHostKeyVerifier{engine: engine}), nil
+
+	default: // regular SSH
+		var auths []gossh.AuthMethod
+		if cfg.SSHKey != "" {
+			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
+				auths = append(auths, gossh.PublicKeys(signer))
+			} else {
+				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
+			}
+		}
+		if password != "" {
+			pw := password
+			auths = append(auths, gossh.Password(pw))
+			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
+				answers := make([]string, len(questions))
+				for i := range questions {
+					answers[i] = pw
+				}
+				return answers, nil
+			}))
+		}
+		if len(auths) == 0 {
+			// Nothing to offer at all: ask for a password rather than failing,
+			// so the caller can retry once the user supplies one.
+			return nil, nil, errPasswordRequired
+		}
+		return auths, gossh.InsecureIgnoreHostKey(), nil // nolint:gosec // TOFU not yet implemented
+	}
+}
+
+func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config) (string, error) {
+	s.mu.Lock()
+	urlOpener := s.urlOpener
+	s.mu.Unlock()
+	if urlOpener == nil {
+		return "", errors.New("URL opener not configured for JWT auth")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profilemanager.GetLoginHint())
+	if err != nil {
+		return "", fmt.Errorf("create oauth flow: %w", err)
+	}
+
+	flowInfo, err := flow.RequestAuthInfo(ctx)
+	if err != nil {
+		return "", fmt.Errorf("request auth info: %w", err)
+	}
+
+	go urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+
+	// WaitToken blocks for as long as the browser round-trip takes, so say so
+	// rather than leaving the terminal blank.
+	s.notifyStatus("Waiting for browser authentication...")
+
+	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
+	if err != nil {
+		return "", fmt.Errorf("wait for token: %w", err)
+	}
+
+	token := tokenInfo.GetTokenToUse()
+	if token == "" {
+		return "", errors.New("empty token returned by IdP")
+	}
+	return token, nil
+}
+
+func (s *SSHClient) dialAndHandshake(host string, port int, clientConfig *gossh.ClientConfig) error {
+	addr := net.JoinHostPort(host, strconv.Itoa(port))
+	log.Infof("SSH: connecting to %s as %s", addr, clientConfig.User)
+
+	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
+	defer cancel()
+
+	var dialer net.Dialer
+	conn, err := dialer.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return fmt.Errorf("dial %s: %w", addr, err)
+	}
+
+	sshConn, chans, reqs, err := gossh.NewClientConn(conn, addr, clientConfig)
+	if err != nil {
+		if cerr := conn.Close(); cerr != nil {
+			log.Debugf("ssh: close after handshake error: %v", cerr)
+		}
+		return fmt.Errorf("ssh handshake: %w", err)
+	}
+
+	s.mu.Lock()
+	s.sshClient = gossh.NewClient(sshConn, chans, reqs)
+	listener := s.listener
+	s.mu.Unlock()
+
+	log.Infof("SSH: connected to %s", addr)
+	if listener != nil {
+		listener.OnConnected()
+	}
+	return nil
+}
+
+func (s *SSHClient) readLoop(r io.Reader, name string) {
+	buf := make([]byte, 4096)
+	for {
+		n, err := r.Read(buf)
+		if n > 0 {
+			s.mu.Lock()
+			listener := s.listener
+			s.mu.Unlock()
+			if listener != nil {
+				chunk := make([]byte, n)
+				copy(chunk, buf[:n])
+				listener.OnData(chunk)
+			}
+		}
+		if err != nil {
+			// EOF is a normal shell exit, so report it without a reason.
+			if errors.Is(err, io.EOF) {
+				s.notifyClose("")
+				return
+			}
+			log.Debugf("ssh %s read: %v", name, err)
+			s.notifyClose(rootCause(err).Error())
+			return
+		}
+	}
+}
+
+// rootCause returns the innermost error of a %w chain, so the terminal shows
+// "i/o timeout" rather than every layer that added context on the way up.
+func rootCause(err error) error {
+	for {
+		// A joined error has no single root, so keep it as-is.
+		if _, ok := err.(interface{ Unwrap() []error }); ok {
+			return err
+		}
+		next := errors.Unwrap(err)
+		if next == nil {
+			return err
+		}
+		err = next
+	}
+}
+
+// Reset makes a closed client usable for another Connect: Close leaves the
+// one-shot guard set, and clearing it lets the same client back a reconnect.
+func (s *SSHClient) Reset() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.closed = false
+}
+
+// notifyStatus writes a progress line to the terminal through the normal
+// output path, so long steps are visible while nothing else is arriving.
+func (s *SSHClient) notifyStatus(text string) {
+	s.mu.Lock()
+	listener := s.listener
+	s.mu.Unlock()
+	if listener != nil {
+		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
+	}
+}
+
+func (s *SSHClient) notifyClose(reason string) {
+	s.mu.Lock()
+	if s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	listener := s.listener
+	s.mu.Unlock()
+	if listener != nil {
+		listener.OnClose(reason)
+	}
+}
+
+// engineHostKeyVerifier adapts *internal.Engine to nbssh.HostKeyVerifier.
+type engineHostKeyVerifier struct {
+	engine *internal.Engine
+}
+
+func (v *engineHostKeyVerifier) VerifySSHHostKey(peerAddress string, presented []byte) error {
+	storedKey, found := v.engine.GetPeerSSHKey(peerAddress)
+	if !found {
+		return nbssh.ErrPeerNotFound
+	}
+	return nbssh.VerifyHostKey(storedKey, presented, peerAddress)
+}
+
+func closeQuiet(c io.Closer, label string) {
+	if c == nil {
+		return
+	}
+	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
+		log.Debugf("ssh: close %s: %v", label, err)
+	}
+}
+
+func detectServerType(host string, port int) detection.ServerType {
+	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
+	defer cancel()
+
+	dialer := &net.Dialer{}
+	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
+	if err != nil {
+		log.Debugf("ssh: server detection for %s:%d failed: %v (assuming regular SSH)", host, port, err)
+		return detection.ServerTypeRegular
+	}
+	return serverType
+}

client/ui/frontend/src/components/ReadySignal.tsx

@@ -1,18 +0,0 @@
-import { useEffect, useRef } from "react";
-import { Events } from "@wailsio/runtime";
-import { useStatus } from "@/contexts/StatusContext.tsx";
-
-const EVENT_WINDOW_PAINTED = "netbird:window-painted";
-
-export const ReadySignal = () => {
-    const { isReady } = useStatus();
-    const sent = useRef(false);
-
-    useEffect(() => {
-        if (!isReady || sent.current) return;
-        sent.current = true;
-        void Events.Emit(EVENT_WINDOW_PAINTED);
-    }, [isReady]);
-
-    return null;
-};

client/ui/frontend/src/layouts/AppLayout.tsx

@@ -5,7 +5,6 @@ import { DebugBundleProvider } from "@/contexts/DebugBundleContext.tsx";
 import { ProfileProvider } from "@/contexts/ProfileContext.tsx";
 import { DialogProvider } from "@/contexts/DialogContext.tsx";
 import { RestrictionsProvider } from "@/contexts/RestrictionsContext.tsx";
-import { ReadySignal } from "@/components/ReadySignal.tsx";
 
 export const AppLayout = () => {
     return (
@@ -17,7 +16,6 @@ export const AppLayout = () => {
                             <DebugBundleProvider>
                                 <ClientVersionProvider>
                                     <Outlet />
-                                    <ReadySignal />
                                 </ClientVersionProvider>
                             </DebugBundleProvider>
                         </RestrictionsProvider>

client/ui/main.go

@@ -95,10 +95,6 @@ func main() {
 		}
 	})
 
-	// Debug patch, not for release: dumps heap/goroutine profiles and the
-	// process tree to /tmp/nbgui for the memory consumption investigation.
-	startMemProfiler(app)
-
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.
@@ -143,11 +139,13 @@ func main() {
 		prefStore:       prefStore,
 	})
 
-	windowManager := services.NewWindowManager(app, nil, bundle, prefStore, iconWindow)
-	windowManager.SetMainFactory(func() *application.WebviewWindow {
-		return newMainWindow(app, prefStore, windowManager)
-	})
-	registerDockReopenHook(app, windowManager)
+	window := newMainWindow(app, prefStore)
+
+	// Settings is created eagerly (hidden) so the first gear click paints
+	// instantly and React keeps per-tab state across reopens. The other
+	// auxiliary windows stay lazy + destroy-on-close so Wails's macOS
+	// dock-reopen handler can't resurrect them.
+	windowManager := services.NewWindowManager(app, window, bundle, prefStore, iconWindow)
 	// Minimal WMs (XEmbed-tray path) neither center small windows nor restore
 	// position across hide -> show, dropping them top-left. Gate Go-side
 	// re-centering on that environment; nil leaves placement to the WM on full
@@ -170,7 +168,7 @@ func main() {
 	// RegisterStatusNotifierItem hits a watcher we control.
 	startStatusNotifierWatcher()
 
-	tray = NewTray(app, nil, TrayServices{
+	tray = NewTray(app, window, TrayServices{
 		Connection:      connection,
 		Settings:        settings,
 		Profiles:        profiles,
@@ -340,7 +338,9 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(s.compat))
 }
 
-func newMainWindow(app *application.App, prefStore *preferences.Store, wm *services.WindowManager) *application.WebviewWindow {
+// newMainWindow creates the hidden main window, sized to the user's last view
+// mode, and installs the hide-on-close and macOS dock-reopen hooks.
+func newMainWindow(app *application.App, prefStore *preferences.Store) *application.WebviewWindow {
 	// Width matches the last view mode so Advanced-mode users don't see the
 	// window pop from 380px to 900px on launch. Height is mode-agnostic.
 	initialWidth := 380
@@ -368,25 +368,29 @@ func newMainWindow(app *application.App, prefStore *preferences.Store, wm *servi
 		},
 	})
 
-	window.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
+	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
 		if services.ShuttingDown() {
 			return
 		}
-		wm.ForgetMain()
+		e.Cancel()
+		window.Hide()
 	})
 
+	// On macOS, Wails' default applicationShouldHandleReopen handler Show()s
+	// every hidden window on dock-icon click, resurrecting hide-on-close
+	// surfaces like Settings. Cancel it in a hook (hooks run before listeners)
+	// and show only the main window. No-op elsewhere — the event never fires.
+	if runtime.GOOS == "darwin" {
+		app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
+			e.Cancel()
+			if e.Context().HasVisibleWindows() {
+				return
+			}
+			window.Show()
+			window.Focus()
+		})
+	}
+
 	return window
 }
-
-func registerDockReopenHook(app *application.App, wm *services.WindowManager) {
-	if runtime.GOOS != "darwin" {
-		return
-	}
-	app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
-		e.Cancel()
-		if e.Context().HasVisibleWindows() {
-			return
-		}
-		wm.ShowMain()
-	})
-}

client/ui/memprof.go

@@ -1,319 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"runtime/pprof"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/shirou/gopsutil/v4/process"
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/events"
-)
-
-// memProfOffsets are the snapshot times measured from application startup.
-var memProfOffsets = []time.Duration{0, 2 * time.Minute, 5 * time.Minute}
-
-// memProfMaxDepth bounds the child walk so a cycle in the reported parent links
-// cannot spin forever.
-const memProfMaxDepth = 4
-
-type memProfileSpec struct {
-	profile string
-	file    string
-	debug   int
-}
-
-var memProfileSpecs = []memProfileSpec{
-	{profile: "heap", file: "heap.pprof", debug: 0},
-	{profile: "heap", file: "heap.txt", debug: 1},
-	{profile: "goroutine", file: "goroutine.txt", debug: 1},
-	{profile: "threadcreate", file: "threadcreate.txt", debug: 1},
-}
-
-var memProfStart = time.Now()
-
-// startMemProfiler dumps a profile snapshot at every memProfOffsets mark, each
-// into its own timestamped directory under memProfBaseDir. The first runs once
-// the application is up so the window inventory sees the eagerly created
-// windows. Every failure is logged and never stops the GUI.
-func startMemProfiler(app *application.App) {
-	log.Infof("memory profiler enabled, writing to %s (snapshots at %v after startup)", memProfBaseDir(), memProfOffsets)
-
-	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
-		go func() {
-			started := time.Now()
-			for _, offset := range memProfOffsets {
-				if wait := time.Until(started.Add(offset)); wait > 0 {
-					time.Sleep(wait)
-				}
-				writeMemProfile(app)
-			}
-		}()
-	})
-}
-
-// memProfBaseDir returns the directory holding the snapshot directories.
-func memProfBaseDir() string {
-	if runtime.GOOS == "windows" {
-		return filepath.Join(os.TempDir(), "nbgui")
-	}
-	return "/tmp/nbgui"
-}
-
-// writeMemProfile creates a <timestamp>-<pid> directory and fills it with the
-// runtime profiles, the memory statistics summary and the process tree.
-func writeMemProfile(app *application.App) {
-	name := fmt.Sprintf("%s-%d", time.Now().Format("20060102-150405"), os.Getpid())
-	dir := filepath.Join(memProfBaseDir(), name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		log.Warnf("create memory profile dir %s: %v", dir, err)
-		return
-	}
-
-	// The heap profile reports live objects as of the last collection, so force
-	// one to keep inuse_space from counting garbage that is already unreachable.
-	runtime.GC()
-
-	if err := writeMemStats(filepath.Join(dir, "memstats.txt"), app); err != nil {
-		log.Warnf("write memory statistics: %v", err)
-	}
-
-	if err := writeProcTree(filepath.Join(dir, "proctree.txt")); err != nil {
-		log.Warnf("write process tree: %v", err)
-	}
-
-	for _, spec := range memProfileSpecs {
-		if err := writeMemProfileFile(spec, filepath.Join(dir, spec.file)); err != nil {
-			log.Warnf("write %s profile: %v", spec.profile, err)
-		}
-	}
-
-	log.Infof("memory profile written to %s", dir)
-}
-
-// writeMemProfileFile writes a single runtime profile to path.
-func writeMemProfileFile(spec memProfileSpec, path string) error {
-	p := pprof.Lookup(spec.profile)
-	if p == nil {
-		return fmt.Errorf("unknown profile %q", spec.profile)
-	}
-
-	f, err := os.Create(path)
-	if err != nil {
-		return fmt.Errorf("create %s: %w", path, err)
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close %s: %v", path, err)
-		}
-	}()
-
-	if err := p.WriteTo(f, spec.debug); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeMemStats dumps the runtime memory statistics next to the process
-// resident set size. A resident set much larger than Sys means the memory sits
-// outside the Go heap (webview, GTK, other cgo allocations), where the pprof
-// profiles cannot see it.
-func writeMemStats(path string, app *application.App) error {
-	var m runtime.MemStats
-	runtime.ReadMemStats(&m)
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time:           %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime:         %s\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "pid:            %d\n", os.Getpid())
-	fmt.Fprintf(&b, "\n")
-
-	rss, vms := processMemory()
-	fmt.Fprintf(&b, "process_rss:    %s\n", rss)
-	fmt.Fprintf(&b, "process_vms:    %s\n", vms)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "sys:            %s\n", formatMemBytes(m.Sys))
-	fmt.Fprintf(&b, "heap_alloc:     %s\n", formatMemBytes(m.HeapAlloc))
-	fmt.Fprintf(&b, "heap_sys:       %s\n", formatMemBytes(m.HeapSys))
-	fmt.Fprintf(&b, "heap_inuse:     %s\n", formatMemBytes(m.HeapInuse))
-	fmt.Fprintf(&b, "heap_idle:      %s\n", formatMemBytes(m.HeapIdle))
-	fmt.Fprintf(&b, "heap_released:  %s\n", formatMemBytes(m.HeapReleased))
-	fmt.Fprintf(&b, "heap_objects:   %d\n", m.HeapObjects)
-	fmt.Fprintf(&b, "stack_inuse:    %s\n", formatMemBytes(m.StackInuse))
-	fmt.Fprintf(&b, "stack_sys:      %s\n", formatMemBytes(m.StackSys))
-	fmt.Fprintf(&b, "mspan_sys:      %s\n", formatMemBytes(m.MSpanSys))
-	fmt.Fprintf(&b, "mcache_sys:     %s\n", formatMemBytes(m.MCacheSys))
-	fmt.Fprintf(&b, "gc_sys:         %s\n", formatMemBytes(m.GCSys))
-	fmt.Fprintf(&b, "other_sys:      %s\n", formatMemBytes(m.OtherSys))
-	fmt.Fprintf(&b, "next_gc:        %s\n", formatMemBytes(m.NextGC))
-	fmt.Fprintf(&b, "num_gc:         %d\n", m.NumGC)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "goroutines:     %d\n", runtime.NumGoroutine())
-	fmt.Fprintf(&b, "cgo_calls:      %d\n", runtime.NumCgoCall())
-	fmt.Fprintf(&b, "gomaxprocs:     %d\n", runtime.GOMAXPROCS(0))
-	fmt.Fprintf(&b, "\n")
-
-	writeWindowInventory(&b, app)
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeWindowInventory lists the live Wails windows. A window that exists holds
-// a webview process even while hidden, so this tells apart a leaked window (the
-// count grows) from windows whose content grew (the count stays put).
-func writeWindowInventory(b *strings.Builder, app *application.App) {
-	windows := app.Window.GetAll()
-	fmt.Fprintf(b, "windows:        %d\n", len(windows))
-	for _, w := range windows {
-		visible := "unknown"
-		if ww, ok := w.(*application.WebviewWindow); ok {
-			visible = strconv.FormatBool(ww.IsVisible())
-		}
-		fmt.Fprintf(b, "  id=%-3d name=%-20q visible=%-7s minimised=%-5t focused=%t\n",
-			w.ID(), w.Name(), visible, w.IsMinimised(), w.IsFocused())
-	}
-}
-
-// writeProcTree dumps this process and its descendants with their memory
-// footprint. The webview runs in child processes whose memory the Go runtime
-// profiles cannot see, so this is what attributes a footprint to a component.
-func writeProcTree(path string) error {
-	self, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		return fmt.Errorf("open own process: %w", err)
-	}
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time: %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime: %s\n\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "%-8s %-8s %-28s %12s %12s %12s %12s\n", "PID", "PPID", "NAME", "RSS", "VMS", "PSS", "PRIV_DIRTY")
-
-	var totalRSS, totalPSS, totalPrivate uint64
-	walkProcTree(&b, self, 0, &totalRSS, &totalPSS, &totalPrivate)
-
-	fmt.Fprintf(&b, "\n%-8s %-8s %-28s %12s %12s %12s %12s\n", "", "", "TOTAL",
-		formatKB(totalRSS), "", formatKB(totalPSS), formatKB(totalPrivate))
-	fmt.Fprintf(&b, "\nPSS and PRIV_DIRTY come from /proc/<pid>/smaps_rollup and are Linux only.\n")
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// walkProcTree appends one line per process, depth-first, accumulating totals.
-func walkProcTree(b *strings.Builder, p *process.Process, depth int, totalRSS, totalPSS, totalPrivate *uint64) {
-	name, err := p.Name()
-	if err != nil {
-		name = "unknown"
-	}
-
-	var rss, vms uint64
-	if info, err := p.MemoryInfo(); err == nil {
-		rss, vms = info.RSS, info.VMS
-	}
-
-	pss, private := smapsRollup(p.Pid)
-	*totalRSS += rss
-	*totalPSS += pss
-	*totalPrivate += private
-
-	ppid, err := p.Ppid()
-	if err != nil {
-		ppid = -1
-	}
-
-	fmt.Fprintf(b, "%-8d %-8d %-28s %12s %12s %12s %12s\n", p.Pid, ppid,
-		strings.Repeat("  ", depth)+name, formatKB(rss), formatKB(vms), formatKB(pss), formatKB(private))
-
-	if depth >= memProfMaxDepth {
-		return
-	}
-
-	children, err := p.Children()
-	if err != nil {
-		return
-	}
-	for _, child := range children {
-		walkProcTree(b, child, depth+1, totalRSS, totalPSS, totalPrivate)
-	}
-}
-
-// smapsRollup returns the proportional set size and private dirty bytes of pid,
-// both zero on platforms without /proc.
-func smapsRollup(pid int32) (uint64, uint64) {
-	f, err := os.Open(fmt.Sprintf("/proc/%d/smaps_rollup", pid))
-	if err != nil {
-		return 0, 0
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close smaps_rollup for %d: %v", pid, err)
-		}
-	}()
-
-	var pss, private uint64
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Fields(scanner.Text())
-		if len(fields) < 2 {
-			continue
-		}
-		kb, err := strconv.ParseUint(fields[1], 10, 64)
-		if err != nil {
-			continue
-		}
-		switch fields[0] {
-		case "Pss:":
-			pss = kb * 1024
-		case "Private_Dirty:":
-			private = kb * 1024
-		}
-	}
-	return pss, private
-}
-
-// processMemory returns the formatted resident and virtual size of this process.
-func processMemory() (string, string) {
-	p, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	info, err := p.MemoryInfo()
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	return formatMemBytes(info.RSS), formatMemBytes(info.VMS)
-}
-
-// formatMemBytes renders a byte count as megabytes with the raw value kept.
-func formatMemBytes(n uint64) string {
-	return fmt.Sprintf("%8.1f MB (%d bytes)", float64(n)/(1024*1024), n)
-}
-
-// formatKB renders a byte count as megabytes for the process tree columns, and
-// a dash when the platform did not report the value.
-func formatKB(n uint64) string {
-	if n == 0 {
-		return "-"
-	}
-	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
-}

client/ui/services/windowmanager.go

@@ -8,7 +8,6 @@ import (
 	"sync"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
 
@@ -30,10 +29,6 @@ const EventBrowserLoginCancel = "browser-login:cancel"
 // EventSettingsOpen tells the mounted settings window which tab to show.
 const EventSettingsOpen = "netbird:settings:open"
 
-const EventWindowPainted = "netbird:window-painted"
-
-const paintedFallback = 2 * time.Second
-
 var WindowBackgroundColour = application.NewRGB(24, 26, 29) // bg-nb-gray-950
 
 // WindowHeight is shared by the main and Settings windows.
@@ -99,6 +94,9 @@ func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.
 	}
 }
 
+// WindowManager owns the auxiliary windows (main is created in main.go). Settings is created
+// eagerly and hidden on close to keep React state; the rest are created on open, destroyed on
+// close, so the macOS dock-reopen handler finds no hidden window to resurrect.
 type WindowManager struct {
 	app               *application.App
 	mainWindow        *application.WebviewWindow
@@ -114,31 +112,15 @@ type WindowManager struct {
 	// hiddenForLogin holds windows hidden while the BrowserLogin popup is open, restored on close.
 	hiddenForLogin []application.Window
 	mu             sync.Mutex
-	newMain        func() *application.WebviewWindow
-	ready          map[uint]bool
-	showPending    map[uint]bool
-	showAsked      map[uint]time.Time
-	pendingTab     map[uint]string
-	fallbackTimers map[uint]*time.Timer
 	// recenterOnShow is set only on the minimal-WM/XEmbed path, where the WM neither centers nor
 	// restores position; nil on full desktops so re-centering can't fight a user-moved window.
 	recenterOnShow func() bool
 }
 
+// NewWindowManager wires the manager to the main app; translator/prefs may be nil (tests). The
+// Settings window is created here (hidden) so the first OpenSettings is instant.
 func NewWindowManager(app *application.App, mainWindow *application.WebviewWindow, translator ErrorTranslator, prefs LanguagePreference, linuxIcon []byte) *WindowManager {
-	s := &WindowManager{
-		app:            app,
-		mainWindow:     mainWindow,
-		translator:     translator,
-		prefs:          prefs,
-		linuxIcon:      linuxIcon,
-		ready:          map[uint]bool{},
-		showPending:    map[uint]bool{},
-		showAsked:      map[uint]time.Time{},
-		pendingTab:     map[uint]string{},
-		fallbackTimers: map[uint]*time.Timer{},
-	}
-	s.watchPainted()
+	s := &WindowManager{app: app, mainWindow: mainWindow, translator: translator, prefs: prefs, linuxIcon: linuxIcon}
 	// Re-title live windows on language flip. Wired internally so the binding generator
 	// doesn't try to expose the interface param.
 	if sub, ok := prefs.(LanguageSubscriber); ok && sub != nil {
@@ -154,11 +136,7 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 			}
 		}()
 	}
-	return s
-}
-
-func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
-	w := s.app.Window.NewWithOptions(application.WebviewWindowOptions{
+	s.settings = app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Name:                "settings",
 		Title:               s.title("window.title.settings"),
 		Width:               900,
@@ -172,15 +150,18 @@ func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
 		URL:                 "/#/settings",
 		Mac:                 AppleMacOSAppearanceOptions(),
 		Windows:             MicrosoftWindowsAppearanceOptions(),
-		Linux:               LinuxAppearanceOptions(s.linuxIcon),
+		Linux:               LinuxAppearanceOptions(linuxIcon),
 	})
-	w.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-		s.mu.Lock()
-		s.settings = nil
-		s.forgetWindowLocked(w)
-		s.mu.Unlock()
+	// Hide (not destroy) on close to keep React state; reset to General for a flash-free reopen.
+	s.settings.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		if ShuttingDown() {
+			return
+		}
+		e.Cancel()
+		s.app.Event.Emit(EventSettingsOpen, "general")
+		s.settings.Hide()
 	})
-	return w
+	return s
 }
 
 // OpenSettings shows the settings window on tab (empty → General), switching tab via
@@ -190,23 +171,11 @@ func (s *WindowManager) OpenSettings(tab string) {
 	if target == "" {
 		target = "general"
 	}
-
-	s.mu.Lock()
-	fresh := s.settings == nil
-	if fresh {
-		s.settings = s.newSettingsWindow()
-		s.armReady(s.settings)
-	}
-	w := s.settings
-	if fresh {
-		s.pendingTab[w.ID()] = target
-	}
-	s.mu.Unlock()
-
-	if !fresh {
-		s.app.Event.Emit(EventSettingsOpen, target)
-	}
-	s.showWhenReady(w)
+	s.app.Event.Emit(EventSettingsOpen, target)
+	s.settings.Show()
+	s.settings.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.settings)
 }
 
 // OpenBrowserLogin shows the SSO popup, creating it on first use.
@@ -471,167 +440,13 @@ func (s *WindowManager) OpenMain() {
 // ShowMain brings the main window forward (re-centering on minimal WMs). The single entry
 // point every surface (tray, SIGUSR1, welcome) should use so centering applies uniformly.
 func (s *WindowManager) ShowMain() {
-	s.showWhenReady(s.MainWindow())
-}
-
-func (s *WindowManager) MainWindow() *application.WebviewWindow {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.mainWindow == nil && s.newMain != nil {
-		s.mainWindow = s.newMain()
-		s.armReady(s.mainWindow)
-	}
-	return s.mainWindow
-}
-
-func (s *WindowManager) armReady(w *application.WebviewWindow) {
-	if w == nil {
+	if s.mainWindow == nil {
 		return
 	}
-	created := time.Now()
-	w.RegisterHook(events.Common.WindowRuntimeReady, func(_ *application.WindowEvent) {
-		log.Infof("window %q runtime ready after %s", w.Name(), time.Since(created).Round(time.Millisecond))
-		timer := time.AfterFunc(paintedFallback, func() {
-			s.markReady(w, "fallback")
-		})
-		s.mu.Lock()
-		s.fallbackTimers[w.ID()] = timer
-		s.mu.Unlock()
-	})
-}
-
-func (s *WindowManager) watchPainted() {
-	s.app.Event.On(EventWindowPainted, func(e *application.CustomEvent) {
-		w := s.windowByName(e.Sender)
-		if w == nil {
-			log.Infof("painted event from unknown sender %q", e.Sender)
-			return
-		}
-		s.markReady(w, "painted")
-	})
-}
-
-func (s *WindowManager) forgetWindowLocked(w *application.WebviewWindow) {
-	if w == nil {
-		return
-	}
-
-	id := w.ID()
-	if timer := s.fallbackTimers[id]; timer != nil {
-		timer.Stop()
-	}
-	delete(s.fallbackTimers, id)
-	delete(s.ready, id)
-	delete(s.showPending, id)
-	delete(s.showAsked, id)
-	delete(s.pendingTab, id)
-
-	kept := s.hiddenForLogin[:0]
-	for _, hidden := range s.hiddenForLogin {
-		if hidden != application.Window(w) {
-			kept = append(kept, hidden)
-		}
-	}
-	s.hiddenForLogin = kept
-}
-
-func (s *WindowManager) windowByName(name string) *application.WebviewWindow {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	switch name {
-	case "main":
-		return s.mainWindow
-	case "settings":
-		return s.settings
-	default:
-		return nil
-	}
-}
-
-func (s *WindowManager) markReady(w *application.WebviewWindow, source string) {
-	id := w.ID()
-	s.mu.Lock()
-	already := s.ready[id]
-	s.ready[id] = true
-	wanted := s.showPending[id]
-	asked := s.showAsked[id]
-	tab, hasTab := s.pendingTab[id]
-	if timer := s.fallbackTimers[id]; timer != nil {
-		timer.Stop()
-		delete(s.fallbackTimers, id)
-	}
-	delete(s.showPending, id)
-	delete(s.showAsked, id)
-	delete(s.pendingTab, id)
-	s.mu.Unlock()
-
-	if already {
-		return
-	}
-
-	if hasTab {
-		s.app.Event.Emit(EventSettingsOpen, tab)
-	}
-
-	waited := "no show waiting"
-	if wanted && !asked.IsZero() {
-		waited = time.Since(asked).Round(time.Millisecond).String()
-	}
-	log.Infof("window %q ready via %s, show waited %s", w.Name(), source, waited)
-
-	if wanted {
-		s.showNow(w)
-	}
-}
-
-func (s *WindowManager) showWhenReady(w *application.WebviewWindow) {
-	if w == nil {
-		return
-	}
-
-	id := w.ID()
-	s.mu.Lock()
-	ready := s.ready[id]
-	if !ready {
-		s.showPending[id] = true
-		s.showAsked[id] = time.Now()
-	}
-	s.mu.Unlock()
-
-	if ready {
-		log.Infof("window %q already ready, showing now", w.Name())
-		s.showNow(w)
-		return
-	}
-	log.Infof("window %q not ready yet, deferring show", w.Name())
-}
-
-func (s *WindowManager) showNow(w *application.WebviewWindow) {
-	w.Show()
-	w.Focus()
-	s.centerWhenReady(w)
-}
-
-func (s *WindowManager) ShowMainAt(url string) {
-	w := s.MainWindow()
-	if w == nil {
-		return
-	}
-	w.SetURL(url)
-	s.showWhenReady(w)
-}
-
-func (s *WindowManager) SetMainFactory(f func() *application.WebviewWindow) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.newMain = f
-}
-
-func (s *WindowManager) ForgetMain() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.forgetWindowLocked(s.mainWindow)
-	s.mainWindow = nil
+	s.mainWindow.Show()
+	s.mainWindow.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.mainWindow)
 }
 
 // SetRecenterOnShow installs the recenterOnShow predicate (see the field).

client/ui/tray.go

@@ -174,7 +174,7 @@ func NewTray(app *application.App, window *application.WebviewWindow, svc TraySe
 		// in the right locale — no English flash then re-paint.
 		loc: svc.Localizer,
 	}
-	t.updater = newTrayUpdater(app, t.showMainAt, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
+	t.updater = newTrayUpdater(app, window, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
 	t.tray = app.SystemTray.New()
 	// Seed panel-theme detection before the first paint so the initial icon
 	// matches the panel's light/dark scheme (Linux only).
@@ -241,6 +241,9 @@ func (t *Tray) ShowWindow() {
 		w.Focus()
 		return
 	}
+	if t.window == nil {
+		return
+	}
 	// Route through WindowManager so the main window is centered on first
 	// show — minimal WMs (fluxbox, the XEmbed tray path) otherwise drop it in
 	// the top-left corner.
@@ -248,40 +251,8 @@ func (t *Tray) ShowWindow() {
 		t.svc.WindowManager.ShowMain()
 		return
 	}
-	if w := t.mainWindow(); w != nil {
-		w.Show()
-		w.Focus()
-	}
-}
-
-func (t *Tray) mainWindow() *application.WebviewWindow {
-	if t.svc.WindowManager == nil {
-		return t.window
-	}
-	return t.svc.WindowManager.MainWindow()
-}
-
-func (t *Tray) showMain() {
-	if t.svc.WindowManager != nil {
-		t.svc.WindowManager.ShowMain()
-		return
-	}
-	if w := t.mainWindow(); w != nil {
-		w.Show()
-		w.Focus()
-	}
-}
-
-func (t *Tray) showMainAt(url string) {
-	if t.svc.WindowManager != nil {
-		t.svc.WindowManager.ShowMainAt(url)
-		return
-	}
-	if w := t.mainWindow(); w != nil {
-		w.SetURL(url)
-		w.Show()
-		w.Focus()
-	}
+	t.window.Show()
+	t.window.Focus()
 }
 
 // applyLanguage re-renders every translated surface in the Localizer's current

client/ui/tray_session.go

@@ -30,7 +30,10 @@ const (
 // handleSessionExpired notifies and brings the window forward so the user can reconnect.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
-	t.showMain()
+	if t.window != nil {
+		t.window.Show()
+		t.window.Focus()
+	}
 }
 
 // applySessionExpiry refreshes the cached SSO deadline and reports whether it changed.
@@ -304,7 +307,6 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.showMain()
 		t.app.Event.Emit(services.EventTriggerLogin)
 		return
 	}

client/ui/tray_update.go

@@ -19,7 +19,7 @@ import (
 // trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
 type trayUpdater struct {
 	app          *application.App
-	showMainAt   func(url string)
+	window       *application.WebviewWindow
 	update       *services.Update
 	notifier     *Notifier
 	loc          *Localizer
@@ -36,10 +36,10 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, showMainAt func(url string), update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
-		showMainAt:   showMainAt,
+		window:       window,
 		update:       update,
 		notifier:     notifier,
 		loc:          loc,
@@ -185,12 +185,14 @@ func (u *trayUpdater) sendUpdateNotification(st updater.State) {
 // openProgressWindow points the main window at the /update progress page and
 // brings it forward.
 func (u *trayUpdater) openProgressWindow(version string) {
-	if u.showMainAt == nil {
+	if u.window == nil {
 		return
 	}
 	url := "/#/update"
 	if version != "" {
 		url += "?version=" + version
 	}
-	u.showMainAt(url)
+	u.window.SetURL(url)
+	u.window.Show()
+	u.window.Focus()
 }