Increase relay early msg buffer size to prevent dropping relayed peers' handshakes

* [client] Add autostart preference marker and MDM disableAutostart key

Adds the autostartInitialized marker to the Wails UI preferences store so
the one-time autostart default decision can persist per OS user, and a
UI-only disableAutostart MDM policy key that suppresses the default and
flows into GetConfigResponse.mDMManagedFields like disableAutoConnect.

* [client] Enable launch-on-login by default on fresh GUI installs

On the first interactive run the GUI persists the autostartInitialized
marker before any enable attempt, then enables autostart only when the
platform supports it, MDM policy does not disable it, the process was not
relaunched by an installer/updater (--post-update), and the installer's
fresh-install breadcrumb is present. Upgrading users have no breadcrumb,
so an update can never write login items, and a user's disable in
Settings is never overridden.

* [release] Write fresh-install breadcrumb from installers

Installers write a .fresh-install breadcrumb on fresh installs only and
delete stale breadcrumbs on upgrade; none of them writes login items or
registry Run keys. Windows NSIS detects upgrades via the uninstall
registry entry or an existing installed executable; the macOS pkg via the
previous pkgutil receipt; Linux deb/rpm via the standard postinstall
arguments. Post-update GUI relaunches (macOS open, Linux
ui-post-install.sh) pass --post-update so the first-run autostart default
cannot fire on updates.

* Revert installer breadcrumb changes

The real Windows installer does uninstall-then-install and deletes
$INSTDIR, so a breadcrumb written there cannot survive or discriminate
a fresh install from an upgrade. Restore the three installer files to
their main versions; no installer or updater writes an autostart entry.

* Detect fresh install from NetBird footprint instead of installer breadcrumb

Replace the installer-written breadcrumb discriminator with a GUI-side
check. netbirdFootprintExists inspects the daemon config/state files
(default.json, legacy config.json, state.json) under profilemanager's
default config dir; combined with whether the UI preferences file already
existed, this tells a genuinely fresh machine from an existing or
upgrading user. Only the signed GUI, via Wails, ever enables
launch-on-login, and a user's later manual disable is never overridden.
The preferences store now exposes ExistedAtLoad and the --post-update
flag is dropped.

* Update tests for footprint-based autostart default

Table tests for shouldEnableAutostartDefault now cover supported,
mdmDisabled, and priorInstall guards plus precedence; breadcrumb and
post-update cases are removed. Add a store test asserting ExistedAtLoad
is false with no file and true after persisting and reopening.

client/mdm/canonical_loaders.go

@@ -22,6 +22,7 @@ var allKeys = []string{
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
 	KeyDisableAutoConnect,
+	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -20,10 +20,10 @@ import (
 // names (lowerCamelCase) so the daemon can map a Policy key directly to a
 // configuration field.
 const (
-	KeyManagementURL            = "managementURL"
-	KeyDisableUpdateSettings    = "disableUpdateSettings"
-	KeyDisableProfiles          = "disableProfiles"
-	KeyDisableNetworks          = "disableNetworks"
+	KeyManagementURL         = "managementURL"
+	KeyDisableUpdateSettings = "disableUpdateSettings"
+	KeyDisableProfiles       = "disableProfiles"
+	KeyDisableNetworks       = "disableNetworks"
 	// KeyDisableAdvancedView gates the advanced-view section in the
 	// upcoming UI revision. UI-only: NOT stored on Config, not
 	// applied by applyMDMPolicy, not rejectable via SetConfig. The
@@ -37,10 +37,16 @@ const (
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	KeyPreSharedKey             = "preSharedKey"
-	KeyRosenpassEnabled         = "rosenpassEnabled"
-	KeyRosenpassPermissive      = "rosenpassPermissive"
-	KeyWireguardPort            = "wireguardPort"
+	// KeyDisableAutostart suppresses the GUI's fresh-install
+	// launch-on-login default and marks the Settings toggle as
+	// MDM-managed. UI-only: NOT stored on Config and not applied by
+	// applyMDMPolicy; the GUI reads it directly and it appears in
+	// GetConfigResponse.mDMManagedFields when set.
+	KeyDisableAutostart    = "disableAutostart"
+	KeyPreSharedKey        = "preSharedKey"
+	KeyRosenpassEnabled    = "rosenpassEnabled"
+	KeyRosenpassPermissive = "rosenpassPermissive"
+	KeyWireguardPort       = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/ui/autostart_default.go

@@ -0,0 +1,107 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+	"github.com/netbirdio/netbird/client/ui/preferences"
+	"github.com/netbirdio/netbird/client/ui/services"
+)
+
+// autostartDefaultState carries the guard inputs of the one-time autostart
+// default decision so the decision itself stays a pure, testable function.
+type autostartDefaultState struct {
+	supported    bool
+	mdmDisabled  bool
+	priorInstall bool
+}
+
+// shouldEnableAutostartDefault applies the first-run guards in order and
+// returns whether autostart may be enabled, plus the reason when it may not.
+func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
+	switch {
+	case !s.supported:
+		return false, "autostart not supported on this platform"
+	case s.mdmDisabled:
+		return false, "autostart disabled by MDM policy"
+	case s.priorInstall:
+		return false, "existing NetBird installation"
+	}
+	return true, ""
+}
+
+// autostartDisabledByMDM reports whether the MDM policy manages the
+// disableAutostart key in a way that must suppress the default. An
+// unparseable managed value is treated as disabled to stay on the safe side.
+func autostartDisabledByMDM(policy *mdm.Policy) bool {
+	if !policy.HasKey(mdm.KeyDisableAutostart) {
+		return false
+	}
+	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
+	return !ok || disabled
+}
+
+// netbirdFootprintExists reports whether the machine already carries NetBird
+// daemon config or state, meaning this is not a genuinely fresh install. It is
+// the update-safety gate for the autostart default: upgrading users always
+// have a footprint, so an update can never trigger a login-item write.
+func netbirdFootprintExists() bool {
+	candidates := []string{
+		profilemanager.DefaultConfigPath,
+		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
+		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
+	}
+	for _, path := range candidates {
+		if path != "" && fileExists(path) {
+			return true
+		}
+	}
+	return false
+}
+
+// applyAutostartDefault runs the one-time launch-on-login default for genuinely
+// fresh installs. The autostartInitialized marker is persisted before any
+// enable attempt so a crash mid-flow degrades to "never enabled" instead of
+// retrying login-item writes on every launch. A user's later disable in
+// Settings is never overridden: the marker guarantees at-most-once, ever.
+func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
+	priorFootprint := netbirdFootprintExists() || prefsFileExisted
+
+	if prefs.Get().AutostartInitialized {
+		return
+	}
+	if err := prefs.SetAutostartInitialized(true); err != nil {
+		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
+		return
+	}
+
+	state := autostartDefaultState{
+		supported:    autostart.Supported(ctx),
+		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
+		priorInstall: priorFootprint,
+	}
+	enable, reason := shouldEnableAutostartDefault(state)
+	if !enable {
+		log.Debugf("skipping autostart default: %s", reason)
+		return
+	}
+
+	if err := autostart.SetEnabled(ctx, true); err != nil {
+		log.Warnf("enable autostart on fresh install: %v", err)
+		return
+	}
+	log.Info("autostart enabled by default on fresh install")
+}
+
+// fileExists reports whether path exists.
+func fileExists(path string) bool {
+	_, err := os.Stat(path)
+	return err == nil
+}

client/ui/autostart_default_test.go

@@ -0,0 +1,125 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+func TestShouldEnableAutostartDefault(t *testing.T) {
+	allPass := autostartDefaultState{
+		supported:    true,
+		mdmDisabled:  false,
+		priorInstall: false,
+	}
+
+	tests := []struct {
+		name       string
+		mutate     func(*autostartDefaultState)
+		wantEnable bool
+		wantReason string
+	}{
+		{
+			name:       "fresh install with all guards passing enables",
+			mutate:     func(*autostartDefaultState) {},
+			wantEnable: true,
+		},
+		{
+			name:       "unsupported platform skips",
+			mutate:     func(s *autostartDefaultState) { s.supported = false },
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name:       "MDM disable skips",
+			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
+			wantReason: "autostart disabled by MDM policy",
+		},
+		{
+			name:       "existing installation (upgrade) skips",
+			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
+			wantReason: "existing NetBird installation",
+		},
+		{
+			name: "unsupported wins over every other guard",
+			mutate: func(s *autostartDefaultState) {
+				s.supported = false
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart not supported on this platform",
+		},
+		{
+			name: "MDM disable wins over prior install",
+			mutate: func(s *autostartDefaultState) {
+				s.mdmDisabled = true
+				s.priorInstall = true
+			},
+			wantReason: "autostart disabled by MDM policy",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			state := allPass
+			tc.mutate(&state)
+			enable, reason := shouldEnableAutostartDefault(state)
+			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
+			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
+		})
+	}
+}
+
+func TestAutostartDisabledByMDM(t *testing.T) {
+	tests := []struct {
+		name   string
+		values map[string]any
+		want   bool
+	}{
+		{
+			name:   "empty policy does not disable",
+			values: nil,
+			want:   false,
+		},
+		{
+			name:   "unrelated managed keys do not disable",
+			values: map[string]any{mdm.KeyDisableAutoConnect: true},
+			want:   false,
+		},
+		{
+			name:   "disableAutostart true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: true},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart registry DWORD 1 disables",
+			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart string true disables",
+			values: map[string]any{mdm.KeyDisableAutostart: "true"},
+			want:   true,
+		},
+		{
+			name:   "disableAutostart explicit false allows",
+			values: map[string]any{mdm.KeyDisableAutostart: false},
+			want:   false,
+		},
+		{
+			name:   "unparseable managed value is treated as disabled",
+			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
+			want:   true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
+			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
+		})
+	}
+}

client/ui/frontend/src/lib/connection.ts

@@ -51,7 +51,14 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
+    // Combine wait + up in Go so the connection comes up the moment SSO
+    // completes. During SSO the tray window is hidden and the webview is
+    // suspended, so a frontend-driven Up (a promise continuation) would not
+    // fire until the user woke the window (e.g. hovering the tray icon).
+    const waitPromise = Connection.WaitSSOLoginAndUp(
+        { userCode: result.userCode, hostname: "" },
+        { profileName: "", username: "" },
+    );
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -89,13 +96,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
+            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        }
-
-        if (!state.cancelled && signal?.aborted) state.cancelled = true;
-
-        if (!state.cancelled) {
-            await Connection.Up({ profileName: "", username: "" });
+        } else {
+            if (!state.cancelled && signal?.aborted) state.cancelled = true;
+            if (!state.cancelled) {
+                await Connection.Up({ profileName: "", username: "" });
+            }
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/main.go

@@ -197,6 +197,9 @@ func main() {
 		// daemon may keep the main window from showing, so the OS toast is the
 		// only reliable signal the user gets.
 		go notifyIfDaemonOutdated(compat, notifier, localizer)
+		// One-time launch-on-login default for fresh installs; gated by the
+		// NetBird footprint check, MDM policy, and the persisted marker.
+		go applyAutostartDefault(context.Background(), services.NewAutostart(app.Autostart), prefStore, prefStore.ExistedAtLoad())
 	})
 
 	if err := app.Run(); err != nil {

client/ui/preferences/store.go

@@ -54,6 +54,10 @@ type UIPreferences struct {
 	Language            i18n.LanguageCode `json:"language"`
 	ViewMode            ViewMode          `json:"viewMode"`
 	OnboardingCompleted bool              `json:"onboardingCompleted"`
+	// AutostartInitialized records that the one-time autostart default
+	// decision has run for this OS user. It only ever transitions to true
+	// and is never reset, so the default-on flow runs at most once, ever.
+	AutostartInitialized bool `json:"autostartInitialized"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -72,8 +76,9 @@ type Emitter interface {
 type Store struct {
 	path string
 
-	mu      sync.RWMutex
-	current UIPreferences
+	mu            sync.RWMutex
+	current       UIPreferences
+	existedAtLoad bool
 
 	subsMu sync.Mutex
 	subs   []chan UIPreferences
@@ -157,6 +162,27 @@ func (s *Store) SetOnboardingCompleted(done bool) error {
 	return nil
 }
 
+// SetAutostartInitialized persists the one-time autostart decision marker.
+// No-op if unchanged.
+func (s *Store) SetAutostartInitialized(done bool) error {
+	s.mu.Lock()
+	if s.current.AutostartInitialized == done {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.AutostartInitialized = done
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -206,13 +232,29 @@ func (s *Store) Subscribe() (<-chan UIPreferences, func()) {
 	return ch, unsubscribe
 }
 
+// ExistedAtLoad reports whether the backing preferences file was present on
+// disk when the store loaded. It distinguishes a user who ran a prior GUI
+// version from a brand-new OS user with no preferences yet.
+func (s *Store) ExistedAtLoad() bool {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.existedAtLoad
+}
+
 // load reads the file into current. A missing file is not an error (the
 // in-memory default stands); malformed contents return an error.
 func (s *Store) load() error {
-	if _, err := os.Stat(s.path); errors.Is(err, os.ErrNotExist) {
-		return nil
+	if _, err := os.Stat(s.path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil
+		}
+		return fmt.Errorf("stat preferences: %w", err)
 	}
 
+	s.mu.Lock()
+	s.existedAtLoad = true
+	s.mu.Unlock()
+
 	var loaded UIPreferences
 	if _, err := util.ReadJson(s.path, &loaded); err != nil {
 		return err

client/ui/preferences/store_test.go

@@ -215,6 +215,46 @@ func TestStore_FileShapeIsJSON(t *testing.T) {
 	assert.Equal(t, i18n.LanguageCode("hu"), parsed.Language)
 }
 
+func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().AutostartInitialized, "marker must default to false when no file is on disk")
+
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.True(t, s.Get().AutostartInitialized, "Get should reflect the persisted marker")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first marker write should broadcast")
+
+	// Re-setting the same value must be a no-op: no disk write, no broadcast.
+	require.NoError(t, s.SetAutostartInitialized(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent marker write should not broadcast again")
+
+	// A fresh Store (new GUI launch) must see the marker so the autostart
+	// default decision never runs twice.
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
+}
+
+func TestStore_ExistedAtLoad(t *testing.T) {
+	withTempConfigDir(t)
+
+	// Brand-new OS user: no preferences file on disk yet.
+	fresh, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, fresh.ExistedAtLoad(), "ExistedAtLoad must be false when no file is on disk")
+
+	// Persisting a value writes the file to disk.
+	require.NoError(t, fresh.SetLanguage("en"))
+
+	// A subsequent GUI launch reopens the now-present file.
+	reopened, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reopened.ExistedAtLoad(), "ExistedAtLoad must be true after the store has persisted and is reopened")
+}
+
 func TestStore_ErrUnsupportedSentinel(t *testing.T) {
 	// Verifies callers can match on the sentinel error rather than parsing
 	// strings — protects against accidental %v -> %w changes that would

client/ui/services/connection.go

@@ -35,7 +35,7 @@ type LoginResult struct {
 	VerificationURIComplete string `json:"verificationUriComplete"`
 }
 
-// WaitSSOParams are the inputs to WaitSSOLogin.
+// WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
@@ -125,23 +125,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}, nil
 }
 
-func (s *Connection) WaitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
-	cli, err := s.conn.Client()
-	if err != nil {
-		return "", err
-	}
-	log.Infof("waiting for SSO login to complete")
-	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
-		UserCode: p.UserCode,
-		Hostname: p.Hostname,
-	})
-	if err != nil {
-		return "", s.classifyDaemonError(err)
-	}
-	log.Infof("SSO login completed, daemon reported success")
-	return resp.GetEmail(), nil
-}
-
 func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -162,6 +145,27 @@ func (s *Connection) Up(ctx context.Context, p UpParams) error {
 	return nil
 }
 
+// WaitSSOLoginAndUp blocks until the SSO login completes and then brings the
+// connection up, both from the Go side. Keeping the post-login Up here rather
+// than as a frontend continuation is deliberate: during SSO the tray window is
+// hidden and the webview is suspended (macOS App Nap / hidden-window timer
+// throttling), so a frontend-driven Up would not run until the user woke the
+// window (e.g. by hovering the tray icon). Doing it in Go connects the moment
+// the daemon reports SSO success. Returns the authenticated user's email.
+func (s *Connection) WaitSSOLoginAndUp(ctx context.Context, wait WaitSSOParams, up UpParams) (string, error) {
+	email, err := s.waitSSOLogin(ctx, wait)
+	if err != nil {
+		return "", err
+	}
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+	if err := s.Up(ctx, up); err != nil {
+		return "", err
+	}
+	return email, nil
+}
+
 func (s *Connection) Down(ctx context.Context) error {
 	cli, err := s.conn.Client()
 	if err != nil {
@@ -221,6 +225,26 @@ func (s *Connection) Logout(ctx context.Context, p LogoutParams) error {
 	return nil
 }
 
+// waitSSOLogin blocks until the daemon reports the SSO login result and returns
+// the authenticated user's email. It is unexported because the frontend drives
+// SSO through the exported WaitSSOLoginAndUp.
+func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string, error) {
+	cli, err := s.conn.Client()
+	if err != nil {
+		return "", err
+	}
+	log.Infof("waiting for SSO login to complete")
+	resp, err := cli.WaitSSOLogin(ctx, &proto.WaitSSOLoginRequest{
+		UserCode: p.UserCode,
+		Hostname: p.Hostname,
+	})
+	if err != nil {
+		return "", s.classifyDaemonError(err)
+	}
+	log.Infof("SSO login completed, daemon reported success")
+	return resp.GetEmail(), nil
+}
+
 // classifyDaemonError maps a gRPC error to a localised ClientError.
 func (s *Connection) classifyDaemonError(err error) *ClientError {
 	return s.classifier.classify(err)

client/ui/services/settings.go

@@ -20,11 +20,12 @@ type MDMFields struct {
 	DisableServerRoutes      bool   `json:"disableServerRoutes"`
 	AllowServerSSH           *bool  `json:"allowServerSSH"`
 	DisableAutoConnect       bool   `json:"disableAutoConnect"`
+	DisableAutostart         bool   `json:"disableAutostart"`
 	BlockInbound             bool   `json:"blockInbound"`
 	DisableMetricsCollection bool   `json:"disableMetricsCollection"`
 	SplitTunnelMode          bool   `json:"splitTunnelMode"`
 	SplitTunnelApps          bool   `json:"splitTunnelApps"`
-	DisableAdvancedView bool `json:"disableAdvancedView"`
+	DisableAdvancedView      bool   `json:"disableAdvancedView"`
 }
 
 type Features struct {

shared/relay/client/early_msg_buffer.go

@@ -10,7 +10,7 @@ import (
 
 const (
 	earlyMsgTTL      = 5 * time.Second
-	earlyMsgCapacity = 1000
+	earlyMsgCapacity = 10000
 )
 
 // earlyMsgBuffer buffers transport messages that arrive before the corresponding