Localize daemon notifications via stable message keys

.github/workflows/pr-title-check.yml

@@ -16,8 +16,6 @@ jobs:
             const allowedTags = [
               'management',
               'client',
-              'android',
-              'ios',
               'signal',
               'proxy',
               'relay',

.goreleaser_ui.yaml

@@ -93,9 +93,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-4-1 (>= 4.14)
-      - libwebkitgtk-6.0-4
+      - netbird
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -116,9 +114,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird >= 0.75.0
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - netbird
 
     rpm:
       signature:

client/android/client.go

@@ -57,12 +57,6 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
-// TunSettings is a snapshot of the settings the TUN device is rebuilt with
-type TunSettings struct {
-	Routes        string
-	SearchDomains string
-}
-
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -246,24 +240,6 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
-func (c *Client) GetTunSettings() (*TunSettings, error) {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return nil, fmt.Errorf("engine not running")
-	}
-
-	e := cc.Engine()
-	if e == nil {
-		return nil, fmt.Errorf("engine not initialized")
-	}
-
-	routes, searchDomains := e.TunSettings()
-	return &TunSettings{
-		Routes:        strings.Join(routes, ";"),
-		SearchDomains: strings.Join(searchDomains, ";"),
-	}, nil
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine.
 func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {

client/android/login.go

@@ -36,20 +36,12 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
-//
-// The configuration at cfgPath is reused when one is already there, and only created when it is
-// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
-// every call: the peer registers under that key, the key is written out, and any peer registered by
-// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
-// the persisted config, because the identity it registered is not the one it runs with — the
-// management stream rejects it with "no peer auth method provided".
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}

client/android/login_test.go

@@ -1,51 +0,0 @@
-package android
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
-//
-// Creating a new in-memory config on every call gives the client a new WireGuard private key each
-// time. The peer registers under that key and the key is written out, so a peer registered by an
-// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
-// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
-// the identity that registered is not the identity that runs, and the management stream rejects it
-// with "no peer auth method provided, please use a setup key or interactive SSO login".
-func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	first, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("first NewAuth: %v", err)
-	}
-	if first.config.PrivateKey == "" {
-		t.Fatal("first NewAuth produced no private key")
-	}
-
-	second, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("second NewAuth: %v", err)
-	}
-
-	if second.config.PrivateKey != first.config.PrivateKey {
-		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
-	}
-}
-
-// A missing configuration is still created, so a first enrolment works unchanged.
-func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("NewAuth: %v", err)
-	}
-	if auth.config == nil || auth.config.PrivateKey == "" {
-		t.Fatal("NewAuth did not create a usable configuration")
-	}
-	if auth.cfgPath != cfgPath {
-		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
-	}
-}

client/internal/auth/sessionwatch/event.go

@@ -11,10 +11,11 @@ import (
 // emits.
 
 // Metadata keys attached by the daemon to session-warning SystemEvents.
-// The UI tray reads these to build a locale-aware notification without
-// relying on the daemon's locale-less UserMessage string, and to
-// disambiguate the T-WarningLead notification from the T-FinalWarningLead
-// fallback that auto-opens the SessionAboutToExpire dialog.
+// The notification text itself travels as a message key (see
+// proto.UserMsgSessionExpiresIn); these keys carry the structured deadline
+// the UI needs for its own countdown label, and disambiguate the
+// T-WarningLead notification from the T-FinalWarningLead fallback that
+// auto-opens the SessionAboutToExpire dialog.
 const (
 	// MetaSessionWarning is set to "true" on both warning events (T-10 and
 	// T-2) so the UI can detect a session-warning SystemEvent without
@@ -36,10 +37,9 @@ const (
 	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
 	// SystemEvent the daemon emits when it discards a deadline from the
 	// management server (pre-epoch, too far in the future, or past the
-	// clock-skew tolerance). The value is the rejection reason string.
-	// userMessage is left empty; the UI detects the event via this key
-	// and builds a localized notification — same pattern as the session
-	// warnings above.
+	// clock-skew tolerance). The value is the rejection reason string,
+	// which is diagnostic only: the user-facing text travels as
+	// proto.UserMsgSessionDeadlineReject.
 	MetaSessionDeadlineRejected = "session_deadline_rejected"
 )
 

client/internal/auth/sessionwatch/watcher.go

@@ -21,6 +21,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	cProto "github.com/netbirdio/netbird/client/proto"
+	nbstatus "github.com/netbirdio/netbird/client/status"
 )
 
 const (
@@ -80,7 +81,7 @@ type StatusRecorder interface {
 		severity cProto.SystemEvent_Severity,
 		category cProto.SystemEvent_Category,
 		message string,
-		userMessage string,
+		userMessage *cProto.UserMessage,
 		metadata map[string]string,
 	)
 }
@@ -376,7 +377,22 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_AUTHENTICATION,
 		message,
-		"",
+		warningUserMessage(deadline),
 		meta,
 	)
 }
+
+// warningUserMessage builds the localizable body for a session warning. The
+// remaining time is rendered here rather than in the UI so every consumer of the
+// event agrees on it; a deadline that is already gone (a warning delivered late)
+// drops to the variant without a countdown.
+func warningUserMessage(deadline time.Time) *cProto.UserMessage {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return cProto.NewUserMessage(cProto.UserMsgSessionExpiresSoon).
+			WithTitle(cProto.TitleSessionWarning)
+	}
+	return cProto.NewUserMessage(cProto.UserMsgSessionExpiresIn,
+		cProto.ArgRemaining, nbstatus.HumaniseDuration(remaining)).
+		WithTitle(cProto.TitleSessionWarning)
+}

client/internal/auth/sessionwatch/watcher_test.go

@@ -34,6 +34,9 @@ type event struct {
 	severity cProto.SystemEvent_Severity
 	category cProto.SystemEvent_Category
 	message  string
+	msgKey   cProto.UserMessageKey
+	titleKey cProto.UserMessageKey
+	msgArgs  map[string]string
 	meta     map[string]string
 }
 
@@ -62,7 +65,7 @@ func (r *fakeRecorder) PublishEvent(
 	severity cProto.SystemEvent_Severity,
 	category cProto.SystemEvent_Category,
 	message string,
-	_ string,
+	userMessage *cProto.UserMessage,
 	metadata map[string]string,
 ) {
 	r.mu.Lock()
@@ -72,6 +75,9 @@ func (r *fakeRecorder) PublishEvent(
 		severity: severity,
 		category: category,
 		message:  message,
+		msgKey:   userMessage.Key(),
+		titleKey: userMessage.TitleKey(),
+		msgArgs:  userMessage.Args(),
 		meta:     metadata,
 	})
 }
@@ -186,6 +192,33 @@ func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
 	}
 }
 
+// The UI localizes the warning body from the key rather than from the daemon's
+// English text, so a warning that ships no key would silently regress to English.
+func TestWarningCarriesLocalizableMessage(t *testing.T) {
+	r := &fakeRecorder{}
+	w := newWatcher(50*time.Millisecond, r)
+	defer w.Close()
+
+	_ = w.Update(time.Now().Add(80 * time.Millisecond))
+
+	events := waitForEvents(t, r, 2)
+	warning := events[1]
+	if !warning.isWarning() {
+		t.Fatalf("event[1] should be a warning publish, got %+v", warning)
+	}
+	if warning.msgKey != cProto.UserMsgSessionExpiresIn {
+		t.Errorf("warning message key = %q, want %q", warning.msgKey, cProto.UserMsgSessionExpiresIn)
+	}
+	if warning.titleKey != cProto.TitleSessionWarning {
+		t.Errorf("warning title key = %q, want %q", warning.titleKey, cProto.TitleSessionWarning)
+	}
+	// The remaining time is rendered at publish time so every consumer of the
+	// event agrees on it; the exact value depends on timer slack.
+	if remaining := warning.msgArgs[cProto.ArgRemaining]; remaining == "" {
+		t.Errorf("warning is missing the %q argument, args=%v", cProto.ArgRemaining, warning.msgArgs)
+	}
+}
+
 func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r) // lead > delta => fire immediately

client/internal/connect.go

@@ -113,14 +113,11 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
-	notifier := tunnelnotifier.New(networkChangeListener, nil)
-	defer notifier.Close()
-
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: notifier,
+		NetworkChangeListener: networkChangeListener,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
@@ -166,7 +163,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 				rec.PublishEvent(
 					cProto.SystemEvent_CRITICAL, cProto.SystemEvent_SYSTEM,
 					"panic occurred",
-					"The Netbird service panicked. Please restart the service and submit a bug report with the client logs.",
+					cProto.NewUserMessage(cProto.UserMsgPanic),
 					nil,
 				)
 			}

client/internal/dns/notifier.go

@@ -51,5 +51,7 @@ func (n *notifier) notify() {
 		return
 	}
 
-	n.listener.OnNetworkChanged("")
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged("")
+	}(n.listener)
 }

client/internal/dns/server.go

@@ -252,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -602,12 +602,6 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	return s.searchDomains()
-}
-
-func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -692,7 +686,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)
@@ -1140,7 +1134,7 @@ func (s *DefaultServer) projectHealthy(p *nsGroupProj, servers []netip.AddrPort)
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_DNS,
 		"Nameserver group recovered",
-		"DNS servers are reachable again.",
+		proto.NewUserMessage(proto.UserMsgDNSRecovered),
 		map[string]string{"upstreams": joinAddrPorts(servers)},
 	)
 	p.warningActive = false
@@ -1163,7 +1157,7 @@ func (s *DefaultServer) projectUnhealthy(p *nsGroupProj, servers []netip.AddrPor
 			proto.SystemEvent_WARNING,
 			proto.SystemEvent_DNS,
 			"Nameserver group unreachable",
-			"Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+			proto.NewUserMessage(proto.UserMsgDNSUnreachable),
 			map[string]string{"upstreams": joinAddrPorts(servers)},
 		)
 		p.warningActive = true

client/internal/engine.go

@@ -572,7 +572,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	dnsServer, err := e.newDnsServer()
+	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
+	if err != nil {
+		return fmt.Errorf("read initial settings: %w", err)
+	}
+
+	dnsServer, err := e.newDnsServer(dnsConfig)
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -590,8 +595,10 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
+		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
+		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -1067,7 +1074,7 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
-	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", "", nil)
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", nil, nil)
 
 	return nil
 }
@@ -2095,6 +2102,42 @@ func (e *Engine) close() {
 	}
 }
 
+func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
+	if runtime.GOOS != "android" {
+		// nolint:nilnil
+		return nil, nil, false, nil
+	}
+
+	info := system.GetInfo(e.ctx)
+	info.SetFlags(
+		e.config.RosenpassEnabled,
+		e.config.RosenpassPermissive,
+		&e.config.ServerSSHAllowed,
+		e.config.DisableClientRoutes,
+		e.config.DisableServerRoutes,
+		e.config.DisableDNS,
+		e.config.DisableFirewall,
+		e.config.BlockLANAccess,
+		e.config.BlockInbound,
+		e.config.DisableIPv6,
+		e.config.SyncMessageVersion,
+		e.config.EnableSSHRoot,
+		e.config.EnableSSHSFTP,
+		e.config.EnableSSHLocalPortForwarding,
+		e.config.EnableSSHRemotePortForwarding,
+		e.config.DisableSSHAuth,
+	)
+
+	netMap, err := e.mgmClient.GetNetworkMap(info)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	routes := toRoutes(netMap.GetRoutes())
+	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
+	dnsFeatureFlag := toDNSFeatureFlag(netMap)
+	return routes, &dnsCfg, dnsFeatureFlag, nil
+}
+
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
 	transportNet, err := e.newStdNet()
 	if err != nil {
@@ -2129,7 +2172,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2142,7 +2185,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer() (dns.Server, error) {
+func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2154,7 +2197,7 @@ func (e *Engine) newDnsServer() (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			nbdns.Config{},
+			*dnsConfig,
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,

client/internal/engine_authsession.go

@@ -57,7 +57,8 @@ func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_AUTHENTICATION,
 			"session deadline rejected",
-			"",
+			cProto.NewUserMessage(cProto.UserMsgSessionDeadlineReject).
+				WithTitle(cProto.TitleSessionDeadlineReject),
 			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
 		)
 	}

client/internal/engine_tunsettings.go

@@ -1,20 +0,0 @@
-package internal
-
-func (e *Engine) TunSettings() ([]string, []string) {
-	e.syncMsgMux.Lock()
-	routeManager := e.routeManager
-	dnsServer := e.dnsServer
-	e.syncMsgMux.Unlock()
-
-	var routes []string
-	if routeManager != nil {
-		routes = routeManager.CurrentRouteRange()
-	}
-
-	var searchDomains []string
-	if dnsServer != nil {
-		searchDomains = dnsServer.SearchDomains()
-	}
-
-	return routes, searchDomains
-}

client/internal/peer/status.go

@@ -1281,12 +1281,15 @@ func (d *Status) numOfPeers() int {
 	return len(d.peers) + len(d.offlinePeers)
 }
 
-// PublishEvent adds an event to the queue and distributes it to all subscribers
+// PublishEvent adds an event to the queue and distributes it to all subscribers.
+// msg is the English log-facing description; userMsg is the localizable
+// user-facing message, or nil for an internal control event that must not
+// surface as a notification.
 func (d *Status) PublishEvent(
 	severity proto.SystemEvent_Severity,
 	category proto.SystemEvent_Category,
 	msg string,
-	userMsg string,
+	userMsg *proto.UserMessage,
 	metadata map[string]string,
 ) {
 	event := &proto.SystemEvent{
@@ -1294,7 +1297,10 @@ func (d *Status) PublishEvent(
 		Severity:    severity,
 		Category:    category,
 		Message:     msg,
-		UserMessage: userMsg,
+		UserMessage: userMsg.Text(),
+		MessageKey:  string(userMsg.Key()),
+		MessageArgs: userMsg.Args(),
+		TitleKey:    string(userMsg.TitleKey()),
 		Metadata:    metadata,
 		Timestamp:   timestamppb.Now(),
 	}

client/internal/profilemanager/state.go

@@ -45,35 +45,12 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-// SetProfileState writes the state file of the profile identified by id. Prefer
-// it over SetActiveProfileState whenever the caller knows which profile the data
-// belongs to: an SSO login spans seconds of user interaction, and the active
-// profile can change during it, which would file the account email under
-// whichever profile happened to be active when the flow returned.
-func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
-	if id == "" {
-		return fmt.Errorf("empty profile ID")
-	}
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid profile ID: %q", id)
-	}
-
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
-		return fmt.Errorf("write profile state: %w", err)
-	}
-
-	return nil
-}
-
-// SetActiveProfileState writes the state file of whichever profile is active at
-// call time. Use SetProfileState when the target profile is known.
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -82,7 +59,18 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	return pm.SetProfileState(activeProf.ID, state)
+	id := activeProf.ID
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid active profile ID: %q", id)
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
+	if err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
 }
 
 // RemoveProfileState deletes the per-profile state file (which holds the

client/internal/routemanager/client/client.go

@@ -403,7 +403,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_NETWORK,
 		"Default route added",
-		"Exit node connected.",
+		proto.NewUserMessage(proto.UserMsgExitNodeConnected),
 		meta,
 	)
 }
@@ -423,7 +423,7 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 
 	var severity proto.SystemEvent_Severity
 	var message string
-	var userMessage string
+	var userMessage *proto.UserMessage
 	meta := make(map[string]string)
 
 	if route != nil {
@@ -435,22 +435,22 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 	case reasonShutdown:
 		severity = proto.SystemEvent_INFO
 		message = "Default route removed"
-		userMessage = "Exit node disconnected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnected)
 	case reasonRouteUpdate:
 		severity = proto.SystemEvent_INFO
 		message = "Default route updated due to configuration change"
 	case reasonPeerUpdate:
 		severity = proto.SystemEvent_WARNING
 		message = "Default route disconnected due to peer unreachability"
-		userMessage = "Exit node connection lost. Your internet access might be affected."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeConnectionLost)
 	case reasonHA:
 		severity = proto.SystemEvent_INFO
 		message = "Default route disconnected due to high availability change"
-		userMessage = "Exit node disconnected due to high availability change."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeHAChange)
 	default:
 		severity = proto.SystemEvent_ERROR
 		message = "Default route disconnected for unknown reasons"
-		userMessage = "Exit node disconnected for unknown reasons."
+		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnectedUnknown)
 	}
 
 	w.statusRecorder.PublishEvent(

client/internal/routemanager/dnsinterceptor/handler.go

@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)

client/internal/routemanager/manager.go

@@ -8,13 +8,14 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -61,7 +62,7 @@ type Manager interface {
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	CurrentRouteRange() []string
+	InitialRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
 	ReconcilePeerAllowedIPs(peerKey string) error
@@ -75,8 +76,10 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
+	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
+	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -146,12 +149,45 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
+	// don't proceed with client routes if it is disabled
+	if config.DisableClientRoutes {
+		return dm
+	}
+
+	if runtime.GOOS == "android" {
+		dm.setupAndroidRoutes(config)
+	}
 	return dm
 }
+func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
+	cr := m.initialClientRoutes(config.InitialRoutes)
 
-func (m *DefaultManager) enableFakeIPRoutes() {
-	m.fakeIPManager = fakeip.NewManager()
-	m.notifier.NotifyRouteChange()
+	routesForComparison := slices.Clone(cr)
+
+	if config.DNSFeatureFlag {
+		m.fakeIPManager = fakeip.NewManager()
+
+		v4ID := uuid.NewString()
+		fakeIPRoute := &route.Route{
+			ID:          route.ID(v4ID),
+			Network:     m.fakeIPManager.GetFakeIPBlock(),
+			NetID:       route.NetID(v4ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv4Network,
+		}
+		v6ID := uuid.NewString()
+		fakeIPv6Route := &route.Route{
+			ID:          route.ID(v6ID),
+			Network:     m.fakeIPManager.GetFakeIPv6Block(),
+			NetID:       route.NetID(v6ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv6Network,
+		}
+		cr = append(cr, fakeIPRoute, fakeIPv6Route)
+		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
+	}
+
+	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -428,9 +464,6 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
-		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
-			m.enableFakeIPRoutes()
-		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -467,32 +500,9 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
-func (m *DefaultManager) CurrentRouteRange() []string {
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	if m.disableClientRoutes {
-		return nil
-	}
-
-	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
-	var nets []string
-	for _, routes := range filtered {
-		for _, r := range routes {
-			if r.IsDynamic() {
-				continue
-			}
-			nets = append(nets, r.NetString())
-		}
-	}
-
-	if m.fakeIPManager != nil {
-		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
-	}
-
-	sort.Strings(nets)
-	return nets
+// InitialRouteRange return the list of initial routes. It used by mobile systems
+func (m *DefaultManager) InitialRouteRange() []string {
+	return m.notifier.GetInitialRouteRanges()
 }
 
 // GetRouteSelector returns the route selector
@@ -690,6 +700,16 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
+func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
+	_, crMap := m.ClassifyRoutes(initialRoutes)
+	rs := make([]*route.Route, 0, len(crMap))
+	for _, routes := range crMap {
+		rs = append(rs, routes...)
+	}
+
+	return rs
+}
+
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true

client/internal/routemanager/mock.go

@@ -30,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
-func (m *MockManager) CurrentRouteRange() []string {
+// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
+func (m *MockManager) InitialRouteRange() []string {
 	return nil
 }
 

client/internal/routemanager/notifier/notifier_android.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"slices"
 	"sort"
+	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -13,15 +14,12 @@ import (
 )
 
 type Notifier struct {
-	mu sync.Mutex
-
-	// currentRoutes is the last announced route set. It exists only to
-	// suppress noise: without it every network map sync would trigger the
-	// Java side, even when the routes did not change. The actual TUN route
-	// state is owned by the route manager and pulled from there.
+	initialRoutes []*route.Route
 	currentRoutes []*route.Route
+	fakeIPRoutes  []*route.Route
 
-	listener listener.NetworkChangeListener
+	listener    listener.NetworkChangeListener
+	listenerMux sync.Mutex
 }
 
 func NewNotifier() *Notifier {
@@ -29,15 +27,20 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.notifyLocked()
+// SetInitialClientRoutes stores the initial route sets for TUN configuration.
+func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
+	n.initialRoutes = filterStatic(initialRoutes)
+	n.currentRoutes = filterStatic(routesForComparison)
+}
+
+// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
+func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
+	n.fakeIPRoutes = routes
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -51,32 +54,46 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if !hasRouteDiff(n.currentRoutes, newRoutes) {
+	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notifyLocked()
+	n.notify()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notifyLocked() {
+func (n *Notifier) notify() {
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	if n.listener == nil {
 		return
 	}
-	n.listener.OnNetworkChanged("")
+
+	allRoutes := slices.Clone(n.currentRoutes)
+	allRoutes = append(allRoutes, n.fakeIPRoutes...)
+
+	routeStrings := n.routesToStrings(allRoutes)
+	sort.Strings(routeStrings)
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged(strings.Join(routeStrings, ","))
+	}(n.listener)
 }
 
-func (n *Notifier) Close() {
-	// unused
+func filterStatic(routes []*route.Route) []*route.Route {
+	out := make([]*route.Route, 0, len(routes))
+	for _, r := range routes {
+		if !r.IsDynamic() {
+			out = append(out, r)
+		}
+	}
+	return out
 }
 
-func routesToStrings(routes []*route.Route) []string {
+func (n *Notifier) routesToStrings(routes []*route.Route) []string {
 	nets := make([]string, 0, len(routes))
 	for _, r := range routes {
 		nets = append(nets, r.NetString())
@@ -84,10 +101,25 @@ func routesToStrings(routes []*route.Route) []string {
 	return nets
 }
 
-func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	as := routesToStrings(a)
-	bs := routesToStrings(b)
-	sort.Strings(as)
-	sort.Strings(bs)
-	return !slices.Equal(as, bs)
+func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	slices.SortFunc(a, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+	slices.SortFunc(b, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+
+	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
+		return x.NetString() == y.NetString()
+	})
+}
+
+func (n *Notifier) GetInitialRouteRanges() []string {
+	initialStrings := n.routesToStrings(n.initialRoutes)
+	sort.Strings(initialStrings)
+	return initialStrings
+}
+
+func (n *Notifier) Close() {
+	// unused
 }

client/internal/routemanager/notifier/notifier_ios.go

@@ -29,7 +29,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// iOS doesn't care about initial routes
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on iOS
 }
 

client/internal/routemanager/notifier/notifier_other.go

@@ -19,7 +19,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// Not used on non-mobile platforms
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on non-mobile platforms
 }
 
@@ -31,6 +35,10 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
+func (n *Notifier) GetInitialRouteRanges() []string {
+	return []string{}
+}
+
 func (n *Notifier) Close() {
 	// unused
 }

client/internal/updater/installer/installer_run_darwin.go

@@ -98,44 +98,47 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	username, err := consoleUser()
+	// Get the current console user
+	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
+	output, err := cmd.Output()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get console user: %w", err)
 	}
 
+	username := strings.TrimSpace(string(output))
+	if username == "" || username == "root" {
+		return fmt.Errorf("no active user session found")
+	}
+
+	log.Infof("starting UI for user: %s", username)
+
+	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("lookup user %s: %w", username, err)
+		return fmt.Errorf("failed to lookup user %s: %w", username, err)
 	}
 
-	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
-
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
+	// Start the UI process as the console user using launchctl
+	// This ensures the app runs in the user's context with proper GUI access
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
+	// Set the user's home directory for proper macOS app behavior
+	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
+	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Run(); err != nil {
-		return fmt.Errorf("run UI launch: %w", err)
+	if err := launchCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start UI process: %w", err)
+	}
+
+	// Release the process so it can run independently
+	if err := launchCmd.Process.Release(); err != nil {
+		log.Warnf("failed to release UI process: %v", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
-func consoleUser() (string, error) {
-	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
-	if err != nil {
-		return "", fmt.Errorf("get console user: %w", err)
-	}
-
-	username := strings.TrimSpace(string(output))
-	switch username {
-	case "", "root", "loginwindow", "_mbsetupuser":
-		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
-	}
-
-	return username, nil
-}
-
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 

client/internal/updater/manager.go

@@ -94,7 +94,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %s", reason),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, reason),
 			nil,
 		)
 	}
@@ -115,7 +115,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update completed",
-			fmt.Sprintf("Your NetBird Client was auto-updated to version %s", m.currentVersion),
+			cProto.NewUserMessage(cProto.UserMsgUpdateCompleted, cProto.ArgVersion, m.currentVersion),
 			nil,
 		)
 		return
@@ -272,7 +272,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": latestVersion.String()},
 		)
 		return
@@ -283,7 +283,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": pendingVersion.String(), "enforced": "true"},
 		)
 	}
@@ -384,7 +384,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			"",
+			nil,
 			map[string]string{"new_version_available": updateVersion.String()},
 		)
 		return
@@ -401,7 +401,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		cProto.SystemEvent_INFO,
 		cProto.SystemEvent_SYSTEM,
 		"New version available",
-		"",
+		nil,
 		map[string]string{"new_version_available": updateVersion.String(), "enforced": "true"},
 	)
 }
@@ -411,14 +411,14 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"Updating client",
-		"Installing update now.",
+		cProto.NewUserMessage(cProto.UserMsgUpdateInstalling),
 		nil,
 	)
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"",
-		"",
+		nil,
 		map[string]string{"progress_window": "show", "version": pendingVersion.String()},
 	)
 
@@ -441,7 +441,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			fmt.Sprintf("Auto-update failed: %v", err),
+			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, err.Error()),
 			nil,
 		)
 		return err

client/proto/daemon.pb.go

@@ -3909,14 +3909,30 @@ func (*SubscribeRequest) Descriptor() ([]byte, []int) {
 }
 
 type SystemEvent struct {
-	state         protoimpl.MessageState `protogen:"open.v1"`
-	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Severity      SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
-	Category      SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
-	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
-	UserMessage   string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
-	Timestamp     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
-	Metadata      map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	state    protoimpl.MessageState `protogen:"open.v1"`
+	Id       string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Severity SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
+	Category SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
+	Message  string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	// userMessage is the daemon's English rendering of messageKey, kept for the
+	// CLI and for UIs that predate messageKey. UIs that localise read messageKey
+	// and treat this as the fallback.
+	UserMessage string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
+	Timestamp   *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	Metadata    map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// messageKey names a user-facing message in a stable, locale-independent
+	// form. A UI resolves it against its own translation bundle and substitutes
+	// messageArgs; an unrecognised key falls back to userMessage. Empty on events
+	// that carry no user-facing text.
+	MessageKey string `protobuf:"bytes,8,opt,name=messageKey,proto3" json:"messageKey,omitempty"`
+	// messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+	// {"version": "0.60.1"} for a "{version}" template. Values are data the
+	// daemon cannot localise (versions, addresses, error text).
+	MessageArgs map[string]string `protobuf:"bytes,9,rep,name=messageArgs,proto3" json:"messageArgs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// titleKey names the notification title in the same way as messageKey. Empty
+	// when the event has no dedicated title, in which case a UI composes one from
+	// severity and category.
+	TitleKey      string `protobuf:"bytes,10,opt,name=titleKey,proto3" json:"titleKey,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4000,6 +4016,27 @@ func (x *SystemEvent) GetMetadata() map[string]string {
 	return nil
 }
 
+func (x *SystemEvent) GetMessageKey() string {
+	if x != nil {
+		return x.MessageKey
+	}
+	return ""
+}
+
+func (x *SystemEvent) GetMessageArgs() map[string]string {
+	if x != nil {
+		return x.MessageArgs
+	}
+	return nil
+}
+
+func (x *SystemEvent) GetTitleKey() string {
+	if x != nil {
+		return x.TitleKey
+	}
+	return ""
+}
+
 type GetEventsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -7332,7 +7369,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x13TracePacketResponse\x12*\n" +
 	"\x06stages\x18\x01 \x03(\v2\x12.daemon.TraceStageR\x06stages\x12+\n" +
 	"\x11final_disposition\x18\x02 \x01(\bR\x10finalDisposition\"\x12\n" +
-	"\x10SubscribeRequest\"\x93\x04\n" +
+	"\x10SubscribeRequest\"\xd7\x05\n" +
 	"\vSystemEvent\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x128\n" +
 	"\bseverity\x18\x02 \x01(\x0e2\x1c.daemon.SystemEvent.SeverityR\bseverity\x128\n" +
@@ -7340,9 +7377,18 @@ const file_daemon_proto_rawDesc = "" +
 	"\amessage\x18\x04 \x01(\tR\amessage\x12 \n" +
 	"\vuserMessage\x18\x05 \x01(\tR\vuserMessage\x128\n" +
 	"\ttimestamp\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12=\n" +
-	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x1a;\n" +
+	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x12\x1e\n" +
+	"\n" +
+	"messageKey\x18\b \x01(\tR\n" +
+	"messageKey\x12F\n" +
+	"\vmessageArgs\x18\t \x03(\v2$.daemon.SystemEvent.MessageArgsEntryR\vmessageArgs\x12\x1a\n" +
+	"\btitleKey\x18\n" +
+	" \x01(\tR\btitleKey\x1a;\n" +
 	"\rMetadataEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10MessageArgsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\":\n" +
 	"\bSeverity\x12\b\n" +
 	"\x04INFO\x10\x00\x12\v\n" +
@@ -7660,7 +7706,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 111)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7776,16 +7822,17 @@ var file_daemon_proto_goTypes = []any{
 	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
 	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
 	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
-	(*durationpb.Duration)(nil),                // 114: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 115: google.protobuf.Timestamp
+	nil,                                        // 114: daemon.SystemEvent.MessageArgsEntry
+	(*durationpb.Duration)(nil),                // 115: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 116: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	114, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	115, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	115, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	115, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	115, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	114, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	116, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	116, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	116, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	115, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
 	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
 	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
 	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
@@ -7808,114 +7855,115 @@ var file_daemon_proto_depIdxs = []int32{
 	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
 	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
 	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	115, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	116, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
 	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	114, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	115, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	114, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	114, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	30,  // 38: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
-	5,   // 39: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
-	7,   // 40: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
-	9,   // 41: daemon.DaemonService.Up:input_type -> daemon.UpRequest
-	11,  // 42: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
-	11,  // 43: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
-	13,  // 44: daemon.DaemonService.Down:input_type -> daemon.DownRequest
-	15,  // 45: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
-	26,  // 46: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
-	28,  // 47: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
-	28,  // 48: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
-	4,   // 49: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
-	35,  // 50: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
-	37,  // 51: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
-	39,  // 52: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
-	44,  // 53: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
-	46,  // 54: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
-	48,  // 55: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
-	50,  // 56: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
-	53,  // 57: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
-	105, // 58: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
-	107, // 59: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
-	109, // 60: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
-	56,  // 61: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
-	58,  // 62: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
-	41,  // 63: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
-	60,  // 64: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
-	62,  // 65: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
-	64,  // 66: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
-	66,  // 67: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
-	68,  // 68: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
-	70,  // 69: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
-	73,  // 70: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
-	75,  // 71: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
-	79,  // 72: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
-	82,  // 73: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
-	84,  // 74: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
-	86,  // 75: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
-	88,  // 76: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
-	90,  // 77: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
-	92,  // 78: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
-	94,  // 79: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
-	96,  // 80: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
-	98,  // 81: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
-	100, // 82: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
-	102, // 83: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
-	77,  // 84: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
-	6,   // 85: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 86: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 87: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 88: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	12,  // 89: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
-	14,  // 90: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 91: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 92: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 93: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 94: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 95: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 96: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 97: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 98: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	45,  // 99: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	47,  // 100: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	49,  // 101: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	51,  // 102: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	55,  // 103: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	106, // 104: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	108, // 105: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	110, // 106: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	57,  // 107: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	59,  // 108: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	42,  // 109: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
-	61,  // 110: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	63,  // 111: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	65,  // 112: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	67,  // 113: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	69,  // 114: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	71,  // 115: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	74,  // 116: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	76,  // 117: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	80,  // 118: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	83,  // 119: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	85,  // 120: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	87,  // 121: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	89,  // 122: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	91,  // 123: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
-	93,  // 124: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
-	95,  // 125: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
-	97,  // 126: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	99,  // 127: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	101, // 128: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	103, // 129: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	78,  // 130: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
-	85,  // [85:131] is the sub-list for method output_type
-	39,  // [39:85] is the sub-list for method input_type
-	39,  // [39:39] is the sub-list for extension type_name
-	39,  // [39:39] is the sub-list for extension extendee
-	0,   // [0:39] is the sub-list for field type_name
+	114, // 30: daemon.SystemEvent.messageArgs:type_name -> daemon.SystemEvent.MessageArgsEntry
+	57,  // 31: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	115, // 32: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 33: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	116, // 34: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 35: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 36: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	115, // 37: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	115, // 38: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
+	30,  // 39: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
+	5,   // 40: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
+	7,   // 41: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
+	9,   // 42: daemon.DaemonService.Up:input_type -> daemon.UpRequest
+	11,  // 43: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
+	11,  // 44: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
+	13,  // 45: daemon.DaemonService.Down:input_type -> daemon.DownRequest
+	15,  // 46: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
+	26,  // 47: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
+	28,  // 48: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
+	28,  // 49: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
+	4,   // 50: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
+	35,  // 51: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
+	37,  // 52: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
+	39,  // 53: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
+	44,  // 54: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
+	46,  // 55: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
+	48,  // 56: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
+	50,  // 57: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
+	53,  // 58: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
+	105, // 59: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
+	107, // 60: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
+	109, // 61: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
+	56,  // 62: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
+	58,  // 63: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
+	41,  // 64: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
+	60,  // 65: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
+	62,  // 66: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
+	64,  // 67: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
+	66,  // 68: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
+	68,  // 69: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
+	70,  // 70: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
+	73,  // 71: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
+	75,  // 72: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
+	79,  // 73: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
+	82,  // 74: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
+	84,  // 75: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
+	86,  // 76: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
+	88,  // 77: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
+	90,  // 78: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
+	92,  // 79: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
+	94,  // 80: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
+	96,  // 81: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
+	98,  // 82: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
+	100, // 83: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
+	102, // 84: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
+	77,  // 85: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
+	6,   // 86: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 87: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 88: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 89: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 90: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 91: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 92: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 93: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 94: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 95: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 96: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 97: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 98: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 99: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 100: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 101: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 102: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 103: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 104: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 105: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 106: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 107: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 108: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 109: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 110: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 111: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 112: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 113: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 114: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 115: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 116: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 117: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 118: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 119: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 120: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 121: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 122: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 123: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 124: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 125: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 126: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 127: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 128: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 129: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 130: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 131: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	86,  // [86:132] is the sub-list for method output_type
+	40,  // [40:86] is the sub-list for method input_type
+	40,  // [40:40] is the sub-list for extension type_name
+	40,  // [40:40] is the sub-list for extension extendee
+	0,   // [0:40] is the sub-list for field type_name
 }
 
 func init() { file_daemon_proto_init() }
@@ -7947,7 +7995,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   110,
+			NumMessages:   111,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

client/proto/daemon.proto

@@ -677,9 +677,25 @@ message SystemEvent {
   Severity severity = 2;
   Category category = 3;
   string message = 4;
+  // userMessage is the daemon's English rendering of messageKey, kept for the
+  // CLI and for UIs that predate messageKey. UIs that localise read messageKey
+  // and treat this as the fallback.
   string userMessage = 5;
   google.protobuf.Timestamp timestamp = 6;
   map<string, string> metadata = 7;
+  // messageKey names a user-facing message in a stable, locale-independent
+  // form. A UI resolves it against its own translation bundle and substitutes
+  // messageArgs; an unrecognised key falls back to userMessage. Empty on events
+  // that carry no user-facing text.
+  string messageKey = 8;
+  // messageArgs holds the placeholder name/value pairs for messageKey, e.g.
+  // {"version": "0.60.1"} for a "{version}" template. Values are data the
+  // daemon cannot localise (versions, addresses, error text).
+  map<string, string> messageArgs = 9;
+  // titleKey names the notification title in the same way as messageKey. Empty
+  // when the event has no dedicated title, in which case a UI composes one from
+  // severity and category.
+  string titleKey = 10;
 }
 
 message GetEventsRequest {}

client/proto/metadata.go

@@ -43,10 +43,10 @@ const (
 	// UIs to re-fetch their cached config + features. UserMessage is empty so
 	// the change is silent; the source is carried in MetadataSourceKey.
 	MetadataTypeConfigChanged = "config_changed"
-	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
-	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
-	// that and builds its own localised toast off the paired config_changed
-	// event instead.
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. It is
+	// the user-facing half of the pair: the daemon stamps it with the message
+	// and title keys a UI localises, while the paired config_changed event stays
+	// silent and only drives the cache refresh.
 	MetadataTypePolicyApplied = "policy_applied"
 
 	// MetadataSourceKey is the SystemEvent.metadata key carrying what

client/proto/usermsg.go

@@ -0,0 +1,183 @@
+package proto
+
+import (
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// UserMessageKey names a piece of user-facing SystemEvent text in a
+// locale-independent form. The daemon has no notion of the user's language, so it
+// publishes the key and lets each UI resolve it.
+//
+// The value doubles as the lookup key in the desktop UI's translation bundles
+// (client/ui/i18n/locales/<code>/common.json), so renaming a constant here means
+// renaming the key in every bundle. The tests in client/ui/i18n lock the two
+// sides together. Keys that predate this mechanism keep their original bundle
+// names so the shipped translations still apply.
+type UserMessageKey string
+
+// Message-body keys published by the daemon. Every key needs an entry in
+// UserMessageTexts below and a translation in the UI bundles.
+const (
+	// UserMsgPanic is the CRITICAL event published from the recover() guard in
+	// the connect loop.
+	UserMsgPanic UserMessageKey = "event.panic"
+
+	// UserMsgDNSRecovered and UserMsgDNSUnreachable bracket a nameserver
+	// group's health transitions.
+	UserMsgDNSRecovered   UserMessageKey = "event.dns.recovered"
+	UserMsgDNSUnreachable UserMessageKey = "event.dns.unreachable"
+
+	// Exit-node (default route) transitions.
+	UserMsgExitNodeConnected           UserMessageKey = "event.exitNode.connected"
+	UserMsgExitNodeDisconnected        UserMessageKey = "event.exitNode.disconnected"
+	UserMsgExitNodeConnectionLost      UserMessageKey = "event.exitNode.connectionLost"
+	UserMsgExitNodeHAChange            UserMessageKey = "event.exitNode.haChange"
+	UserMsgExitNodeDisconnectedUnknown UserMessageKey = "event.exitNode.disconnectedUnknown"
+
+	// Auto-update lifecycle. UserMsgUpdateFailed takes a {reason} argument and
+	// UserMsgUpdateCompleted a {version}.
+	UserMsgUpdateInstalling UserMessageKey = "event.update.installing"
+	UserMsgUpdateCompleted  UserMessageKey = "event.update.completed"
+	UserMsgUpdateFailed     UserMessageKey = "event.update.failed"
+
+	// UserMsgMDMPolicyApplied reports that an MDM policy replaced the config.
+	UserMsgMDMPolicyApplied UserMessageKey = "notify.mdm.policyApplied.body"
+
+	// Session-expiry events. UserMsgSessionExpiresIn takes a {remaining}
+	// argument; the "soon" variant is published when the deadline has already
+	// passed by the time the warning fires.
+	UserMsgSessionExpiresIn      UserMessageKey = "notify.sessionWarning.body"
+	UserMsgSessionExpiresSoon    UserMessageKey = "notify.sessionWarning.bodyGeneric"
+	UserMsgSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.body"
+)
+
+// Notification-title keys. An event without one leaves titleKey empty and the UI
+// composes a title from severity and category, which is what every event did
+// before message keys existed. These carry no English fallback: a UI old enough
+// to ignore titleKey already builds its own title.
+const (
+	TitleMDMPolicyApplied      UserMessageKey = "notify.mdm.policyApplied.title"
+	TitleSessionWarning        UserMessageKey = "notify.sessionWarning.title"
+	TitleSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.title"
+)
+
+// UserMessageTitleKeys lists every title key a daemon can publish. It sits next
+// to the constants above because the two must grow together: a title key missing
+// from this slice ships untranslated, and the i18n test that would have caught it
+// reads this list.
+var UserMessageTitleKeys = []UserMessageKey{
+	TitleMDMPolicyApplied,
+	TitleSessionWarning,
+	TitleSessionDeadlineReject,
+}
+
+// ArgReason, ArgVersion and ArgRemaining are the placeholder names used by the
+// templates below. Producers pass them to NewUserMessage; the UI bundles use the
+// same names inside {}.
+const (
+	ArgReason    = "reason"
+	ArgVersion   = "version"
+	ArgRemaining = "remaining"
+)
+
+// UserMessageTexts is the English rendering of every body key, and the source of
+// the SystemEvent.userMessage fallback that the CLI and pre-messageKey UIs read.
+// It must match the en bundle, which the i18n test enforces.
+var UserMessageTexts = map[UserMessageKey]string{
+	UserMsgPanic:                       "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+	UserMsgDNSRecovered:                "DNS servers are reachable again.",
+	UserMsgDNSUnreachable:              "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+	UserMsgExitNodeConnected:           "Exit node connected.",
+	UserMsgExitNodeDisconnected:        "Exit node disconnected.",
+	UserMsgExitNodeConnectionLost:      "Exit node connection lost. Your internet access might be affected.",
+	UserMsgExitNodeHAChange:            "Exit node disconnected due to high availability change.",
+	UserMsgExitNodeDisconnectedUnknown: "Exit node disconnected for unknown reasons.",
+	UserMsgUpdateInstalling:            "Installing update now.",
+	UserMsgUpdateCompleted:             "Your NetBird client was auto-updated to version {version}.",
+	UserMsgUpdateFailed:                "Auto-update failed: {reason}",
+	UserMsgMDMPolicyApplied:            "Your NetBird configuration was updated by your IT policy.",
+	UserMsgSessionExpiresIn:            "Your NetBird session expires in {remaining}. Click Extend now to renew.",
+	UserMsgSessionExpiresSoon:          "Your NetBird session is about to expire. Click Extend now to renew.",
+	UserMsgSessionDeadlineReject:       "The server sent an invalid session deadline. Please sign in again.",
+}
+
+// UserMessage is a localizable user-facing event message: a stable body key, an
+// optional title key, and the placeholder values to substitute. A nil
+// *UserMessage carries no user-facing text, which is how internal control events
+// are published.
+type UserMessage struct {
+	key   UserMessageKey
+	title UserMessageKey
+	args  map[string]string
+}
+
+// NewUserMessage builds a UserMessage from key and flat placeholder name/value
+// pairs, e.g. NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"). An
+// unpaired trailing argument is dropped.
+func NewUserMessage(key UserMessageKey, args ...string) *UserMessage {
+	m := &UserMessage{key: key}
+	if len(args)%2 != 0 {
+		log.Debugf("user message %q: placeholder args not paired: %d items, last dropped", key, len(args))
+		args = args[:len(args)-1]
+	}
+	if len(args) > 0 {
+		m.args = make(map[string]string, len(args)/2)
+		for i := 0; i < len(args); i += 2 {
+			m.args[args[i]] = args[i+1]
+		}
+	}
+	return m
+}
+
+// WithTitle attaches a notification title key and returns m, so it chains onto
+// NewUserMessage.
+func (m *UserMessage) WithTitle(key UserMessageKey) *UserMessage {
+	m.title = key
+	return m
+}
+
+// Key returns the body key, or the empty key for a nil message.
+func (m *UserMessage) Key() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.key
+}
+
+// TitleKey returns the title key, which is empty unless WithTitle was called.
+func (m *UserMessage) TitleKey() UserMessageKey {
+	if m == nil {
+		return ""
+	}
+	return m.title
+}
+
+// Args returns the placeholder values, or nil for a nil message. The map is the
+// message's own and must not be mutated by the caller; it is handed straight to
+// SystemEvent.messageArgs.
+func (m *UserMessage) Args() map[string]string {
+	if m == nil {
+		return nil
+	}
+	return m.args
+}
+
+// Text renders the English fallback for m, with placeholders substituted. A nil
+// message, or a key with no registered template, renders empty so a UI treats
+// the event as carrying no user-facing text.
+func (m *UserMessage) Text() string {
+	if m == nil {
+		return ""
+	}
+	tmpl, ok := UserMessageTexts[m.key]
+	if !ok {
+		log.Warnf("no English template for user message key %q", m.key)
+		return ""
+	}
+	for name, value := range m.args {
+		tmpl = strings.ReplaceAll(tmpl, "{"+name+"}", value)
+	}
+	return tmpl
+}

client/proto/usermsg_test.go

@@ -0,0 +1,91 @@
+package proto
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestUserMessageText(t *testing.T) {
+	tests := []struct {
+		name string
+		msg  *UserMessage
+		want string
+	}{
+		{
+			name: "no placeholders",
+			msg:  NewUserMessage(UserMsgExitNodeConnected),
+			want: "Exit node connected.",
+		},
+		{
+			name: "placeholder substituted",
+			msg:  NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"),
+			want: "Your NetBird client was auto-updated to version 0.60.1.",
+		},
+		{
+			// A dangling arg is a caller mistake; dropping it must still yield a
+			// readable sentence rather than panicking on the wire path.
+			name: "unpaired trailing arg dropped",
+			msg:  NewUserMessage(UserMsgUpdateFailed, ArgReason, "disk full", "extra"),
+			want: "Auto-update failed: disk full",
+		},
+		{
+			name: "unknown key renders empty so the UI treats the event as silent",
+			msg:  NewUserMessage("event.notRegistered"),
+			want: "",
+		},
+		{
+			name: "nil message carries no text",
+			msg:  nil,
+			want: "",
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, tc.msg.Text())
+		})
+	}
+}
+
+// A nil *UserMessage is how every internal control event is published, so the
+// accessors must stay usable without a nil check at each of the ~25 call sites.
+func TestNilUserMessageAccessors(t *testing.T) {
+	var msg *UserMessage
+
+	assert.Empty(t, msg.Key(), "nil message must have no body key")
+	assert.Empty(t, msg.TitleKey(), "nil message must have no title key")
+	assert.Nil(t, msg.Args(), "nil message must have no args")
+	assert.Empty(t, msg.Text(), "nil message must render empty")
+}
+
+func TestUserMessageArgsAndTitle(t *testing.T) {
+	msg := NewUserMessage(UserMsgSessionExpiresIn, ArgRemaining, "10m").
+		WithTitle(TitleSessionWarning)
+
+	assert.Equal(t, UserMsgSessionExpiresIn, msg.Key())
+	assert.Equal(t, TitleSessionWarning, msg.TitleKey())
+	assert.Equal(t, map[string]string{ArgRemaining: "10m"}, msg.Args())
+	assert.Equal(t, "Your NetBird session expires in 10m. Click Extend now to renew.", msg.Text())
+}
+
+// Every registered template must be reachable: a key whose text is empty would
+// publish an event with a key but no fallback for the CLI and older UIs.
+func TestUserMessageTextsAreNonEmpty(t *testing.T) {
+	texts := UserMessageTexts
+	assert.NotEmpty(t, texts, "the catalog must not be empty")
+
+	for key, text := range texts {
+		assert.NotEmpty(t, text, "message key %q has an empty template", key)
+		assert.NotEmpty(t, key, "the catalog must not contain an empty key")
+	}
+}
+
+func TestUserMessageTitleKeysAreUnique(t *testing.T) {
+	seen := make(map[UserMessageKey]struct{})
+	for _, key := range UserMessageTitleKeys {
+		assert.NotEmpty(t, key, "title keys must not be empty")
+		_, dup := seen[key]
+		assert.False(t, dup, "title key %q listed twice", key)
+		seen[key] = struct{}{}
+	}
+}

client/server/login_outcome_test.go

@@ -1,89 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A login that never reached Management is not a decision about the peer's
-// credentials, so it must come back as a retryable error rather than an SSO
-// prompt: the user cannot finish a browser login while Management is down, and
-// the CLI's own backoff resolves the outage on its own once the daemon reports
-// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
-// because Management happened to be restarting when the daemon dialed it.
-func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	unreachable := errors.New("create connection: dial context: context deadline exceeded")
-	attempts := 0
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		attempts++
-		return internal.StatusLoginFailed, unreachable
-	}
-
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
-	require.Nil(t, resp, "a failed login must not answer with a login response")
-	require.Equal(t, 1, attempts)
-	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"a peer that could not reach Management is not waiting on a login")
-}
-
-// The counterpart: Management refusing the peer's credentials is a decision, and
-// the SSO flow still has to start for it. The profile carries an unusable
-// private key so the flow setup fails immediately instead of dialing, which is
-// enough to show the branch was entered — the refusal itself is never what comes
-// back out.
-func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
-	s, _, _, username, cfgPath := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-	breakProfilePrivateKey(t, cfgPath)
-
-	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
-	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
-		return internal.StatusNeedsLogin, refused
-	}
-
-	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.NotErrorIs(t, err, refused,
-		"the refusal was handed back to the caller instead of starting the SSO flow")
-
-	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, stateErr)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"the SSO flow setup was never reached with the broken key")
-}
-
-// breakProfilePrivateKey replaces the profile's private key with an unparseable
-// one, which makes any attempt to build a Management client fail on the spot.
-func breakProfilePrivateKey(t *testing.T, cfgPath string) {
-	t.Helper()
-
-	raw, err := os.ReadFile(cfgPath)
-	require.NoError(t, err)
-
-	var cfg map[string]any
-	require.NoError(t, json.Unmarshal(raw, &cfg))
-	cfg["PrivateKey"] = "not-a-key"
-
-	patched, err := json.Marshal(cfg)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
-}

client/server/mdm.go

@@ -94,12 +94,12 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 	// publishConfigChangedEvent has already fired inside
 	// restartEngineForMDMLocked with source="mdm". Emit an MDM-specific
 	// user-visible toast so the operator knows their IT policy was
-	// applied (UserMessage != "" triggers the GUI notifier).
+	// applied; the message and title keys let the GUI localise it.
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
-		"NetBird configuration was updated by your IT policy.",
+		proto.NewUserMessage(proto.UserMsgMDMPolicyApplied).WithTitle(proto.TitleMDMPolicyApplied),
 		map[string]string{
 			proto.MetadataSourceKey: proto.MetadataSourceMDM,
 			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
@@ -126,7 +126,7 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		fmt.Sprintf("daemon config changed (source=%s)", source),
-		"",
+		nil,
 		map[string]string{
 			proto.MetadataSourceKey: source,
 			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,

client/server/network.go

@@ -170,7 +170,7 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network selection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -214,7 +214,7 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network deselection changed",
-		"",
+		nil,
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -232,4 +232,3 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
-

client/server/server.go

@@ -135,11 +135,6 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
-
-	// loginAttemptFn stands in for the Management login round trip. Tests set
-	// it to drive the login outcomes that need a server on the other end;
-	// production leaves it nil, and every login goes through loginAttempt.
-	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
 }
 
 type oauthAuthFlow struct {
@@ -375,19 +370,7 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// attemptLogin runs a login round trip against Management, or the stand-in a
-// test installed in place of it.
-func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
-	if s.loginAttemptFn != nil {
-		return s.loginAttemptFn(ctx, setupKey, jwtToken)
-	}
-	return s.loginAttempt(ctx, setupKey, jwtToken)
-}
-
-// loginAttempt attempts to login using the provided information. It returns
-// StatusNeedsLogin when Management refused the peer's credentials and
-// StatusLoginFailed for every other failure, so callers can tell an
-// authentication decision apart from a login that never got made.
+// loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -640,23 +623,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	loginStatus, err := s.attemptLogin(ctx, "", "")
-	if err == nil {
+	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
 
-	// Only an authentication refusal means the peer has to (re-)authenticate.
-	// Any other failure leaves the login undecided: Management unreachable, a
-	// restart mid-request, an internal error. Those are returned for the caller
-	// to retry, because turning them into an SSO prompt asks the user to solve
-	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway.
-	if loginStatus != internal.StatusNeedsLogin {
-		state.Set(loginStatus)
-		return nil, err
-	}
-
 	if msg.SetupKey == "" {
 		hint := ""
 		if msg.Hint != nil {
@@ -713,7 +684,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -868,7 +839,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -2210,7 +2181,7 @@ func (s *Server) publishProfileListChanged(profileName string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Profile list changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
 	)
 }
@@ -2229,7 +2200,7 @@ func (s *Server) publishLogLevelChanged(level string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Log level changed",
-		"",
+		nil,
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
 	)
 }

client/ui/build/linux/nfpm/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1 (>= 4.14)
+  - libgtk-4-1
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
   rpm:
     depends:
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - gtk4
+      - webkitgtk6.0
       - xdg-utils
 
   # Arch Linux packages

client/ui/frontend/src/lib/connection.ts

@@ -43,12 +43,7 @@ function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<v
 }
 
 async function runSsoLogin(
-    result: {
-        verificationUri: string;
-        verificationUriComplete: string;
-        userCode: string;
-        profileId: string;
-    },
+    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
     state: SsoState,
     signal?: AbortSignal,
 ): Promise<void> {
@@ -61,7 +56,7 @@ async function runSsoLogin(
     // suspended, so a frontend-driven Up (a promise continuation) would not
     // fire until the user woke the window (e.g. hovering the tray icon).
     const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "", profileId: result.profileId },
+        { userCode: result.userCode, hostname: "" },
         { profileName: "", username: "" },
     );
 

client/ui/i18n/TRANSLATING.md

@@ -40,6 +40,12 @@ i18n/locales/<code>/common.json  a target — message only
 
 Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
 
+The `event.*` keys are a special group: the background service names them when it
+publishes a notification, and the app looks them up here. Their names are part of
+a Go↔JSON contract (`client/proto/usermsg.go`), so they are even less renameable
+than the rest — and a missing one shows the user English. Tests fail the build if
+any locale drops one.
+
 | ✅ Do | ❌ Don't |
 |---|---|
 | Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |

client/ui/i18n/bundle.go

@@ -126,18 +126,29 @@ func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
 // pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
 // the default language, then to the key itself so a miss is visible in the UI.
 func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
+	if v, ok := b.Lookup(lang, key, args...); ok {
+		return v
+	}
+	return key
+}
+
+// Lookup resolves key like Translate but reports whether it was found in the
+// requested or the default bundle. Callers holding a better fallback than the
+// raw key — a daemon-supplied English string for a key this build predates —
+// use this to tell a miss from a hit.
+func (b *Bundle) Lookup(lang LanguageCode, key string, args ...string) (string, bool) {
 	b.mu.RLock()
 	defer b.mu.RUnlock()
 
 	if v, ok := b.bundles[lang][key]; ok {
-		return applyPlaceholders(v, args)
+		return applyPlaceholders(v, args), true
 	}
 	if lang != DefaultLanguage {
 		if v, ok := b.bundles[DefaultLanguage][key]; ok {
-			return applyPlaceholders(v, args)
+			return applyPlaceholders(v, args), true
 		}
 	}
-	return key
+	return "", false
 }
 
 // applyPlaceholders substitutes {name} in s using args as flat name/value

client/ui/i18n/eventkeys_test.go

@@ -0,0 +1,126 @@
+//go:build !android && !ios && !freebsd && !js
+
+package i18n
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// shippedBundle loads the real locale tree rather than the fstest fixture the
+// other tests use: these checks exist to catch a key the daemon publishes but no
+// bundle translates, which only the shipped files can prove.
+func shippedBundle(t *testing.T) *Bundle {
+	t.Helper()
+	b, err := NewBundle(os.DirFS("locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return b
+}
+
+// The daemon publishes a message key and each UI resolves it locally, so a key
+// with no en entry degrades to the daemon's English fallback and silently stops
+// being translatable. Fail the build instead.
+func TestUserMessageKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for key, text := range proto.UserMessageTexts {
+		got, ok := b.Lookup(DefaultLanguage, string(key))
+		if !assert.True(t, ok, "message key %q has no en translation", key) {
+			continue
+		}
+		assert.Equal(t, text, got,
+			"en translation of %q must match the daemon's English fallback", key)
+	}
+}
+
+func TestUserMessageTitleKeysExistInEnglishBundle(t *testing.T) {
+	b := shippedBundle(t)
+
+	for _, key := range proto.UserMessageTitleKeys {
+		_, ok := b.Lookup(DefaultLanguage, string(key))
+		assert.True(t, ok, "title key %q has no en translation", key)
+	}
+}
+
+// Every shipped locale must translate the daemon's keys, not just en. A missing
+// one still renders (Lookup falls back to en) but the notification would show up
+// in English for that user, which is the bug this whole mechanism exists to fix.
+func TestUserMessageKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := make([]proto.UserMessageKey, 0, len(proto.UserMessageTexts))
+	for key := range proto.UserMessageTexts {
+		keys = append(keys, key)
+	}
+	keys = append(keys, proto.UserMessageTitleKeys...)
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[string(key)]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+}
+
+// The tray composes a title from these when an event carries no title key, so a
+// gap here would render "event.severity.warning: DNS" to the user.
+func TestEventTitleKeysTranslatedInEveryLanguage(t *testing.T) {
+	b := shippedBundle(t)
+
+	keys := []string{
+		"event.title",
+		"event.severity.info", "event.severity.warning",
+		"event.severity.error", "event.severity.critical",
+		"event.category.network", "event.category.dns",
+		"event.category.authentication", "event.category.connectivity",
+		"event.category.system",
+	}
+
+	for _, lang := range b.Languages() {
+		bundle, err := b.BundleFor(lang.Code)
+		require.NoError(t, err, "BundleFor(%q)", lang.Code)
+
+		for _, key := range keys {
+			text, ok := bundle[key]
+			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
+				continue
+			}
+			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
+		}
+	}
+
+	// The composed title is useless without both slots.
+	title, ok := b.Lookup(DefaultLanguage, "event.title", "severity", "Warning", "category", "DNS")
+	require.True(t, ok)
+	assert.Equal(t, "Warning: DNS", title, "event.title must substitute both placeholders")
+}
+
+func TestBundleLookupReportsMisses(t *testing.T) {
+	b, err := NewBundle(fakeLocales())
+	require.NoError(t, err)
+
+	got, ok := b.Lookup("en", "tray.menu.connect")
+	assert.True(t, ok)
+	assert.Equal(t, "Connect", got)
+
+	// An absent key must report a miss rather than echo the key, so callers can
+	// substitute their own fallback.
+	got, ok = b.Lookup("en", "tray.missing")
+	assert.False(t, ok, "unknown key must report a miss")
+	assert.Empty(t, got, "a miss must not return the key")
+
+	// Empty keys reach Lookup from events that carry no title key at all.
+	_, ok = b.Lookup("en", "")
+	assert.False(t, ok, "empty key must report a miss")
+}

client/ui/i18n/locales/de/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Warnung"
+    },
+    "event.severity.error": {
+        "message": "Fehler"
+    },
+    "event.severity.critical": {
+        "message": "Kritisch"
+    },
+    "event.category.network": {
+        "message": "Netzwerk"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentifizierung"
+    },
+    "event.category.connectivity": {
+        "message": "Konnektivität"
+    },
+    "event.category.system": {
+        "message": "System"
+    },
+    "event.panic": {
+        "message": "Der NetBird-Dienst ist abgestürzt. Bitte starten Sie den Dienst neu und senden Sie einen Fehlerbericht mit den Client-Protokollen."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-Server sind wieder erreichbar."
+    },
+    "event.dns.unreachable": {
+        "message": "Ein oder mehrere DNS-Server sind nicht erreichbar. Das kann die Verbindung zu einigen Diensten beeinträchtigen."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node verbunden."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node getrennt."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Verbindung zum Exit Node verloren. Ihr Internetzugang kann beeinträchtigt sein."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit Node aufgrund einer Änderung der Hochverfügbarkeit getrennt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit Node aus unbekannten Gründen getrennt."
+    },
+    "event.update.installing": {
+        "message": "Update wird jetzt installiert."
+    },
+    "event.update.completed": {
+        "message": "Ihr NetBird-Client wurde automatisch auf Version {version} aktualisiert."
+    },
+    "event.update.failed": {
+        "message": "Automatisches Update fehlgeschlagen: {reason}"
+    },
     "common.cancel": {
         "message": "Abbrechen"
     },

client/ui/i18n/locales/en/common.json

@@ -239,6 +239,90 @@
         "message": "Your NetBird configuration was updated by your IT policy.",
         "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
     },
+    "event.title": {
+        "message": "{severity}: {category}",
+        "description": "Notification title for a daemon event, composed from severity and category, e.g. \"Warning: DNS\". Keep both placeholders; use your locale's colon spacing."
+    },
+    "event.severity.info": {
+        "message": "Info",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.warning": {
+        "message": "Warning",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.error": {
+        "message": "Error",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.severity.critical": {
+        "message": "Critical",
+        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
+    },
+    "event.category.network": {
+        "message": "Network",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the overlay network."
+    },
+    "event.category.dns": {
+        "message": "DNS",
+        "description": "Event category label used in the {category} slot of event.title. Acronym, do not translate."
+    },
+    "event.category.authentication": {
+        "message": "Authentication",
+        "description": "Event category label used in the {category} slot of event.title. Refers to signing in to the management server."
+    },
+    "event.category.connectivity": {
+        "message": "Connectivity",
+        "description": "Event category label used in the {category} slot of event.title. Refers to reaching peers."
+    },
+    "event.category.system": {
+        "message": "System",
+        "description": "Event category label used in the {category} slot of event.title. Refers to the local machine and the NetBird service."
+    },
+    "event.panic": {
+        "message": "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
+        "description": "Notification body after the NetBird background service crashed. \"Service\" is the daemon, not a remote service."
+    },
+    "event.dns.recovered": {
+        "message": "DNS servers are reachable again.",
+        "description": "Notification body when previously unreachable upstream DNS servers respond again."
+    },
+    "event.dns.unreachable": {
+        "message": "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
+        "description": "Notification body when one or more upstream DNS servers stop responding."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit node connected.",
+        "description": "Notification body when a full-tunnel exit node becomes active."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit node disconnected.",
+        "description": "Notification body when the user or the client shuts the exit node down deliberately."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Exit node connection lost. Your internet access might be affected.",
+        "description": "Notification body when the exit node peer became unreachable. \"Internet access\" means the user's own browsing."
+    },
+    "event.exitNode.haChange": {
+        "message": "Exit node disconnected due to high availability change.",
+        "description": "Notification body when a high-availability group switched away from this exit node. High availability is the standard IT term."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Exit node disconnected for unknown reasons.",
+        "description": "Notification body when the exit node dropped for a reason the client could not classify."
+    },
+    "event.update.installing": {
+        "message": "Installing update now.",
+        "description": "Notification body shown as an automatic client update starts installing."
+    },
+    "event.update.completed": {
+        "message": "Your NetBird client was auto-updated to version {version}.",
+        "description": "Notification body after an automatic client update succeeded. {version} is a version number, keep verbatim."
+    },
+    "event.update.failed": {
+        "message": "Auto-update failed: {reason}",
+        "description": "Notification body when an automatic client update failed. {reason} is an untranslated technical error string; keep your locale's colon spacing."
+    },
     "common.cancel": {
         "message": "Cancel",
         "description": "Generic Cancel button label, reused across dialogs. Keep short."

client/ui/i18n/locales/es/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Su configuración de NetBird fue actualizada por su política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Información"
+    },
+    "event.severity.warning": {
+        "message": "Advertencia"
+    },
+    "event.severity.error": {
+        "message": "Error"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Red"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticación"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividad"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "El servicio de NetBird falló de forma inesperada. Reinicie el servicio y envíe un informe de error con los registros del cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Los servidores DNS vuelven a estar accesibles."
+    },
+    "event.dns.unreachable": {
+        "message": "No se puede acceder a uno o más servidores DNS. Esto puede afectar la conexión a algunos servicios."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo de salida conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo de salida desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Se perdió la conexión con el nodo de salida. Su acceso a Internet puede verse afectado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo de salida desconectado por un cambio de alta disponibilidad."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo de salida desconectado por motivos desconocidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando la actualización ahora."
+    },
+    "event.update.completed": {
+        "message": "Su cliente de NetBird se actualizó automáticamente a la versión {version}."
+    },
+    "event.update.failed": {
+        "message": "La actualización automática falló: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/fr/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
     },
+    "event.title": {
+        "message": "{severity} : {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avertissement"
+    },
+    "event.severity.error": {
+        "message": "Erreur"
+    },
+    "event.severity.critical": {
+        "message": "Critique"
+    },
+    "event.category.network": {
+        "message": "Réseau"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Authentification"
+    },
+    "event.category.connectivity": {
+        "message": "Connectivité"
+    },
+    "event.category.system": {
+        "message": "Système"
+    },
+    "event.panic": {
+        "message": "Le service NetBird s'est arrêté brutalement. Veuillez redémarrer le service et envoyer un rapport de bug avec les journaux du client."
+    },
+    "event.dns.recovered": {
+        "message": "Les serveurs DNS sont de nouveau joignables."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossible de joindre un ou plusieurs serveurs DNS. Cela peut affecter la connexion à certains services."
+    },
+    "event.exitNode.connected": {
+        "message": "Nœud de sortie connecté."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nœud de sortie déconnecté."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connexion au nœud de sortie perdue. Votre accès à Internet peut être affecté."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nœud de sortie déconnecté suite à un changement de haute disponibilité."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nœud de sortie déconnecté pour une raison inconnue."
+    },
+    "event.update.installing": {
+        "message": "Installation de la mise à jour en cours."
+    },
+    "event.update.completed": {
+        "message": "Votre client NetBird a été mis à jour automatiquement vers la version {version}."
+    },
+    "event.update.failed": {
+        "message": "Échec de la mise à jour automatique : {reason}"
+    },
     "common.cancel": {
         "message": "Annuler"
     },

client/ui/i18n/locales/hu/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Információ"
+    },
+    "event.severity.warning": {
+        "message": "Figyelmeztetés"
+    },
+    "event.severity.error": {
+        "message": "Hiba"
+    },
+    "event.severity.critical": {
+        "message": "Kritikus"
+    },
+    "event.category.network": {
+        "message": "Hálózat"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Hitelesítés"
+    },
+    "event.category.connectivity": {
+        "message": "Kapcsolat"
+    },
+    "event.category.system": {
+        "message": "Rendszer"
+    },
+    "event.panic": {
+        "message": "A NetBird szolgáltatás összeomlott. Kérjük, indítsa újra a szolgáltatást, és küldjön hibajelentést a kliens naplóival."
+    },
+    "event.dns.recovered": {
+        "message": "A DNS-kiszolgálók ismét elérhetők."
+    },
+    "event.dns.unreachable": {
+        "message": "Egy vagy több DNS-kiszolgáló nem érhető el. Ez befolyásolhatja egyes szolgáltatások elérését."
+    },
+    "event.exitNode.connected": {
+        "message": "Exit Node csatlakoztatva."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Exit Node leválasztva."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Megszakadt a kapcsolat az Exit Node-dal. Ez érintheti az internetelérést."
+    },
+    "event.exitNode.haChange": {
+        "message": "Az Exit Node leválasztva a magas rendelkezésre állás változása miatt."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Az Exit Node ismeretlen okból leválasztva."
+    },
+    "event.update.installing": {
+        "message": "A frissítés telepítése folyamatban."
+    },
+    "event.update.completed": {
+        "message": "A NetBird kliens automatikusan a {version} verzióra frissült."
+    },
+    "event.update.failed": {
+        "message": "Az automatikus frissítés sikertelen: {reason}"
+    },
     "common.cancel": {
         "message": "Mégse"
     },

client/ui/i18n/locales/it/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Info"
+    },
+    "event.severity.warning": {
+        "message": "Avviso"
+    },
+    "event.severity.error": {
+        "message": "Errore"
+    },
+    "event.severity.critical": {
+        "message": "Critico"
+    },
+    "event.category.network": {
+        "message": "Rete"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticazione"
+    },
+    "event.category.connectivity": {
+        "message": "Connettività"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "Il servizio NetBird si è arrestato in modo anomalo. Riavvii il servizio e invii una segnalazione di bug con i log del client."
+    },
+    "event.dns.recovered": {
+        "message": "I server DNS sono di nuovo raggiungibili."
+    },
+    "event.dns.unreachable": {
+        "message": "Impossibile raggiungere uno o più server DNS. Questo potrebbe influire sulla connessione ad alcuni servizi."
+    },
+    "event.exitNode.connected": {
+        "message": "Nodo di uscita connesso."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nodo di uscita disconnesso."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Connessione al nodo di uscita perduta. L'accesso a Internet potrebbe essere compromesso."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nodo di uscita disconnesso a causa di una modifica dell'alta disponibilità."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nodo di uscita disconnesso per motivi sconosciuti."
+    },
+    "event.update.installing": {
+        "message": "Installazione dell'aggiornamento in corso."
+    },
+    "event.update.completed": {
+        "message": "Il client NetBird è stato aggiornato automaticamente alla versione {version}."
+    },
+    "event.update.failed": {
+        "message": "Aggiornamento automatico non riuscito: {reason}"
+    },
     "common.cancel": {
         "message": "Annulla"
     },

client/ui/i18n/locales/ja/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "NetBird の構成が IT ポリシーによって更新されました。"
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "情報"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "エラー"
+    },
+    "event.severity.critical": {
+        "message": "重大"
+    },
+    "event.category.network": {
+        "message": "ネットワーク"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "認証"
+    },
+    "event.category.connectivity": {
+        "message": "接続"
+    },
+    "event.category.system": {
+        "message": "システム"
+    },
+    "event.panic": {
+        "message": "NetBird サービスがクラッシュしました。サービスを再起動し、クライアントログを添えてバグを報告してください。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS サーバーに再び到達できるようになりました。"
+    },
+    "event.dns.unreachable": {
+        "message": "1 つ以上の DNS サーバーに到達できません。一部のサービスへの接続に影響する可能性があります。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口ノードに接続しました。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口ノードの接続を解除しました。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "出口ノードとの接続が失われました。インターネット接続に影響する可能性があります。"
+    },
+    "event.exitNode.haChange": {
+        "message": "高可用性の変更により出口ノードの接続が解除されました。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "不明な理由により出口ノードの接続が解除されました。"
+    },
+    "event.update.installing": {
+        "message": "更新をインストールしています。"
+    },
+    "event.update.completed": {
+        "message": "NetBird クライアントがバージョン {version} に自動更新されました。"
+    },
+    "event.update.failed": {
+        "message": "自動更新に失敗しました: {reason}"
+    },
     "common.cancel": {
         "message": "キャンセル"
     },

client/ui/i18n/locales/pt/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "A sua configuração do NetBird foi atualizada pela política de TI."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Informação"
+    },
+    "event.severity.warning": {
+        "message": "Aviso"
+    },
+    "event.severity.error": {
+        "message": "Erro"
+    },
+    "event.severity.critical": {
+        "message": "Crítico"
+    },
+    "event.category.network": {
+        "message": "Rede"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Autenticação"
+    },
+    "event.category.connectivity": {
+        "message": "Conectividade"
+    },
+    "event.category.system": {
+        "message": "Sistema"
+    },
+    "event.panic": {
+        "message": "O serviço NetBird falhou de forma inesperada. Reinicie o serviço e envie um relatório de erro com os registros do cliente."
+    },
+    "event.dns.recovered": {
+        "message": "Os servidores DNS estão novamente acessíveis."
+    },
+    "event.dns.unreachable": {
+        "message": "Não é possível acessar um ou mais servidores DNS. Isto pode afetar a conexão a alguns serviços."
+    },
+    "event.exitNode.connected": {
+        "message": "Nó de saída conectado."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Nó de saída desconectado."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Conexão com o nó de saída perdida. O seu acesso à Internet pode ser afetado."
+    },
+    "event.exitNode.haChange": {
+        "message": "Nó de saída desconectado devido a uma alteração de alta disponibilidade."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Nó de saída desconectado por motivos desconhecidos."
+    },
+    "event.update.installing": {
+        "message": "Instalando a atualização agora."
+    },
+    "event.update.completed": {
+        "message": "O seu cliente NetBird foi atualizado automaticamente para a versão {version}."
+    },
+    "event.update.failed": {
+        "message": "Falha na atualização automática: {reason}"
+    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/ru/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
     },
+    "event.title": {
+        "message": "{severity}: {category}"
+    },
+    "event.severity.info": {
+        "message": "Информация"
+    },
+    "event.severity.warning": {
+        "message": "Предупреждение"
+    },
+    "event.severity.error": {
+        "message": "Ошибка"
+    },
+    "event.severity.critical": {
+        "message": "Критично"
+    },
+    "event.category.network": {
+        "message": "Сеть"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "Аутентификация"
+    },
+    "event.category.connectivity": {
+        "message": "Связь"
+    },
+    "event.category.system": {
+        "message": "Система"
+    },
+    "event.panic": {
+        "message": "Служба NetBird аварийно завершилась. Перезапустите службу и отправьте отчёт об ошибке с журналами клиента."
+    },
+    "event.dns.recovered": {
+        "message": "DNS-серверы снова доступны."
+    },
+    "event.dns.unreachable": {
+        "message": "Не удалось связаться с одним или несколькими DNS-серверами. Это может повлиять на подключение к некоторым сервисам."
+    },
+    "event.exitNode.connected": {
+        "message": "Выходной узел подключён."
+    },
+    "event.exitNode.disconnected": {
+        "message": "Выходной узел отключён."
+    },
+    "event.exitNode.connectionLost": {
+        "message": "Соединение с выходным узлом потеряно. Доступ в интернет может быть нарушен."
+    },
+    "event.exitNode.haChange": {
+        "message": "Выходной узел отключён из-за изменения конфигурации высокой доступности."
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "Выходной узел отключён по неизвестной причине."
+    },
+    "event.update.installing": {
+        "message": "Устанавливается обновление."
+    },
+    "event.update.completed": {
+        "message": "Клиент NetBird автоматически обновлён до версии {version}."
+    },
+    "event.update.failed": {
+        "message": "Не удалось выполнить автоматическое обновление: {reason}"
+    },
     "common.cancel": {
         "message": "Отмена"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -179,6 +179,69 @@
     "notify.mdm.policyApplied.body": {
         "message": "您的 NetBird 配置已根据 IT 策略更新。"
     },
+    "event.title": {
+        "message": "{severity}：{category}"
+    },
+    "event.severity.info": {
+        "message": "信息"
+    },
+    "event.severity.warning": {
+        "message": "警告"
+    },
+    "event.severity.error": {
+        "message": "错误"
+    },
+    "event.severity.critical": {
+        "message": "严重"
+    },
+    "event.category.network": {
+        "message": "网络"
+    },
+    "event.category.dns": {
+        "message": "DNS"
+    },
+    "event.category.authentication": {
+        "message": "身份验证"
+    },
+    "event.category.connectivity": {
+        "message": "连接"
+    },
+    "event.category.system": {
+        "message": "系统"
+    },
+    "event.panic": {
+        "message": "NetBird 服务发生崩溃。请重启该服务，并附上客户端日志提交错误报告。"
+    },
+    "event.dns.recovered": {
+        "message": "DNS 服务器已恢复可访问。"
+    },
+    "event.dns.unreachable": {
+        "message": "无法访问一个或多个 DNS 服务器。这可能影响您连接部分服务。"
+    },
+    "event.exitNode.connected": {
+        "message": "出口节点已连接。"
+    },
+    "event.exitNode.disconnected": {
+        "message": "出口节点已断开。"
+    },
+    "event.exitNode.connectionLost": {
+        "message": "与出口节点的连接已丢失。您的互联网访问可能受到影响。"
+    },
+    "event.exitNode.haChange": {
+        "message": "由于高可用性变更，出口节点已断开。"
+    },
+    "event.exitNode.disconnectedUnknown": {
+        "message": "出口节点因未知原因已断开。"
+    },
+    "event.update.installing": {
+        "message": "正在安装更新。"
+    },
+    "event.update.completed": {
+        "message": "NetBird 客户端已自动更新到版本 {version}。"
+    },
+    "event.update.failed": {
+        "message": "自动更新失败：{reason}"
+    },
     "common.cancel": {
         "message": "取消"
     },

client/ui/localizer.go

@@ -63,6 +63,20 @@ func (l *Localizer) T(key string, args ...string) string {
 	return l.bundle.Translate(lang, key, args...)
 }
 
+// Lookup resolves a key supplied at runtime by the daemon, substituting args as
+// {placeholder}/value pairs. It reports false when the key is in no bundle, so
+// the caller can fall back to the daemon's own English text instead of showing a
+// bare key. An empty key never resolves.
+func (l *Localizer) Lookup(key string, args map[string]string) (string, bool) {
+	if l == nil || l.bundle == nil || key == "" {
+		return "", false
+	}
+	l.mu.RLock()
+	lang := l.lang
+	l.mu.RUnlock()
+	return l.bundle.Lookup(lang, key, flattenArgs(args)...)
+}
+
 // Watch invokes cb on each language change, after the cached language is
 // updated so cb may call l.T with the new locale. Replaces any prior subscription.
 func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
@@ -128,3 +142,17 @@ func (l *Localizer) StatusLabel(status string) string {
 	}
 	return status
 }
+
+// flattenArgs turns a placeholder map into the flat name/value slice the bundle
+// takes. Iteration order is irrelevant: each pair substitutes an independent
+// {name}.
+func flattenArgs(args map[string]string) []string {
+	if len(args) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(args)*2)
+	for name, value := range args {
+		out = append(out, name, value)
+	}
+	return out
+}

client/ui/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -62,7 +63,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *Notifier
+	notifier        *notifications.NotificationService
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -95,17 +96,13 @@ func main() {
 		}
 	})
 
-	// Debug patch, not for release: dumps heap/goroutine profiles and the
-	// process tree to /tmp/nbgui for the memory consumption investigation.
-	startMemProfiler(app)
-
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := newNotifier()
+	notifier := notifications.New()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -213,7 +210,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *Notifier) {
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/memprof.go

@@ -1,319 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"runtime/pprof"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/shirou/gopsutil/v4/process"
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/events"
-)
-
-// memProfOffsets are the snapshot times measured from application startup.
-var memProfOffsets = []time.Duration{0, 2 * time.Minute, 5 * time.Minute}
-
-// memProfMaxDepth bounds the child walk so a cycle in the reported parent links
-// cannot spin forever.
-const memProfMaxDepth = 4
-
-type memProfileSpec struct {
-	profile string
-	file    string
-	debug   int
-}
-
-var memProfileSpecs = []memProfileSpec{
-	{profile: "heap", file: "heap.pprof", debug: 0},
-	{profile: "heap", file: "heap.txt", debug: 1},
-	{profile: "goroutine", file: "goroutine.txt", debug: 1},
-	{profile: "threadcreate", file: "threadcreate.txt", debug: 1},
-}
-
-var memProfStart = time.Now()
-
-// startMemProfiler dumps a profile snapshot at every memProfOffsets mark, each
-// into its own timestamped directory under memProfBaseDir. The first runs once
-// the application is up so the window inventory sees the eagerly created
-// windows. Every failure is logged and never stops the GUI.
-func startMemProfiler(app *application.App) {
-	log.Infof("memory profiler enabled, writing to %s (snapshots at %v after startup)", memProfBaseDir(), memProfOffsets)
-
-	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
-		go func() {
-			started := time.Now()
-			for _, offset := range memProfOffsets {
-				if wait := time.Until(started.Add(offset)); wait > 0 {
-					time.Sleep(wait)
-				}
-				writeMemProfile(app)
-			}
-		}()
-	})
-}
-
-// memProfBaseDir returns the directory holding the snapshot directories.
-func memProfBaseDir() string {
-	if runtime.GOOS == "windows" {
-		return filepath.Join(os.TempDir(), "nbgui")
-	}
-	return "/tmp/nbgui"
-}
-
-// writeMemProfile creates a <timestamp>-<pid> directory and fills it with the
-// runtime profiles, the memory statistics summary and the process tree.
-func writeMemProfile(app *application.App) {
-	name := fmt.Sprintf("%s-%d", time.Now().Format("20060102-150405"), os.Getpid())
-	dir := filepath.Join(memProfBaseDir(), name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		log.Warnf("create memory profile dir %s: %v", dir, err)
-		return
-	}
-
-	// The heap profile reports live objects as of the last collection, so force
-	// one to keep inuse_space from counting garbage that is already unreachable.
-	runtime.GC()
-
-	if err := writeMemStats(filepath.Join(dir, "memstats.txt"), app); err != nil {
-		log.Warnf("write memory statistics: %v", err)
-	}
-
-	if err := writeProcTree(filepath.Join(dir, "proctree.txt")); err != nil {
-		log.Warnf("write process tree: %v", err)
-	}
-
-	for _, spec := range memProfileSpecs {
-		if err := writeMemProfileFile(spec, filepath.Join(dir, spec.file)); err != nil {
-			log.Warnf("write %s profile: %v", spec.profile, err)
-		}
-	}
-
-	log.Infof("memory profile written to %s", dir)
-}
-
-// writeMemProfileFile writes a single runtime profile to path.
-func writeMemProfileFile(spec memProfileSpec, path string) error {
-	p := pprof.Lookup(spec.profile)
-	if p == nil {
-		return fmt.Errorf("unknown profile %q", spec.profile)
-	}
-
-	f, err := os.Create(path)
-	if err != nil {
-		return fmt.Errorf("create %s: %w", path, err)
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close %s: %v", path, err)
-		}
-	}()
-
-	if err := p.WriteTo(f, spec.debug); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeMemStats dumps the runtime memory statistics next to the process
-// resident set size. A resident set much larger than Sys means the memory sits
-// outside the Go heap (webview, GTK, other cgo allocations), where the pprof
-// profiles cannot see it.
-func writeMemStats(path string, app *application.App) error {
-	var m runtime.MemStats
-	runtime.ReadMemStats(&m)
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time:           %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime:         %s\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "pid:            %d\n", os.Getpid())
-	fmt.Fprintf(&b, "\n")
-
-	rss, vms := processMemory()
-	fmt.Fprintf(&b, "process_rss:    %s\n", rss)
-	fmt.Fprintf(&b, "process_vms:    %s\n", vms)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "sys:            %s\n", formatMemBytes(m.Sys))
-	fmt.Fprintf(&b, "heap_alloc:     %s\n", formatMemBytes(m.HeapAlloc))
-	fmt.Fprintf(&b, "heap_sys:       %s\n", formatMemBytes(m.HeapSys))
-	fmt.Fprintf(&b, "heap_inuse:     %s\n", formatMemBytes(m.HeapInuse))
-	fmt.Fprintf(&b, "heap_idle:      %s\n", formatMemBytes(m.HeapIdle))
-	fmt.Fprintf(&b, "heap_released:  %s\n", formatMemBytes(m.HeapReleased))
-	fmt.Fprintf(&b, "heap_objects:   %d\n", m.HeapObjects)
-	fmt.Fprintf(&b, "stack_inuse:    %s\n", formatMemBytes(m.StackInuse))
-	fmt.Fprintf(&b, "stack_sys:      %s\n", formatMemBytes(m.StackSys))
-	fmt.Fprintf(&b, "mspan_sys:      %s\n", formatMemBytes(m.MSpanSys))
-	fmt.Fprintf(&b, "mcache_sys:     %s\n", formatMemBytes(m.MCacheSys))
-	fmt.Fprintf(&b, "gc_sys:         %s\n", formatMemBytes(m.GCSys))
-	fmt.Fprintf(&b, "other_sys:      %s\n", formatMemBytes(m.OtherSys))
-	fmt.Fprintf(&b, "next_gc:        %s\n", formatMemBytes(m.NextGC))
-	fmt.Fprintf(&b, "num_gc:         %d\n", m.NumGC)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "goroutines:     %d\n", runtime.NumGoroutine())
-	fmt.Fprintf(&b, "cgo_calls:      %d\n", runtime.NumCgoCall())
-	fmt.Fprintf(&b, "gomaxprocs:     %d\n", runtime.GOMAXPROCS(0))
-	fmt.Fprintf(&b, "\n")
-
-	writeWindowInventory(&b, app)
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeWindowInventory lists the live Wails windows. A window that exists holds
-// a webview process even while hidden, so this tells apart a leaked window (the
-// count grows) from windows whose content grew (the count stays put).
-func writeWindowInventory(b *strings.Builder, app *application.App) {
-	windows := app.Window.GetAll()
-	fmt.Fprintf(b, "windows:        %d\n", len(windows))
-	for _, w := range windows {
-		visible := "unknown"
-		if ww, ok := w.(*application.WebviewWindow); ok {
-			visible = strconv.FormatBool(ww.IsVisible())
-		}
-		fmt.Fprintf(b, "  id=%-3d name=%-20q visible=%-7s minimised=%-5t focused=%t\n",
-			w.ID(), w.Name(), visible, w.IsMinimised(), w.IsFocused())
-	}
-}
-
-// writeProcTree dumps this process and its descendants with their memory
-// footprint. The webview runs in child processes whose memory the Go runtime
-// profiles cannot see, so this is what attributes a footprint to a component.
-func writeProcTree(path string) error {
-	self, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		return fmt.Errorf("open own process: %w", err)
-	}
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time: %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime: %s\n\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "%-8s %-8s %-28s %12s %12s %12s %12s\n", "PID", "PPID", "NAME", "RSS", "VMS", "PSS", "PRIV_DIRTY")
-
-	var totalRSS, totalPSS, totalPrivate uint64
-	walkProcTree(&b, self, 0, &totalRSS, &totalPSS, &totalPrivate)
-
-	fmt.Fprintf(&b, "\n%-8s %-8s %-28s %12s %12s %12s %12s\n", "", "", "TOTAL",
-		formatKB(totalRSS), "", formatKB(totalPSS), formatKB(totalPrivate))
-	fmt.Fprintf(&b, "\nPSS and PRIV_DIRTY come from /proc/<pid>/smaps_rollup and are Linux only.\n")
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// walkProcTree appends one line per process, depth-first, accumulating totals.
-func walkProcTree(b *strings.Builder, p *process.Process, depth int, totalRSS, totalPSS, totalPrivate *uint64) {
-	name, err := p.Name()
-	if err != nil {
-		name = "unknown"
-	}
-
-	var rss, vms uint64
-	if info, err := p.MemoryInfo(); err == nil {
-		rss, vms = info.RSS, info.VMS
-	}
-
-	pss, private := smapsRollup(p.Pid)
-	*totalRSS += rss
-	*totalPSS += pss
-	*totalPrivate += private
-
-	ppid, err := p.Ppid()
-	if err != nil {
-		ppid = -1
-	}
-
-	fmt.Fprintf(b, "%-8d %-8d %-28s %12s %12s %12s %12s\n", p.Pid, ppid,
-		strings.Repeat("  ", depth)+name, formatKB(rss), formatKB(vms), formatKB(pss), formatKB(private))
-
-	if depth >= memProfMaxDepth {
-		return
-	}
-
-	children, err := p.Children()
-	if err != nil {
-		return
-	}
-	for _, child := range children {
-		walkProcTree(b, child, depth+1, totalRSS, totalPSS, totalPrivate)
-	}
-}
-
-// smapsRollup returns the proportional set size and private dirty bytes of pid,
-// both zero on platforms without /proc.
-func smapsRollup(pid int32) (uint64, uint64) {
-	f, err := os.Open(fmt.Sprintf("/proc/%d/smaps_rollup", pid))
-	if err != nil {
-		return 0, 0
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close smaps_rollup for %d: %v", pid, err)
-		}
-	}()
-
-	var pss, private uint64
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Fields(scanner.Text())
-		if len(fields) < 2 {
-			continue
-		}
-		kb, err := strconv.ParseUint(fields[1], 10, 64)
-		if err != nil {
-			continue
-		}
-		switch fields[0] {
-		case "Pss:":
-			pss = kb * 1024
-		case "Private_Dirty:":
-			private = kb * 1024
-		}
-	}
-	return pss, private
-}
-
-// processMemory returns the formatted resident and virtual size of this process.
-func processMemory() (string, string) {
-	p, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	info, err := p.MemoryInfo()
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	return formatMemBytes(info.RSS), formatMemBytes(info.VMS)
-}
-
-// formatMemBytes renders a byte count as megabytes with the raw value kept.
-func formatMemBytes(n uint64) string {
-	return fmt.Sprintf("%8.1f MB (%d bytes)", float64(n)/(1024*1024), n)
-}
-
-// formatKB renders a byte count as megabytes for the process tree columns, and
-// a dash when the platform did not report the value.
-func formatKB(n uint64) string {
-	if n == 0 {
-		return "-"
-	}
-	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
-}

client/ui/notifier.go

@@ -1,101 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
-)
-
-var errNotificationsUnavailable = errors.New("notifications unavailable")
-
-// Notifier wraps the Wails notification service so an unavailable backend
-// disables notifications instead of aborting the app. Startup fails for
-// environment reasons (a bare unbundled binary on macOS has no bundle
-// identifier, a headless Linux session has no D-Bus session bus), and Wails
-// treats a service startup error as fatal. After a failed startup every call
-// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
-// identifier raises an Objective-C exception that recover() cannot catch.
-type Notifier struct {
-	inner     *notifications.NotificationService
-	available atomic.Bool
-}
-
-func newNotifier() *Notifier {
-	return &Notifier{inner: notifications.New()}
-}
-
-// ServiceName implements the Wails service-name hook for startup logs.
-func (n *Notifier) ServiceName() string {
-	return n.inner.ServiceName()
-}
-
-// ServiceStartup starts the platform notifier, downgrading failure to a
-// warning so the app keeps running without notifications.
-func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
-	if err := n.inner.ServiceStartup(ctx, options); err != nil {
-		log.Warnf("notifications disabled: %v", err)
-		return nil
-	}
-	n.available.Store(true)
-	return nil
-}
-
-func (n *Notifier) ServiceShutdown() error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.ServiceShutdown()
-}
-
-func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.CheckNotificationAuthorization()
-}
-
-func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.RequestNotificationAuthorization()
-}
-
-// SendNotification delivers a notification, silently dropping it when the
-// backend never started (notifications are best-effort everywhere).
-func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotification(options)
-}
-
-func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotificationWithActions(options)
-}
-
-func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RegisterNotificationCategory(category)
-}
-
-// OnNotificationResponse registers the response callback. Pure Go state, so
-// it is safe (and simply inert) when the backend never started.
-//
-//wails:ignore
-func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
-	n.inner.OnNotificationResponse(callback)
-}

client/ui/preferences/store.go

@@ -246,7 +246,6 @@ func (s *Store) ExistedAtLoad() bool {
 func (s *Store) load() error {
 	if _, err := os.Stat(s.path); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			log.Infof("no ui preferences file at %s; using defaults", s.path)
 			return nil
 		}
 		return fmt.Errorf("stat preferences: %w", err)

client/ui/services/connection.go

@@ -33,21 +33,12 @@ type LoginResult struct {
 	UserCode                string `json:"userCode"`
 	VerificationURI         string `json:"verificationUri"`
 	VerificationURIComplete string `json:"verificationUriComplete"`
-	// ProfileID is the ID of the profile this login ran against, or "" when the
-	// caller named the profile itself and no ID was resolved. Pass it back in
-	// WaitSSOParams so the account email lands on this profile even if the
-	// active one changes during SSO.
-	ProfileID string `json:"profileId"`
 }
 
 // WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
-	// ProfileID is the profile the login was started for, used to file the
-	// account email against it rather than against whichever profile is active
-	// when the flow returns. Optional: empty falls back to the active profile.
-	ProfileID string `json:"profileId"`
 }
 
 // UpParams selects the profile to bring up.
@@ -86,16 +77,11 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	// Fall back to the daemon's active profile and the current OS user.
 	profileName := p.ProfileName
 	username := p.Username
-	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
-	// a handle — a display name or an ID prefix resolve too — and the state file
-	// is named after the ID, so passing a handle on would name the wrong file.
-	profileID := ""
 	if profileName == "" {
 		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
 			// Address the active profile by ID (the daemon resolves it as a
 			// handle); names can collide, the ID cannot.
 			profileName = active.GetId()
-			profileID = profileName
 			if username == "" {
 				username = active.GetUsername()
 			}
@@ -136,7 +122,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 		UserCode:                resp.GetUserCode(),
 		VerificationURI:         resp.GetVerificationURI(),
 		VerificationURIComplete: resp.GetVerificationURIComplete(),
-		ProfileID:               profileID,
 	}, nil
 }
 
@@ -257,31 +242,6 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		return "", s.classifyDaemonError(err)
 	}
 	log.Infof("SSO login completed, daemon reported success")
-
-	// Persist the account email the same way the CLI does after its own
-	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Logout below).
-	// Without this the profile has no email, so Profiles.List shows no account
-	// and later logins and session extends go out without a login_hint —
-	// leaving the IdP to guess which account was meant.
-	if email := resp.GetEmail(); email != "" {
-		state := &profilemanager.ProfileState{Email: email}
-		pm := profilemanager.NewProfileManager()
-
-		// Against the profile the login was started for: SSO spans seconds of
-		// user interaction, and a profile switch in that window would otherwise
-		// file the email under the wrong profile.
-		if p.ProfileID != "" {
-			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
-		} else {
-			err = pm.SetActiveProfileState(state)
-		}
-		if err != nil {
-			// Non-fatal: the login itself succeeded.
-			log.Warnf("failed to store account email: %v", err)
-		}
-	}
-
 	return resp.GetEmail(), nil
 }
 

client/ui/services/daemon_feed.go

@@ -59,13 +59,21 @@ type Emitter interface {
 
 // SystemEvent is the frontend-facing shape of a daemon SystemEvent.
 type SystemEvent struct {
-	ID          string            `json:"id"`
-	Severity    string            `json:"severity"`
-	Category    string            `json:"category"`
-	Message     string            `json:"message"`
-	UserMessage string            `json:"userMessage"`
-	Timestamp   int64             `json:"timestamp"`
-	Metadata    map[string]string `json:"metadata"`
+	ID          string `json:"id"`
+	Severity    string `json:"severity"`
+	Category    string `json:"category"`
+	Message     string `json:"message"`
+	UserMessage string `json:"userMessage"`
+	// MessageKey names the localizable body for this event; empty on control
+	// events and on events from a daemon that predates the field. Resolve it
+	// against the UI bundle and fall back to UserMessage on a miss.
+	MessageKey  string            `json:"messageKey"`
+	MessageArgs map[string]string `json:"messageArgs"`
+	// TitleKey names the localizable notification title, empty when the event
+	// has none and the consumer should compose one from severity and category.
+	TitleKey  string            `json:"titleKey"`
+	Timestamp int64             `json:"timestamp"`
+	Metadata  map[string]string `json:"metadata"`
 }
 
 // PeerStatus is the frontend-facing shape of a daemon PeerState.
@@ -563,6 +571,9 @@ func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
 		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
 		Message:     e.GetMessage(),
 		UserMessage: e.GetUserMessage(),
+		MessageKey:  e.GetMessageKey(),
+		MessageArgs: e.GetMessageArgs(),
+		TitleKey:    e.GetTitleKey(),
 		Metadata:    map[string]string{},
 	}
 	if ts := e.GetTimestamp(); ts != nil {

client/ui/services/profile.go

@@ -6,8 +6,6 @@ import (
 	"context"
 	"os/user"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -153,31 +151,11 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	if err != nil {
 		return err
 	}
-	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
 		ProfileName: p.ProfileName,
 		Username:    p.Username,
 	})
-	if err != nil {
-		return err
-	}
-
-	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind (same split as
-	// Connection.Logout). Legacy profiles are keyed by name rather than by a
-	// generated ID, so a recreated profile of the same name would inherit the
-	// deleted one's email and offer it as the login_hint.
-	//
-	// Keyed on the ID the daemon resolved, not on the request handle: that may
-	// have been a display name or an ID prefix, which would name a different
-	// file (or none).
-	if id := resp.GetId(); id != "" {
-		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
-			// Non-fatal: the profile itself is gone.
-			log.Warnf("failed to remove profile state for %s: %v", id, err)
-		}
-	}
-
-	return nil
+	return err
 }
 
 // Rename changes a profile's display name. The on-disk ID is unaffected, so

client/ui/tray.go

@@ -26,7 +26,6 @@ const (
 	notifyIDUpdatePrefix = "netbird-update-"
 	notifyIDEvent        = "netbird-event-"
 	notifyIDTrayError    = "netbird-tray-error"
-	notifyIDMDMPolicy    = "netbird-mdm-policy"
 
 	statusError = "Error"
 
@@ -44,7 +43,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *Notifier
+	Notifier        *notifications.NotificationService
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager

client/ui/tray_events.go

@@ -21,32 +21,14 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	if !ok {
 		return
 	}
-	// config_changed carries no UserMessage, so handle it before the message gate below.
+	// config_changed carries no user-facing message, so handle it before the gate below.
 	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
 		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
 		go t.refreshRestrictions()
 		go t.loadConfig()
-		// MDM gets a localised toast here; the daemon's English "policy_applied"
-		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
-		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
-			t.profileMu.Lock()
-			enabled := t.notificationsEnabled
-			t.profileMu.Unlock()
-			if enabled {
-				t.notify(
-					t.loc.T("notify.mdm.policyApplied.title"),
-					t.loc.T("notify.mdm.policyApplied.body"),
-					notifyIDMDMPolicy,
-				)
-			}
-		}
 		return
 	}
-	// Session-warning and deadline-rejected events build their body locally from
-	// metadata; every other event needs a UserMessage.
-	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
-	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
-	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
+	if se.MessageKey == "" && se.UserMessage == "" {
 		return
 	}
 	if shouldSkipSystemEvent(se) {
@@ -61,56 +43,56 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		return
 	}
 
-	// Session-warning events route via stable metadata flags rather than
-	// category/severity so a daemon-side reword still lands here. Final warning
-	// auto-opens the SessionExpiration dialog with no notification (the dialog is
-	// the last-chance reminder; doubling up would be noise).
-	if isDeadlineRejected {
-		t.notify(
-			t.loc.T("notify.sessionDeadlineRejected.title"),
-			t.loc.T("notify.sessionDeadlineRejected.body"),
-			notifyIDSessionExpired,
-		)
-		return
-	}
+	body := t.localizedEventMessage(se)
 
-	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
+	// The final session warning auto-opens the SessionExpiration dialog instead of
+	// toasting: the dialog is the last-chance reminder and doubling up would be
+	// noise. This routes on metadata rather than the message key because it is a
+	// behavioural distinction, not a wording one.
+	if se.Metadata[authsession.MetaWarning] == "true" {
 		if se.Metadata[authsession.MetaFinal] == "true" {
 			t.openSessionExpiration()
 			return
 		}
-		t.notifySessionWarning(
-			t.loc.T("notify.sessionWarning.title"),
-			t.buildSessionWarningBody(se.Metadata),
-		)
+		t.notifySessionWarning(t.eventTitle(se), body)
 		return
 	}
 
-	body := se.UserMessage
 	if id := se.Metadata["id"]; id != "" {
 		body += fmt.Sprintf(" ID: %s", id)
 	}
-	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
+	t.notify(t.eventTitle(se), body, notifyIDEvent+se.ID)
 }
 
-// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
-func eventTitle(e services.SystemEvent) string {
-	prefix := titleCase(e.Severity)
-	if prefix == "" {
-		prefix = "Info"
+// localizedEventMessage resolves the daemon's message key against the active
+// locale. A key this build does not ship — a daemon newer than the UI — falls
+// back to the daemon's own English rendering rather than showing a bare key.
+func (t *Tray) localizedEventMessage(se services.SystemEvent) string {
+	if body, ok := t.loc.Lookup(se.MessageKey, se.MessageArgs); ok {
+		return body
 	}
-	category := titleCase(e.Category)
-	if category == "" {
-		category = "System"
+	if se.MessageKey != "" {
+		log.Debugf("no translation for event message key %q, using the daemon's text", se.MessageKey)
 	}
-	return prefix + ": " + category
+	return se.UserMessage
 }
 
-func titleCase(s string) string {
-	if s == "" {
-		return ""
+// eventTitle resolves the event's own title key, falling back to a title
+// composed from severity and category, e.g. "Critical: DNS" in English. An enum
+// value this build does not know falls back to the Info and System labels.
+func (t *Tray) eventTitle(se services.SystemEvent) string {
+	if title, ok := t.loc.Lookup(se.TitleKey, nil); ok {
+		return title
 	}
-	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
+	severity, ok := t.loc.Lookup("event.severity."+strings.ToLower(se.Severity), nil)
+	if !ok {
+		severity = t.loc.T("event.severity.info")
+	}
+	category, ok := t.loc.Lookup("event.category."+strings.ToLower(se.Category), nil)
+	if !ok {
+		category = t.loc.T("event.category.system")
+	}
+	return t.loc.T("event.title", "severity", severity, "category", category)
 }
 
 // shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
@@ -119,11 +101,6 @@ func titleCase(s string) string {
 //   - install-progress signals (consumed by the install-progress window)
 //   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
 func shouldSkipSystemEvent(se services.SystemEvent) bool {
-	// "policy_applied" carries a hardcoded English message; the localised toast
-	// fires on the paired config_changed (source=mdm) event instead.
-	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
-		return true
-	}
 	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
 		return true
 	}

client/ui/tray_events_test.go

@@ -0,0 +1,150 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// trayWithLocalizer builds the minimum Tray the message/title resolvers touch:
+// they read t.loc and nothing else, so no app, window or daemon connection is
+// needed. The shipped locale tree is used so the assertions below exercise the
+// real bundles rather than a fixture.
+func trayWithLocalizer(t *testing.T) *Tray {
+	t.Helper()
+	bundle, err := i18n.NewBundle(os.DirFS("i18n/locales"))
+	require.NoError(t, err, "the shipped locale tree must load")
+	return &Tray{loc: NewLocalizer(bundle, nil)}
+}
+
+func TestLocalizedEventMessageResolvesKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey: string(proto.UserMsgExitNodeConnected),
+		// A daemon always ships its English rendering too; the key must win.
+		UserMessage: "should not be used",
+	})
+	assert.Equal(t, "Exit node connected.", got)
+}
+
+func TestLocalizedEventMessageSubstitutesArgs(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  string(proto.UserMsgUpdateCompleted),
+		MessageArgs: map[string]string{proto.ArgVersion: "0.60.1"},
+	})
+	assert.Equal(t, "Your NetBird client was auto-updated to version 0.60.1.", got)
+}
+
+// A daemon newer than the UI can publish a key this build has never heard of.
+// Showing the raw key would be a visible regression, so the daemon's own English
+// text has to win instead.
+func TestLocalizedEventMessageFallsBackToDaemonText(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{
+		MessageKey:  "event.somethingThisBuildNeverHeardOf",
+		UserMessage: "A message from a newer daemon.",
+	})
+	assert.Equal(t, "A message from a newer daemon.", got)
+}
+
+// An old daemon sends no key at all, only userMessage.
+func TestLocalizedEventMessageWithoutKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.localizedEventMessage(services.SystemEvent{UserMessage: "Legacy English text."})
+	assert.Equal(t, "Legacy English text.", got)
+}
+
+func TestEventTitlePrefersTitleKey(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	got := tray.eventTitle(services.SystemEvent{
+		Severity: "critical",
+		Category: "authentication",
+		TitleKey: string(proto.TitleSessionWarning),
+	})
+	assert.Equal(t, "Session expires soon", got, "a title key must beat the composed title")
+}
+
+func TestEventTitleComposesFromSeverityAndCategory(t *testing.T) {
+	tray := trayWithLocalizer(t)
+
+	tests := []struct {
+		name     string
+		severity string
+		category string
+		want     string
+	}{
+		{"warning dns", "warning", "dns", "Warning: DNS"},
+		{"critical system", "critical", "system", "Critical: System"},
+		{"info network", "info", "network", "Info: Network"},
+		{"error authentication", "error", "authentication", "Error: Authentication"},
+		// Enum values this build does not know, and the empty severity/category
+		// an event carries before the daemon fills them in.
+		{"unknown severity", "apocalyptic", "dns", "Info: DNS"},
+		{"unknown category", "warning", "quantum", "Warning: System"},
+		{"empty", "", "", "Info: System"},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := tray.eventTitle(services.SystemEvent{Severity: tc.severity, Category: tc.category})
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}
+
+func TestShouldSkipSystemEvent(t *testing.T) {
+	tests := []struct {
+		name string
+		ev   services.SystemEvent
+		want bool
+	}{
+		{
+			name: "update announcement handled by the tray updater",
+			ev:   services.SystemEvent{Metadata: map[string]string{"new_version_available": "0.60.1"}},
+			want: true,
+		},
+		{
+			name: "install progress belongs to the progress window",
+			ev:   services.SystemEvent{Metadata: map[string]string{"progress_window": "show"}},
+			want: true,
+		},
+		{
+			name: "the v6 half of a dual-stack default route is already toasted as v4",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "::/0"}},
+			want: true,
+		},
+		{
+			name: "the v4 default route is the one that toasts",
+			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "0.0.0.0/0"}},
+			want: false,
+		},
+		{
+			// policy_applied used to be suppressed here while the tray toasted
+			// off the paired config_changed event; it now carries its own keys.
+			name: "mdm policy applied surfaces normally",
+			ev: services.SystemEvent{
+				MessageKey: string(proto.UserMsgMDMPolicyApplied),
+				Metadata:   map[string]string{proto.MetadataTypeKey: proto.MetadataTypePolicyApplied},
+			},
+			want: false,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, shouldSkipSystemEvent(tc.ev))
+		})
+	}
+}

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_session.go

@@ -10,8 +10,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
-	nbstatus "github.com/netbirdio/netbird/client/status"
-	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/services"
 )
 
@@ -196,25 +194,6 @@ func (t *Tray) registerSessionWarningCategory() {
 	})
 }
 
-// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
-// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
-// Falls back to a generic string when metadata is missing or unparsable.
-func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
-	if meta == nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	raw := meta[authsession.MetaExpiresAt]
-	if raw == "" {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	deadline, err := authsession.ParseExpiresAt(raw)
-	if err != nil {
-		return t.loc.T("notify.sessionWarning.bodyGeneric")
-	}
-	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
-	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
-}
-
 // notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
 // with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
 func (t *Tray) notifySessionWarning(title, body string) {

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *Notifier
+	notifier     *notifications.NotificationService
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

management/internals/modules/agentnetwork/manager.go

@@ -157,14 +157,14 @@ func NewManager(
 }
 
 func (m *managerImpl) GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
@@ -175,14 +175,9 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 // been created yet; otherwise it is ignored (the cluster is pinned on
 // Settings and every provider in the account routes through it).
 func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
-	if strings.TrimSpace(bootstrapCluster) != "" {
-		if err := m.requireSettingsBootstrapPermission(ctx, provider.AccountID, userID); err != nil {
-			return nil, err
-		}
-	}
 
 	// An empty api_key would silently produce a synthesised service
 	// that 401s on every upstream request. Surface the misconfiguration
@@ -223,7 +218,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -262,7 +257,7 @@ func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) DeleteProvider(ctx context.Context, accountID, userID, providerID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -311,21 +306,21 @@ func pluralize(n int, singular, plural string) string {
 }
 
 func (m *managerImpl) GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthNone, accountID, policyID)
 }
 
 func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -351,7 +346,7 @@ func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -378,7 +373,7 @@ func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, policyID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -398,21 +393,21 @@ func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, polic
 }
 
 func (m *managerImpl) GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthNone, accountID, guardrailID)
 }
 
 func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -434,7 +429,7 @@ func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -457,7 +452,7 @@ func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -478,7 +473,7 @@ func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, gu
 
 // GetAllBudgetRules returns every account-level budget rule for the account.
 func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
@@ -486,7 +481,7 @@ func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID s
 
 // GetBudgetRule returns a single account-level budget rule.
 func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthNone, accountID, ruleID)
@@ -496,7 +491,7 @@ func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, rule
 // enforced at request time (CheckLLMPolicyLimits), not baked into the synth
 // proxy config, so no reconcile is needed.
 func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -518,7 +513,7 @@ func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule
 
 // UpdateBudgetRule updates an existing account-level budget rule.
 func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -541,7 +536,7 @@ func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule
 
 // DeleteBudgetRule removes an account-level budget rule.
 func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
 		return err
 	}
 
@@ -566,7 +561,7 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 // gating, access-log emission), a reconcile is triggered so the proxy and peer
 // network maps converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, settings.AccountID, userID, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -620,7 +615,7 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 // Returns the underlying status.NotFound when no row has been
 // bootstrapped yet (i.e. the account has no providers).
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
@@ -632,22 +627,6 @@ func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string)
 // the subdomain is picked from the curated wordlist avoiding
 // collisions on the same cluster. Idempotent: if a row already exists
 // it is returned untouched and the hint is ignored.
-// requireSettingsBootstrapPermission gates the one-time settings bootstrap a
-// first provider create performs. Pinning the account's cluster and subdomain
-// is a settings write, so it needs the settings permission on top of the
-// provider one. No-op once the settings row exists.
-func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, accountID, userID string) error {
-	_, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	if err == nil {
-		return nil
-	}
-	var sErr *status.Error
-	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
-		return fmt.Errorf("get agent network settings: %w", err)
-	}
-	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
-}
-
 func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
 	if accountID == "" {
 		return nil, fmt.Errorf("bootstrap settings: account id is required")
@@ -706,7 +685,7 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 // counter view; permission gate is the same Read role that gates
 // every other agent-network surface.
 func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
@@ -715,7 +694,7 @@ func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID str
 // ListAccessLogs returns a paginated, server-side-filtered page of
 // agent-network access logs plus the total count matching the filter.
 func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
@@ -725,7 +704,7 @@ func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID stri
 // agent-network access logs grouped by session, plus the total number of
 // sessions matching the filter.
 func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
@@ -734,7 +713,7 @@ func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, user
 // GetUsageOverview returns the filtered usage rows aggregated into time buckets
 // at the requested granularity, oldest-first.
 func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
 		return nil, err
 	}
 	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
@@ -808,8 +787,8 @@ func (m *managerImpl) RecordConsumption(ctx context.Context, accountID string, k
 	return m.store.IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
 }
 
-func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, module modules.Module, op operations.Operation) error {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, op)
+func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, op operations.Operation) error {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetwork, op)
 	if err != nil {
 		return status.NewPermissionValidationError(err)
 	}

management/internals/modules/agentnetwork/provider_bootstrap_test.go

@@ -1,134 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"runtime"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// bootstrapFixture wires a real sqlite store to a gomock permissions manager
-// so tests can grant the provider permission while denying (or never
-// expecting) the settings one.
-type bootstrapFixture struct {
-	manager Manager
-	store   store.Store
-	perms   *permissions.MockManager
-}
-
-func newBootstrapFixture(t *testing.T) *bootstrapFixture {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("sqlite store not properly supported on Windows yet")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
-
-	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err, "test store setup must succeed")
-	t.Cleanup(cleanUp)
-
-	ctrl := gomock.NewController(t)
-	perms := permissions.NewMockManager(ctrl)
-
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-
-	return &bootstrapFixture{
-		manager: NewManager(st, perms, accounts, nil),
-		store:   st,
-		perms:   perms,
-	}
-}
-
-func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
-	f.perms.EXPECT().
-		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
-		Return(allowed, context.Background(), nil)
-}
-
-func newBootstrapProvider(accountID string) *types.Provider {
-	p := types.NewProvider(accountID)
-	p.Name = "openai"
-	p.UpstreamURL = "https://api.openai.com"
-	p.APIKey = "sk-test"
-	p.Enabled = true
-	return p
-}
-
-// TestCreateProviderBootstrapRequiresSettingsPermission pins the gate on the
-// one-time settings bootstrap: creating the first provider with a
-// bootstrap_cluster pins the account's cluster and subdomain, which is a
-// settings write and must not ride on the providers permission alone.
-func TestCreateProviderBootstrapRequiresSettingsPermission(t *testing.T) {
-	ctx := context.Background()
-
-	t.Run("denied without settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.Error(t, err, "bootstrap without settings permission must fail")
-		var sErr *status.Error
-		require.ErrorAs(t, err, &sErr)
-		assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
-
-		providers, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
-		require.NoError(t, err)
-		assert.Empty(t, providers, "provider must not be persisted when bootstrap is denied")
-		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-		assert.Error(t, err, "settings row must not be created when bootstrap is denied")
-	})
-
-	t.Run("allowed with settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-		created, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.NoError(t, err, "bootstrap with both permissions must succeed")
-		require.NotNil(t, created)
-
-		settings, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-		require.NoError(t, err, "bootstrap must create the settings row")
-		assert.Equal(t, "cluster1.example.com", settings.Cluster, "settings should pin the bootstrap cluster")
-	})
-
-	t.Run("existing settings need no settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		require.NoError(t, f.store.SaveAgentNetworkSettings(ctx, &types.Settings{
-			AccountID: "account1",
-			Cluster:   "cluster1.example.com",
-			Subdomain: "existing",
-		}), "pre-existing settings row setup must succeed")
-
-		// Only the providers permission may be consulted: gomock fails the
-		// test on any unexpected settings-permission call.
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
-		require.NoError(t, err, "create with existing settings must not require the settings permission")
-	})
-
-	t.Run("no bootstrap cluster needs no settings permission", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "")
-		require.NoError(t, err, "create without bootstrap must not require the settings permission")
-	})
-}

management/internals/server/boot.go

@@ -24,13 +24,13 @@ import (
 
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -184,10 +184,6 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 			grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(realipOpts...), streamInterceptor, proxyStream),
 		}
 
-		// Append interceptors contributed by registered gRPC extensions. These
-		// run after the built-in chain (ChainUnaryInterceptor is additive).
-		gRPCOpts = appendExtensionInterceptors(gRPCOpts, s.grpcExtensions)
-
 		if s.Config.HttpConfig.LetsEncryptDomain != "" {
 			certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
 			if err != nil {
@@ -219,9 +215,6 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 		mgmtProto.RegisterProxyServiceServer(gRPCAPIHandler, s.ReverseProxyGRPCServer())
 		log.Info("ProxyService registered on gRPC server")
 
-		// Register services contributed by external modules via the extension seam.
-		registerExtensions(gRPCAPIHandler, s.grpcExtensions)
-
 		return gRPCAPIHandler
 	})
 }

management/internals/server/grpc_extension.go

@@ -1,74 +0,0 @@
-package server
-
-import (
-	"context"
-
-	"google.golang.org/grpc"
-)
-
-// GRPCExtension bundles an external module's contribution to the management
-// gRPC server: the registration of one or more services onto the shared
-// grpc.Server, any server-wide interceptors those services require, and an
-// optional shutdown hook. It is a generic extension point with no knowledge of
-// any specific service.
-type GRPCExtension struct {
-	// Register is invoked with the shared grpc.Server (as a ServiceRegistrar)
-	// after the built-in services are registered. It may register any number of
-	// services. May be nil.
-	Register func(grpc.ServiceRegistrar)
-	// UnaryInterceptors are appended to the server's unary interceptor chain,
-	// running after the built-in interceptors. May be empty.
-	UnaryInterceptors []grpc.UnaryServerInterceptor
-	// StreamInterceptors are appended to the server's stream interceptor chain,
-	// running after the built-in interceptors. May be empty.
-	StreamInterceptors []grpc.StreamServerInterceptor
-	// Shutdown, if non-nil, is called once during Stop() with the context
-	// governing server shutdown, which carries a deadline. The hook MUST
-	// return promptly and MUST abandon its work once that context is
-	// cancelled or expires: it runs before the rest of Stop()'s cleanup
-	// (store, event store, embedded IdP) and before Stop() itself checks the
-	// context's deadline, so a hook that ignores the context will delay all
-	// of that cleanup and prevent Stop() from returning on time. May be nil.
-	Shutdown func(ctx context.Context)
-}
-
-// RegisterGRPCExtension registers a gRPC extension. Call before the gRPC server
-// is first built (i.e. before Start); registrations after that have no effect.
-func (s *BaseServer) RegisterGRPCExtension(ext GRPCExtension) {
-	s.grpcExtensions = append(s.grpcExtensions, ext)
-}
-
-// appendExtensionInterceptors appends each extension's interceptors to the gRPC
-// server options as additional chained interceptors. grpc.ChainUnaryInterceptor
-// and grpc.ChainStreamInterceptor are additive, so the returned options run the
-// extension interceptors after any interceptors already present in opts.
-func appendExtensionInterceptors(opts []grpc.ServerOption, exts []GRPCExtension) []grpc.ServerOption {
-	for _, ext := range exts {
-		if len(ext.UnaryInterceptors) > 0 {
-			opts = append(opts, grpc.ChainUnaryInterceptor(ext.UnaryInterceptors...))
-		}
-		if len(ext.StreamInterceptors) > 0 {
-			opts = append(opts, grpc.ChainStreamInterceptor(ext.StreamInterceptors...))
-		}
-	}
-	return opts
-}
-
-// registerExtensions registers each extension's services onto reg.
-func registerExtensions(reg grpc.ServiceRegistrar, exts []GRPCExtension) {
-	for _, ext := range exts {
-		if ext.Register != nil {
-			ext.Register(reg)
-		}
-	}
-}
-
-// runExtensionShutdownHooks calls each extension's shutdown hook, if set,
-// passing ctx through so hooks can honor its deadline/cancellation.
-func runExtensionShutdownHooks(ctx context.Context, exts []GRPCExtension) {
-	for _, ext := range exts {
-		if ext.Shutdown != nil {
-			ext.Shutdown(ctx)
-		}
-	}
-}

management/internals/server/grpc_extension_test.go

@@ -1,160 +0,0 @@
-package server
-
-import (
-	"context"
-	"net"
-	"sync/atomic"
-	"testing"
-
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials/insecure"
-	"google.golang.org/grpc/health"
-	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
-	"google.golang.org/grpc/test/bufconn"
-)
-
-// Test that an extension's interceptors and service registration are actually
-// wired onto a real in-process gRPC server via the helpers, and that shutdown
-// hooks run. This validates the load-bearing assumption that
-// grpc.ChainUnaryInterceptor is additive (extension interceptors run in
-// addition to any base chain).
-func TestGRPCExtensionAppliedToServer(t *testing.T) {
-	var unaryCalls atomic.Int32
-	var streamShutdownCalled atomic.Bool
-
-	ext := GRPCExtension{
-		Register: func(reg grpc.ServiceRegistrar) {
-			healthgrpc.RegisterHealthServer(reg, health.NewServer())
-		},
-		UnaryInterceptors: []grpc.UnaryServerInterceptor{
-			func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
-				unaryCalls.Add(1)
-				return handler(ctx, req)
-			},
-		},
-		Shutdown: func(ctx context.Context) { streamShutdownCalled.Store(true) },
-	}
-	exts := []GRPCExtension{ext}
-
-	// Base options mimic GRPCServer(): a pre-existing chain the extension appends to.
-	var baseUnaryCalls atomic.Int32
-	opts := []grpc.ServerOption{
-		grpc.ChainUnaryInterceptor(func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
-			baseUnaryCalls.Add(1)
-			return handler(ctx, req)
-		}),
-	}
-	opts = appendExtensionInterceptors(opts, exts)
-
-	srv := grpc.NewServer(opts...)
-	registerExtensions(srv, exts)
-
-	lis := bufconn.Listen(1024 * 1024)
-	go func() { _ = srv.Serve(lis) }()
-	t.Cleanup(srv.Stop)
-
-	conn, err := grpc.NewClient("passthrough:///bufnet",
-		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return lis.DialContext(ctx) }),
-		grpc.WithTransportCredentials(insecure.NewCredentials()))
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { _ = conn.Close() })
-
-	_, err = healthgrpc.NewHealthClient(conn).Check(context.Background(), &healthgrpc.HealthCheckRequest{})
-	if err != nil {
-		t.Fatalf("health check via extension-registered service failed: %v", err)
-	}
-	if baseUnaryCalls.Load() != 1 {
-		t.Errorf("base interceptor calls = %d, want 1 (base chain must be preserved)", baseUnaryCalls.Load())
-	}
-	if unaryCalls.Load() != 1 {
-		t.Errorf("extension interceptor calls = %d, want 1", unaryCalls.Load())
-	}
-
-	runExtensionShutdownHooks(context.Background(), exts)
-	if !streamShutdownCalled.Load() {
-		t.Error("extension shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookReceivesCallerContext asserts that each hook receives
-// a non-nil context and that it is the very same context the caller passed
-// in, so hooks can rely on values/deadlines placed on it by Stop().
-func TestGRPCExtensionShutdownHookReceivesCallerContext(t *testing.T) {
-	type sentinelKey struct{}
-	want := "shutdown-ctx-sentinel"
-	ctx := context.WithValue(context.Background(), sentinelKey{}, want)
-
-	var called bool
-	ext := GRPCExtension{
-		Shutdown: func(hookCtx context.Context) {
-			called = true
-			if hookCtx == nil {
-				t.Fatal("hook received a nil context")
-			}
-			got, _ := hookCtx.Value(sentinelKey{}).(string)
-			if got != want {
-				t.Errorf("hook context sentinel = %q, want %q (not the caller's context)", got, want)
-			}
-		},
-	}
-
-	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
-	if !called {
-		t.Fatal("shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookObservesCancellation documents, by test, that
-// hooks can honor cancellation/deadlines: a hook given an already-cancelled
-// context must see ctx.Err() != nil and a closed Done() channel.
-func TestGRPCExtensionShutdownHookObservesCancellation(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	var called bool
-	ext := GRPCExtension{
-		Shutdown: func(hookCtx context.Context) {
-			called = true
-			if hookCtx.Err() == nil {
-				t.Error("hook context Err() = nil, want non-nil for a cancelled context")
-			}
-			select {
-			case <-hookCtx.Done():
-			default:
-				t.Error("hook context Done() channel is not closed for a cancelled context")
-			}
-		},
-	}
-
-	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
-	if !called {
-		t.Fatal("shutdown hook was not called")
-	}
-}
-
-// TestGRPCExtensionShutdownHookNilSkipped asserts that an extension
-// with a nil Shutdown hook is skipped without panicking, and that hooks for
-// other extensions still run.
-func TestGRPCExtensionShutdownHookNilSkipped(t *testing.T) {
-	var called atomic.Bool
-	exts := []GRPCExtension{
-		{Shutdown: nil},
-		{Shutdown: func(context.Context) { called.Store(true) }},
-	}
-
-	runExtensionShutdownHooks(context.Background(), exts)
-	if !called.Load() {
-		t.Error("shutdown hook for non-nil extension was not called")
-	}
-}
-
-func TestRegisterGRPCExtensionAccumulates(t *testing.T) {
-	s := &BaseServer{}
-	s.RegisterGRPCExtension(GRPCExtension{})
-	s.RegisterGRPCExtension(GRPCExtension{})
-	if len(s.grpcExtensions) != 2 {
-		t.Fatalf("grpcExtensions len = %d, want 2", len(s.grpcExtensions))
-	}
-}

management/internals/server/server.go

@@ -68,11 +68,6 @@ type BaseServer struct {
 
 	proxyAuthClose func()
 
-	// grpcExtensions holds additional gRPC services, interceptors, and shutdown
-	// hooks registered by external modules via RegisterGRPCExtension. Populated
-	// during boot (single-threaded), consumed by GRPCServer() and Stop().
-	grpcExtensions []GRPCExtension
-
 	listener    net.Listener
 	certManager *autocert.Manager
 	update      *version.Update
@@ -262,7 +257,6 @@ func (s *BaseServer) Stop() error {
 		s.proxyAuthClose()
 		s.proxyAuthClose = nil
 	}
-	runExtensionShutdownHooks(ctx, s.grpcExtensions)
 	_ = s.Store().Close(ctx)
 	_ = s.EventStore().Close(ctx)
 	if s.update != nil {

management/internals/shared/grpc/components_encoder.go

@@ -61,8 +61,6 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
-					Serial:     networkSerial(c.Network),
-					Network:    toAccountNetwork(c.Network),
 					PeerConfig: in.PeerConfig,
 					// components.Peers always contains the target peer
 					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},

management/internals/shared/grpc/components_encoder_test.go

@@ -758,9 +758,6 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	assert.Equal(t, "netbird.cloud", full.DnsDomain)
 	assert.Len(t, full.Peers, 1)
 	assert.Empty(t, full.Policies)
-	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
-	assert.Equal(t, "net-empty", full.Network.Identifier)
-	assert.Equal(t, uint64(9), full.Serial)
 }
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
@@ -779,12 +776,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}},
-			Network: &types.Network{
-				Identifier: "net-empty",
-				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
-				Serial:     9,
-			},
-		},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
 	)
 }

management/server/permissions/manager.go

@@ -82,9 +82,6 @@ func (m *managerImpl) ValidateUserPermissions(
 	return m.ValidateRoleModuleAccess(ctx, accountID, role, module, operation), ctxEnriched, nil
 }
 
-// ValidateRoleModuleAccess resolves an operation against the role's explicit
-// grant for the module, then the grant for its parent module when the module
-// is a dotted submodule, and finally the role's AutoAllowNew default.
 func (m *managerImpl) ValidateRoleModuleAccess(
 	ctx context.Context,
 	accountID string,
@@ -92,7 +89,7 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	module modules.Module,
 	operation operations.Operation,
 ) bool {
-	if permissions, ok := lookupModulePermissions(role, module); ok {
+	if permissions, ok := role.Permissions[module]; ok {
 		if allowed, exists := permissions[operation]; exists {
 			return allowed
 		}
@@ -103,21 +100,6 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	return role.AutoAllowNew[operation]
 }
 
-// lookupModulePermissions returns the role's explicit permission set for the
-// module, falling back to the parent module's set for dotted submodules. The
-// second return reports whether any explicit set was found.
-func lookupModulePermissions(role roles.RolePermissions, module modules.Module) (map[operations.Operation]bool, bool) {
-	if permissions, ok := role.Permissions[module]; ok {
-		return permissions, true
-	}
-	if parent, hasParent := module.Parent(); hasParent {
-		if permissions, ok := role.Permissions[parent]; ok {
-			return permissions, true
-		}
-	}
-	return nil, false
-}
-
 func (m *managerImpl) ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) (context.Context, error) {
 	if user.AccountID != accountID {
 		return ctx, status.NewUserNotPartOfAccountError()
@@ -137,7 +119,7 @@ func (m *managerImpl) GetPermissionsByRole(ctx context.Context, role types.UserR
 	permissions := roles.Permissions{}
 
 	for k := range modules.All {
-		if rolePermissions, ok := lookupModulePermissions(roleMap, k); ok {
+		if rolePermissions, ok := roleMap.Permissions[k]; ok {
 			permissions[k] = rolePermissions
 			continue
 		}

management/server/permissions/manager_test.go

@@ -1,139 +0,0 @@
-package permissions
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/permissions/roles"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-func TestValidateRoleModuleAccessSubmoduleCascade(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	fullAccess := map[operations.Operation]bool{
-		operations.Read:   true,
-		operations.Create: true,
-		operations.Update: true,
-		operations.Delete: true,
-	}
-	readOnly := map[operations.Operation]bool{
-		operations.Read:   true,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	}
-	denyAll := map[operations.Operation]bool{
-		operations.Read:   false,
-		operations.Create: false,
-		operations.Update: false,
-		operations.Delete: false,
-	}
-
-	t.Run("parent grant covers submodules", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions:  roles.Permissions{modules.AgentNetwork: fullAccess},
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Create),
-			"parent full grant should allow create on a submodule")
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
-			"parent full grant should allow read on a submodule")
-	})
-
-	t.Run("submodule grant does not leak to parent or siblings", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions:  roles.Permissions{modules.AgentNetworkUsage: readOnly},
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-			"explicit submodule read should be allowed")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Create),
-			"read-only submodule grant should not allow create")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetwork, operations.Read),
-			"submodule grant should not grant the parent module")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
-			"submodule grant should not grant a sibling submodule")
-	})
-
-	t.Run("explicit submodule entry wins over parent grant", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: denyAll,
-			Permissions: roles.Permissions{
-				modules.AgentNetwork:     fullAccess,
-				modules.AgentNetworkLogs: denyAll,
-			},
-		}
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
-			"explicit submodule deny should override the parent grant")
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
-			"sibling submodules should still resolve through the parent grant")
-	})
-
-	t.Run("auto allow applies when neither submodule nor parent is granted", func(t *testing.T) {
-		role := roles.RolePermissions{
-			AutoAllowNew: readOnly,
-		}
-		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
-			"auto-allow read should apply to submodules")
-		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Delete),
-			"auto-allow should not grant unlisted operations")
-	})
-}
-
-// TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules pins the behavior the
-// submodule split must not change: every built-in role resolves the new
-// submodules exactly as it resolved the agent_network module before.
-func TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	submodules := []modules.Module{
-		modules.AgentNetworkProviders,
-		modules.AgentNetworkPolicies,
-		modules.AgentNetworkGuardrails,
-		modules.AgentNetworkBudgets,
-		modules.AgentNetworkUsage,
-		modules.AgentNetworkLogs,
-		modules.AgentNetworkSettings,
-	}
-	allOperations := []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
-
-	for _, role := range []types.UserRole{types.UserRoleOwner, types.UserRoleAdmin, types.UserRoleAuditor, types.UserRoleNetworkAdmin, types.UserRoleUser} {
-		rolePermissions, ok := roles.RolesMap[role]
-		require.True(t, ok, "role %s must exist in RolesMap", role)
-
-		for _, sub := range submodules {
-			for _, op := range allOperations {
-				expected := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, modules.AgentNetwork, op)
-				actual := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, sub, op)
-				assert.Equal(t, expected, actual, "role %s: %s on %s should match the agent_network module", role, op, sub)
-			}
-		}
-	}
-}
-
-func TestGetPermissionsByRoleIncludesSubmodules(t *testing.T) {
-	manager := NewManager(nil)
-	ctx := context.Background()
-
-	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAuditor)
-	require.NoError(t, err, "auditor role must resolve")
-
-	usage, ok := permissions[modules.AgentNetworkUsage]
-	require.True(t, ok, "permissions map should contain the usage submodule")
-	assert.True(t, usage[operations.Read], "auditor should read the usage submodule")
-	assert.False(t, usage[operations.Update], "auditor should not update the usage submodule")
-
-	adminPermissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAdmin)
-	require.NoError(t, err, "admin role must resolve")
-	providers, ok := adminPermissions[modules.AgentNetworkProviders]
-	require.True(t, ok, "permissions map should contain the providers submodule")
-	assert.True(t, providers[operations.Delete], "admin should delete on the providers submodule")
-}

management/server/permissions/modules/module.go

@@ -1,7 +1,5 @@
 package modules
 
-import "strings"
-
 type Module string
 
 const (
@@ -22,17 +20,6 @@ const (
 	IdentityProviders Module = "identity_providers"
 	Services          Module = "services"
 	AgentNetwork      Module = "agent_network"
-
-	// Agent Network submodules. A role may grant one of these directly
-	// or grant the AgentNetwork parent, which covers all of them (see
-	// permissions.Manager cascade resolution).
-	AgentNetworkProviders  Module = "agent_network.providers"
-	AgentNetworkPolicies   Module = "agent_network.policies"
-	AgentNetworkGuardrails Module = "agent_network.guardrails"
-	AgentNetworkBudgets    Module = "agent_network.budgets"
-	AgentNetworkUsage      Module = "agent_network.usage"
-	AgentNetworkLogs       Module = "agent_network.logs"
-	AgentNetworkSettings   Module = "agent_network.settings"
 )
 
 var All = map[Module]struct{}{
@@ -53,21 +40,4 @@ var All = map[Module]struct{}{
 	IdentityProviders: {},
 	Services:          {},
 	AgentNetwork:      {},
-
-	AgentNetworkProviders:  {},
-	AgentNetworkPolicies:   {},
-	AgentNetworkGuardrails: {},
-	AgentNetworkBudgets:    {},
-	AgentNetworkUsage:      {},
-	AgentNetworkLogs:       {},
-	AgentNetworkSettings:   {},
-}
-
-// Parent returns the module owning a dotted submodule name and true, or the
-// module itself and false when it has no parent.
-func (m Module) Parent() (Module, bool) {
-	if i := strings.IndexByte(string(m), '.'); i > 0 {
-		return Module(string(m)[:i]), true
-	}
-	return m, false
 }

management/server/types/proxy_access_token.go

@@ -68,7 +68,7 @@ type ProxyAccessTokenGenerated struct {
 // CreateNewProxyAccessToken generates a new proxy access token.
 // Returns the token with hashed value stored and plain token for one-time display.
 func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *string, createdBy string) (*ProxyAccessTokenGenerated, error) {
-	hashedToken, plainToken, err := GenerateProxyToken()
+	hashedToken, plainToken, err := generateProxyToken()
 	if err != nil {
 		return nil, err
 	}
@@ -94,10 +94,7 @@ func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *
 	}, nil
 }
 
-// GenerateProxyToken generates a new random proxy token, returning its SHA-256
-// hash (for storage) and the one-time plaintext. Exported so external modules
-// can mint tokens in the canonical proxy-token format.
-func GenerateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
+func generateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
 	secret, err := b.Random(ProxyTokenSecretLength)
 	if err != nil {
 		return "", "", err

management/server/types/proxy_access_token_test.go

@@ -1,7 +1,6 @@
 package types
 
 import (
-	"strings"
 	"testing"
 	"time"
 
@@ -124,22 +123,6 @@ func TestCreateNewProxyAccessToken(t *testing.T) {
 	})
 }
 
-func TestGenerateProxyToken(t *testing.T) {
-	hashed, plain, err := GenerateProxyToken()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := plain.Validate(); err != nil {
-		t.Errorf("generated token failed Validate(): %v", err)
-	}
-	if plain.Hash() != hashed {
-		t.Error("returned hashed token does not match Hash(plain)")
-	}
-	if !strings.HasPrefix(string(plain), ProxyTokenPrefix) {
-		t.Errorf("token %q missing prefix %q", plain, ProxyTokenPrefix)
-	}
-}
-
 func TestProxyAccessToken_IsExpired(t *testing.T) {
 	past := time.Now().Add(-1 * time.Hour)
 	future := time.Now().Add(1 * time.Hour)

release_files/darwin_pkg/postinstall

@@ -30,23 +30,7 @@ mkdir -p /usr/local/bin/
     $AGENT service install || true
     $AGENT service start || true
 
-    console_user=$(stat -f%Su /dev/console 2>/dev/null)
-    case "$console_user" in
-        ""|root|loginwindow|_mbsetupuser)
-            echo "No active GUI user session (console user: '${console_user:-none}'); skipping UI launch."
-            ;;
-        *)
-            uid=$(id -u "$console_user" 2>/dev/null)
-            if [ -z "$uid" ]; then
-                echo "Could not resolve uid for console user '$console_user'; skipping UI launch."
-            else
-                echo "Launching NetBird UI as console user $console_user (uid $uid)."
-                if ! launchctl asuser "$uid" sudo -u "$console_user" -H open "$APP"; then
-                    echo "Failed to launch NetBird UI; if autostart is enabled it will start at next login."
-                fi
-            fi
-            ;;
-    esac
+    open $APP
 
     echo "Finished Netbird installation successfully"
     exit 0 # all good

shared/management/client/client.go

@@ -22,6 +22,7 @@ type Client interface {
 	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
 	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
+	GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error)
 	GetServerURL() string
 	// IsHealthy returns the current connection status without blocking.
 	// Used by the engine to monitor connectivity in the background.

shared/management/client/grpc.go

@@ -436,6 +436,49 @@ func (c *GrpcClient) handleSyncStream(ctx context.Context, serverPubKey wgtypes.
 	return nil
 }
 
+// GetNetworkMap return with the network map
+func (c *GrpcClient) GetNetworkMap(sysInfo *system.Info) (*proto.NetworkMap, error) {
+	serverPubKey, err := c.getServerPublicKey()
+	if err != nil {
+		log.Debugf("failed getting Management Service public key: %s", err)
+		return nil, err
+	}
+
+	ctx, cancelStream := context.WithCancel(c.ctx)
+	defer cancelStream()
+	stream, err := c.connectToSyncStream(ctx, *serverPubKey, sysInfo)
+	if err != nil {
+		log.Debugf("failed to open Management Service stream: %s", err)
+		return nil, err
+	}
+	defer func() {
+		_ = stream.CloseSend()
+	}()
+
+	update, err := stream.Recv()
+	if err == io.EOF {
+		log.Debugf("Management stream has been closed by server: %s", err)
+		return nil, err
+	}
+	if err != nil {
+		log.Debugf("disconnected from Management Service sync stream: %v", err)
+		return nil, err
+	}
+
+	decryptedResp := &proto.SyncResponse{}
+	err = encryption.DecryptMessage(*serverPubKey, c.key, update.Body, decryptedResp)
+	if err != nil {
+		log.Errorf("failed decrypting update message from Management Service: %s", err)
+		return nil, err
+	}
+
+	if decryptedResp.GetNetworkMap() == nil {
+		return nil, fmt.Errorf("invalid msg, required network map")
+	}
+
+	return decryptedResp.GetNetworkMap(), nil
+}
+
 func (c *GrpcClient) connectToSyncStream(ctx context.Context, serverPubKey wgtypes.Key, sysInfo *system.Info) (proto.ManagementService_SyncClient, error) {
 	req := &proto.SyncRequest{Meta: infoToMetaData(sysInfo)}
 

shared/management/client/mock.go

@@ -94,6 +94,11 @@ func (m *MockClient) HealthCheck() error {
 	return m.HealthCheckFunc()
 }
 
+// GetNetworkMap mock implementation of GetNetworkMap from Client interface.
+func (m *MockClient) GetNetworkMap(_ *system.Info) (*proto.NetworkMap, error) {
+	return nil, nil
+}
+
 // GetServerURL mock implementation of GetServerURL from mgm.Client interface
 func (m *MockClient) GetServerURL() string {
 	if m.GetServerURLFunc == nil {

shared/management/networkmap/decode.go

@@ -228,17 +228,15 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	return c, nil
 }
 
-// decodeAccountNetwork never returns nil — Calculate() dereferences
-// c.Network unconditionally, and servers that predate the fix omit the field
-// entirely from the empty-components envelope.
 func decodeAccountNetwork(an *proto.AccountNetwork) *types.Network {
-	n := &types.Network{}
 	if an == nil {
-		return n
+		return nil
+	}
+	n := &types.Network{
+		Identifier: an.Identifier,
+		Dns:        an.Dns,
+		Serial:     an.Serial,
 	}
-	n.Identifier = an.Identifier
-	n.Dns = an.Dns
-	n.Serial = an.Serial
 	if an.NetCidr != "" {
 		if _, ipnet, err := net.ParseCIDR(an.NetCidr); err == nil && ipnet != nil {
 			n.Net = *ipnet

shared/management/networkmap/envelope_test.go

@@ -221,66 +221,6 @@ func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 		"client-side Calculate must connect the same remote peers as the server")
 }
 
-// TestEnvelopeToNetworkMap_EmptyComponents covers the graceful-degrade path
-// the server takes for a peer that is missing from the account or absent from
-// the validated-peers map. The legacy server short-circuited before
-// Calculate() and shipped a NetworkMap carrying only the account Network; the
-// components path runs Calculate() on the client instead, so the envelope must
-// carry Network or the client panics dereferencing a nil *types.Network.
-func TestEnvelopeToNetworkMap_EmptyComponents(t *testing.T) {
-	localPeerKey := randomWgKey(t)
-	c := types.EmptyNetworkMapComponents(&types.NetworkMapComponents{
-		PeerID: "peer-A",
-		Network: &types.Network{
-			Identifier: "net-empty",
-			Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
-			Serial:     7,
-		},
-		Peers: map[string]*types.ComponentPeer{
-			"peer-A": {ID: "peer-A", Key: localPeerKey, IP: netip.AddrFrom4([4]byte{100, 64, 0, 1})},
-		},
-	})
-
-	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
-		Components: c,
-		DNSDomain:  "netbird.cloud",
-	})
-	require.NotNil(t, envelope.GetFull().Network, "empty envelope must carry the account Network")
-
-	wire, err := goproto.Marshal(envelope)
-	require.NoError(t, err, "marshal envelope")
-	var decoded proto.NetworkMapEnvelope
-	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
-
-	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
-	require.NoError(t, err, "EnvelopeToNetworkMap must degrade gracefully on empty components")
-	require.Equal(t, uint64(7), result.NetworkMap.Serial)
-	require.Empty(t, result.NetworkMap.RemotePeers, "unvalidated peer connects to nobody")
-}
-
-// TestEnvelopeToNetworkMap_MissingNetwork simulates a server that omits
-// AccountNetwork from the envelope. Clients must degrade rather than panic, so
-// they survive talking to a management server that predates the encoder fix.
-func TestEnvelopeToNetworkMap_MissingNetwork(t *testing.T) {
-	c, localPeerKey := buildSmokeComponents(t)
-
-	envelope := mgmtgrpc.EncodeNetworkMapEnvelope(mgmtgrpc.ComponentsEnvelopeInput{
-		Components: c,
-		DNSDomain:  "netbird.cloud",
-	})
-	envelope.GetFull().Network = nil
-
-	wire, err := goproto.Marshal(envelope)
-	require.NoError(t, err, "marshal envelope")
-	var decoded proto.NetworkMapEnvelope
-	require.NoError(t, goproto.Unmarshal(wire, &decoded), "unmarshal envelope")
-
-	result, err := nbnetworkmap.EnvelopeToNetworkMap(context.Background(), &decoded, localPeerKey, "netbird.cloud")
-	require.NoError(t, err, "a missing AccountNetwork must not panic the client")
-	require.NotNil(t, result.Components.Network)
-	require.NotEmpty(t, result.NetworkMap.RemotePeers, "the rest of the snapshot stays usable")
-}
-
 // buildSmokeComponents returns a minimal NetworkMapComponents (2 peers, 1
 // group, 1 allow policy) plus the receiving peer's WG public key. Sufficient
 // to validate the encode → marshal → decode → Calculate pipeline produces